SOC L1 Alert Triage | TryHackMe Writeup

I am ready to start!

No answer needed

What is the number of alerts you see in the SOC dashboard?

What is the name of the most recent alert you see?

Double-Extension File Creation

What was the verdict for the "Unusual VPN Login Location" alert?

False Positive

What user was mentioned in the "Unusual VPN Login Location" alert?

M. Clark

Should you first prioritise medium over low severity alerts? (Yea/Nay)

Yea

Should you first take the newest alerts and then the older ones? (Yea/Nay)

Nay

Assign yourself to the first-priority alert and change its status to In Progress. The name of your selected alert will be the answer to the question.

Potential Data Exfiltration

Which flag did you receive after you correctly triaged the first-priority alert?

THM{looks_like_lots_of_zoom_meetings}

💡

Traffic seems to be someone using zoom for a meeting. Perfectly safe.

Which flag did you receive after you correctly triaged the second-priority alert?

THM{how_could_this_user_fall_for_it?}

💡

This is a h0t.exe cryptominer trojan. Definitely malicious. The double extension is also a dead giveaway

Which flag did you receive after you correctly triaged the third-priority alert?

THM{should_we_allow_github_for_devs?}

💡

User downloaded the react library from the official github source. Perfectly safe

I am ready to move on!

No answer needed