Sysmon

Walkthrough summary

Sysmon TryHackMe walkthrough with 22 answered prompts and lab methodology notes.

Sample prompts covered

• How many event ID 3 events are in C:\Users\THM-Analyst\Desktop\Scenarios\Practice\Filtering.evtx?
  Open the walkthrough page to inspect the full answer and command flow.
• What is the UTC time created of the first network event in C:\Users\THM-Analyst\Desktop\Scenarios\Practice\Filtering.evtx?
  Open the walkthrough page to inspect the full answer and command flow.
• What is the full registry key of the USB device calling svchost.exe in Investigation 1?
  Open the walkthrough page to inspect the full answer and command flow.
• What is the device name when being called by RawAccessRead in Investigation 1?
  Open the walkthrough page to inspect the full answer and command flow.
• What is the first exe the process executes in Investigation 1?
  Open the walkthrough page to inspect the full answer and command flow.