Hack The Box
Hack The Box Sherlock — Unit42
A Sysmon EVTX investigation tracing a cloud-hosted installer through execution, file staging, timestamp changes, network activity and process exit.
Read write-uproot@kali:~$ ls ./writeups/sherlocks
HTB Sherlock Write-ups
Evidence-led investigations that reconstruct incidents, timelines and attacker behavior.
Knowledge base
Retired Sherlock archive
Structured case notes covering evidence handling, artifact analysis, timelines, findings and defensive lessons.
2 write-ups
Hack The Box
Hack The Box Sherlock — LogJammer
A reproducible Windows EVTX investigation correlating logons, Defender detections, firewall changes, scheduled tasks, PowerShell activity and log clearing.
Read write-upNo matching write-ups
Try a broader search or clear one of the filters.