{"status":"success","data":[{"_id":"620174d9e69211004469d46c","id":1,"questions":[{"hint":"","question":"Read the description! Continue to the next task.","questionNo":1,"disableAnswerPlaceholder":false}],"type":"none","title":"Room Outline","taskNo":1,"created":"2022-02-07T19:36:57.842Z","deadline":null,"uploadId":"","description":"

This room will cover the concepts of Threat Intelligence and various open-source tools that are useful. The learning objectives include:

"},{"_id":"620175dae47818005c3152d1","id":2,"questions":[{"hint":"","question":"I've read on Threat Intel and the classifications","questionNo":1,"disableAnswerPlaceholder":false}],"type":"none","title":"Threat Intelligence","taskNo":2,"created":"2022-02-07T19:41:14.900Z","deadline":null,"uploadId":"","description":"

Threat Intelligence is the analysis of data and information using\ntools and techniques to generate meaningful patterns on how to mitigate\nagainst potential risks associated with existing or emerging threats\ntargeting organisations, industries, sectors or governments.

\n

To mitigate against risks, we can start by trying to answer a few simple questions:

\n

Threat Intelligence Classifications:

\n\n

Threat Intel is geared towards understanding the relationship between your operational environment and your adversary. With this in mind, we can break down threat intel into the following classifications: 

"},{"_id":"620176a442023100498a13a6","id":3,"questions":[{"hint":"","question":"What was TryHackMe's Cisco Umbrella Rank based on the screenshot?","questionNo":1,"disableAnswerPlaceholder":false},{"hint":"","question":"

How many domains did UrlScan.io identify on the screenshot?

","questionNo":2,"disableAnswerPlaceholder":false},{"hint":"","question":"

What was the main domain registrar listed on the screenshot?

","questionNo":3,"disableAnswerPlaceholder":false},{"hint":"","question":"

What was the main IP address identified for TryHackMe on the screenshot?

","questionNo":4,"disableAnswerPlaceholder":false}],"type":"none","title":"UrlScan.io","taskNo":3,"created":"2022-02-07T19:44:36.758Z","deadline":null,"uploadId":"","description":"

Urlscan.io is a free service developed to assist in scanning and\nanalysing websites. It is used to automate the process of browsing and\ncrawling through websites to record activities and interactions.

\n

When a URL is submitted, the information recorded includes the\ndomains and IP addresses contacted, resources requested from the\ndomains, a snapshot of the web page, technologies utilised and other\nmetadata about the website.

\n

The site provides two views, the first one showing the most recent\nscans performed and the second one showing current live scans.

\n

 \"Live

\n

Scan Results

\n

\nURL scan results provide ample information, with the following key areas being essential to look at:\n\n

\n\n\n\n

\"

Note: Due to the dynamic nature of internet activities, data searched can produce different results on different days as new information gets updated.

\n\n

Scenario

\n\n

You have been tasked to perform a scan on TryHackMe's domain. The results obtained are displayed in the image below. Use the details on the image to answer the questions:

\"TryHackMe

\n\n\n\n"},{"_id":"624b09f20b33e800492457d1","id":4,"questions":[{"hint":"Search%20through%20the%20ThreatFox%20database%20using%20the%20syntax%20ioc%3A%3Cip%20here%3E%20and%20you%20will%20find%20the%20malware%20alias%20name.","question":"The IOC 212.192.246.30:5555 is identified under which malware alias name on ThreatFox?
","questionNo":1,"disableAnswerPlaceholder":false},{"hint":"","question":"

Which malware is associated with the JA3 Fingerprint 51c64c77e60f3980eea90869b68c58a8 on SSL Blacklist?

","questionNo":2,"disableAnswerPlaceholder":false},{"hint":"","question":"

From the statistics page on URLHaus, what malware-hosting network has the ASN number AS14061? 

","questionNo":3,"disableAnswerPlaceholder":false},{"hint":"","question":"

Which country is the botnet IP address 178.134.47.166 associated with according to FeodoTracker?

","questionNo":4,"disableAnswerPlaceholder":false}],"type":"none","title":"Abuse.ch","taskNo":4,"created":"2022-04-04T15:08:34.187Z","deadline":null,"uploadId":"","description":"

Abuse.ch is a research project hosted by the Institue for Cybersecurity and Engineering at the Bern University of Applied Sciences in Switzerland. It was developed to identify and track malware and botnets through several operational platforms developed under the project. These platforms are:

\n\n

Let us look into these platforms individually.

\n

MalwareBazaar

\n

As the name suggests, this project is an all in one malware collection and analysis database. The project supports the following features:

\n\n

\"Malware

\n

FeodoTracker

\n

With this project, Abuse.ch is targeting to share intelligence on botnet Command & Control (C&C) servers associated with Dridex, Emotes (aka Heodo), TrickBot, QakBot and BazarLoader/BazarBackdoor. This is achieved by providing a database of the C&C servers that security analysts can search through and investigate any suspicious IP addresses they have come across. Additionally, they provide various IP and IOC blocklists and mitigation information to be used to prevent botnet infections.

\n

\"Feodo

\n

 

\n

SSL Blacklist

\n

Abuse.ch developed this tool to identify and detect malicious SSL connections. From these connections, SSL certificates used by botnet C2 servers would be identified and updated on a denylist that is provided for use. The denylist is also used to identify JA3 fingerprints that would help detect and block malware botnet C2 communications on the TCP layer.

\n

You can browse through the SSL certificates and JA3 fingerprints lists or download them to add to your deny list or threat hunting rulesets.

\n

\"SSL

\n

URLhaus

\n

As the name points out, this tool focuses on sharing malicious URLs used for malware distribution. As an analyst, you can search through the database for domains, URLs, hashes and filetypes that are suspected to be malicious and validate your investigations.

\n

The tool also provides feeds associated with country, AS number and Top Level Domain that an analyst can generate based on specific search needs.

\n

\"URLHaus

\n

ThreatFox

\n

With ThreatFox,  security analysts can search for, share and export indicators of compromise associated with malware. IOCs can be exported in various formats such as MISP events, Suricata IDS Ruleset, Domain Host files, DNS Response Policy Zone, JSON files and CSV files.

\n

\"ThreatFox

"},{"_id":"620176dd42023100498a15f2","id":5,"questions":[{"hint":"Use Thunderbird to open the email and you should recognise the famous social platform via the logo.","question":"

What social media platform is the attacker trying to pose as in the email?

","questionNo":1,"disableAnswerPlaceholder":false},{"hint":"","question":"What is the senders email address?
","questionNo":2,"disableAnswerPlaceholder":false},{"hint":"","question":"

What is the recipient's email address?

","questionNo":3,"disableAnswerPlaceholder":false},{"hint":"Cyberchef has a defang recipe","question":"

What is the Originating IP address? Defang the IP address.

","questionNo":4,"disableAnswerPlaceholder":false},{"hint":"","question":"

How many hops did the email go through to get to the recipient?

","questionNo":5,"disableAnswerPlaceholder":false}],"type":"vm","title":"PhishTool","taskNo":5,"created":"2022-02-07T19:45:33.301Z","deadline":null,"uploadId":"67a8aefad08d1f35157a7b83","description":"

Before going into the task, click the Start Lab Machine button to start the attached VM and open it in Split View. You will be using the same machine through tasks 7 and 8.

\n

This task will introduce you to a tool, PhishTool, that you would add to your toolkit of email analysis tools. Please take note that it would not be necessary to use it to complete the task; however, the principles learnt would be helpful.

\n

Email Phishing

\n

Email phishing is one of the main precursors of any cyber attack. Unsuspecting users get duped into opening and accessing malicious files and links sent to them by email, as they appear to be legitimate. As a result, adversaries infect their victims’ systems with malware, harvesting their credentials and personal data and performing other actions such as financial fraud or conducting ransomware attacks.

\n

For more information and content on phishing, check out these rooms:

\n\n

PhishTool seeks to elevate the perception of phishing as a severe form of attack and provide a responsive means of email security. Through email analysis, security analysts can uncover email IOCs, prevent breaches and provide forensic reports that could be used in phishing containment and training engagements.

\n

PhishTool has two accessible versions: Community and Enterprise. We shall mainly focus on the Community version and the core features in this task. Sign up for an account via this link to use the tool. Note: The tool may be geo-blocked in some locations, and therefore you can take appropriate action towards accessing it.

\n

The core features include:

\n\n

Additional features are available on the Enterprise version:

\n\n

We are presented with an upload file screen from the Analysis tab on login. Here, we submit our email for analysis in the stated file formats. Other tabs include:

\n\n

\"PhishTool

\n

Analysis Tab

\n

Once uploaded, we are presented with the details of our email for a more in-depth look. Here, we have the following tabs:

\n\n

We can further perform lookups and flag indicators as malicious from these options. On the right-hand side of the screen, we are presented with the Plaintext and Source details of the email.

\n

\"Email

\n

Above the Plaintext section, we have a Resolve checkmark. Here, we get to perform the resolution of our analysis by classifying the email, setting up flagged artefacts and setting the classification codes. Once the email has been classified, the details will appear on the Resolution tab on the analysis of the email.

\n

\"Email

\n

You can now add PhishTool to your list of email analysis tools.

\n

 

\n

Scenario

\n
You are a SOC Analyst and have been tasked to analyse a suspicious email, Email1.eml. To solve the task, open the email using Thunderbird on the attached VM, analyse it and answer the questions below.
","taskVmRegions":["us-east-1","ap-south-1","eu-west-1","eu-central-1","eu-west-3","us-west-2"],"hasUploadOwnership":false},{"_id":"620a4c9f269aa3005f574f9f","id":6,"questions":[{"hint":"Use the IP addressed discovered in Task 5 and search for it.","question":"

What is the listed network owner of the IP address from the previous task?

","questionNo":1,"disableAnswerPlaceholder":false},{"hint":"Perform a WHOIS lookup against the IP to identify the customer, if you cannot find the information on Talos.","question":"

What is the customer name of the IP address?

","questionNo":2,"disableAnswerPlaceholder":false}],"type":"none","title":"Cisco Talos Intelligence","taskNo":6,"created":"2022-02-14T12:35:43.456Z","deadline":null,"uploadId":"","description":"

IT and Cybersecurity companies collect massive amounts of information\nthat could be used for threat analysis and intelligence. Being\none of those companies, Cisco assembled a large team of security practitioners\ncalled Cisco Talos to provide actionable intelligence, visibility on\nindicators, and protection against emerging threats through data\ncollected from their products. The solution is accessible as Talos Intelligence.

\n

Cisco Talos encompasses six key teams:

\n\n

More information about Cisco Talos can be found on their White\nPaper

\n

Talos Dashboard

\n

Accessing the open-source solution, we are first presented with a\nreputation lookup dashboard with a world map. This map shows an\noverview of email traffic with indicators of whether the emails are\nlegitimate, spam or malware across numerous countries. Clicking on any\nmarker, we see more information associated with IP and hostname\naddresses, volume on the day and the type.

\n

\"Talos

At the top, we have several tabs that provide different types of\nintelligence resources. The primary tabs that an analyst would interact\nwith are:

\n\n

\"Talos

\n\n

\"Talos


\n\n

\n\"Talos

\n

Task

\n

Use the information gathered from inspecting the Email1.eml file from Task 5 to answer the following questions using Cisco Talos Intelligence. Please note that the VM launched in Task 5 would not have access to the Internet.

"},{"_id":"620a4cd2269aa3005f57522d","id":7,"questions":[{"hint":"","question":"According to Email2.eml, what is the recipient's email address?","questionNo":1,"disableAnswerPlaceholder":false},{"hint":"","question":"

On VirusTotal, which year recorded the first submission details of the mentioned file?

","questionNo":2,"disableAnswerPlaceholder":false}],"type":"none","title":"Scenario 1","taskNo":7,"created":"2022-02-14T12:36:34.633Z","deadline":null,"uploadId":"","description":"

\"A

\n

Scenario: You are a SOC Analyst. Several suspicious emails have been forwarded to you from other coworkers. You must obtain details from each email to triage the incidents reported. 

Task: Use the tools and knowledge discussed throughout this room (or use your resources) to help you analyze Email2.eml found on the VM attached to Task 5 and use the information to answer the questions.

"},{"_id":"625f1b26ddc51f005f53c745","id":8,"questions":[{"hint":"","question":"What is the name of the attachment on Email3.eml?","questionNo":1,"disableAnswerPlaceholder":false},{"hint":"","question":"

What malware family is associated with the attachment on Email3.eml?

","questionNo":2,"disableAnswerPlaceholder":false}],"type":"none","title":"Scenario 2","taskNo":8,"created":"2022-04-19T20:27:18.847Z","deadline":null,"uploadId":"","description":"

\"A

\n

Scenario: You are a SOC Analyst. Several suspicious emails have been forwarded to you from other coworkers. You must obtain details from each email to triage the incidents reported. 

Task: Use the tools and knowledge discussed throughout this room (or use your resources) to help you analyze Email3.eml found on the VM attached to Task 5 and use the information to answer the questions.

"},{"_id":"623cc56d613737004281e117","id":9,"questions":[{"hint":"","question":"Read the above and completed the room","questionNo":1,"disableAnswerPlaceholder":false}],"type":"none","title":"Conclusion","taskNo":9,"created":"2022-03-24T19:24:29.671Z","deadline":null,"uploadId":"","description":"

There's More Out There

\n

You have come to the end of the room. However, this is just the tip of the iceberg for open-source threat intelligence tools that can help you as an analyst triage through incidents. There are plenty of more tools that may have more functionalities than the ones discussed in this room.

Check out these rooms to dive deeper into Threat Intelligence:

"}]}