TryHackMe: Investigating Windows Walkthrough

Подписаться 114 тыс.

Просмотров 9 тыс.

50% 1

Background: A windows machine has been hacked, its your job to go investigate this windows machine and find clues to what the hacker might have done.
We will dive into how you can go about, investigating a compromised windows system using windows event logs etc
Room: tryhackme.com/...
This is a free room Connect and Direct Message me on Linkedin: / howard-mukanda-24503144

Опубликовано:

13 окт 2024

Ссылка:

Скачать:

Готовим ссылку...

Добавить в:

Мой плейлист

Посмотреть позже

Комментарии : 19

@jasonlayton8760 9 месяцев назад

your answer to #4 kinda seems like B.S. Why would you not show you actually retrieving the IP? update: the correct way to find the answer is much more complicated, the pop-up cmd shell does not give you the answer. One should go to the registry editor and go down the rabbit hole to Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run which with a little research you will learn that this is where programs or scripts are stored that should be executed automatically when the Windows OS starts up. Here you will find the script that gives you the answer to #4 in the correct way.

@mochagawd Год назад

That was great! I learned a lot watching you and realized I was overthinking how to resolve a lot of these questions

@bartomiejpotaman6973 Месяц назад

High quality stuff! There was one step with the ip address in the beggining you skipped but with some external resources yall can find it. Tremendous!

@Moyyyi Год назад

at @6.40 why this event and not at the bottom one which is at 4:04:39 PM? Question asking first assign time its earlier

@nump9768 Год назад

i had the same question

@mohammedk8545 Год назад

same question

@SNan-oi9no Год назад

I couldn't wrap my head around it too. It would be nice if someone could explain the reason for picking 4:04:49@@nump9768

@8080VB Год назад

Somebody stands up for this. Guys. . But if you check the net user $username. There lies the correct answer. But however in the event viewer it's not the same.