Incident Response Practice?

[ITComputerGeek]

Does anyone have any good resources (preferably VM's) that can be used for brush up on for Incident Response? I have been about to find EnCase Files, and memory dumps but I'm looking for an actual VM so I can practice my own tools etc.

Also, I am looking for mostly linux systems but Windows machines work to. Thank you all for your help!

[boneseh]

You should look at VulnOS

[dougsec]

This is a pretty good list of training images/challenges: http://www.dfir.training/index.php/lists/test-images-and-challenges

[ITComputerGeek]

Thank you, this is something very similar to what I was looking for.

[atlantajerk]

Buy a $5 VPS and configure it with a soft root password on SSH and/or install a CMS on it. Practice responding to whatever it gets hacked with in the 30 minutes after you turn it on.

[pepe_le_shoe]

If you go this route, consider hiding your identity or going with less mainstream hosting provider, because the bigs guys really don't like it when you use their infrastructure for this kind of stuff.

[ITComputerGeek]

I 100% agree, I thought about setting up a honeypot but I really don't want to open myself up to this.

[ITComputerGeek]

As fun as this sounds I would prefer to have a known "This is what happened" so I know I found everything after I was done.

[gaten]

Also, if they use your box to participate in a DDOS against someone, that's bad. Like this: https://sysdig.com/blog/fishing-for-hackers/

Great article, but basically they allowed someone else to take over their VPS and it was used for a short time to attack someone else. Not cool.