Forum Widgets
Recent Discussions
Immersive Labs – APT29: Threat Hunting with Splunk
Hi everyone, I’m currently working through the Immersive Labs – APT29: Threat Hunting with Splunk lab and got stuck on Question 10. Question: A PowerShell script was initially executed to extract encoded data from an image file. What is the full ParentCommandLine field value used to execute this? What I’ve tried so far: Searched PowerShell logs (EventCode 4103 / 4104) in Splunk Looked for base64/encoded content indicators (e.g., FromBase64String, -enc, IEX) Filtered for image-related activity (e.g., .jpg, .png) Reviewed process creation context but struggling to identify the exact ParentCommandLine. Appreciate any guidance—trying to understand the hunting logic, not just the answer. Thanks in advance!Investigating IAM Incidents in AWS: Preparation - Question 7
For the question: The ‘MetrolioQA’ IAM role in your account grants write access to a ‘metrolio’ role from another account. What is the full name of the external principle? I can't seem to find insight onto the role. I am wondering about what is the location of the GUI I should be looking into more of. I have mostly been digging throughout the csv download for any possible insights as well as the IAM access analyzer but I cant seem to get any good leads. Done through the MetrolioIAMAnalyst AWS role account. Summary: I am wondering if there is any direction that can be provided in which I can look into more for finding external principles.Lab not getting complete even it is correct
I am working on C# / ASP.NET API from the I am doing ASP.NET Core API: Username Enumeration lab, this lab task 1 is always showing incomplete even after I am generating correct results [HttpPost("login")] public ActionResult<LoginResponse> LoginUser(LoginRequest request) { var user = _repository.GetUserByEmail(request.Email); var passwordValid = _hashingService.VerifyPassword( request.Password, user.Password ); if (user == null || !passwordValid) { return Unauthorized(); } return new LoginResponse { Jwt = _jwtService.GenerateJwt(user.Id, user.Email) }; } Could you please help? I need to complete this today? Regards NageshNeed help in Splunk Lab!
I am attempting the Splunk collection under Upskill. In the final lab i.e. Demonstrate your skill lab, I am getting stuck at a particular task. This is the prompt that I need to solve. The problem is there is no field for Destination IP in the log. Whenever I search according to the prompt, no results are returned and the question won't take 0 as an answer. Please help me move forward.
If your question has been answered, help others by clicking:
