Tactical Detection

Walkthrough summary

Tactical Detection TryHackMe walkthrough with 16 answered prompts and lab methodology notes.

Sample prompts covered

• What did we use to transform IOCs as detection rules in a vendor-agnostic format?
  Open the walkthrough page to inspect the full answer and command flow.
• What is the original indicator found by the authors of the documentation? Write it as written in the spreadsheet.
  Open the walkthrough page to inspect the full answer and command flow.
• What is the full file path of the malicious file downloaded from the internet?
  Open the walkthrough page to inspect the full answer and command flow.
• In the Sigma Rule baddomains.yml, what is the logsource category used by the author?
  Open the walkthrough page to inspect the full answer and command flow.
• Upon translating the Follina Sigma Rule, what is the index name that the rule will be using, as shown in the output?
  Open the walkthrough page to inspect the full answer and command flow.