APT29 Threat Hunting with Splunk Ep.11 Q11

Question

What other value was set on the same key to facilitate the bypass. Searching on the key, there's only one log entry. I'm not clear on what "other value" means. I've tried all the file paths referenced in that log entry, different parts of the registry key, parts of the script that executes, even the cat.png file. What am I missing?

arthurdent · Answer

I finally figured out that the question just wanted the value at the end of the path, not the full path. I kept trying the full path because of the wording in the question saying it needed the full value.

Forum Discussion

APT29 Threat Hunting with Splunk Ep.11 Q11

1 Reply

Featured Places

Help & Support Forum

Related Content

APT29 Threat Hunting with Splunk: Ep.4 – Clean-up & Reconnaissance

FIN7 Threat Hunting with Splunk: Ep.3 – Execution Logs

FIN7 Threat Hunting with Splunk: Ep.2 – Initial Access

APT29 Threat Hunting with Splunk: Ep.11 – Demonstrate Your Skills - Question to Q9

Help needed for Threat Hunting: Mining Behaviour

Recent Discussions

Radare2 Reverse Engineering: Ep.2 – Windows Binary Part 2

ICS Malware: Triton - unpack trilog.exe

Privilege Escalation: Windows – Automated Enumeration

Web App Hacking (Lab series): CVE-2022-42889 (Text4Shell) – Offensive

FIN7 Threat Hunting with Splunk: Ep.3 – Execution Logs