Task 1 & 2 are easy “I read this” ones, so let’s skip to…
Question 1: Which open-source platform supports the analysis of observables within TheHive?
In the reading under “Observable Enrichment with Cortex” bullet it explains that
One of the main feature integrations TheHive supports is Cortex
Answer: Cortex
(more…)Happy Halloween! It’s already the end of the year! Time files when you are learning cybersecurity!
Cyberwire Daily – Ep 1940 | 11.2.23 – The beginning of an international consensus on AI governance may be emerging from Bletchley Park.
LinkedIn Learning – CompTIA Security+ Module 8: Network Security Design and Implementation | This is a long one, I’m still working on it.
TryHackMe – SOC Level 1(90 % Complete): Velociraptor – Complete
UDemy – Python for Cybersecurity – Gitlab
First task that has any questions is…
Question 1: Using the documentation, how would you launch an Instant Velociraptor on Windows?
It’s in the documentation. Scroll to “Instant Velociraptor” and you will find…
Answer: Velociraptor.exe gui
Question 1: What is the hostname for the client?
Open the Ubuntu terminal and run:
./velociraptor-v0.5.8-linux-amd64 --config velociraptor.config.yaml frontend -vLet that run for a while….
Then launch Chrome and click on the short cut under the search bar called Velociraptor
If you get the warning about your connection not being private, click the advanced button, then proceed to 127.0.0.1
Enter the sign-in information given in task 3 instructions.
Once it comes up click on the magnifying glass next to the search bar:
Then this loads…
Boom! Hostname.
Answer:
thm-velociraptor.eu-west-1.compute.internalQuestion 2: What is listed as the agent version?
From our last step go ahead and click on that Client ID link. It opens up a page with Agent Version on it.
Answer:
2021-04-11T22:11:10ZQuestion 3: In the Collected tab, what was the VQL command to query the client user accounts?
Click the collected button at the top of the page. Then click on the requests tab in the bottom frame. The VQL statement we are looking for is the fourth one down:
Answer:
LET Generic_Client_Info_Users_0_0=SELECT Name, Description, Mtime AS LastLogin FROM Artifact.Windows.Sys.Users()Question 4: In the Collected tab, check the results for the PowerShell whoami command you executed previously. What is the column header that shows the output of the command?
If you didn’t run the whoami command while running through the instructions, do that now. Click on magnifying glass then the Client ID and then on the right upper of the screen you will see the “>_ Shell” button click that run whoami. Then you will see this in the results tab here:
In the screenshot above you can see the column header name is Stdout.
Answer: Stdout
Question 5: In the Shell, run the following PowerShell command Get-Date. What was the PowerShell command executed with VQL to retrieve the result?
This is not the same as pulling the VQL from the previous answer. For this one we have to go to the Log tab after we run the command. There we find the VQL command that was run in the second line. Copy that out starting at the [powershell…
Answer:
[powershell -ExecutionPolicy Unrestricted -encodedCommand RwBlAHQALQBEAGEAdABlAA==]Question 1: Earlier you created a new artifact collection for Windows.KapeFiles.Targets. You configured the parameters to include Ubuntu artifacts. Review the parameter description for this setting. What is this parameter specifically looking for?
The answer for this is in the screenshots for the instructions:
Answer: Ubuntu on Windows Subsystem for Linux
Question 2: Review the output. How many files were uploaded?
I hope you did the exercise otherwise, you won’t find the answer. Take the time go back and do the exercise, then you can find the answer after the process completes:
I’m pretty sure I didn’t do anything wrong here. I see 19 files uploaded and saw other walk-through’s getting the same answer. But the answer TryHackMe wants is 20.
Answer: 20
Question 1: Which accessor can access hidden NTFS files and Alternate Data Streams? (format: xyz accessor)
The answer to this is in the documentation. Read the paragraph under VFS accessors.
Answer: ntfs accessor
Question 2: Which accessor provides file-like access to the registry? (format: xyz accessor)
This answer is also in the documentation same section.
Answer: registry accessor
Question 3: What is the name of the file in $Recycle.Bin?
Ok, time to get real. Dive back into Velociraptor and click the little file folder on the left navigation, it’s called virtual file system in the nav. Click File > C: > $Recycle.Bin ? S-1….. file folder under recyclebin. There is your file.
Answer: desktop.ini
Question 4: There is hidden text in a file located in the Admin’s Documents folder. What is the flag?
Alright, Click C: again followed by Users > Administrator > Documents.
The file we want is called flag.txt and we will need to collect it from the host, in order to get the Textview tab to be clickable.
Answer: THM{VkVMT0NJUkFQVE9S}
Question 1: What is followed after the SELECT keyword in a standard VQL query?
The answer to this question is found in the documentation. Read the Whitespace section.
Answer: Column Selectors
Question 2: What goes after the FROM keyword?
Keep reading same sentence to get the next anwser.
Answer: VQL Plugin
Question 3: What is followed by the WHERE keyword?
Just keep reading.. Just keep reading… next sentence has the next answer.
Answer: filter expression
Question marked by a “?”. This is also in the documentation, but you will need to navigate to notebooks. Look in number 5 for…
After clicking the
Edit Cellbutton, you can type VQL directory into the cell. As you type, the GUI offers context sensitive suggestions about what possible completions can appear at the cursor. Typing “?” will show all suggestions possible.
Answer: ?
Question: What plugin would you use to run PowerShell code from Velociraptor?
Back to the documentation. Read the section about “Extending Artifacts – PowerShell” to find…
Answer: execve()
Question 1: What are the arguments for parse_mft()?
It’s in the documentation. Look under time analysis for…
Answer: parse_mft(filename=”C:/$MFT”, accessor=”ntfs”)
Question 2: What filter expression will ensure that no directories are returned in the results?
Once again answer in the documentation. Filesystem doc under Glob Results.
Answer: IsDir
Start the new machine.
Question 1: What is the name in the Artifact Exchange to detect Printnightmare?
Start up Velociraptor by opening a DOS shell and typing…
cd desktop
Velociraptor.exe guiLet’s check the documentation. Using search I found. https://docs.velociraptor.app/exchange/artifacts/pages/printnightmare/
Answer is in the documentation! Again!
Answer: Windows.Detection.PrintNightmare
Question 2: Per the above instructions, what is your Select clause? (no spaces after commas)
Replace the **** per the instructions.
Answer:
SELECT “C:/” + FullPath AS Full_Path,FileName AS File_Name,parse_pe(file=”C:/” + FullPath) AS PEQuestion 3: What is the name of the DLL that was placed by the attacker?
We have to create a notebook and plugin some VQL that we build using the previous answer as a template:
SELECT "C:/" + FullPath AS Full_Path,FileName AS File_Name,parse_pe(file="C:/" + FullPath) AS PE
FROM parse_mft(filename="C:/$MFT", accessor="ntfs")
WHERE NOT IsDir AND FullPath =~ "Windows/System32/spool/drivers" AND PE29 rows later, we see a oddly named DLL as the last row…
Answer: nightmare.dll
Question 4: What is the PDB entry?
Once you have the above, just look at the PDB line.
Answer: C:\Users\caleb\source\repos\nightmare\x64\Release\nightmare.pdb
Confident Cyber Security: How to Get Started in Cyber Security and Futureproof Your Career by Jessica Barker
As I said in point 3 above, the book spent all its content educating on the basics of cyber and did not dive deep into getting into the field or futureproofing your career in cyber. This is all contained in 1 chapter second to last in the book. This is not a bad book, but it doesn’t accomplish the goal on the cover. I was looking for something deeper about securing a future in a cyber career.
Anyone interested in cybersecurity that does not already have a foundation in it. Those with a basic understanding will find, like me, 90% of the book covers the basics they already know.
I wouldn’t say this book had a huge impact on me. I got a couple of book and website recommendations and further solidified my cyber security understanding. Other than that, I learned maybe to abandon a book a little earlier in the future.
This will only cover Task 10 – Practical Investigations
Question 1: What is the build version of the host machine in Case 001?
In the above screenshot look at NTBuildLab.
Answer: 2600.xpsp.080413-2111
Question 2: At what time was the memory file acquired in Case 001?
Also, in the previous screenshot look at SystemTime.
Answer: 2012-07-22 02:45:08
Question 3: What process can be considered suspicious in Case 001?
Find the last line PID 1640.
Answer: reader_sl.exe
Question 4: What is the parent process of the suspicious process in Case 001?
See previous screenshot. It is the executable just above reader_sl.exe
Answer: explorer.exe
Question 5: What is the PID of the suspicious process in Case 001?
Also in the last screenshot, look under the PID column.
Answer: 1640
Question 6: What is the parent process PID in Case 001?
Again, same screenshot, look at the PID for explorer.exe
Answer: 1484
Question 7: What user-agent was employed by the adversary in Case 001?
We are going to use memmap to figure this out:
./vol.py -f /Scenarios/Investigations/Investigation-1.vmem -o /tmp windows.memmap --pid 1640 --dumpThis will load pid.1640.dmp in tmp
Now we use string to dig deeper
Answer: Mozilla/5.0 (Windows; U; MSIE 7.0; Windows NT 6.0; en-US
Question 8: Was Chase Bank one of the suspicious bank domains found in Case 001? (Y/N)
Strings to the recue again…
strings /tmp/pid.1640.dmp | grep "chase"
Answer: Y
Question 9: What suspicious process is running at PID 740 in Case 002?
Okay, case 2.
./vol.py -f /Scenarios/Investigations/Investigation-2.raw windows.pstree
Look at PID 740
Answer: @WanaDecryptor@
Question 10: What is the full path of the suspicious binary in PID 740 in Case 002?
Time to break out dlllist and our friend grep
./vol.py -f /Scenarios/Investigations/Investigation-2.raw windows.dlllist | grep 740
The directory is in the second line.
Answer: C:\Intel\ivecuqmanpnirkt615\@WanaDecryptor@.exe
Question 11: What is the parent process of PID 740 in Case 002?
See screenshot above with PIDs listed. You can see that the executable before PID 740 is…
Answer: tasksche.exe
Question 12: What is the suspicious parent process PID connected to the decryptor in Case 002?
This is in the same screenshot. Basically this is asking what the PID for tasksche.exe is…
Answer: 1940
Question 13: From our current information, what malware is present on the system in Case 002?
This is kinda self-explanatory, so let’s take a wild guess..
Answer: WannaCry
Question 14: What DLL is loaded by the decryptor used for socket creation in Case 002?
PID 740 has a lot of DLLs listed. We could try each one in the answer box, but it did say socket in the question. WS stands for WinSock as in Winsock DLLs.
Answer: WS2_32.dll
Question 15: What mutex can be found that is a known indicator of the malware in question in Case 002?
We are going to use handles on this one and look for PID 1940
./vol.py -f /Scenarios/Investigations/Investigation-2.raw windows.handles | grep 1940
I could have searched for this one, but it popped out of the screen when looking for mutex…
Answer: MsWinZonesCacheCounterMutexA
Question 16: What plugin could be used to identify all files loaded from the malware working directory in Case 002?
Again, we look at the reference and find filescan
Answer: windows.filescan
LinkedIn Learning – CompTIA Security+ Module 8: Network Security Design and Implementation
TryHackMe – SOC Level 1(85 % Complete): KAPE – Complete
Python for Cybersecurity (Section 5 out of 10)
TryHackMe – SOC Level 1(82 % Complete): Autopsy, Redline – Complete
I tried this and found Chat GPT to be helpful writing about myself and using “resume speak”.
I’m studying for the Security+ right now. This was a good overview, but I think anyone with any technical background can skip directly to the Security+.
I’ll watch anything with Rachel Tobac in it. She is a master of social engineering!
This certificate looks like it would be worth while to do after the Security+ as it covers CISSP a lot and I’ll need lots of time to review the topics for that more difficult certificate.
TryHackMe – SOC Level 1(75 % Complete): Windows Forensics 2 – In Progress