CTRL + ALT + SEC

Author: ByteMe

  • TryHackMe Walkthrough – Incident Response – Identification & Scoping

    Preparation is the first room in the Incident Response learning path within the TryHackMe learning platform.

    The learning path consist of the following rooms:

    • Preparation
    • Identification & Scoping
    • Threat Intel & Containment
    • Eradication & Remediation
    • Lessons Learned
    • Tardigrade

    In this post I will be walking through Identification & Scoping.

    Task 1: Introduction

    Question 1: No answer needed.

    Task 2: Identification: Unearthing the Existence of a Security Incident

    Question 1: What is the Subject of Ticket#2023012398704232?

    Follow the directions in the reading to dismiss all the Windows Office warnings. Once outlook opens on the VM scroll down the inbox to the first message from John Sterling that’s the one with the correct ticket number from the question. In the message thread scroll to the first message and you will see the ticket information including the subject.

    Answer: weird error in outlook

    (more…)

  • TryHackMe Walkthrough – Incident Response – Preparation

    Preparation is the first room in the Incident Response learning path within the TryHackMe learning platform.

    The learning path consist of the following rooms:

    • Preparation
    • Identification & Scoping
    • Threat Intel & Containment
    • Eradication & Remediation
    • Lessons Learned
    • Tardigrade

    In this post I will walkthrough the Preparation room.

    Task 1: Introduction

    Question 1: No answer needed

    Task 2: Incident Response Capability

    Question 1: What is an observed occurrence within a system?

    The answer is in the reading. Look at the first bullets in this task.

    Answer: Event

    Question 2: What is described as a violation of security policies and practices?

    This answer is also in the reading, in the same place as question 1.

    Answer: Incident

    (more…)

  • TryHackMe – SOC Level 1 Path Complete!

    In this post I’d like to talk a bit about TryHackMe and my experience working through the SOC Level 1 learning path.

    TryHackMe is a learning platform that sends users to virtual machines (VM) they can access through their web browser. Extremely low barrier to entry! Absolutely no previous knowledge is required. I’m not sponsored and TryHackMe did not ask me to write this.

    I’m a big fan of theirs. I think the learning paths and rooms (think learning modules) are fantastic hands-on learnings! I learned

    • Cyber Defense Frameworks
    • Cyber Threat Intelligence
    • Network Security and Traffic Analysis
    • Endpoint Security Monitoring
    • Security Information and Event Management (SIEM)
    • Digital Forensics and Incident Response
    • Phishing

    Each room walks the learner through hands-on learning.  I learned all these tools:

    • yara
    • opencti
    • misp
    • mitre
    • cyberkillchain
    • snort
    • zeek
    • brim
    • wireshark
    • sysmon
    • sysinternals
    • osquery
    • wazuh
    • splunk
    • autopsy
    • redline
    • linux (a lot!)
    • thehive
    • phishing

    And even more! It’s a great platform. As of this writing it is $14 a month. If you’re not going to use it, don’t sign up, but if you really want to learn these tools and more it’s a great place to get started. You can spend as much time as you want learning these tools in real environments. You can’t break anything because it’s all VMs that start fresh each time the are launched. Getting the chance to work on these environments without setting up all these VMs is a huge time savings.

    If you want to play around in there for free you can do that too. There is plenty of free content to get started with and see if you want to pay for the premium rooms and features. It’s worth checking out.

  • Weekly Cybersecurity Wrap-up 11/20/23

    Projects

    LinkedIn Learning – CompTIA Security+ Module 9: Operations and Incident Response | Complete!

    TryHackMe – SOC Level 1(100 % Complete): Phishing Analysis Fundamentals, Phishing Emails in Action, Phishing Analysis Tools, Phishing Prevention, The Greenholt Phish

    UDemy – Python for Cybersecurity – Gitlab

    Videos

    Articles

  • TryHackMe Walkthrough – The Greenholt Phish

    Task 1: Just another day as a SOC analyst

    Only one task for this room.

    Question 1: What date was the email received? (answer format: M/DD/YY)

    I opened the email in Thunderbird.

    Answer: 6/10/20

    Question 2: Who is the email from?

    In the From…

    Answer: Mr. James Jackson

    Question 3: What is his email address?

    Also in the From…

    Answer: info@mutawamarine.com

    (more…)

  • TryHackMe Walkthrough – Phishing Prevention

    Task 1: Introduction

    Question 1: After visiting the link in the task, what is the MITRE ID for the “Software Configuration” mitigation technique?

    Follow the link to https://attack.mitre.org/techniques/T1598/#mitigations. Look for Software Configuration and the ID is there.

    Answer: M1054

    Task 2: SPF (Sender Policy Framework

    Question 1: Referencing the dmarcian SPF syntax table, what prefix character can be added to the “all” mechanism to ensure a “softfail” result?

    Follow the link to the page and then click on the here in: “More in-depth information on the differences between “~” and “–” can be found here“

    This gives you the…

    Anwser: ~

    Question 2: What is the meaning of the -all tag?

    This answer is on that second webpage as well. Scroll down a little and to see the difference between ~all and -all.

    • “softfail” in the case of “~”
    • “fail” in the case of “-“

    Answer: fail

    (more…)

  • TryHackMe Walkthrough – Phishing Analysis Tools

    Task 1: Introduction

    Question 1: No answer needed

    Task 2: What information should we collect?

    Question 1: No answer needed

    Task 3: Email header analysis

    Question 1: What is the official site name of the bank that capitai-one.com tried to resemble?

    This should be self-explanatory, google capitol one to see what their domain is.

    Answer: capitalone.com

    (more…)

  • Phishing Email Example | How To Report Phishing Attempts in Gmail

    I received this email this morning and I thought it would be a great example to point out the issues in the email that flag it as a phishing email.

    Alright, here we have Jr. emailing us regarding an invoice. Two things off the bat, I’m not expecting anything from someone named Jr. and I have no idea what invoice I should be expecting. The last name Hade is not familiar to me. Next this attacker used Hello and Dear right after each other. This isn’t done. Then instead of using Jason to address me he uses my email address. Next looking at the attached PDF file name, which you should never open or download, the file name is just gibberish. The attacker didn’t even go to the bother of naming it “invoice” or anything that would make more sense. If we keep looking we see that their email is gibberish too and its from a gmail domain, who does legit business with a gmail address and not a real domain like bestbuy.com or something are slim.

    Okay, so I know this is a phishing attempt, but what do I do with it? I could just delete it, but that doesn’t flag as something that gmail can research and prevent other users from getting this message. I could report spam, but it’s worse than just an unsolicited marketing email. This thing is malicious, so let’s see what gmail suggest.

    Okay so I click on The three dots near reply and I can submit a phishing attempt.

    After clicking on the message we get a pop-up that says…

    And the email is removed from my inbox. We’re done. Great job and keep vigilant, Always be suspicious!

  • TryHackMe Walkthrough – Phishing Emails in Action

    Task 1: Introduction

    Question 1: No answer needed

    Task 2: Cancel your PayPal order

    Question 1: What phrase does the gibberish sender email start with?

    This answer is in the reading. Look at the email address highlighted with a red circle 2.

    Answer: noreply

    (more…)

  • TryHackMe Walkthrough – Phishing Analysis Fundamentals

    Task 1: Introduction

    Question 1: No answer needed.

    Task 2: The Email Address

    Question 1: Email dates back to what time frame?

    Answer is in the reading. Second paragraph.

    Answer: 1970s

    (more…)