https://tryhackme.com/room/cyberkillchainzmt

Task 1 Introduction

Keine Fragen in diesem Task.

Task 2 Reconnaissance

What is the name of the Intel Gathering Tool that is a web-based interface to the common tools and resources for open-source intelligence?

Das dritte gelistete Tool.

Antwort: OSINT Framework

What is the definition for the email gathering process during the stage of reconnaissance?

Die Methode ist auch als „Email harvesting“ bekannt.

Antwort: Email harvesting

Task 3 Weaponization

This term is referred to as a group of commands that perform a specific task. You can think of them as subroutines or functions that contain the code that most users use to automate routine tasks. But malicious actors tend to use them for malicious purposes and include them in Microsoft Office documents. Can you provide the term for it? 

Den Namen lernen wir im Text kennen, der erste Punkt unter „Weaponization“.

Antwort: macro

Task 4 Delivery

What is the name of the attack when it is performed against a specific group of people, and the attacker seeks to infect the website that the mentioned group of people is constantly visiting.

Die Antwort basiert auf Tieren (eine Gruppe Angestellte einer Firma), die sich alle an einem Wasserloch (Website) tränken und von einem Löwen (Angreifer) ausgespäht (Malware) werden.

Antwort: Watering hole attack

Task 5 Exploitation

Can you provide the name for a cyberattack targeting a software vulnerability that is unknown to the antivirus or software vendors?

Die Antwort beschreibt den Zustand „seit 0 Tagen dem Hersteller bekannt“.

Antwort: zero-day

Task 6 Installation

Can you provide the technique used to modify file time attributes to hide new or changes to existing files?

Antwort: Timestomping

Can you name the malicious script planted by an attacker on the webserver to maintain access to the compromised system and enables the webserver to be accessed remotely?

Antwort: web shell

Task 7 Command & Control

What is the C2 communication where the victim makes regular DNS requests to a DNS server and domain which belong to an attacker. 

Antwort: DNS Tunneling

Task 8 Actions on Objectives (Exfiltration)

Can you provide a technology included in Microsoft Windows that can create backup copies or snapshots of files or volumes on the computer, even when they are in use? 

Antwort: Shadow Copy

Task 9 Practice Analysis

What is the flag after you complete the static site?

Die korrekte Reihenfolge (von oben nach unten):

  • powershell
  • spearphishing attachment
  • exploit public-facing application
  • dynamic linker hijacking
  • fallback channels
  • data from local system

Antwort: THM{7HR347_1N73L_12_4w35om3}

Task 10 Conclusion

Keine Fragen in diesem Task.