IronShade

Walkthrough summary

IronShade TryHackMe walkthrough with 12 answered prompts and lab methodology notes.

Sample prompts covered

• What is the Machine ID of the machine we are investigating?
  Open the walkthrough page to inspect the full answer and command flow.
• What backdoor user account was created on the server?
  Open the walkthrough page to inspect the full answer and command flow.
• What is the cronjob that was set up by the attacker for persistence?
  Open the walkthrough page to inspect the full answer and command flow.
• Examine the running processes on the machine. Can you identify the suspicious-looking hidden process from the backdoor account?
  Open the walkthrough page to inspect the full answer and command flow.
• How many processes are found to be running from the backdoor account’s directory?
  Open the walkthrough page to inspect the full answer and command flow.