TryHackMe - IronShade challage (medium level)

-

 



Incident Scenario

There I was, seated with a Caffè Latte and cold server dump, while my team successfully lured IronShade-one of the world’s most renowned APT groups-into our honeypot using exposed SSH ports with weak credentials. Of course, sure enough, they pounced like moths to a flame. The fun part would then be trying to piece every single one of their moves together-like some sort of Sherlock in cybersecurity.The mission? To investigate the compromised Linux server, find the attack footprints, and maybe poke a little fun at the audacity of the “subtle” moves of IronShade Lab Incident


Hackers Get Too Cocky

According to the threat intel report, IronShade loves persistence-so do we all. They are supposed to have created backdoor accounts, cronjobs, and even installed their shady services. Think about your very own malicious startup operating on your infrastructure. But enough chit-chat; let’s dive in. Here is the juicy investigative breakdown.


Explanation  - " Who Let the Backdoor In? " - you can see a misspelling "mircoservice" 

Explanation  - On this one "Files in Memory? Found You!" 

A listing in the root directory presents one very suspicious hidden file, reveals a file which shouldn’t be there. 

Explanation - "Suspicious Services Installed" 

Every APT leave a scent of bad choices, including shady services. The listing of all services and find them . Here is a time consuming but on the video was fast forward .

Explanation  - "Malicious Packages? Installed with Care" - Here not to mutch explanation , read about 

pscanner.

Comments

Post a Comment

Popular posts from this blog

TryHackMe - Typo Snare Threat Hunter Simulator (medium level)

-
Image
  Threat Hunt Walkthrough The "Typo Snare" scenario on TryHackMe is a fantastic real-world simulation of a sophisticated, multi-stage attack. It starts with a simple mistake and escalates to a full domain compromise, culminating in ransomware. This post will walk you through the entire attack chain, phase by phase, showing you how to find each piece of evidence using Elastic KQL queries. Phase 1: Initial Access & Execution What Happened: The attack began when the user perry.parsons on workstation WKSTN-03 needed a 7-Zip tool. He googled it, clicked a typosquatted link ( 7zipp.org ), and downloaded a trojanized installer. This installer executed a PowerShell script ( 7z.ps1 ) directly from the attacker's server to establish the initial foothold. How to Find It: You are looking for a PowerShell process that was likely spawned by a browser and contains a command to download and execute a script ( iwr for Invoke-WebRequest and iex for Invoke-Expression ). KQL Query...
Read more

TryHackMe - Threat Hunting Simulator - Health Hazard

-
Image
  Scenario overview After months of juggling content calendars and caffeine-fueled brainstorming, co-founder Tom Whiskers finally carved out time to build the company’s first website. It was supposed to be simple: follow a tutorial, install a few packages, and bring the brand to life with lightweight JavaScript magic.   But between sleepless nights and copy-pasted code, Tom started feeling off. Not sick exactly, just off. The terminal scrolled with reassuring green text, the site loaded fine, and everything looked normal.   Then, a strange file appeared on the system. No one could say where it came from. It wasn’t part of the tutorial, didn’t match any known dependencies, and didn’t even run.   It just waited.   Scenario objectives Determine how a threat actor first gained a foothold on the system. Identify suspicious activity that may point to the initial compromise method. Investigate signs of malicious execution following the initial access. Analyse the logs ...
Read more

TryHackMe - Initial Access Pot | CTF | (hard level)

-
Image
  This is another challenge for the Blue Team, but the level here is hard. Once the machine starts, we will receive credentials that allow us to dig into the logs directly. By exploring the attacker’s footsteps, we will identify which pages of the web application they accessed. Additionally, we have full access to the backend code of the running application once we log in via SSH. So I am not running any directory fuzzing tool. All Details are in the video  Thank you for watching 
Read more