Brock

1st place

5540 points


Awards


Hint 29

hints

Hint for 16 - Baselining [BONUS]

-20


Hint 22

hints

Hint for 6 - Get with the Process

-10


Hint 21

hints

Hint for 6 - Get with the Process

-5


Hint 9

hints

Hint for 4 - Event Clearing 1 - MITRE T1562.002

-5


Hint 3

hints

Hint for 5 - TTP

-5


Solves

Challenge Category Value Time
6 - Agent Smith 10 - Investigation - Trick or Treat 50
5 - True or False? 10 - Investigation - Trick or Treat 75
4 - Do you chose exile or deletion? 10 - Investigation - Trick or Treat 75
3 - At your service 10 - Investigation - Trick or Treat 75
2 - Trick than I guess 10 - Investigation - Trick or Treat 75
1 - Trick or Treat 10 - Investigation - Trick or Treat 75
6 - Where does it make port? [BONUS] 9 - Investigation - Job Application 100
5 - Epic Fail [BONUS] 9 - Investigation - Job Application 100
4 - Admin work 9 - Investigation - Job Application 50
3 - This just in! 9 - Investigation - Job Application 50
2 - Thank you for coming in! 9 - Investigation - Job Application 50
1 - Apply inside 9 - Investigation - Job Application 75
8 - A numbers game [BONUS] 8 - Investigation - A Lateral Move 100
7 - Sound of silence [BONUS] 8 - Investigation - A Lateral Move 100
6 - Monitor your monitors [BONUS] 8 - Investigation - A Lateral Move 150
5 - Access granted? 8 - Investigation - A Lateral Move 75
4 - At your service 8 - Investigation - A Lateral Move 75
3 - Is this working? 8 - Investigation - A Lateral Move 75
2 - Movin on up! 8 - Investigation - A Lateral Move 75
1 - Twin suns 8 - Investigation - A Lateral Move 75
17 - Baselining 2 [BONUS] 7 - Investigation - Ow That Hurt! 200
16 - Baselining [BONUS] 7 - Investigation - Ow That Hurt! 150
15 - Well how about that [BONUS] 7 - Investigation - Ow That Hurt! 100
14 - Start your engines! 7 - Investigation - Ow That Hurt! 100
13 - Secret admirer 7 - Investigation - Ow That Hurt! 50
12 - Copycat 7 - Investigation - Ow That Hurt! 75
11 - Further reading 7 - Investigation - Ow That Hurt! 75
10 - This just gets better 7 - Investigation - Ow That Hurt! 75
9 - Lucky us! 7 - Investigation - Ow That Hurt! 50
8 - Leaving a mark 2 7 - Investigation - Ow That Hurt! 75
7 - Leaving a mark 7 - Investigation - Ow That Hurt! 75
6 - Seriously no arguing! 7 - Investigation - Ow That Hurt! 50
5 - By the light of the fifth alert 7 - Investigation - Ow That Hurt! 50
4 - Upon further analysis 7 - Investigation - Ow That Hurt! 50
3 - OSINT challenge! 7 - Investigation - Ow That Hurt! 50
2 - But wait 7 - Investigation - Ow That Hurt! 50
1 - Break out the magnifying glass! 7 - Investigation - Ow That Hurt! 50
8 - A little extra! [BONUS] 6 - Investigation - RDP 100
7 - These things do happen 6 - Investigation - RDP 50
6 - The elephant in the room 6 - Investigation - RDP 50
5 - Where? [BONUS] 6 - Investigation - RDP 75
4 - System Blank 6 - Investigation - RDP 50
3 - How many events? 6 - Investigation - RDP 50
2 - Return to The Source 6 - Investigation - RDP 50
1 - The big picture 6 - Investigation - RDP 50
15 - Gesundheit [BONUS] 5 - Investigation - Alert Triage 150
14 - Not cool [BONUS] 5 - Investigation - Alert Triage 150
13 - The Pagemaster [BONUS] 5 - Investigation - Alert Triage 120
12 - Ahead my dears! 5 - Investigation - Alert Triage 100
11 - Didn't your parents tell you not to argue? 5 - Investigation - Alert Triage 100
10 - So now what? 5 - Investigation - Alert Triage 75
9 - How original 5 - Investigation - Alert Triage 100
8 - The Mark of Success 5 - Investigation - Alert Triage 100
7 - Sort of a big deal 5 - Investigation - Alert Triage 75
6 - Get with the Process 5 - Investigation - Alert Triage 75
5 - The Sorting Hat 5 - Investigation - Alert Triage 50
4 - Groups are fun 5 - Investigation - Alert Triage 50
3 - The Internet can be a scary place 5 - Investigation - Alert Triage 50
2 - Shodan 5 - Investigation - Alert Triage 50
1 - Who is noisy? 5 - Investigation - Alert Triage 50
3 - New User 3 4 - User Activity 50
2 - New User 2 4 - User Activity 50
1 - New User 1 4 - User Activity 50
9 - SSH connections 3 - Exploring the Network 50
8 - Which endpoint went to that IP? 3 - Exploring the Network 50
7 - Indicator Match User! 3 - Exploring the Network 50
6 - Indicator Match! 3 - Exploring the Network 50
5 - Event Clearing 2 - MITRE T1562.002 3 - Exploring the Network 50
4 - Event Clearing 1 - MITRE T1562.002 3 - Exploring the Network 50
3 - Total Queries live.com 3 - Exploring the Network 50
2 - JA3 compression tools DEEP 3 - Exploring the Network 50
1 - JA3 for compression tools 3 - Exploring the Network 25
7 - Severe Situation 2 - SIEM Overview 50
6 - Which one? 2 - SIEM Overview 50
5 - TTP 2 - SIEM Overview 50
4 - Alert! Alert! 2 - SIEM Overview 25
3 - Threat Intel Sources 2 - SIEM Overview 25
2 - Expansion is Key 2 - SIEM Overview 25
1 - SIEMple 2 - SIEM Overview 25
4 - Room of Requirement 1 - Elastic Security Components 25
3 - QueryOS 1 - Elastic Security Components 25
2 - Native Protection 1 - Elastic Security Components 20
1 - CIA 1 - Elastic Security Components 20