rhys@mcclew:~$ls ./ctfs/htb-sherlocksVOL.02 / DEFENSIVE
HackTheBoxSherlock Writeups
DFIR labs: artefact analysis, event timelines and detection notes.
VOL.02 / WRITEUPS
/
DIFF
SORT
Operation Blackout 2025: Phantom CheckVery EasyPhantom Check is a Sherlock challenge showcasing some of the common virtualization detection techniques used by attackers. Players will gain the ability to create detection rules by identifying specific WMI queries, comparing processes for virtual machine detection, and analyzing registry keys or file paths associated with virtual environments.→BrutusVery EasyIn this very easy Sherlock, you will familiarize yourself with Unix auth.log and wtmp logs. We’ll explore a scenario where a Confluence server was brute-forced via its SSH service. After gaining access to the server, the attacker performed additional activities, which we can track using auth.log. Although auth.log is primarily used for brute-force analysis, we will delve into the full potential of this artifact in our investigation, including aspects of privilege escalation, persistence, and even some visibility into command execution.→