Eviction

Walkthrough summary

Eviction TryHackMe walkthrough with 10 answered prompts and lab methodology notes.

Sample prompts covered

• What is a technique used by the APT to both perform recon and gain initial access?
  Open the walkthrough page to inspect the full answer and command flow.
• Sunny identified that the APT might have moved forward from the recon phase. Which accounts might the APT compromise while developing resources?
  Open the walkthrough page to inspect the full answer and command flow.
• E-corp has found that the APT might have gained initial access using social engineering to make the user execute code for the threat actor. Sunny wants to identify if the APT was also successful in execution. What two techniques of user execution should Sunny look out for? (Answer format: and )
  Open the walkthrough page to inspect the full answer and command flow.
• If the above technique was successful, which scripting interpreters should Sunny search for to identify successful execution? (Answer format: and )
  Open the walkthrough page to inspect the full answer and command flow.
• While looking at the scripting interpreters identified in Q4, Sunny found some obfuscated scripts that changed the registry. Assuming these changes are for maintaining persistence, which registry keys should Sunny observe to track these changes?
  Open the walkthrough page to inspect the full answer and command flow.