TryHackMe | Threat Hunting With YARA | WriteUp

This room focuses on using YARA for threat hunting

↓↓↓ Click here and earn $5 TryHackMe credit ↓↓↓

https://tryhackme.com/signup?referrer=62f3f5b5f9ea33006194e018

TryHackMe | Threat Hunting With YARA | WriteUp

Find the room here: https://tryhackme.com/r/room/threathuntingwithyara

Task 1 Introduction

Are you ready to hunt for malware?

No answer needed

Task 2 Scenario Description

What technique does ID T1134 describe?

Access Token Manipulation

What does the detection rule M_APT_Dropper_Rootsaw_Obfuscated detect?

Detects obfuscated ROOTSAW payloads

Task 3 Opportunities for Threat Hunting

Which threat hunting style is proactive and uses indicators of attack and TTPs?

structured hunting

In which phase of the threat hunting process, tools like YARA or Volatility are used?

Investigation

You have received a threat intelligence report consisting only of Indicators of Compromise. What threat hunting style do you recommend to use?