TryHackMe – SOC Level 1 Path Complete!

In this post I’d like to talk a bit about TryHackMe and my experience working through the SOC Level 1 learning path.

TryHackMe is a learning platform that sends users to virtual machines (VM) they can access through their web browser. Extremely low barrier to entry! Absolutely no previous knowledge is required. I’m not sponsored and TryHackMe did not ask me to write this.

I’m a big fan of theirs. I think the learning paths and rooms (think learning modules) are fantastic hands-on learnings! I learned

Cyber Defense Frameworks
Cyber Threat Intelligence
Network Security and Traffic Analysis
Endpoint Security Monitoring
Security Information and Event Management (SIEM)
Digital Forensics and Incident Response
Phishing

Each room walks the learner through hands-on learning. I learned all these tools:

yara
opencti
misp
mitre
cyberkillchain
snort
zeek
brim
wireshark
sysmon
sysinternals
osquery
wazuh
splunk
autopsy
redline
linux (a lot!)
thehive
phishing

And even more! It’s a great platform. As of this writing it is $14 a month. If you’re not going to use it, don’t sign up, but if you really want to learn these tools and more it’s a great place to get started. You can spend as much time as you want learning these tools in real environments. You can’t break anything because it’s all VMs that start fresh each time the are launched. Getting the chance to work on these environments without setting up all these VMs is a huge time savings.

If you want to play around in there for free you can do that too. There is plenty of free content to get started with and see if you want to pay for the premium rooms and features. It’s worth checking out.

Weekly Cybersecurity Wrap-up 11/20/23

Projects

LinkedIn Learning – CompTIA Security+ Module 9: Operations and Incident Response | Complete!

TryHackMe – SOC Level 1(100 % Complete): Phishing Analysis Fundamentals, Phishing Emails in Action, Phishing Analysis Tools, Phishing Prevention, The Greenholt Phish

UDemy – Python for Cybersecurity – Gitlab

Videos

Articles

AutoZone Files MOVEit Data Breach Notice With State of Maine – The company temporarily disabled the application and patched the vulnerability, though affected individuals should still remain vigilant.
Hacktivists breach U.S. nuclear research lab, steal employee data – The Idaho National Laboratory (INL) confirms they suffered a cyberattack after ‘SiegedSec’ hacktivists leaked stolen human resources data online.
Inside Job: Cyber Exec Admits to Hospital Hacks – Healthcare cyber services executive Vikas Singla admits to hobbling hospital operations, then using the incidents to try and gin up extra business.
AI Helps Uncover Russian State-Sponsored Disinformation in Hungary – Researchers used machine learning to analyze Hungarian media reports and found Russian narratives soured the nation’s perspective on EU sanctions and arms deliveries months before the Ukraine invasion.
Canadian Military, Police Impacted by Data Breach at Moving Companies – Data breach at moving companies impacts Canadian government employees, and military and police personnel.
Tor Network Removes Risky Relays Associated With Cryptocurrency Scheme – The Tor network has removed many relays associated with a cryptocurrency scheme, citing risk to integrity and users.
Windows Hello auth bypassed on Microsoft, Dell, Lenovo laptops – Security researchers bypassed Windows Hello fingerprint authentication on Dell Inspiron, Lenovo ThinkPad, and Microsoft Surface Pro X laptops in attacks exploiting security flaws found in the embedded fingerprint sensors.

TryHackMe Walkthrough – The Greenholt Phish

Task 1: Just another day as a SOC analyst

Only one task for this room.

Question 1: What date was the email received? (answer format: M/DD/YY)

I opened the email in Thunderbird.

Answer: 6/10/20

Question 2: Who is the email from?

In the From…

Answer: Mr. James Jackson

Question 3: What is his email address?

Also in the From…

Answer: info@mutawamarine.com

TryHackMe Walkthrough – Phishing Prevention

Task 1: Introduction

Question 1: After visiting the link in the task, what is the MITRE ID for the “Software Configuration” mitigation technique?

Follow the link to https://attack.mitre.org/techniques/T1598/#mitigations. Look for Software Configuration and the ID is there.

Answer: M1054

Task 2: SPF (Sender Policy Framework

Question 1: Referencing the dmarcian SPF syntax table, what prefix character can be added to the “all” mechanism to ensure a “softfail” result?

Follow the link to the page and then click on the here in: “More in-depth information on the differences between “~” and “–” can be found here“

This gives you the…

Anwser: ~

Question 2: What is the meaning of the -all tag?

This answer is on that second webpage as well. Scroll down a little and to see the difference between ~all and -all.

“softfail” in the case of “~”

“fail” in the case of “-“

Answer: fail

TryHackMe Walkthrough – Phishing Analysis Tools

Task 1: Introduction

Question 1: No answer needed

Task 2: What information should we collect?

Question 1: No answer needed

Task 3: Email header analysis

Question 1: What is the official site name of the bank that capitai-one.com tried to resemble?

This should be self-explanatory, google capitol one to see what their domain is.

Answer: capitalone.com

Phishing Email Example | How To Report Phishing Attempts in Gmail

I received this email this morning and I thought it would be a great example to point out the issues in the email that flag it as a phishing email.

Alright, here we have Jr. emailing us regarding an invoice. Two things off the bat, I’m not expecting anything from someone named Jr. and I have no idea what invoice I should be expecting. The last name Hade is not familiar to me. Next this attacker used Hello and Dear right after each other. This isn’t done. Then instead of using Jason to address me he uses my email address. Next looking at the attached PDF file name, which you should never open or download, the file name is just gibberish. The attacker didn’t even go to the bother of naming it “invoice” or anything that would make more sense. If we keep looking we see that their email is gibberish too and its from a gmail domain, who does legit business with a gmail address and not a real domain like bestbuy.com or something are slim.

Okay, so I know this is a phishing attempt, but what do I do with it? I could just delete it, but that doesn’t flag as something that gmail can research and prevent other users from getting this message. I could report spam, but it’s worse than just an unsolicited marketing email. This thing is malicious, so let’s see what gmail suggest.

Okay so I click on The three dots near reply and I can submit a phishing attempt.

After clicking on the message we get a pop-up that says…

And the email is removed from my inbox. We’re done. Great job and keep vigilant, Always be suspicious!

TryHackMe Walkthrough – Phishing Emails in Action

Task 1: Introduction

Question 1: No answer needed

Task 2: Cancel your PayPal order

Question 1: What phrase does the gibberish sender email start with?

This answer is in the reading. Look at the email address highlighted with a red circle 2.

Answer: noreply

TryHackMe Walkthrough – Phishing Analysis Fundamentals

Task 1: Introduction

Question 1: No answer needed.

Task 2: The Email Address

Question 1: Email dates back to what time frame?

Answer is in the reading. Second paragraph.

Answer: 1970s

Weekly Cybersecurity Wrap-up 11/13/23

Learn Cybersecurity with me. I’m posting my journey here.

Webinars/Videos

Articles

Australian Ports Resume Operation After Crippling Cyber Disruption – Details of a major cyberattack against Australia’s shipping industry remain few and far between, but the economic impact is clear.
Ransomware Group Leaks Files Allegedly Stolen From Boeing – The LockBit ransomware group has leaked gigabytes of files allegedly stolen from the systems of aerospace giant Boeing.
Hackers swipe Booking.com, damage from attack is global – Hackers breached Booking.com, one of the world’s largest online accommodation reservation sites, by posing as hotel staff to steal credit card information from travelers making bookings.
Administrator of Darkode Hacking Forum Sentenced to Prison – Thomas McCormick, aka fubar, an administrator of the Darkode hacking forum, has been sentenced to 18 months in prison.
CISA Alert – Scattered Spider
Russian Hackers Linked to ‘Largest Ever Cyber Attack’ on Danish Critical Infrastructure – Russian threat actors have been possibly linked to what’s been described as the “largest cyber attack against Danish critical infrastructure,” in which 22 companies associated with the operation of the country’s energy sector were targeted in May 2023.
Ransomware gang files SEC complaint over victim’s undisclosed breach – The ALPHV/BlackCat ransomware operation has taken extortion to a new level by filing a U.S. Securities and Exchange Commission complaint against one of their alleged victims for not complying with the four-day rule to disclose a cyberattack.
IPStorm botnet with 23,000 proxies for malicious traffic dismantled – The U.S. Department of Justice announced today that Federal Bureau of Investigation took down the network and infrastructure of a botnet proxy service called IPStorm.
FBI knows identities of some U.S. members of “Scattered Spider,” but no arrests so far? – For more than six months, the FBI has known the identities of at least a dozen members tied to the hacking group responsible for the devastating September break-ins at casino operators MGM Resorts International and Caesars Entertainment, according to four people familiar with the investigation.
Biden Campaign Looking for CISO – The Biden for President campaign is looking for a cybersecurity chief to “define the organization’s risk appetite” and manage its cybersecurity and IT initiatives.
Hackers Could Exploit Google Workspace and Cloud Platform for Ransomware Attacks – A set of novel attack methods has been demonstrated against Google Workspace and the Google Cloud Platform that could be potentially leveraged by threat actors to conduct ransomware, data exfiltration, and password recovery attacks.
CitrixBleed Vulnerability Exploitation Suspected in Toyota Ransomware Attack – Toyota Financial Services has been hit by a ransomware attack that may have involved exploitation of the CitrixBleed vulnerability.
Long Beach, California turns off IT systems after cyberattack – The Californian City of Long Beach is warning that they suffered a cyberattack on Tuesday that has led them to shut down portions of their IT network to prevent the attack’s spread.
US Teen Pleads Guilty to Credential Stuffing Attack on Fantasy Sports Website – Wisconsin teenager Joseph Garrison has admitted in court to launching a credential stuffing attack on a betting website.

Podcasts

Cyberwire – Ep 1949 | 11.16.23 – Shopping during wartime? Focus, people.

Projects

LinkedIn Learning – CompTIA Security+ Module 8: Network Security Design and Implementation | Complete!

TryHackMe – SOC Level 1(92 % Complete): Intro to Malware Analysis

UDemy – Python for Cybersecurity – Gitlab

TryHackMe – Intro to Malware Analysis Walkthrough

In this walkthrough we will go step by step to answer the questions.

Task 1: Introduction

No questions here, so let’s keep moving.

Task 2: Malware Analysis

Question: Which team uses malware analysis to look for IOCs and hunt for malware in a network?

The answer can be found in the reading in “The purpose behind Malware Analysis” section. Specifically, the Threat Hunt bullet.

Threat Hunt teams analyze malware to identify IOCs, which they use to hunt for malware in a network.

Answer: threat hunt teams