Windows Incident Surface

Walkthrough summary

Windows Incident Surface TryHackMe walkthrough with 28 answered prompts and lab methodology notes.

Sample prompts covered

• What tool did the adversary use to delete the logs?
  Open the walkthrough page to inspect the full answer and command flow.
• What was the registry path used by the adversary to store and steal the login credentials?
  Open the walkthrough page to inspect the full answer and command flow.
• What is the hostname of the compromised host?
  Open the walkthrough page to inspect the full answer and command flow.
• What is the OS version of the compromised host?
  Open the walkthrough page to inspect the full answer and command flow.
• What is the Time ID of the compromised host?
  Open the walkthrough page to inspect the full answer and command flow.