Your Mission

You are a Security Analyst at West Tech, a classified defence and R&D contractor. Early this morning, internal monitoring systems flagged unusual network activity originating from the workstation of senior researcher Oliver Deer. Upon accessing the machine, a ransom note was discovered on the desktop, suggesting that sensitive project data had been exfiltrated and encrypted. Your job is to investigate the incident: identify how the attacker gained access, trace their actions, recover any stolen data, and neutralise the threat. Time is critical; the integrity of West Tech’s most sensitive technologies may be at risk.

Your Set Up

Set up your virtual environment

To successfully complete this room, you'll need to set up your virtual environment. This involves starting both your AttackBox (if you're not using your VPN) and Lab Machines, ensuring you're equipped with the necessary tools and access to tackle the challenges ahead.

Attacker machine

Status:Off

Lab machine

Status:Off

Start Lab Machine

After giving your machines a couple of minutes to boot up, you’ll have access to:

• A workstation environment. You have been granted SSH access to the affected employee's workstation. You can access this from the AttackBox (or your personal machine if you are connected to the VPN) via:
  ssh o.deer@MACHINE_IP Password: TryHackMe!.
• A trusty AI IR security assistant, armed with "tools" built and designed specifically to help you with the heavy lifting in this challenge. They don't need to be manually triggered by yourself, our AI is a smart cookie and can intelligently determine when these tools should be triggered from prompt context. Some of the tools may provide hints as to when to engage the AI for help and are presented in the "available tools" section in chronological order in which they can be used throughout the investigation. You can simply use it as you would a chatbot. Another cool feature is that this AI is deployed on the same system as the workstation you are investigating and so has access to all the files you do, meaning you can give it file paths in your queries. The AI is accessible via: http://MACHINE_IP:7860/?__theme=light

This challenge is built to reflect a real defensive scenario, where all tasks can be accomplished without the use of your AI companion and its tools, but can be done with far more efficiency when taken advantage of. And with that, you're all set to go! Can you help save the day and contAIn the threat?

Note: Your AI assistant takes some time to wake up, so the first prompt may take a little longer to respond to than subsequent prompts.