APT29 Threat Hunting with Splunk Ep.11 Q11

Question

What other value was set on the same key to facilitate the bypass. Searching on the key, there's only one log entry. I'm not clear on what "other value" means. I've tried all the file paths referenced in that log entry, different parts of the registry key, parts of the script that executes, even the cat.png file. What am I missing?

arthurdent · Accepted Answer

I finally figured out that the question just wanted the value at the end of the path, not the full path. I kept trying the full path because of the wording in the question saying it needed the full value.

Forum Discussion

APT29 Threat Hunting with Splunk Ep.11 Q11

2 Replies

Featured Places

Help & Support Forum

Related Content

APT29 Threat Hunting with Splunk: Ep.4 – Clean-up & Reconnaissance

FIN7 Threat Hunting with Splunk: Ep.3 – Execution Logs

FIN7 Threat Hunting with Splunk: Ep.3 – Execution Logs

FIN7 Threat Hunting with Splunk: Ep.2 – Initial Access

APT29 Threat Hunting with Splunk: Ep.11 – Demonstrate Your Skills - Question to Q9

Recent Discussions

Help with Introduction to Python Scripting: Ep.7 – Demonstrate Your Skills

Privilege Escalation: Windows – Finding Passwords

Microsoft Defender for Cloud: Inventory, Resource Health and Recommendations.

Malware Analysis: Shlayer

CSP Hash Incorrect Despite Correct Script and Hash (CSP Lab Issue?)