Execution in Windows

Career Paths SOC Analyst
1

At the module “Execution in Windows” I keep disconnecting, getting the following message:
An error was detected with your lab connection: Aborted. See logs.

2

Hello, I have the same problem. My labs too.

3

Hey, same here in 4 of my labs. Really annoying as i can’t progress any further in my ‘learn’ section of my career path

4

I’m also having the same problem.

5

Hello,

I am having a similar issue. I am confused on the Windows Event Logs exercises…
I do not get how you connect the two systems?? Can someone help me with it please?

6

i have trouble with Lab challenging exce.. in windows execution and Guiding exer… in Spearphishing with link too

7

3. In Wazuh, what is the IP address of the host that generated the Powershell process??? however i write the answer

8

Hey there - could you please provide the following information?

Lab Name: Execution in Windows
Lesson:
Part / Step Number:
Description of issue:
Screenshot:

If you have a second issue with a different lab, please open a separate thread.

9

I am on the Challenge and it is saying that the agent ip address is wrong as well as the time stamp and there is only one ip address and only two timestamps. Not sure what is being asked?

10

Question #3 and Question #5

11

Without giving too much away, the expectation for Question 3-5 of the Challenge Exercise is that you return to the SIEM, clear any previous search queries, and update the time frame. At this point, you can run the appropriate queries (using the same patterns that you learned in the Guided Exercise) to first locate any new processes related to PowerShell. You should find three alerts, all with the same IP address. Next, search for new processes related to the Command Prompt. You should find some number of alerts. You can answer Questions 4 and 5 with that information.

1 Like