- Starting Out In Cyber Sec - Learn about the different career paths in Cyber Security and how TryHackMe can help!
- Junior Security Analyst Intro - Play through a day in the life of a Junior Security Analyst, their responsibilities and qualifications needed to land a role as an analyst
- Security Engineer Intro - What does a day in the life of a security engineer look like?
SOC Analyst Role
- SOC Role in Blue Team - Discover security roles and learn how to advance your SOC career, starting from the L1 analyst.
- SOC Fundamentals - Learn about the SOC team ad their processes.
- SOC L1 Alert Triage - Learn more about SOC alerts and build a systematic approach to efficiently triaging them.
- SOC L1 Alert Reporting - Learn how to properly report, escalate, and communicate about high-risk SOC alerts.
- Security Principles - Learn about the security triad and common security models and principles.
- Cyber Kill Chain - The Cyber Kill Chain framework is designed for identification and prevention of the network intrusions. You will learn what the adversaries need to do in order to achieve their goals.
- Pyramid Of Pain - Learn what is the Pyramid of Pain and how to utilise this model to determine the level of difficulty it will cause for an adversary to change the indicators associated with them, and their campaign.
- Unified Kill Chain - The Unified Kill Chain is a framework which establishes the phases of an attack, and a means of identifying and mitigating risk to IT assets.
- Introductory Researching - A brief introduction to research skills for pentesting
- Vulnerabilities 101 - Understand the flaws of an application and apply your researching skills on some vulnerability databases
- Phishing Analysis Fundamentals - Learn all the components that make up an email
- Phishing Emails in Action - Learn the different indicators of phishing attempts by examining actual phishing emails
- Nessus - Learn how to set up and use Nessus, a popular vulnerability scanner
- OpenVAS - Learn the basics of threat and vulnerability management using Open Vulnerability Assessment Scanning
- Intro to Detection Engineering - Introduce the concept of detection engineering and the frameworks used towards crafting effective threat detection strategies
- Intro to Cyber Threat Intel - Introducing cyber threat intelligence and related topics, such as relevant standards and frameworks
- Threat Intelligence Tools - Explore different OSINT tools used to conduct security threat assessments and investigations
Logs & its Importance -
- Intro to Logs - Learn the fundamentals of logging, data sources, collection methods and principles to step into the log analysis world
- Log Operations - Learn the operation process details.
- Intro to Log Analysis - An intro to log analysis, best practices, and essential tools for effective detection and response
- Linux Logging for SOC - Explore key Linux log sources and learn how to use them in your SOC triage.
- Windows Logging for SOC - Start your Windows monitoring journey by learning how to use system logs to detect threats.
SIEM, EDR and Security Solutions -
- Introduction to SIEM - An introduction to Security Information and Event Management
- Log Analysis with SIEM - Learn how SIEM solutions can be used to detect and analyse malicious behaviour.
- Splunk: Exploring SPL - Learn and explore the basics of the Search Processing Language
- Servidae: Log Analysis in ELK - Analyze the logs of an affected workstation to determine the attacker's indicators of compromise.
- Intro to Endpoint Security - Learn about fundamentals, methodology, and tooling for endpoint security monitoring
- Wazuh - Wazuh is a free, open source and enterprise-ready security monitoring solution for threat detection, integrity monitoring
- Snort - Learn how to use Snort to detect real-time threats, analyse recorded traffic files and identify anomalies
Digital Forensics
- Intro to Digital Forensics - Learn about digital forensics and related processes and experiment with a practical example
- DFIR: An Introduction - Introductory room for the DFIR module
- Windows Forensics 1 - Introduction to Windows Registry Forensics
- Linux Server Forensics - Learn about digital forensics artefacts found on Linux servers by analysing a compromised server
- Digital Forensics Case B4DM755 - Acquire the critical skills of evidence preservation, disk imaging, and artefact analysis for use in court
- KAPE - An introduction to Kroll Artifact Parser and Extractor (KAPE) for collecting and processing forensic artifacts
- Legal Considerations in DFIR - Understand the processes involved in DFIR and the legal considerations that guide them.
Incident Response
- Incident Response Process - Practice the NIST Incident Response lifecycle steps on a compromised Windows workstation.
- Intro to IR and IM - An introduction to Incident Response and Incident Management
- Identity and Access Management - Learn about identification, authentication, authorisation, accounting, and identity management.
- Preparation - A look into the Preparation phase of the Incident Response
- Identification & Scoping - A look into the second phase of the Incident Response Framework, Identification & Scoping
- Linux Incident Surface - Explore various areas of Incident Surface in Linux and how to identify the footprints of the incident.
- Windows Incident Surface - Learn how to implement DFIR techniques explore the to Windows incident surface.
- Investigating Windows - A Windows machine has been hacked, it's your job to go investigate this Windows machine and find clues to what the hacker might have done
- Redline - Learn how to use Redline to perform memory analysis and to scan for IOCs on an endpoint
- History of Malware - Join this room to learn about the first forms of malware and how they turned into the malicious code we see today
- Malware Classification - Learn how to identify, classify, and understand common types of malware.
- MAL: Malware Introductory - The start of a series of rooms covering Malware Analysis
- MAL: Researching - Understanding checksums, how to generate them and their use throughout malware analysis with online sandboxing & reporting services
Android Malware
- Android Hacking 101 - Android Mobile Application Penetration Testing
- Mobile Malware Analysis - Learn and practice mobile malware analysis
- Android Malware Analysis - Android malware analysis with Pithus (static and hunting)
Computer Architecture
- Dissecting PE Headers - Learn about Portable Executable files and how their headers work
- Registry Persistence Detection - Learn to use the AutoRuns PowerShell module to detect persistence mechanisms that use the Registry
- x86 Architecture Overview - A crash course in x86 architecture to enable us in malware reverse engineering
- Intro to Threat Emulation - A look into threat emulation practices as a means of cyber security assessment
- Threat Hunting: Introduction - Behind the scenes of Threat Hunting - mindset, process, and goals
- Threat Hunting: Foothold - Hunting suspicious activities indicating initial user or host compromise
- Confluence CVE-2023-22515 - Exploit CVE-2023-22515 to get admin access to Confluence Server and Data Center editions
Easy
- Investigating Windows - A windows machine has been hacked, it's your job to go investigate this windows machine and find clues to what the hacker might have done
- Pickle Rick - A Rick and Morty CTF. Help turn Rick back into a human!
- Overpass 2 - Hacked - Overpass has been hacked! Can you analyse the attacker's actions and hack back in?
Medium
- Carnage - Apply your analytical skills to analyse the malicious network traffic using Wireshark
- Masterminds - Practice analysing malicious traffic using Brim
- REvil Corp - You are involved in an incident response engagement and need to analyse an infected host using Redline
- Disk Analysis & Autopsy - Ready for a challenge? Use Autopsy to investigate artifacts from a disk image
- Conti - An Exchange server was compromised with ransomware - use Splunk to investigate how the attackers compromised the server!
- Investigating Windows 2.0 - In the previous challenge you performed a brief analysis. Within this challenge, you will take a deeper dive into the attack
- Investigating Windows 3.x - Find the artifacts resident on the endpoint and sift through captured data to determine what type of attack occurred on the endpoint