Blue Team Cyber Defender

  Introducing cyber threat intelligence and related topics, such as relevant standards and frameworks. Link - https://tryhackme.com/room/cyberthreatintel What does CTI stand for? Cyber Threat Intelligence IP addresses, Hashes and other threat artefacts would be found under which Threat Intelligence classification? Technical Intel At which phase of the lifecycle is data made usable through sorting, organising, correlation and presentation? processing During which phase do security analysts get the chance to define the questions to investigate incidents? direction What sharing models are supported by TAXII? collection and channel When an adversary has obtained access to a network and is extracting data, what phase of the kill chain are they on? action on objectives What was the source email address? vipivillain@badbank.com What was the name of the file downloaded? flbpfuh.exe After building the threat profile, what message do you receive? After solving below you get code That’s it! See y

  Learn how to interact with the win32 API and understand its wide range of use cases Link- https://tryhackme.com/room/windowsapi Does a process in the user mode have direct hardware access? (Y/N) n Does launching an application as an administrator open the process in kernel mode? (Y/N) n What header file imports and defines the User32 DLL and structure? winuser.h What parent header file contains all other required child and core header files? windows.h What overarching namespace provides P/Invoke to .NET? system What memory protection solution obscures the process of importing API calls? aslr Which character appended to an API call represents an ANSI encoding? a Which character appended to an API call represents extended functionality? ex What is the memory allocation type of 0x00080000 in the VirtualAlloc API call? MEM_RESET Do you need to define a structure to use API calls in C? (Y/N) n What method is used to import a required DLL? dllimport What type of method is used to reference

  Learn the steps and procedures of a red team engagement, including planning, frameworks, and documentation. Link - https://tryhackme.com/room/redteamengagements What CIDR range is permitted to be attacked? 10.0.4.0/22 Is the use of white cards permitted? (Y/N) Y Are you permitted to access “*.bethechange.xyz?” (Y/N) N How many explicit restriction are specified? 3 What is the first access type mentioned in the document? phishing Is the red team permitted to attack 192.168.1.0/24? (Y/N) N How long will the engagement last? 1 Month How long is the red cell expected to maintain persistence? 3 Weeks What is the primary tool used within the engagement? Cobalt Strike When will the engagement end? 11/14/2021 What is the budget the red team has for AWS cloud cost? $1000 Are there any miscellaneous requirements for the engagement? (Y/N) N What phishing method will be employed during the initial access phase? Spearphishing What site will be utilized for communication between the client and red

  An introduction to security awareness; why its important, the impact of being attacked, different threat actors and basic account security. Link - https://tryhackme.com/room/securityawarenessintro How many people were affected by eBay being hacked? 145 million What data was leaked from Playstation being hacked? names, addresses, e-mail, birth dates Who would most likely be interested in exploiting a business? Cybercriminals Who would most likely be interested in exploiting a personal computer for fun? Thrill-seekers Who would most likely be interested in exploiting a website to deliver a message? Hacktivists That’s it! See you in the next Room :)

  Learn the different indicators of phishing attempts by examining actual phishing emails. Link- https://tryhackme.com/room/phishingemails1tryoe What phrase does the gibberish sender email start with? noreply What is the root domain for each URL? Defang the URL. devret[.]xyz This email sample used the names of a few major companies, their products, and logos such as OneDrive and Adobe. What other company name was used in this phishing email? Citrix What should users do if they receive a suspicious email or text message claiming to be from Netflix? forward the message to phishing@netflix.com What does BCC mean? Blind Carbon Copy What technique was used to persuade the victim to not ignore the email and act swiftly? Urgency What is the name of the executable that the Excel attachment attempts to run? regasms.exe That’s it! See you in the next Room :)

  Learn all the components that make up an email. Link- https://tryhackme.com/room/phishingemails1tryoe Email dates back to what time frame? 1970s What port is classified as Secure Transport for SMTP? 465 What port is classified as Secure Transport for IMAP? 993 What port is classified as Secure Transport for POP3? 995 What email header is the same as “Reply-to”? Return-Path Once you find the email sender’s IP address, where can you retrieve more information about the IP? http://www.arin.net/ In the above screenshots, what is the URI of the blocked image? https://i.imgur.com/lsw0tdi.png In the above screenshots, what is the name of the PDF attachment? payment-updateid.pdf In the attached virtual machine, view the information in email2.txt and reconstruct the PDF using the base64 data. What is the text within the PDF? Use Cyberchef from Base64 and save the output as a pdf file. Open the pdf. THM{BENIGN_PDF_ATTACHMENT} What trusted entity is this email masquerading as? Decode the subject

  You are involved in an incident response engagement and need to analyze an infected host using Redline. Link - https://tryhackme.com/room/revilcorp Upload the analysis file in Redline What is the compromised employee’s full name? John Coleman What is the operating system of the compromised host? Windows 7 Home Premium 7601 Service Pack 1 What is the name of the malicious executable that the user opened? WinRAR2021.exe What is the full URL that the user visited to download the malicious binary? (include the binary as well) http://192.168.75.129:4748/Documents/WinRAR2021.exe What is the MD5 hash of the binary? 890a58f200dfff23165df9e1b088e58f What is the size of the binary in kilobytes? 164 What is the extension to which the user’s files got renamed? .t48s39la What is the number of files that got renamed and changed to that extension? 48 What is the full path to the wallpaper that got changed by an attacker, including the image name? C:\Users\John Coleman\AppData\Local\Temp\hk8.bmp The

  Apply your analytical skills to analyze the malicious network traffic using Wireshark. Link - https://tryhackme.com/room/c2carnage After loading the pcap file in wireshark. Change the time display preferences. What was the date and time for the first HTTP connection to the malicious IP? (answer format: yyyy-mm-dd hh:mm:ss) check the HTTP traffic 2021–09–24 16:44:38 What is the name of the zip file that was downloaded? Check the contents of the packet documents.zip What was the domain hosting the malicious zip file? attirenepal.com Without downloading the file, what is the name of the file in the zip file? Right click the packet and follow HTTP stream chart-1530076591.xls What is the name of the webserver of the malicious IP from which the zip file was downloaded? LiteSpeed What is the version of the webserver from the previous question? PHP/7.2.34 Malicious files were downloaded to the victim host from multiple domains. What were the three domains involved with this activity? finejew

  Learn vim, a universal text editor that can be incredibly powerful when used properly. From basic text editing to editing of binary files, Vim can be an important arsenal in a security toolkit. Link - https://tryhackme.com/room/toolboxvim How do we enter “INSERT” mode? i How do we start entering text into our new Vim document? typing How do we return to command mode? esc How do we move the cursor left? h How do we move the cursor right? l How do we move the cursor up? k How do we move the cursor down? j How do we jump to the start of a word? w How do we jump to the end of a word? e How do we insert (before the cursor) i How do we insert (at the beginning of the line?) I How do we append (after the cursor) a How do we append (at the end of the line) A How do we make a new line under the current line? o How do we write the file, but don’t exit? :w How do we write the file, but don’t exit- as root? :w !sudo tee % How do we write and quit? :wq How do we quit? :q How do we force quit? :q!