TryHackMe | Hacktivities

1,651 results

room

Detecting Persistent Scheduled Tasks

Discover how threat actors abuse Scheduled Tasks for persistence and how to detect this abuse.

medium

Walkthrough

room

Threat Hunting Simulator: Health Hazard

Learn how the Threat Hunting Simulator works by playing your first scenario, from the hypothesis to the final report.

easy

Walkthrough

room

SOC Simulator: Introduction to Phishing

Play your first SOC Simulator scenario and learn to triage phishing alerts, one alert at a time.

easy

Walkthrough

room

Live Detection With LOKI and THOR

Apply YARA-based detection with LOKI and THOR to catch active threats.

medium

Walkthrough

room

Attacking Open and WPA2-PSK Networks

Bypass a captive portal, then capture, crack and decrypt a WPA2 handshake.

medium

Walkthrough

room

Investigating Script-Based Executions

Learn how attackers abuse legitimate scripting engines for intrusion, then investigate the evidence.

medium

Walkthrough

room

Jackpot

No card. No PIN. No transaction. Teach the machine to empty itself.

medium

Challenge

room

Investigating LOLBin and Fileless

Learn about LOLBins and fileless techniques from execution to detection.

medium

Walkthrough

room

Investigating PowerShell Execution

Learn which forensic artifacts PowerShell leaves on a compromised system.

medium

Walkthrough

room

Investigating Executables Evidence

Learn to detect, prevent, and mitigate malicious executables through log data and DFIR artifacts.

medium

Walkthrough

room

The O365 Intrusion

THM Security Services has been engaged for an Incident Response activity for Vantage Dynamics.

medium

Challenge

room

The Agent Took a Shortcut

Reproduce the Sept 2026 OpenAI rogue-agent exploit chain on a health-data portal, then detect it.

medium

Walkthrough

room

Investigating Public-Facing Exploitation

Learn about detecting the exploitation of public-facing applications through log data and artifacts.

medium

Walkthrough

room

Investigating Valid Credentials Abuse

Investigate initial access with valid credentials through log data and forensic artifacts.

medium

Walkthrough

room

Red Queen Protocol

Understand what reverse engineering is and explore different approaches in this guided challenge.

easy

Walkthrough

room

Constrained Language Mode Bypass

Escape PowerShell Constrained Language Mode and see the traces each bypass leaves behind.

medium

Walkthrough

room

Kansa Live Triage

Learn Kansa, a PowerShell framework for sweeping many hosts during incident response.

medium

Walkthrough

room

KAPE Data Triage

Learn KAPE, a targeted Windows artifact collection tool for incident response.

medium

Walkthrough

room

Wi-Fi Fundamentals and Reconnaissance

Learn how Wi-Fi works and use airodump-ng to map networks and reveal hidden SSIDs.

easy

Walkthrough

room

The Clean Exit

THM Security Services has been engaged for a Digital Forensics activity for GlobalTech Manufacturing.

medium

Challenge

room

Key Artifacts for DFIR

Explore what artifacts to collect from a compromised host during DFIR.

medium

Walkthrough

room

Accessing a Compromised Network

Learn the ways to access a compromised network for DFIR needs.

medium

Walkthrough

room

Phantom Fob

The fob locks but won’t unlock. Codes change every second, forge the signal; don’t replay it.

medium

Challenge

Showing 24 of 1651 results

Search

1.4K+

500+

Phishing Unfolding

Detecting Persistent Scheduled Tasks

Threat Hunting Simulator: Health Hazard

SOC Simulator: Introduction to Phishing

Live Detection With LOKI and THOR

Attacking Open and WPA2-PSK Networks

Investigating Script-Based Executions

Jackpot

Investigating LOLBin and Fileless

Investigating PowerShell Execution

Investigating Executables Evidence

The O365 Intrusion

The Agent Took a Shortcut

Investigating Public-Facing Exploitation

Investigating Valid Credentials Abuse

Red Queen Protocol

Constrained Language Mode Bypass

Kansa Live Triage

KAPE Data Triage

Wi-Fi Fundamentals and Reconnaissance

The Clean Exit

Key Artifacts for DFIR

Accessing a Compromised Network

Phantom Fob