Forum Discussion

Hazzie's avatar
Hazzie
Icon for Bronze I rankBronze I
9 days ago

Trick or Treat on Specter Street: Ghost of the SOC

Hi, I am being very blind here but i am struggling so a hint would be great. I am at Q3 trying to find the username the Glitch Geist executed the script under. The alert i have found in kibana rela...
challenges
neeemu's avatar
neeemu
Icon for Bronze III rankBronze III
8 days ago

Hi Hazzie​ , as it's PowerShell script that was executed have you tried searching for *.ps1 to see what users executed that file type?