soc-comguard

1st place

281 points


Awards


Solves

Challenge Category Value Time
Written Files LR SIEM Chapter 6 - Processes 5
WMIC LR SIEM Chapter 6 - Processes 3
Terminated Process (2/2) LR SIEM Chapter 6 - Processes 4
Terminated Process (1/2) LR SIEM Chapter 6 - Processes 4
Suspicious File Creation Time (2/2) LR SIEM Chapter 6 - Processes 4
Suspicious File Creation Time (1/2) LR SIEM Chapter 6 - Processes 4
Service Started (2/3) LR SIEM Chapter 6 - Processes 4
Service Started (1/3) LR SIEM Chapter 6 - Processes 4
Russian Domain LR SIEM Chapter 6 - Processes 4
Remote Thread Creation LR SIEM Chapter 6 - Processes 3
mshta Process LR SIEM Chapter 6 - Processes 5
Invoke LR SIEM Chapter 6 - Processes 5
iewin7 LR SIEM Chapter 6 - Processes 3
Hash - SHA256 LR SIEM Chapter 6 - Processes 5
A Cheesy Executable LR SIEM Chapter 6 - Processes 3
Service Installed LR SIEM Chapter 5 - Logs 4
Process Connection (1/2) LR SIEM Chapter 5 - Logs 4
PowerShell Arguments LR SIEM Chapter 5 - Logs 4
Password Changes LR SIEM Chapter 5 - Logs 3
Haxor Activity LR SIEM Chapter 5 - Logs 3
Explorer (2/2) LR SIEM Chapter 5 - Logs 5
Explorer (1/2) LR SIEM Chapter 5 - Logs 5
Disabling Security LR SIEM Chapter 5 - Logs 5
Base64 Log Source Type LR SIEM Chapter 5 - Logs 5
Base64 Commands LR SIEM Chapter 5 - Logs 4
Process Involvement LR SIEM Chapter 4 - Networking 3
Outbound Connections LR SIEM Chapter 4 - Networking 3
Network Traffic LR SIEM Chapter 4 - Networking 3
NetMon Host Origin LR SIEM Chapter 4 - Networking 3
mshta LR SIEM Chapter 4 - Networking 3
Google_Gen (2/2) LR SIEM Chapter 4 - Networking 3
Google_Gen (1/2) LR SIEM Chapter 4 - Networking 3
GitHub Download*** LR SIEM Chapter 4 - Networking 5
DNS (3/3) LR SIEM Chapter 4 - Networking 4
DNS (2/2) LR SIEM Chapter 4 - Networking 4
DNS (1/2) LR SIEM Chapter 4 - Networking 4
Blocked Traffic LR SIEM Chapter 4 - Networking 4
Associations (2/2) LR SIEM Chapter 4 - Networking 4
Associations (1/2) LR SIEM Chapter 4 - Networking 4
Top Email Subject LR SIEM Chapter 3 - Emails & Accounts 3
RhythmWorld Email LR SIEM Chapter 3 - Emails & Accounts 3
Pending Delivery LR SIEM Chapter 3 - Emails & Accounts 3
An Astronomical Miss LR SIEM Chapter 3 - Emails & Accounts 3
Alarming File Access (2/2) LR SIEM Chapter 3 - Emails & Accounts 4
Alarming File Access (1/2) LR SIEM Chapter 3 - Emails & Accounts 4
Alarming Account (3/3) LR SIEM Chapter 3 - Emails & Accounts 4
Alarming Account (2/3) LR SIEM Chapter 3 - Emails & Accounts 4
Alarming Account (1/3) LR SIEM Chapter 3 - Emails & Accounts 4
Widget Label Position LR SIEM Chapter 2 - Dashboards & Searches 3
The Jake Event LR SIEM Chapter 2 - Dashboards & Searches 4
Started Applications LR SIEM Chapter 2 - Dashboards & Searches 3
Software Install LR SIEM Chapter 2 - Dashboards & Searches 4
Query Timeout Setting LR SIEM Chapter 2 - Dashboards & Searches 3
Node-Link Formatting LR SIEM Chapter 2 - Dashboards & Searches 3
Netmon Node-Link (2/2) LR SIEM Chapter 2 - Dashboards & Searches 3
Netmon Node-Link (1/2) LR SIEM Chapter 2 - Dashboards & Searches 3
MS Windows Common Event LR SIEM Chapter 2 - Dashboards & Searches 3
Modified Time LR SIEM Chapter 2 - Dashboards & Searches 5
Local Service Activity LR SIEM Chapter 2 - Dashboards & Searches 4
Haxor Fail LR SIEM Chapter 2 - Dashboards & Searches 4
Hardware Vendor LR SIEM Chapter 2 - Dashboards & Searches 5
End of Flow LR SIEM Chapter 2 - Dashboards & Searches 3
Dashboards & Searches 26 LR SIEM Chapter 2 - Dashboards & Searches 5
Alarms Page - Status Options LR SIEM Chapter 1 - Get to Know the Web Console 2
Alarms Page - Filter Visibility LR SIEM Chapter 1 - Get to Know the Web Console 2
22) Hunting - Configuration Classification (3/3) LR SIEM Chapter 1 - Get to Know the Web Console 2
21) Hunting - Configuration Classification (2/3) LR SIEM Chapter 1 - Get to Know the Web Console 2
20) Hunting - Configuration Classification (1/3) LR SIEM Chapter 1 - Get to Know the Web Console 2
19) Hunting - Classification is Access Success LR SIEM Chapter 1 - Get to Know the Web Console 2
18) Hunting - Drill Down LR SIEM Chapter 1 - Get to Know the Web Console 2
17) Hunting - Top Parent Processes LR SIEM Chapter 1 - Get to Know the Web Console 2
15) Cases and Response - Modifying Playbooks LR SIEM Chapter 1 - Get to Know the Web Console 2
14) Cases and Response - Reviewing Playbooks LR SIEM Chapter 1 - Get to Know the Web Console 2
13) Cases and Response - Creating Playbooks LR SIEM Chapter 1 - Get to Know the Web Console 2
12) Cases and Response - Case Metrics LR SIEM Chapter 1 - Get to Know the Web Console 2
11) Cases and Response - Case Details (2/2) LR SIEM Chapter 1 - Get to Know the Web Console 2
10) Cases and Response - Case Details (1/2) LR SIEM Chapter 1 - Get to Know the Web Console 2
9) Alarms Page - Rule Block Logic LR SIEM Chapter 1 - Get to Know the Web Console 2
8) Alarms Page - Inspector Options LR SIEM Chapter 1 - Get to Know the Web Console 2
7) Alarms Page - Case Creation? LR SIEM Chapter 1 - Get to Know the Web Console 2
6) Alarms Page - Card vs. Grid View LR SIEM Chapter 1 - Get to Know the Web Console 2
5) Dashboards Page - Widget Filtering LR SIEM Chapter 1 - Get to Know the Web Console 2
2) Dashboards Page - Sharing (1/2) LR SIEM Chapter 1 - Get to Know the Web Console 2
1) Dashboards Page - Filters LR SIEM Chapter 1 - Get to Know the Web Console 2