Incident Response Process

Walkthrough summary

Incident Response Process TryHackMe walkthrough with 9 answered prompts and lab methodology notes.

Sample prompts covered

• What is the phase of the NIST Incident Response Framework in which incident responders are usually called to action?
  Open the walkthrough page to inspect the full answer and command flow.
• What is the name of the process active in the attached VM that we suspect could be a miner?
  Open the walkthrough page to inspect the full answer and command flow.
• What is the combination IP:port of the C2 server of the malware?
  Open the walkthrough page to inspect the full answer and command flow.
• What is the name of the document containing the malicious macro?
  Open the walkthrough page to inspect the full answer and command flow.
• What is the website from which the miner was downloaded?
  Open the walkthrough page to inspect the full answer and command flow.