# The Blue Team Perspective (TryHackMe) Link to the Challenge on TryHackMe: **The Blue Team Perspective** ```markdown index=botsv1 | stats count by sourcetype ``` ![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/c14b508f-e9b5-417e-9c92-995504377630.png align="center") ```markdown index=botsv1 sourcetype=fgt_utm subtype=ips | stats count by srcip | sort -count | head 1 ``` ![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/aa4f927a-bdd3-4dac-8e4c-33c05aeec577.png align="center") ```markdown index=botsv1 sourcetype=iis sc_status=404 | stats count by c_ip | where count > 100 | sort -count ``` ![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/b2ed9d27-b517-4370-8a77-da3c22f6b56b.png align="center") ```markdown index=botsv1 sourcetype=suricata NOT src_ip=192.168.* NOT src_ip=10.* | stats count by src_ip | sort -count | head 1 ``` `40.80.148.42` ```markdown index=botsv1 sourcetype=iis c_ip=40.80.148.42 cs_method=POST | stats count by cs_uri_stem | sort -count | head 1 ``` `/joomla/index.php/component/search/` ```markdown index=botsv1 sourcetype=iis c_ip=40.80.148.42 sc_status=404 | stats count ``` `2009` ```markdown The Blue Team Perspective // Companion Ops Console Reset Fullscreen Briefing Alert Triage IR Lifecycle Pyramid Attack Chain Debrief You have been on the attacker's side for twelve modules. Step across. Over the next thirty minutes, this companion will put you through four exercises the Splunk lab cannot run for you. You will make triage calls under a live alert queue, map two incident-response frameworks onto each other, rank indicators by the pain they cause adversaries, and piece the Wayne Corp attack chain back together across every framework in this room. This is not a test. It is a parallel track to the room. The Splunk VM teaches you what the queries look like. This teaches you how to think around them. It is 8:47 AM. You are shadowing the L1 desk at Wayne Corp's SOC. The alert queue is live. Over the next thirty minutes you will make four judgment calls the Splunk lab cannot test on its own. This companion runs alongside your TryHackMe room. It does not replace the Splunk VM - it fills the conceptual gaps the VM cannot cover. Start shift SOC Alert Triage Simulator Shift summary Your calls for this shift Alert Your call Correct call 4 failed logons from a single internal IP over 20 minutes Close as false positive Close as false positive 300+ Event ID 4625 from one external IP against one account in 5 minutes, then one 4624 Escalate to L2 Escalate to L2 FireEye-style malware detection alert on POS system Escalate to L2 Escalate to L2 Single EventCode=1102 outside any documented maintenance window Escalate to L2 Escalate to L2 Replay shift IR Lifecycle Phase Mapper Drop each SANS step into the NIST phase it belongs to. One of the NIST phases holds more than one. Preparation 1 of 1 Preparation Detection and Analysis 1 of 1 Identification Containment, Eradication, and Recovery 3 of 3 Containment Eradication Recovery Post-Incident Activity 1 of 1 Lessons Learned Tab to navigate cards. Enter to select. Tab to navigate buckets. Enter to drop. Esc to cancel. Six SANS steps. Four NIST phases. One of them carries the operational load. Reset × Halfway. Two frameworks down, one hierarchy to go. You just mapped SANS PICERL onto the NIST lifecycle. In the next exercise you will rank indicators by attacker cost, which is a different kind of thinking. Where IR phases ask what happens next, the Pyramid of Pain asks what hurts the adversary most when you block it. The room has covered both concepts. This is where you get to feel the difference between them. Pyramid of Pain Builder Place each indicator on the tier that matches the pain it causes the attacker when you block it. Some will feel counter-intuitive. TTPs - Tough Tools - Challenging Network or Host Artifacts - Annoying Domain Names - Simple IP Addresses - Easy Hash Values - Trivial Block a hash: the attacker recompiles in seconds. Block a TTP: the attacker redesigns their operation. That is the asymmetry. Reset Tab to navigate cards. Enter to select. Tab to navigate tiers. Enter to place. Esc to cancel. Wayne Corp Attack Chain Explorer You reconstructed this chain in the VM. Click each stage to see how it maps across the frameworks from this room. ✓ Reconnaissance Wordlist scanning against the Wayne Corp web server ✓ Initial Exploitation Concentrated POST requests to the target URI ✓ Credential Access Brute force against Windows hosts ✓ Impact Web defacement via POST activity to specific URIs Impact ATT&CK technique T1491.002 Defacement: External from Task 7 attack chain NIST IR phase Detection and Analysis from Task 7 attack chain Pyramid of Pain layer Network/Host Artifacts from Task 7 attack chain Sourcetype that revealed it access_combined (POST to specific URIs) from Task 7 attack chain Close Containment, Eradication, and Recovery Reset Shift complete. Carry this across the screen. You made four triage calls, mapped two frameworks onto each other, ranked six indicators by attacker cost, and reconstructed the Wayne Corp chain across every framework in this room. None of that is scored. None of it needs to be - the point was to rehearse the judgment the Splunk lab cannot rehearse for you. Every pentest you run from this point is an opportunity to notice which of your actions would have been caught and which would not. That observation, written down, is purple teaming in practice. The next room in Module 13 shifts the focus from reactive defense to proactive security. You will still need the defender's perspective there, but from a different angle. Go finish the room. Return to TryHackMe room Flag unlocked THM{Blue-T34M-Redacted} Companion site for TryHackMe room "The Blue Team Perspective." Not affiliated with TryHackMe Ltd. Wrong tier — try again. ``` ![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/b21dfdb1-31fe-439e-bda6-6f32e3a81d10.png align="center")