Advent of Cyber 2024 [ Day 3 ] Writeup | TryHackMe Walkthrough

Task 9: Log analysis Day 3: Even if I wanted to go, their vulnerabilities wouldn’t allow it.

1. BLUE: Where was the web shell uploaded to?

Answer format: /directory/directory/directory/filename.php

1. Open Elastic Page Using the Given Url
2. Click On the vertical nav bar on the Left side, click Discover, and select Frostypines if not selected.
3. Set the Time Oct 1 00:00 to Oct 3 20:00
4. You can Add a field called requests to find the malicious path

Read Further on Medium...