APT29 Threat Hunting with Splunk Ep.11 Q11

Question

What other value was set on the same key to facilitate the bypass. Searching on the key, there's only one log entry. I'm not clear on what "other value" means. I've tried all the file paths referenced in that log entry, different parts of the registry key, parts of the script that executes, even the cat.png file. What am I missing?

arthurdent · Accepted Answer

I finally figured out that the question just wanted the value at the end of the path, not the full path. I kept trying the full path because of the wording in the question saying it needed the full value.

Forum Discussion

APT29 Threat Hunting with Splunk Ep.11 Q11

2 Replies

Featured Places

Help & Support Forum

Related Content

APT29 Threat Hunting with Splunk: Ep.4 – Clean-up & Reconnaissance

FIN7 Threat Hunting with Splunk: Ep.3 – Execution Logs

FIN7 Threat Hunting with Splunk: Ep.3 – Execution Logs

FIN7 Threat Hunting with Splunk: Ep.2 – Initial Access

APT29 Threat Hunting with Splunk: Ep.11 – Demonstrate Your Skills - Question to Q9

Recent Discussions

Foundational Static Analysis: API Analysis step 10

copy-paste-compromise-malicious-documents-analysis

Brute Ratel: Extracting Indicators of Compromise

Microsoft Defender for Cloud: Inventory, Resource Health and Recommendations.

Snort Rules: Ep.9 – Exploit Kits