Threat Hunting: Foothold

Walkthrough summary

Threat Hunting: Foothold TryHackMe walkthrough with 14 answered prompts and lab methodology notes.

Sample prompts covered

• What is the attacker's successful authentication timestamp on the Jumphost server?
  Open the walkthrough page to inspect the full answer and command flow.
• What is the name of the PHP file accessed by the attacker via the cat command after gaining successful code execution on web01?
  Open the walkthrough page to inspect the full answer and command flow.
• What is the name of the unusual process executed within the timeframe of update.lnk execution on WKSTN-2?
  Open the walkthrough page to inspect the full answer and command flow.
• Tracing back the cmd and PowerShell child processes spawned by installer.exe, what is the first command executed via cmd?
  Open the walkthrough page to inspect the full answer and command flow.
• Using the process ID of the PowerShell process spawned by mshta.exe, what is the destination IP of the network connections made by this process?
  Open the walkthrough page to inspect the full answer and command flow.