A process hash on the intel feed

Match Sysmon process hashes against a threat intel list. Sysmon prints SHA256 in uppercase and the feed uses lowercase, so match case-insensitively and then trace the parent.

Terminal mission
Intermediate
3 objectives
0 of 3 solved

Briefing

Sysmon can hash every executable it sees start (the Hashes field). The intel team shared three SHA256 values from a campaign that abuses remote support tools.

Select-String is case-insensitive by default, which matters here: Sysmon writes hashes in capitals.

PowerShell · WKS-0507

WKS-0507 · Sysmon triage

Type help for the command list and objectives for your tasks. Everything runs in this browser.

PS /Users/analyst>

Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.