{"id":1609,"date":"2026-01-17T19:30:00","date_gmt":"2026-01-17T19:30:00","guid":{"rendered":"https:\/\/zombierollz.blog\/?p=1609"},"modified":"2026-01-17T16:57:07","modified_gmt":"2026-01-17T16:57:07","slug":"windows-threat-detection-1","status":"publish","type":"post","link":"https:\/\/zombierollz.blog\/?p=1609","title":{"rendered":"Windows Threat Detection 1"},"content":{"rendered":"\n

https:\/\/tryhackme.com\/room\/windowsthreatdetection1<\/a>
Created by: tryhackme, TactfulTurtle<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

Task 3, Initial Access via RDP, goes over the risks of using RDP and the vulnerabilities that it presents. We will be using the RDP event logs for this task.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

“Which user seems to be most actively brute-forced by botnets?”<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

“Which IP managed to breach the host via RDP (Logon Type 10)?”<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

“Can you get the real Workstation Name (hostname) of the threat actor?”

Staying on the same event, we obtain the workstation name.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

On to Task 4, Initial Access via Phishing!

By now, we all know what phishing is and how it’s carried out. This task covers other ways that we might be tricked by a phishing attack.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Per THM, “Files with a .lnk file extension refers to “link files” or “desktop shortcuts”. These files are often used to point to a file or folder from another location, making it convenient to access frequently used files and folders.”

“Let’s play the role of the untrained user and mindlessly open the COM file.
Run the www.skype.com file from the Phishing Case 1<\/strong> folder, which flag do you get?”<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

“Continue with the second attachment from the Phishing Case 2<\/strong> folder.
From which URL does the malicious LNK download the next stage malware?”<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Open the zip file, then extract it. After you extract it, look at the properties of the website file and copy and paste only the HTTP link.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

“Finally, move on to the Phishing Case 3<\/strong> folder and review its content.
What is the name of the double-extension file you see there?”<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

On to Task 5, Continuing Phishing Topic!

“Which file did the user download via the web browser?”<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

“In which folder did the user unarchive the suspicious file?”<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

“What is the process ID of the launched phishing malware?”

The easiest way to obtain this is to look at the Process Create in the Task Category column and have the time and date from beginning to end.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

“Finally, which malicious domain did the malware try to connect to?”<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

On no Task 6, Initial Access via USB!<\/p>\n\n\n\n

By now, we know of the social engineering attacks when it comes to USBs. Drop it in a parking lot, and a curious user picks it up, plugs it in, and voila, we have our attack entrance. However, how is one able to detect an infected USB?<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

With the next few questions, as long as you change the Date and Time to match up from beginning to end, they follow each other when it comes to Event order.

“Which USB file was launched by the user?”<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

“Which suspicious file did the malware drop to the disk?
(Format: full path to the file, e.g. C:\\file.txt)”<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

“To which other USB did the malware propagate?
(Format: just the letter, e.g. X:)”<\/p>\n\n\n\n

\"\"<\/figure>\n","protected":false},"excerpt":{"rendered":"

https:\/\/tryhackme.com\/room\/windowsthreatdetection1Created by: tryhackme, TactfulTurtle Task 3, Initial Access via RDP, goes over the risks of using RDP and the vulnerabilities that it presents. We will be using the RDP event logs for this task. “Which user seems to be most actively brute-forced by botnets?” “Which IP managed to breach the host via RDP (Logon Type […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-1609","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"blocksy_meta":{"styles_descriptor":{"styles":{"desktop":"","tablet":"","mobile":""},"google_fonts":[],"version":8}},"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/posts\/1609","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1609"}],"version-history":[{"count":4,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/posts\/1609\/revisions"}],"predecessor-version":[{"id":1634,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/posts\/1609\/revisions\/1634"}],"wp:attachment":[{"href":"https:\/\/zombierollz.blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1609"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1609"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1609"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}