The Dutch Hacker
mitre tryhackme

Mitre on Tryhackme

This is the write up for the room Mitre on Tryhackme and it is part of the Tryhackme Cyber Defense Path

Make connection with VPN or use the attackbox on Tryhackme site to connect to the Tryhackme lab environment

Tasks Mitre on tryhackme

Task 1

Read all that is in the task and press complete

Task 2

Read all that is in the task and press complete

Task 3

Open Phishing, Technique T1566 – Enterprise | MITRE ATT&CK®

3.1 Only blue teamers will use the ATT&CK Matrix? (Yay/Nay)

Answer: Nay

3.2 What is the ID for this technique?

We can find this on the page right corner

Answer: T1566

3.3 Based on this technique, what mitigation covers identifying social engineering techniques?

Mitre tryhackme
Answer: User Training

3.4 There are other possible areas for detection for this technique, which occurs after what other technique?

Mitre tryhackme
Answer: User Execution

3.5 What group has used spear phishing in their campaigns?

Mitre tryhackme
Answer: Dragonfly

3.6 Based on the information for this group, what are their associated groups?

Click on the link Dragonfly Dragonfly, TG-4192, Crouching Yeti, IRON LIBERTY, Energetic Bear, Group G0035 | MITRE ATT&CK®

Mitre tryhackme
Answer: TG-4192,Crouching Yeti,IRON LIBERTY,Energetic Bear

3.7 What tool is attributed to this group to transfer tools or files from one host to another within a compromised environment?

Mitre tryhackme
Answer: PSexec

3.8 Based on the information about this tool, what group used a customized version of it?

Click on the link PSexec PsExec, Software S0029 | MITRE ATT&CK®

Mitre tryhackme

3.9 This group has been active since what year?

Click on the link FIN5 FIN5, Group G0053 | MITRE ATT&CK®

Answer: 2008

3.10 Instead of Mimikatz, what OS Credential Dumping tool is does this group use?

Mitre tryhackme
Answer: Correct Answer

Task 4

4.1 For the above analytic, what is the pseudocode a representation of?

Answer: Splunk Search

4.2 What tactic has an ID of TA0003?

Go to mitre.org and type in the searchbox TA0003. Once found I notice the URL

Persistence, Tactic TA0003 – Enterprise | MITRE ATT&CK®

Answer: Persistence

4.3 What is the name of the library that is a collection of Zeek (BRO) scripts?

Head to https://car.mitre.org/ and search for Zeek

Answer: BZAR

4.4 What is the name of the technique for running executables with the same hash and different names?

Answer: Masquerading

4.5 Examine CAR-2013-05-004, what additional information is provided to analysts to ensure coverage for this technique?

Go to this URL CAR-2013-05-004: Execution with AT | MITRE Cyber Analytics Repository

Answer: Unit  Tests

Task 5

Open Shield Home (mitre.org)

5.1 Which Shield tactic has the most techniques?

Head over to Active Defense Matrix (mitre.org). We can see Detect has the most

Answer: Detect

5.2 Is the technique ‘Decoy Credentials’ listed under the tactic from question #1? (Yay/Nay)

Mitre
Answer: Yay

5.3 Explore DTE0011, what is the ID for the use case where a defender can plant artifacts on a system to make it look like a virtual machine to the adversary?

Go to the techniques Active Defense Techniques (mitre.org)

Then Click on DTE0011 and notice it is a Decoy Content. Scroll further down

Mitre
Answer: DUC0234

5.4 Based on the above use case, what is its ATT&CK® Technique mapping?

Navigate to https://shield.mitre.org/attack_mapping/mapping_all.html

Answer: T1497

5.5 Continuing from the previous question, look at the information for this ATT&CK® Technique, what 2 programs are listed that adversary’s will check for?

Answer: Sysinternals and Wireshark

Task 6

6.1 How many phases does APT3 Emulation Plan consists of?

APT 3 Phases
Answer: 3

6.2 Under Persistence, what binary was replaced with cmd.exe?

The answer can be found in the PDF https://attack.mitre.org/docs/APT3_Adversary_Emulation_Plan.pdf

PDF Mitre
Answer: sethc.exe

6.3 Examining APT29, what 2 tools were used to execute the first scenario?

The answer can be found in scenario1 infrastructure adversary_emulation_library/Infrastructure.md at master · center-for-threat-informed-defense/adversary_emulation_library · GitHub

Answer Pupy and Metasploit

6.4 What tool was used to execute the second scenario?

The answer can be found in scenario 2 infrastucture

adversary_emulation_library/Infrastructure.md at master · center-for-threat-informed-defense/adversary_emulation_library · GitHub

Answer PoshC2

6.5 Where can you find step-by-step instructions to execute both scenarios?

Answer: ATT&CK Arsenal

Task 7

7.1 What is a group that targets your sector who has been in operation since at least 2013?

Groups | MITRE ATT&CK®

Answer: APT33

7.2 Does this group use Stuxnet? (Yay/Nay)

APT33, HOLMIUM, Elfin, Group G0064 | MITRE ATT&CK®

Answer: Nay

7.3 As your organization is migrating to the cloud, is there anything attributed to this APT group that you should focus on? If so, what is it?

Mitre
Answer:  Cloud Accounts

7.4 What tool is associated with this technique?

Valid Accounts: Cloud Accounts, Sub-technique T1078.004 – Enterprise | MITRE ATT&CK®

Answer Ruler

7.5 Per the detection tip, what should you be detecting?

Mitre
Answer abnormal or malicious behavior

7.6 What platforms does this affect?

Mitre
Answer Azure AD, Google Workspace, IaaS, Office 365, SaaS

And this concludes the Mitre on Tryhackme

Great designs and products for your hacker’s cave

You can get these designs on more than 70 products ranging from

  • T-shirt
  • mugs
  • mousepad
  • baseball caps
  • Metal prints
  • Art Board

And much more.

Most Popular Post

Sign Up

Signup today for free and be the first to get notified on new updates.
* indicates required

Follow Me

Most Popular Post

Contact Us