Sighunt
TryHackMe Challenge Walkthrough
Challenge Overview
You are hired as a Detection Engineer for your organization. During your first week, a ransomware incident has just concluded, and the Incident Responders of your organization have successfully mitigated the threat. With their collective effort, the Incident Response (IR) Team provided the IOCs based on their investigation. Your task is to create Sigma rules to improve the detection capabilities of your organization and prevent future incidents similar to this.
Indicators of Compromise
Based on the given incident report, the Incident Responders discovered the following attack chain:
- Execution of malicious HTA payload from a phishing link.
- Execution of Certutil tool to download Netcat binary.
- Netcat execution to establish a reverse shell.
- Enumeration of privilege escalation vectors through PowerUp.ps1.
- Abused service modification privileges to achieve System privileges.
- Collected sensitive data by archiving via 7-zip.
- Exfiltrated sensitive data through cURL binary.
- Executed ransomware with huntme as the file extension.
Q & A
Q1 What is the Challenge #1 flag?
Answer
THM{ph1sh1ng_msht4_101}
Q2 What is the Challenge #2 flag?
Answer
THM{n0t_just_4_c3rts}
Q3 What is the Challenge #3 flag?
Answer
THM{cl4ss1c_n3tc4t_r3vs}
Q4 What is the Challenge #4 flag?
Answer
THM{p0wp0wp0w3rup_3num}
Q5 What is the Challenge #5 flag?
Answer
THM{ov3rpr1v1l3g3d_s3rv1c3}
Q6 What is the Challenge #6 flag?
Answer
THM{h1d3_m3_1n_run0nc3}
Q7 What is the Challenge #7 flag?
Answer
THM{c0ll3ct1ng_7z_ftw}
Q8 What is the Challenge #8 flag?
Answer
THM{cUrling_0n_w1nd0ws}
Q9 What is the Challenge #9 flag?
Answer
THM{huntm3_pl34s3}
Conclusion
SigHunt offers a hands-on opportunity to delve into the intricacies of detection engineering. By translating real-world IOCs into actionable Sigma rules, you gain a deeper understanding of how to proactively identify and respond to threats within a SIEM environment. This challenge underscores the importance of precise rule creation in maintaining robust cybersecurity defenses.