APT29 Threat Hunting with Splunk Ep.11 Q11

Question

What other value was set on the same key to facilitate the bypass. Searching on the key, there's only one log entry. I'm not clear on what "other value" means. I've tried all the file paths referenced in that log entry, different parts of the registry key, parts of the script that executes, even the cat.png file. What am I missing?

arthurdent · Answer

I finally figured out that the question just wanted the value at the end of the path, not the full path. I kept trying the full path because of the wording in the question saying it needed the full value.

Forum Discussion

APT29 Threat Hunting with Splunk Ep.11 Q11

1 Reply

Featured Places

Help & Support Forum

Related Content

FIN7 Threat Hunting with Splunk: Ep.3 – Execution Logs

APT29 Threat Hunting with Splunk: Ep.11 – Demonstrate Your Skills - Question to Q9

Help needed for Threat Hunting: Mining Behaviour

Help needed for Threat Hunting - Credential Access

APT29 Threat Hunting with Splunk: Ep.4 – Clean-up & Reconnaissance

Recent Discussions

Wizard Spider DFIR: Ep.10 – Demonstrate Your Skills

APT29 Threat Hunting with Splunk Ep.11 Q11

kali linux: killall xfce4-panel

"Git Security: SSH Keys" lab Question 4

APT29 Threat Hunting with Splunk: Ep.4 – Clean-up & Reconnaissance