NOTES

1. Assign the received alert to yourself to initiate the investigation.

1. Review the alert type and context: is it related to a typosquatted domain, a known C2 server, a known bad IP?
2. Prioritize alerts involving sensitive internal assets or external destinations known for malware/phishing.
3. Look for clustering of similar alerts (multiple hits to the same domain or IP) or across multiple hosts.

1. Open associated firewall or DNS logs.
2. Extract connection metadata: source IP (internal host), destination domain or IP, timestamp, and port/protocol.
3. Determine whether the connection was blocked or allowed.
4. Check if the DNS resolution was internal (e.g., proxy-resolved) or direct (if applicable).

1. For typosquatted domains: Compare the domain with legitimate domains it resembles. Look for small variations (e.g., micros0ft.com, goggle.net).
2. Use threat intel feeds (e.g., the internal TryDetectThis app) to validate whether the domain/IP address is known for phishing or malware.
3. Note any malware hosting, C2 activity, or blacklisting.

1. Identify the user or system that initiated the connection.
2. Determine if the connection was initiated via browser, application, or automated script.
3. Review recent activity from the same host: downloads, logins, process creation.
4. Check for signs of compromise (e.g., suspicious processes, credential abuse, or prior alerts).
5. Note if the host shows infection signs.

1. Classify the alert as True Positive or False Positive based on your investigation.
2. Document findings including domain/IP reputation, host behavior, and user context.
3. Escalate if response actions are needed, such as blocking the domain/IP or performing incident response on the host.
4. Submit and close the alert according to standard procedures defined in the documentation.

1. Assign received alert to yourself for investigation process.

1. Familiarize yourself with the fields included in the alert. Review the phishing alert from your email security gateway (SEG), SIEM, or user report. Note available fields such as sender, subject, recipient, message ID, and delivery time.
2. Identify the time at which the email was received. Review the timestamp field or header to determine when the message was delivered to the recipient's inbox. This helps in scoping related activity.
3. Identify the specific asset associated with the alert. Determine which user or mailbox received the email. Note whether the user is a standard employee, VIP, or part of a sensitive business unit.
4. Identify the user associated with the activity. Look up the recipient in internal directory tools to determine their department, title, and whether they are active or privileged. Review the "To" or "Recipient" field.
5. Determine the malicious element in the email. Check whether the threat is a suspicious link, attachment, spoofed sender, or impersonation attempt.

1. Follow steps 3.1–3.2 to detect potential anomalies and accurately classify the activity.

1. Look up the sender’s domain/IP in the TryDetectThis app for threat intel.
2. Search historical mail logs to check if the sender has contacted other users.

1. Upload the attachment to TryDetectThis to assess for malicious indicators.
2. If no threats are found, manually review the file’s contents for suspicious behavior.

1. Identify other recipients who received the same email.
2. Check for process starts or detections related to the attachment or domain.
3. Search proxy and DNS logs for access to email-linked URLs.
4. Look for lateral movement via unusual logons or internal connections.

1. Classify the alert as True Positive or False Positive based on the results of your investigation.
2. Describe your analysis in the Case Report as specified in the "Alert Reporting" documentation section.
3. Submit and close alert.

Retrieves all raw events from the main index that have a source type of web_traffic. This is the foundational search for web log analysis.

index=main sourcetype=web_traffic

Retrieves web traffic events and uses the timechart command to count the total number of events, grouping them by 1-day intervals (span=1d).

index=main sourcetype=web_traffic | timechart span=1d count

Similar to the above, but after counting, it sorts the daily counts (sort by count) and then reverses the order (reverse) to show the day with the lowest count first. (If reverse is omitted, it shows the highest first). Note: The query as written shows lowest first.

index=main sourcetype=web_traffic | timechart span=1d count | sort by count | reverse

Filter Non-Standard Browsers/Agents - Retrieves web traffic events but excludes logs where the user_agent field contains common, legitimate browser strings (Mozilla, Chrome, Safari, Firefox).

index=main sourcetype=web_traffic user_agent!=*Mozilla* user_agent!=*Chrome* user_agent!=*Safari* user_agent!=*Firefox*

Narrows down to non-standard user agents (as above), counts the total number of events per client IP address, sorts to find the highest counts, and displays the Top 5 IP addresses.

sourcetype=web_traffic user_agent!=*Mozilla* user_agent!=*Chrome* user_agent!=*Safari* user_agent!=*Firefox* | stats count by client_ip | sort -count | head 5

Filters web traffic from a specific IP (<REDACTED>) where the requested path includes common targets for attackers seeking sensitive files (e.g., application configuration (.env), PHP debugging info (phpinfo), or source control data (.git)).

sourcetype=web_traffic client_ip="<REDACTED>" AND path IN ("/.env", "/*phpinfo*", "/.git*") | table _time, path, user_agent, status

Filters traffic from a specific IP (<REDACTED>) looking for requests where the path contains path traversal indicators (*..*) or patterns related to open redirection attacks (*redirect*).

sourcetype=web_traffic client_ip="<REDACTED>" AND path="*..*" OR path="*redirect*"

Focuses the Path Traversal search on highly suspicious, multiple-level traversal attempts (*..\/..\/*) and redirection attempts (*redirect*), then provides a count of how many times each unique path was requested.

sourcetype=web_traffic client_ip="<REDACTED>" AND path="*..\/..\/*" OR path="*redirect*" | stats count by path

Filters traffic from a specific IP (<REDACTED>) where the user_agent field contains the signature of popular SQL injection tools (sqlmap, Havij).

sourcetype=web_traffic client_ip="<REDACTED>" AND user_agent IN ("*sqlmap*", "*Havij*") | table _time, path, status

Filters traffic from a specific IP (<REDACTED>) for requests targeting common names for compressed backup or log files (backup.zip, logs.tar.gz).

sourcetype=web_traffic client_ip="<REDACTED>" AND path IN ("*backup.zip*", "*logs.tar.gz*") | table _time path, user_agent

Filters traffic from a specific IP (<REDACTED>) for requests matching known indicators of malicious files or command execution via a webshell (e.g., bunnylock.bin, shell.php?cmd=).

sourcetype=web_traffic client_ip="<REDACTED>" AND path IN ("*bunnylock.bin*", "*shell.php?cmd=*") | table _time, path, user_agent, status

Retrieves allowed firewall logs (sourcetype=firewall_logs) for traffic originating from a specific internal IP (10.10.1.5) to a specific destination (<REDACTED>), showing detailed flow data.

sourcetype=firewall_logs src_ip="10.10.1.5" AND dest_ip="<REDACTED>" AND action="ALLOWED" | table _time, action, protocol, src_ip, dest_ip, dest_port, reason

Same as above, but uses the stats command to calculate the total sum of bytes transferred for the specific source IP in the allowed flows.

sourcetype=firewall_logs src_ip="10.10.1.5" AND dest_ip="<REDACTED>" AND action="ALLOWED" | stats sum(bytes_transferred) by src_ip

Command Execution Attempt Detection - Searches Apache access logs (index=windows_apache_access) for common command-line tool names (cmd.exe, powershell, Invoke-Expression) used by attackers in the HTTP request (either in the path or query string). Displays key fields.

index=windows_apache_access (cmd.exe OR powershell OR "powershell.exe" OR "Invoke-Expression") | table _time host clientip uri_path uri_query status

Command Execution/Error Detection - Searches Apache error logs (index=windows_apache_error) for command-line tools or the Internal Server Error message. Attackers often execute commands that fail, resulting in an error log entry.

index=windows_apache_error ("cmd.exe" OR "powershell" OR "Internal Server Error")

Processes Spawned by Web Server - Filters System Monitor (Sysmon) logs (index=windows_sysmon) for any new process whose parent process (ParentImage) is the Apache executable (httpd.exe).

index=windows_sysmon ParentImage="*httpd.exe"

Discovery Command Execution - Filters Sysmon logs for the execution of cmd.exe that includes the attacker reconnaissance command whoami.

index=windows_sysmon *cmd.exe* *whoami*

Obfuscated PowerShell Detection - Filters Sysmon logs for powershell.exe execution where the command line contains keywords (enc, -EncodedCommand, Base64) indicating the use of obfuscated, base64-encoded commands.

index=windows_sysmon Image="*powershell.exe" (CommandLine="*enc*" OR CommandLine="*-EncodedCommand*" OR CommandLine="*Base64*")

This query first sets a variable query_now (though it's not strictly used in the subsequent steps), then filters the Syslog_CL table to only include logs where the host name (host_s) exactly matches 'app-02'. Finally, it projects (selects) only the timestamp, host name, and the log message.

set query_now = datetime(2025-10-30T05:09:25.9886229Z);
Syslog_CL
| where host_s == 'app-02'
| project _timestamp_t, host_s, Message

Provide registration details for domain names. Gives the authoritative name servers for the domain. WHOIS servers listen on TCP port 43. Most personal details are now redacted for privacy.

whois tryhackme.com

Registration Data Access Protocol (RDAP). RDAP is the modern successor of WHOIS: it uses HTTPS (secure), returns structured JSON (machine-readable and consistent), supports internationalisation, provides better privacy controls (differentiated access), and aligns with current data protection rules.

curl -s https://rdap.verisign.com/com/v1/domain/tryhackme.com | jq .

Translate domain names to IP addresses, find mail servers, reveal TXT records (SPF, DMARC, verification strings), and more. Standard DNS lookups (dig/nslookup) only resolve names you already know. They will not reveal unadvertised subdomains like blog.tryhackme.com, app.tryhackme.com, or dev.internal.company.com. Online alternatives (if the whois command behaves unexpectedly): https://whois.icann.org/ (legacy WHOIS) https://lookup.icann.org/ (modern RDAP-focused lookup) https://www.whoxy.com/ (historical WHOIS snapshots, free limited use)

nslookup -type=A tryhackme.com 1.1.1.1
nslookup -type=MX tryhackme.com

Historically a backronym for "Domain Information Groper", is the modern, preferred option compared to NSLOOKUP.

dig @1.1.1.1 tryhackme.com MX

Subdomain enumeration for DNS aggregation and graphing Standard DNS lookups (dig/nslookup) only resolve names you already know. They will not reveal unadvertised subdomains like blog.tryhackme.com, app.tryhackme.com, or dev.internal.company.com. It aggregates public DNS data from sources such as search engine caches, zone transfer databases, and certificate records. It does not perform brute-force enumeration, which means it remains fully passive.

Certificate Transparency log searches. The most effective passive subdomain discovery method today is Certificate Transparency logs, accessible through crt.sh. Fully passive, operates in real time, and has no rate limits for basic use. Other passive subdomain discovery options include SecurityTrails (free limited searches) and command-line tools like Subfinder, which aggregate multiple passive sources.

Exposed services. Search engine for internet-connected devices. It continuously scans the public internet, collects banners and responses from open ports and services, and indexes them for search. Unlike Google, which indexes web pages, Shodan focuses on devices: servers, IoT equipment, cameras, routers, industrial control systems, and more.

Same with Shodan, it provides similar host and certificate data. It can serve as a useful complement when cross-referencing results.

Active reconnaissance requires direct engagement with the target. Your probes can be logged, detected, or blocked. It is analogous to walking up to the doors and windows to test locks, cameras, and alarms.

Free service developed to assist in scanning and analysing websites. It is used to automate the process of browsing and crawling through websites to record activities and interactions. When a URL is submitted, the information recorded includes the domains and IP addresses contacted, resources requested from the domains, a snapshot of the web page, technologies utilised and other metadata about the website.

a research project hosted by the Institue for Cybersecurity and Engineering at the Bern University of Applied Sciences in Switzerland. It was developed to identify and track malware and botnets through several operational platforms developed under the project. These platforms are: Malware Bazaar: A resource for sharing malware samples. Feodo Tracker: A resource used to track botnet command and control (C2) infrastructure linked with Emotet, Dridex and TrickBot. SSL Blacklist: A resource for collecting and providing a blocklist for malicious SSL certificates and JA3/JA3s fingerprints. URL Haus: A resource for sharing malware distribution sites. Threat Fox: A resource for sharing indicators of compromise (IOCs).

Seeks to elevate the perception of phishing as a severe form of attack and provide a responsive means of email security. Through email analysis, security analysts can uncover email IOCs, prevent breaches and provide forensic reports that could be used in phishing containment and training engagements. The core features include: Perform email analysis: PhishTool retrieves metadata from phishing emails and provides analysts with the relevant explanations and capabilities to follow the email’s actions, attachments, and URLs to triage the situation. Heuristic intelligence: OSINT is baked into the tool to provide analysts with the intelligence needed to stay ahead of persistent attacks and understand what TTPs were used to evade security controls and allow the adversary to social engineer a target. Classification and reporting: Phishing email classifications are conducted to allow analysts to take action quickly. Additionally, reports can be generated to provide a forensic record that can be shared.

Cisco assembled a large team of security practitioners called Cisco Talos to provide actionable intelligence, visibility on indicators, and protection against emerging threats through data collected from their products. Cisco Talos encompasses six key teams: Threat Intelligence & Interdiction: Quick correlation and tracking of threats provide a means to turn simple IOCs into context-rich intel. Detection Research: Vulnerability and malware analysis is performed to create rules and content for threat detection. Engineering & Development: Provides the maintenance support for the inspection engines and keeps them up-to-date to identify and triage emerging threats. Vulnerability Research & Discovery: Working with service and software vendors to develop repeatable means of identifying and reporting security vulnerabilities. Communities: Maintains the image of the team and the open-source solutions. Global Outreach: Disseminates intelligence to customers and the security community through publications. More information about Cisco Talos can be found on their White Paper

SYSTEM

Services · Mounted Devices · Boot Configuration · Drivers · Hardware C:\Windows\System32\config\SYSTEM

SECURITY

Local Security Policies · Audit Policy Settings C:\Windows\System32\config\SECURITY

SOFTWARE

Installed Programs · OS Version and other info · Autostarts · Program Settings C:\Windows\System32\config\SOFTWARE

SAM

Usernames and their Metadata · Password Hashes · Group Memberships · Account Statuses C:\Windows\System32\config\SAM

NTUSER.DAT

Recent Files · User Preferences · User-specific Autostarts C:\Users\username\NTUSER.DAT

USRCLASS.DAT

Shellbags · Jump Lists C:\Users\username\AppData\Local\Microsoft\Windows\USRCLASS.DAT

SYSTEM

HKEY_LOCAL_MACHINE\SYSTEM

SECURITY

HKEY_LOCAL_MACHINE\SECURITY

SOFTWARE

HKEY_LOCAL_MACHINE\SOFTWARE

SAM

HKEY_LOCAL_MACHINE\SAM

NTUSER.DAT

HKEY_USERS\<SID> and HKEY_CURRENT_USER

USRCLASS.DAT

HKEY_USERS\<SID>\Software\Classes

UserAssist

It stores information on recently accessed applications launched via the GUI. HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist

TypedPaths

It stores all the paths and locations typed by the user inside the Explorer address bar. HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths

App Paths

It stores the path of the applications. HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths

WordWheelQuery

It stores all the search terms typed by the user in the Explorer search bar. HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\WordWheelQuery

Run

It stores information on the programs that are set to automatically start (startup programs) when the users logs in. HKLM\Software\Microsoft\Windows\CurrentVersion\Run

RecentDocs

It stores information on the files that the user has recently accessed. HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs

ComputerName

It stores the computer's name (hostname). HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName

Uninstall

It stores information on the installed programs. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Install Git from git-scm.com

git config sets configuration options. --global makes this apply to all repositories on your computer. user.name is the name that shows on commits. user.email is the email linked to your GitHub account.

Git uses these to record who made each commit.

git config --global user.name "Your Name"
git config --global user.email "youremail@example.com"

core.editor tells Git which editor to open when it needs you to type messages. "code --wait" tells Git to wait until you close VS Code before continuing. You can replace code with nano, vim, etc., if you prefer.

git config --global core.editor "code --wait"

user.name=Your Name user.email=youremail@example.com

git config --list

Go to GitHub → Settings → Developer Settings → Personal Access Tokens → Generate new token. Give it repo permissions. Use the token instead of your password when Git asks.

Copy the public key (~/.ssh/id_ed25519.pub) to GitHub → Settings → SSH and GPG keys.

ssh-keygen -t ed25519 -C "youremail@example.com"

This command turns your project folder into a Git repository. It creates a hidden .git folder where Git stores all version history. If you already did this, you can skip it.

git init

git add moves files into Git’s “staging area” so they are ready to be committed. . means “all files in the current directory.” You can also add files individually: git add filename.

git add .

git commit saves a snapshot of your staged files into Git history. -m "message" lets you attach a message describing the commit. Here "Initial commit" is a conventional message for the first commit.

git commit -m "Initial commit"

git remote add adds a new remote repository. origin is the standard name for the main remote (you can name it differently, but most people use origin). The URL is your GitHub repo URL. Replace username and repo_name with your GitHub username and repository name.

git remote add origin https://github.com/username/repo_name.git

This will show something like: origin https://github.com/username/repo_name.git (fetch) origin https://github.com/username/repo_name.git (push)

git remote -v

git push uploads your commits to the remote repo. -u sets origin/main as the default upstream branch, so in the future you can just run git push without specifying the branch. origin is the remote name we just added. main is the branch you’re pushing to. (Older repos sometimes use master; check your GitHub default branch.)

git push -u origin main

-u sets upstream so next time you can just do git push

git push -u origin <new-branch>

Branches let you work on new features separately from the main branch (main or master). When a feature is ready, you merge it. git checkout branch_name switches to the branch.

git checkout main

Suppose your feature branch is called feature-login. git merge combines the changes from the branch you specify into the current branch. If there are conflicts, Git will tell you, and you’ll need to resolve them manually in the affected files.

git merge <branch-name>

-d deletes a branch that has been merged.

git branch -d <branch-name>

If the file is already listed in .gitignore but Git is still tracking changes locally, that means the file was tracked before it was added to .gitignore. This is expected Git behavior.

git rm --cached <file>
git commit -m "Stop tracking a file"

Git is protecting your local changes from being overwritten. Use this if your local changes are not needed and you want your local to be the same with remote.

git reset --hard HEAD
git pull

This deletes: Untracked files Untracked directories Now your working tree matches the remote checkout byte-for-byte.

git clean -fd

Use this if your .gitignore edits are intentional. If conflicts appear after stash pop, Git will prompt you to resolve them.

git stash push -m "Local .gitignore changes"
git pull
git stash pop

GitHub Actions will automatically: - Build executables for macOS, Linux, Windows - Create a release at https://github.com/username/repo-name/releases/tag/v1.0.0 - Attach all binaries to that release

# Make sure you're on main and it's up to date
git checkout main
git pull origin main

# Create and push a version tag
git tag v1.0.0
git push origin v1.0.0

git push origin :v1.0.1 is shorthand for git push origin :refs/tags/v1.0.1

git tag -d v1.0.1          # delete local tag
git push origin :v1.0.1    # delete remote tag
git tag v1.0.1             # recreate the tag
git push origin v1.0.1     # trigger new build

This undoes the change but keeps history clean. Find the commit hash if you don’t know it: git log --oneline

git checkout main
git revert <commit-hash>
git push