# The Advent of Cyber: Day 4: Atomic Red Team -  I’m all atomic inside! (TryHackMe)

In this article, we’ll cover the Atomic Red Team - I’m all atomic inside! The write-up is called the Day 4 challenge of the Advent of Cyber event challenge. It was interesting to understand and navigate through the Cyber Attacks & the Kill Chain, the [Atomic Red Library](https://www.atomicredteam.io/) which is a red team test case that is mapped to the [MITRE ATT&CK](https://attack.mitre.org/) framework. We’re still at Wareville for SOC-mas!

As Glitch continues to prepare for SOC-mas and fortifies Wareville's security, he decides to conduct an attack simulation that would mimic a ransomware attack across the environment. He is unsure of the correct detection metrics to implement for this test and asks you for help. Your task is to identify the correct atomic test to run that will take advantage of **a command and scripting interpreter**, conduct the test, and extract valuable artifacts that would be used to craft a detection rule.

Answer the questions below

1. What was the flag found in the .txt file that is found in the same directory as the PhishingAttachment.xslm artefact? `THM{GlitchTestingForSpearphishing}`  
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1736594530691/75863fcd-9913-4855-a93f-975e70d23461.png align="center")
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1736594569009/0d7f1372-6279-4a63-b1ce-cd7d409a3086.png align="center")
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1736594596045/477939dc-7b7c-4a2a-b552-9f4446205856.png align="center")
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1736594626386/f2d55aed-d678-4f1d-85e6-e4111c1d7f24.png align="center")
    
2. What ATT&CK technique ID would be our point of interest? `T1059`  
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1736595505888/6fd5e6d6-c16a-44a7-b4dd-a09d25a0e415.png align="center")
    
3. What ATT&CK subtechnique ID focuses on the Windows Command Shell? `T1059.003`  
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1736595567376/9a92ae7b-fdce-4d1c-82e5-24954609c322.png align="center")
    
4. What is the name of the Atomic Test to be simulated? `Simulate BlackByte Ransomware Print Bombing`  
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1736595986622/48a3feff-f0ca-4143-8f83-bae344720df6.png align="center")
    
5. What is the name of the file used in the test? `Wareville_Ransomware.txt`  
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1736596015156/9ce381e1-aa3a-46d7-bd67-feec1b7ea28b.png align="center")
    
6. What is the flag found from this Atomic Test? `THM{R2xpdGNoIGlzIG5vdCB0aGUgZW5lbXk=}`  
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1736596029206/496e68a1-8204-427d-8b23-e2284a1946b7.png align="center")
    
7. Learn more about the [Atomic Red Team](https://tryhackme.com/r/room/atomicredteam) via the linked room.
    

Thank you for reading through this article. You can leave a comment with your thoughts: areas to improve or other suggestions and questions if any. Till the next one, stay secure!