Baselines and Anomalies

Walkthrough summary

Baselines and Anomalies TryHackMe walkthrough with 12 answered prompts and lab methodology notes.

Sample prompts covered

• What is the name of the workstation that has the anomalous IP address?
  Open the walkthrough page to inspect the full answer and command flow.
• What is the name of the server with the anomalous IP address?
  Open the walkthrough page to inspect the full answer and command flow.
• Which workstation has a device model different from the rest?
  Open the walkthrough page to inspect the full answer and command flow.
• There are two installed software programs that should not be included in Anna's list. Which ones are they? Share their serial numbers. Answer format: X, Y
  Open the walkthrough page to inspect the full answer and command flow.
• When trying to identify if an activity was performed by the administrator or not, what is the biggest tool that a defender can use?
  Open the walkthrough page to inspect the full answer and command flow.