Cyber Kill Chain: Reconnaissance

Question

I'm stucked at question 7 (At what time did the attacker first start conducting their reconnaissance efforts? (Provide your answer in the format H:MM:SS or HH:MM:SS). The answer I get is 21:37:36 as shown in screenshot, but it's saying its wrong. PLEASE HELP

samdickison · Answer

Hey mathias​, I've just checked who's completed it and found these people:N8mann​, CyberAAA​, Mango​ and Zexceed​.&nbsp; I wonder if they can quickly give you a tip?

neeemu · Answer

Hi mathias​&nbsp;Just looking at your SPL, I believe the sort command defaults to descending (newest first). You're trying to find the first event that matches so require the oldest.Try changing to "| sort +_time" instead

Forum Discussion

Cyber Kill Chain: Reconnaissance

2 Replies

Featured Places

Help

Related Content

Cyber Kill Chain: Delivery

APT29 Threat Hunting with Splunk: Ep.4 – Clean-up & Reconnaissance

Cyber Kill Chain: Demonstrate Your Skills

AI Blue Teaming: Reconnaissance – Demonstrate Your Skills Question 10

OT Cyber Threat Intelligence: Collection / Question 14

Recent Discussions

OT Threat Actors - CyberAv3ngers

FIN7 Threat Hunting with Splunk: Execution Analysis

Threat Research: Dependency Confusion exercise 8

CWE-565: Reliance on Cookies Without Validation and Integrity CheckingOpens in a new tab

Struggling to find the IT email on Simulations: BarterTown Delivery