Recent Discussions
Sentinel Labs
My team and I have been encountering a few peculiar issues with the Microsoft Azure Sentinel based labs (KQL, Sentinel Blue Team Ops, Sentinel SOAR, etc.) where correct answers do not appear to be getting accepted. My team and I have even gone back to try solving previously completed labs and found that the answers/methods used to solve the labs do not seem to work. Have there been any issues/problems identified/reported with this style of lab?
APT29 Threat Hunting with Elasticsearch: Ep.5 – LNK File Analysis - Tools?
I was able to complete Ep. 1-4 without much difficulty because I have previous experience with Elasticsearch. But this lab feels like getting pushed into the deep end with no floaties. Not only is this lab not related at all to Elasticsearch, I don't see any links to the suite of tools that I am supposed to know about (Ghidra, procmon, HxD?) in order to decode and analyze malware.Did I miss the prerequisites for this series? I am trying to find a path forward. I don't know where to start with this lab. I have been poking around for a while, but it hasn't been productive. Are there supporting labs that I should consider completing first? And if so, can the course material be updated to reflect this?Ransomware: Annabelle Entry Point
I am attempting to solve the question in the Ransomware: Annabelle lab that goes as follows: "Review the ransomware sample in Ghidra. What is the memory address for the entry point of this export?". Under the symbol tree I navigate to the entry point and see that the value is 1400000b0, yet this doesn't appear to be the correct answer. Can someone point me in the right direction? See screenshot below:
Systems Manager: Run Command (AWS)
Hi, I am attempting to complete the Systems Manager: Run Command lab and successfully complete run the commands (both turn green). It mentions there should be a token output from the second command but the commands fail each time. Anywhere else I should be looking to get the token and/or successful run the command.
