TryHackMe - Trusted By Default CFT

#tryhackme #cybersecurity #cft #forensics In this complete CTF / Blue Team / Threat Hunting walkthrough, we investigate an end-to-end security incident using Splunk Enterprise. We track the attacker's footprint starting from a suspicious HTTP POST request all the way to lateral movement and data return on the organization's file server. Investigation Timeline & Answered Objectives: Initial Access: Identifying the suspicious POST request in the web logs (URI Path & Source IP). Execution & Privilege Escalation: Correlating web activity with Windows Event Logs (EventCode 4624 - Batch Logon) on the web server (AUR-WEB01). Active Directory Modification: Analyzing unauthorized group membership changes (Portal Application Service) and identifying the compromised user account. Lateral Movement: Identifying RDP and SMB sessions on the File Server (AUR-FS01) originating from the pivot source IP Network Traffic Forensics: Inspecting network telemetry to determine the exact volume of returned data ( Technologies & Event IDs Covered: Splunk SPL (Search Processing Language) Windows Security Event Logs (EventCode 4624 - Logon Types 3, 4, 10) Sysmon EventID 3 (Network Connections) Network Flow / Zeek Traffic Analysis