TryHackMe | Hacktivities

1,655 results

room

Day-O

A process left traces in memory. Analyze the evidence and uncover what the malware was set to do.

medium

Challenge

room

Strange & Unusual Activity

Something is hiding in the network traffic. Hunt through Zeek logs and uncover what slipped through.

medium

Challenge

room

Dead Endpoint

A photo gallery went dark. Trace the compromise on the Linux disk and recover the locked images.

hard

Challenge

room

The Waiting Room

A supplier email hides an odd attachment. Follow the evidence and find what left the workstation.

medium

Challenge

room

Handbook for the Recently Compromised

Trace an intrusion through Windows event logs and uncover what happened on the workstation.

easy

Challenge

room

PHP2Shell

Exploit the PHP2Shell runtime CVEs via session.upload_progress for unauthenticated RCE.

easy

Walkthrough

room

Detecting Persistent WMI Consumers

Learn how attackers abuse WMI for persistence and detect it with event logs and forensic artefacts.

medium

Walkthrough

room

Detecting Persistent Malicious Services

Explore how threat actors abuse Windows Services for persistence and how to detect it.

medium

Walkthrough

room

Attacking WPA3 and Rogue Access Points

Downgrade WPA3 clients and abuse rogue access points to capture and crack Wi-Fi handshakes.

hard

Walkthrough

room

Detecting Persistent AutoStart Run Keys

Discover how threat actors abuse AutoStart Run keys for persistence and how to detect it.

medium

Walkthrough

room

The Finance Trail

THM Security Services has been engaged for a SOC Analysis activity for Vantara Financial Group.

medium

Challenge

room

Detecting Persistent Scheduled Tasks

Discover how threat actors abuse Scheduled Tasks for persistence and how to detect this abuse.

medium

Walkthrough

room

Threat Hunting Simulator: Health Hazard

Learn how the Threat Hunting Simulator works by playing your first scenario, from the hypothesis to the final report.

easy

Walkthrough

room

SOC Simulator: Introduction to Phishing

Play your first SOC Simulator scenario and learn to triage phishing alerts, one alert at a time.

easy

Walkthrough

room

Live Detection With LOKI and THOR

Apply YARA-based detection with LOKI and THOR to catch active threats.

medium

Walkthrough

room

Attacking Open and WPA2-PSK Networks

Bypass a captive portal, then capture, crack and decrypt a WPA2 handshake.

medium

Walkthrough

room

Investigating Script-Based Executions

Learn how attackers abuse legitimate scripting engines for intrusion, then investigate the evidence.

medium

Walkthrough

room

Jackpot

No card. No PIN. No transaction. Teach the machine to empty itself.

medium

Challenge

room

Investigating LOLBin and Fileless

Learn about LOLBins and fileless techniques from execution to detection.

medium

Walkthrough

room

Investigating PowerShell Execution

Learn which forensic artifacts PowerShell leaves on a compromised system.

medium

Walkthrough

room

Investigating Executables Evidence

Learn to detect, prevent, and mitigate malicious executables through log data and DFIR artifacts.

medium

Walkthrough

room

The O365 Intrusion

THM Security Services has been engaged for an Incident Response activity for Vantage Dynamics.

medium

Challenge

room

The Agent Took a Shortcut

Reproduce the Sept 2026 OpenAI rogue-agent exploit chain on a health-data portal, then detect it.

medium

Walkthrough

Showing 24 of 1655 results

Search

1.4K+

500+

Phishing Unfolding

Day-O

Strange & Unusual Activity

Dead Endpoint

The Waiting Room

Handbook for the Recently Compromised

PHP2Shell

Detecting Persistent WMI Consumers

Detecting Persistent Malicious Services

Attacking WPA3 and Rogue Access Points

Detecting Persistent AutoStart Run Keys

The Finance Trail

Detecting Persistent Scheduled Tasks

Threat Hunting Simulator: Health Hazard

SOC Simulator: Introduction to Phishing

Live Detection With LOKI and THOR

Attacking Open and WPA2-PSK Networks

Investigating Script-Based Executions

Jackpot

Investigating LOLBin and Fileless

Investigating PowerShell Execution

Investigating Executables Evidence

The O365 Intrusion

The Agent Took a Shortcut