Payton Harris
9th place
1225 points
Awards
Hint 23
hints
Hint for 7 - Sort of a big deal
-10
Hint 22
hints
Hint for 6 - Get with the Process
-10
Hint 21
hints
Hint for 6 - Get with the Process
-5
Hint 17
hints
Hint for 1 - New User 1
-5
Hint 18
hints
Hint for 1 - New User 1
-5
Hint 16
hints
Hint for 9 - SSH connections
-10
Hint 9
hints
Hint for 4 - Event Clearing 1 - MITRE T1562.002
-5
Hint 10
hints
Hint for 4 - Event Clearing 1 - MITRE T1562.002
-5
Hint 8
hints
Hint for 3 - Total Queries live.com
-5
Hint 7
hints
Hint for 2 - JA3 compression tools DEEP
-5
Hint 5
hints
Hint for 1 - JA3 for compression tools
-5
Hint 4
hints
Hint for 1 - JA3 for compression tools
-5
Hint 3
hints
Hint for 5 - TTP
-5
Hint 1
hints
Hint for 2 - Native Protection
-5
Hint 2
hints
Hint for 2 - Native Protection
-5
Solves
| Challenge | Category | Value | Time |
| 6 - Get with the Process | 5 - Investigation - Alert Triage | 75 | |
| 7 - Sort of a big deal | 5 - Investigation - Alert Triage | 75 | |
| 5 - The Sorting Hat | 5 - Investigation - Alert Triage | 50 | |
| 4 - Groups are fun | 5 - Investigation - Alert Triage | 50 | |
| 3 - The Internet can be a scary place | 5 - Investigation - Alert Triage | 50 | |
| 2 - Shodan | 5 - Investigation - Alert Triage | 50 | |
| 1 - Who is noisy? | 5 - Investigation - Alert Triage | 50 | |
| 3 - New User 3 | 4 - User Activity | 50 | |
| 2 - New User 2 | 4 - User Activity | 50 | |
| 1 - New User 1 | 4 - User Activity | 50 | |
| 9 - SSH connections | 3 - Exploring the Network | 50 | |
| 8 - Which endpoint went to that IP? | 3 - Exploring the Network | 50 | |
| 7 - Indicator Match User! | 3 - Exploring the Network | 50 | |
| 6 - Indicator Match! | 3 - Exploring the Network | 50 | |
| 5 - Event Clearing 2 - MITRE T1562.002 | 3 - Exploring the Network | 50 | |
| 4 - Event Clearing 1 - MITRE T1562.002 | 3 - Exploring the Network | 50 | |
| 3 - Total Queries live.com | 3 - Exploring the Network | 50 | |
| 2 - JA3 compression tools DEEP | 3 - Exploring the Network | 50 | |
| 1 - JA3 for compression tools | 3 - Exploring the Network | 25 | |
| 7 - Severe Situation | 2 - SIEM Overview | 50 | |
| 6 - Which one? | 2 - SIEM Overview | 50 | |
| 5 - TTP | 2 - SIEM Overview | 50 | |
| 4 - Alert! Alert! | 2 - SIEM Overview | 25 | |
| 3 - Threat Intel Sources | 2 - SIEM Overview | 25 | |
| 2 - Expansion is Key | 2 - SIEM Overview | 25 | |
| 1 - SIEMple | 2 - SIEM Overview | 25 | |
| 2 - Native Protection | 1 - Elastic Security Components | 20 | |
| 4 - Room of Requirement | 1 - Elastic Security Components | 25 | |
| 3 - QueryOS | 1 - Elastic Security Components | 25 | |
| 1 - CIA | 1 - Elastic Security Components | 20 |