Forum Discussion

MartinChau's avatar
MartinChau
Icon for Bronze I rankBronze I
12 days ago

Detecting Sliver - Team Sim

Hello,

Cyber Team Sim - Detecting Sliver

Following the Debrief/answers - I'm stuck on Answer 1. 

our velociraptor hunts are coming back as "access is denied" - limiting us to continue any further in the lab. It is run on the Analyst Windows machine.

Wondering if you have any tips or tricks for us to grant access

Best regards,
Martin

cyber team simulations
help & support
  • Allure's avatar
    Allure
    Icon for Immerser rankImmerser
    9 days ago

    Yo MartinChau - It is normal for YARA to prompt those error logs as it may not have sufficient privileges to open certain process handles. If you are to check the results tab in that interface (provided you're in the correct host where the implant is running) - you will be able to see a hit on one of the YARA rules. 

    Let me know if this works for you 👍