CHALLENGE INFORMATION
Platform: TryHackMe
Path: Pre Security
Module: Introduction to Cyber Security
Room: Defensive Security Intro
Description: Introducing defensive security and related topics, such as threat intelligence, security operations centers (SOCs), digital forensics and incident response (DFIR), malware analysis, and security information and event management (SIEM).
Introduction to Defensive Security
Before proceeding to the practical exercises, we reviewed the introduction to defensive security. This section establishes the foundational concepts of the blue team approach to cybersecurity.
Question 1: Which team focuses on defensive security?
Blue Team
Areas of Defensive Security
This section introduces core topics related to defensive security, including the security operations center (SOC) and digital forensics and incident response (DFIR). We recommend gaining a solid understanding of these concepts before proceeding.
Question 1: What would you call a team of cybersecurity professionals that monitors a network and its systems for malicious events?
Security Operations Center
Question 2: What does DFIR stand for?
Digital Forensics and Incident Response
Question 3: Which kind of malware requires the user to pay money to regain access to their files?
Ransomware
Practical Example of Defensive Security
In this task, we followed along with a simulated junior (associate) security analyst’s daily workflow. The exercise provides hands-on experience with the tools and processes used in a typical SOC environment.
Notice the login timestamp: 05:25. Early morning – somebody either had a rough night or is just getting started.
First, we checked the SIEM alerts for any suspicious activity:
Figure 1: Reviewing SIEM alerts for suspicious login activity
Next, we ran a check on the suspicious IP address associated with the login attempt:
Figure 2: Running an IP reputation check
We then verified the results to confirm the threat:
Figure 3: Verifying the IP check results
After confirming the malicious activity, we escalated the event to a senior staff member:
Figure 4: Escalating the security event
Following escalation, we adjusted the firewall rules to block the malicious IP address:
Figure 5: Adding a firewall rule to block the malicious IP address
Finally, we retrieved the flag:
Figure 6: Retrieved flag (redacted)
This practical exercise demonstrates the typical workflow of a defensive security analyst: monitoring, investigating, escalating, and mitigating threats.
Question 1: What is the flag that you obtained by following along?
<redacted-flag>