August 25, 2026
Windows Threat Detection 1 | Windows Security Monitoring | SOC Level 1 TryHackMe Writeup
Task 2 — Intro to Initial Access
By Aalishaf
2 min read
- Which MITRE technique ID describes Initial Access via a vulnerable mail server?
answer: T1190
- Which Initial Access method relies on a user opening a malicious email attachment?
answer: Phishing
Task 3 — Initial Access via RDP
- Which user seems to be most actively brute-forced by botnets?
answer: Adminstrator
- Which IP managed to breach the host via RDP (Logon Type 10)?
answer: 203.205.34.107
- Can you get the real Workstation Name (hostname) of the threat actor?
answer: DESKTOP-QNBC4UU
in the Security-RDP.evtx, copy the Logon ID from the previous Process whose the logon type 10,
copied the Logon ID from the successful 4624 event and switched over to the Sysmon logs. By searching Sysmon for that specific Logon ID and filtering for Event ID 1 (Process Creation)
Task 4 — Initial Access via Phishing
- Let's play the role of the untrained user and mindlessly open the COM file. Run the www.skype.com file from the Phishing Case 1 folder, which flag do you get?
answer: THM{misleading_extension}
- Continue with the second attachment from the Phishing Case 2 folder. From which URL does the malicious LNK download the next stage malware?
answer: http://wp16.hqywlqpa.thm:8000/cgi-bin/f
- Finally, move on to the Phishing Case 3 folder and review its content. What is the name of the double-extension file you see there?
answer: best-cat.jpg.exe
Task 5 — Continuing Phishing Topic
- Which file did the user download via the web browser?
answer: C:\Users\Administrator\Downloads\top-cats.zip
- In which folder did the user unarchive the suspicious file?
answer: C:\Users\Administrator\Pictures
- What is the process ID of the launched phishing malware?
answer: 5484
- Finally, which malicious domain did the malware try to connect to?
answer: rjj.store
Task 6 — Initial Access via USB
- Which USB file was launched by the user?
answer: E:\Open Sandisk 4GB USB.exe
- Which suspicious file did the malware drop to the disk? (Format: full path to the file, e.g. C:\file.txt)
answer: C:\Users\Public\Documents\winupdate.exe
- To which other USB did the malware propagate? (Format: just the letter, e.g. X:)
answer: F:
