Forum Discussion

clermagic224's avatar
clermagic224
Icon for Bronze II rankBronze II
3 months ago

Help needed for Threat Hunting - Credential Access

Hey! I'm not sure if this is the right place to seek help for labs but I've been trying this lab for the longest of time and could not get the answer for this question. OfficeSupplies.7z felt the mos...
help & support
  • NyePrior's avatar
    NyePrior
    3 months ago

    Hey clermagic224

    This question is looking for the specific file that contains the credentials, not a ZIP file containing multiple files. If you keep digging, you'll find a file whose filename specifically refers to "passwords"—this is the file you're looking for! The answer to the next question also might give you a clue as to what the correct file is. I hope this helps! 

NyePrior's avatar
NyePrior
Icon for Immerser rankImmerser
3 months ago

Hey clermagic224

This question is looking for the specific file that contains the credentials, not a ZIP file containing multiple files. If you keep digging, you'll find a file whose filename specifically refers to "passwords"—this is the file you're looking for! The answer to the next question also might give you a clue as to what the correct file is. I hope this helps! 

  • clermagic224's avatar
    clermagic224
    Icon for Bronze II rankBronze II
    3 months ago

    thank you very much for the reply! i'll try this approach :)

  • clermagic224's avatar
    clermagic224
    Icon for Bronze II rankBronze II
    3 months ago

    Hey, i tried to query using targetimage, targetgetpath, targetfilename, image with, password* and pw* but still could not find. Any suggestions on how else i should filter? thanks!

    • NyePrior's avatar
      NyePrior
      Icon for Immerser rankImmerser
      3 months ago

      The full path contains the word password, but doesn't start with it, so you'd need to look for *password*, instead of password* 

      • clermagic224's avatar
        clermagic224
        Icon for Bronze II rankBronze II
        3 months ago

        How dumb I was - forgotting that wildcards work both ways! Thank you for pointing that out - I managed to figure it and completed the lab