Tag: tryhackme
-
TryHackMe – Advent of Cyber 2023 | Day 7
Day 7 – ‘cut’ command -
TryHackMe – Advent of Cyber 2023 | Day 6
Day 6 – Video games! -
TryHackMe – Advent of Cyber 2023 | Day 5
DOS! Sorry no audio on this one.
-
TryHackMe | Advent of Cyber 2023 | Day 1
I’m a rule follower, so I can’t write up the walkthrough for this TryHackMe room. This one will be a video. Click play above to follow along.
-
TryHackMe Walkthrough – Incident Response – Identification & Scoping
Preparation is the first room in the Incident Response learning path within the TryHackMe learning platform.
The learning path consist of the following rooms:
- Preparation
- Identification & Scoping
- Threat Intel & Containment
- Eradication & Remediation
- Lessons Learned
- Tardigrade
In this post I will be walking through Identification & Scoping.
Task 1: Introduction
Question 1: No answer needed.
Task 2: Identification: Unearthing the Existence of a Security Incident
Question 1: What is the Subject of Ticket#2023012398704232?
Follow the directions in the reading to dismiss all the Windows Office warnings. Once outlook opens on the VM scroll down the inbox to the first message from John Sterling that’s the one with the correct ticket number from the question. In the message thread scroll to the first message and you will see the ticket information including the subject.
Answer: weird error in outlook
(more…) -
TryHackMe Walkthrough – Incident Response – Preparation
Preparation is the first room in the Incident Response learning path within the TryHackMe learning platform.
The learning path consist of the following rooms:
- Preparation
- Identification & Scoping
- Threat Intel & Containment
- Eradication & Remediation
- Lessons Learned
- Tardigrade
In this post I will walkthrough the Preparation room.
Task 1: Introduction
Question 1: No answer needed
Task 2: Incident Response Capability
Question 1: What is an observed occurrence within a system?
The answer is in the reading. Look at the first bullets in this task.
Answer: Event
Question 2: What is described as a violation of security policies and practices?
This answer is also in the reading, in the same place as question 1.
Answer: Incident
(more…) -
TryHackMe – SOC Level 1 Path Complete!
In this post I’d like to talk a bit about TryHackMe and my experience working through the SOC Level 1 learning path.
TryHackMe is a learning platform that sends users to virtual machines (VM) they can access through their web browser. Extremely low barrier to entry! Absolutely no previous knowledge is required. I’m not sponsored and TryHackMe did not ask me to write this.
I’m a big fan of theirs. I think the learning paths and rooms (think learning modules) are fantastic hands-on learnings! I learned
- Cyber Defense Frameworks
- Cyber Threat Intelligence
- Network Security and Traffic Analysis
- Endpoint Security Monitoring
- Security Information and Event Management (SIEM)
- Digital Forensics and Incident Response
- Phishing
Each room walks the learner through hands-on learning. I learned all these tools:
- yara
- opencti
- misp
- mitre
- cyberkillchain
- snort
- zeek
- brim
- wireshark
- sysmon
- sysinternals
- osquery
- wazuh
- splunk
- autopsy
- redline
- linux (a lot!)
- thehive
- phishing
And even more! It’s a great platform. As of this writing it is $14 a month. If you’re not going to use it, don’t sign up, but if you really want to learn these tools and more it’s a great place to get started. You can spend as much time as you want learning these tools in real environments. You can’t break anything because it’s all VMs that start fresh each time the are launched. Getting the chance to work on these environments without setting up all these VMs is a huge time savings.
If you want to play around in there for free you can do that too. There is plenty of free content to get started with and see if you want to pay for the premium rooms and features. It’s worth checking out.
