Forum Discussion
retornet
Bronze III
Bronze IIIAPT29 Threat Hunting with Splunk: Ep.4 – Clean-up & Reconnaissance
I need help with Q6. Any hint please The attacker launches a PowerScript useful for reconnaissance activities. What is the full file path of the executed script? I searched (EventCode=4103 OR Eve...
Found it at the end. Thanks
beejar
Bronze I
Bronze IHow did you find the answer to the first question.
I solved all of them except the "The attacker uploads additional tools via a compressed archive. What is the full path of this folder? Look for IOCs in the event logs to find the correct answer." I am quite sure the file is an image extension with the name of an animal, but tried all the combinations with full path, path without file name... and nothing is working :( Any help?
netcat
Silver III
Silver IIIAt some point the archive will be decompressed.
Anyway, the original question was answered, so you'd better start a new thread.
