Blue Team Cyber Defender

  Introductory room for the DFIR module Link - https://tryhackme.com/room/introductoryroomdfirmodule What does DFIR stand for? Digital Forensics and Incident Response DFIR requires expertise in two fields. One of the fields is Digital Forensics. What is the other field? Incident Response. Complete the timeline creation exercise in the attached static site. What is the flag that you get after completion? At what stage of the IR process are disrupted services brought back online as they were before the incident? recovery At what stage of the IR process is the threat evicted from the network after performing the forensic analysis? eradication What is the NIST-equivalent of the step called “Lessons learned” in the SANS process? Post-incident Activity That’s it! See you in the next Room :)

  Introducing cyber threat intelligence and related topics, such as relevant standards and frameworks. Link - https://tryhackme.com/room/cyberthreatintel What does CTI stand for? Cyber Threat Intelligence IP addresses, Hashes and other threat artefacts would be found under which Threat Intelligence classification? Technical Intel At which phase of the lifecycle is data made usable through sorting, organising, correlation and presentation? processing During which phase do security analysts get the chance to define the questions to investigate incidents? direction What sharing models are supported by TAXII? collection and channel When an adversary has obtained access to a network and is extracting data, what phase of the kill chain are they on? action on objectives What was the source email address? vipivillain@badbank.com What was the name of the file downloaded? flbpfuh.exe After building the threat profile, what message do you receive? After solving below you get code That’s it! S...

  Learn about fundamentals, methodology, and tooling for endpoint security monitoring. Link - https://tryhackme.com/room/introtoendpointsecurity What is the normal parent process of services.exe? wininit.exe What is the name of the network utility tool introduced in this task? tcpview What is the PowerShell cmdlet for viewing Windows Event Logs? get-winevent Provide the command used to enter OSQuery CLI. osqueryi What does EDR mean? Provide the answer in lowercase. Endpoint detection and response Provide the flag for the simulated investigation activity. That’s it! See you in the next Room :)

  Learn the basics of Wireshark and how to analyse protocols and PCAPs. Link- https://tryhackme.com/room/wiresharkthebasics Which file is used to simulate the screenshots? http1.pcapng Which file is used to answer the questions? Exercise.pcapng Use the “Exercise.pcapng” file to answer the questions. Read the “capture file comments”. What is the flag? TryHackMe_Wireshark_Demo What is the total number of packets? 58620 What is the SHA256 hash value of the capture file? f446de335565fb0b0ee5e5a3266703c778b2f3dfad7efeaeccb2da5641a6d6eb Use the “Exercise.pcapng” file to answer the questions. View packet number 38. Which markup language is used under the HTTP protocol? extensible markup language What is the arrival date of the packet? (Answer format: Month/Day/Year) 05/13/2004 What is the TTL value? 47 What is the TCP payload size? 424 What is the e-tag value? Follow HTTP Stream 9a01a-4696–7e354b00 Use the “Exercise.pcapng” file to answer the questions. Search the “r4w” string in packet d...

  Understand how antivirus software works and what detection techniques are used to bypass malicious files checks. Link - https://tryhackme.com/room/introtoav What was the virus name that infected John McAfee’s PC? brain Which PC Antivirus vendor implemented the first AV software on the market? mcafee Antivirus software is a _____-based security solution. host Which AV feature analyzes malware in a safe and isolated environment? emulator An _______ feature is a process of restoring or decrypting the compressed executable files to the original. unpacker What is the sigtool tool output to generate an MD5 of the AV-Check.exe binary? f4a974b0cf25dca7fbce8701b7ab3a88:6144:AV-Check.exe Use the strings tool to list all human-readable strings of the AV-Check binary. What is the flag? THM{Y0uC4nC-5tr16s} Which detection method is used to analyze malicious software inside virtual environments? dynamic detection That’s it! See you in the next Room :)

  Learn what is the Pyramid of Pain and how to utilize this model to determine the level of difficulty it will cause for an adversary to change the indicators associated with them, and their campaign. Link - https://tryhackme.com/room/pyramidofpainax Provide the ransomware name for the hash ‘63625702e63e333f235b5025078cea1545f29b1ad42b1e46031911321779b6be’ using open-source lookup tools Conti What is the ASN for the third IP address observed? Host Europe GmbH What is the domain name associated with the first IP address observed? craftingalegacy.com Go to this report on app.any.run and provide the first malicious URL request you are seeing, you will be using this report to answer the remaining questions of this task. craftingalegacy.com What term refers to an address used to access websites? Domain Name What type of attack uses Unicode characters in the domain name to imitate the a known domain? Punycode attack Provide the redirected website for the shortened URL using a preview: ht...

  Learn the steps and procedures of a red team engagement, including planning, frameworks, and documentation. Link - https://tryhackme.com/room/redteamengagements What CIDR range is permitted to be attacked? 10.0.4.0/22 Is the use of white cards permitted? (Y/N) Y Are you permitted to access “*.bethechange.xyz?” (Y/N) N How many explicit restriction are specified? 3 What is the first access type mentioned in the document? phishing Is the red team permitted to attack 192.168.1.0/24? (Y/N) N How long will the engagement last? 1 Month How long is the red cell expected to maintain persistence? 3 Weeks What is the primary tool used within the engagement? Cobalt Strike When will the engagement end? 11/14/2021 What is the budget the red team has for AWS cloud cost? $1000 Are there any miscellaneous requirements for the engagement? (Y/N) N What phishing method will be employed during the initial access phase? Spearphishing What site will be utilized for communication between the client and...

  Learn the different indicators of phishing attempts by examining actual phishing emails. Link- https://tryhackme.com/room/phishingemails1tryoe What phrase does the gibberish sender email start with? noreply What is the root domain for each URL? Defang the URL. devret[.]xyz This email sample used the names of a few major companies, their products, and logos such as OneDrive and Adobe. What other company name was used in this phishing email? Citrix What should users do if they receive a suspicious email or text message claiming to be from Netflix? forward the message to phishing@netflix.com What does BCC mean? Blind Carbon Copy What technique was used to persuade the victim to not ignore the email and act swiftly? Urgency What is the name of the executable that the Excel attachment attempts to run? regasms.exe That’s it! See you in the next Room :)

  Learn the basics of automated web scanning! Link - https://tryhackme.com/room/rpwebscanning First and foremost, what switch do we use to set the target host? -h Websites don’t always properly redirect to their secure transport port and can sometimes have different issues depending on the manner in which they are scanned. How do we disable secure transport? -nossl How about the opposite, how do we force secure transport? -ssl What if we want to set a specific port to scan? -p As the web is constantly evolving, so is Nikto. A database of vulnerabilities represents a core component to this web scanner, how do we verify that this database is working and free from error? -dbcheck If instructed to, Nikto will attempt to guess and test both files within directories as well as usernames. Which switch and numerical value do we use to set Nikto to enumerate usernames in Apache? Keep in mind, this option is deprecated in favor of plugins, however, it’s still a great option to be aware of fo...

  Learn how to detect and exploit SQL Injection vulnerabilities Link - https://tryhackme.com/room/sqlinjectionlm What does SQL stand for? Structured Query Language What is the acronym for the software that controls a database? DBMS What is the name of the grid-like structure which holds the data? table What SQL statement is used to retrieve data? SELECT What SQL clause can be used to retrieve data from multiple tables? UNION What SQL statement is used to add data? INSERT What character signifies the end of an SQL query? ; What is the flag after completing level 1? Login as Martin What is the flag after completing level two? (and moving to level 3) What is the flag after completing level three? Login as admin with the password What is the final flag after completing level four? Use the following referrer= admin123' UNION SELECT SLEEP(5),2 from users where username=’admin’ and password like ‘4961% login as admin with password 4961 Name a protocol beginning with D that can be used to ...