Baselines and Anomalies: TryHackMe CTF Writeup / walkthrough
Task 1 - Introduction
Q1. Let's begin.
No Answer Needed
Task 2 - Baselining Hardware Inventory
- Download the given file , It would be a xlsx file with similar name of Asset-Inventory-with-Anomalies-1733034688169.xlsx
- Open the file in any xlsx viewer. Data within the file looks like following :
Q1. What is the name of the workstation that has the anomalous IP address?
Lets find the anomalous ip address of the workstation in above file.
- Look at carefully at the files, the entry no 16 have different ip which somehow doesnot matches anyone of that workstations ip address. br
Answer š WS-LON-004
Q2. What is the name of the server with the anomalous IP address?
- Similarly look at the ip address of servers that looks different.
- Look at entry no 8 , which have different ip
Answer š SVR-NYC-BKUP01
Q3. Which workstation has a device model different from the rest?
- Now this time look at the device model of each workstations
- You can easily find the different device model with your sharp eyes
Answer š WS-NYC-004
Task 3 - Baselining Software Inventory
Q1. There are two installed software programs that should not be included in Anna's list. Which ones are they? Share their serial numbers. Answer format: X, Y
- Think like a detective, which software should not be there.
- Althogh software looks trusted , but ... why are there multiple software with the same service and having much less workstations !!
Answer š 9, 15
Task 4 - Living Off the Land
Q1. When trying to identify if an activity was performed by the administrator or not, what is the biggest tool that a defender can use?
Answer š communication
Q2. Which process can be used to track and approve changes to the firewall Access Control List?
Answer š Change Management and Approvals
Task 5 - Baselining Network Traffic
Q1. If we are looking for DNS traffic bypassing the local DNS server, what should we exclude from the search of all queries to the DNS port?
Answer š Internal DNS server
Task 6 - Baselining Identity and Access Management
Q1. What kind of alert should be generated if a user logs in from two vastly geographically different places in a short amount of time?
Answer š Impossible travel
Task 7 - Identifying Suspicious Environment Specific Use Cases
- Start the machine and wait for 5 minutes
- Visit the given url ()
- Click on 3 line on top left then click on discover
- Make sure that sorted is selected
Q1. You have been alerted of a login outside of normal office hours on the 27th of July, 2024. Can you identify the time this login happened?
- Now we know that a login alert occure on 27th July 2024,outside of normal office hours
- Change the time from 26th July 2024 to 28th July 2024
- We know that this event occure outside of normal of office hours, which can be possibly to early in morning or late night
- Lets analyze the first events of the day , there are 8 events. Click on the event
- From Available fields click on plus(+) icon of description , domain, hardware_info_ip
- Now we can easily find the answer of each question by just looking at the dashboard.
Answer š 06:37:07.659259000
Q2. Which user logged in at this time?
Answer š Mia Perez
Q3. This user performed anomalous activities from two different machines; what is the IP address of the other machine?
Answer š 192.168.1.36
Q4. What suspicious domain does this user connect to?
Answer š c2server.com
Task 8 - Conclusion
Q1. I am ready to hunt for anomalies.
No Answer Needed