Spoiler-Free Learning Guide: This article contains no TryHackMe flags, challenge-file contents, or direct task answers. It focuses on the Linux concepts, commands, and practical methodology I learned while completing the room.

Introduction

After working with Windows, networking, SOC tools, and endpoint security, I went back to strengthen one of the most important foundations in cybersecurity:

Linux

Linux appears almost everywhere in cybersecurity.

It powers:

Web Servers
Cloud Infrastructure
Security Appliances
Containers
Network Devices
Embedded Systems
Penetration Testing Tools
SOC Infrastructure

Many cybersecurity tools are also designed primarily for Linux environments.

The Linux Fundamentals (Pt1) room introduces the Linux terminal and some of the commands I will repeatedly use throughout my cybersecurity journey.

The room follows this learning path:

Introduction
     ↓
Talking to Linux
     ↓
Finding Your Way Around
     ↓
Searching Files & Content
     ↓
Shell Operators

The goal is not to memorize hundreds of commands.

It is to become comfortable enough with the terminal that navigating and investigating a Linux system starts to feel natural.

Task 1 — Introduction

The first task introduces Linux and provides an interactive Linux machine directly inside the browser.

Unlike Windows, where most beginners interact primarily through a graphical interface, Linux administration frequently happens through the:

Terminal

The terminal allows us to communicate with the operating system by typing commands.

Conceptually:

User
  |
  | Command
  v
Terminal / Shell
  |
  v
Linux
  |
  | Output
  v
User

For example, instead of clicking through folders using a mouse, I can navigate the filesystem with commands.

Instead of opening system menus, I can ask Linux directly for information.

Where Is Linux Used?

One important takeaway was understanding how widespread Linux actually is.

Linux can be found in:

Web Servers
Android-based Devices
Cloud Servers
Point-of-Sale Systems
Smart Devices
Industrial Systems
Networking Equipment
Supercomputers

For cybersecurity, this matters because many systems I may later:

Defend
Investigate
Administer
Test
or
Exploit

will run Linux.

Linux Distributions

Linux is available through different distributions.

Examples include:

Ubuntu
Debian
Fedora
Arch Linux
Kali Linux
Parrot OS

Different distributions may package software differently, but the fundamental command-line skills are largely transferable.

For this introductory environment, the important part was becoming comfortable with a Linux terminal rather than focusing on distribution differences.

🛠️ Hands-On / Commands — Task 1

Tools Used

TryHackMe browser lab
Linux terminal
Ubuntu environment

This task mainly involved starting the interactive Linux machine and getting comfortable with the terminal.

A terminal prompt may look similar to:

user@machine:~$

The important thing to recognize is that this is waiting for us to enter a command.

For example:

echo "Hello Linux"

The shell processes the command and prints the result.

My first mental model became:

Command
   ↓
Shell interprets it
   ↓
Linux performs action
   ↓
Output returned

Task 2 — Talking to Linux

This task introduces some of the first commands every Linux beginner should know.

The two most basic ideas are:

Who am I?

and:

How do I print something?

whoami

The command:

whoami

shows the user account currently running the shell.

This may seem simple, but it is extremely important in cybersecurity.

Different Linux users may have different:

Permissions
File access
Command privileges
Administrative capabilities

If I gain access to a Linux machine during an authorized lab, one of my first questions should be:

Which user am I operating as?

Conceptually:

Linux Machine
     ↓
Current Session
     ↓
whoami
     ↓
Current User

Why User Identity Matters

Suppose I am logged in as:

standard-user

I may only be able to access that user's files.

Another account might have administrative privileges.

Therefore:

User Identity
      ↓
Determines
      ↓
Permissions

This becomes very important later when learning:

Linux Permissions
sudo
Privilege Escalation
User Groups
Post-Exploitation

echo

Another fundamental command is:

echo

It prints text to the terminal.

For example:

echo "Learning Linux"

Output:

Learning Linux

This looks simple, but echo becomes much more useful once combined with:

Variables
Files
Shell scripts
Redirection
Pipelines

Quoting Text

For multiple words, it is often convenient to use quotes:

echo "Linux is useful for cybersecurity"

This treats the text as one argument.

🛠️ Hands-On / Commands — Task 2

Commands Practiced

whoami

echo "Hello Linux"

A small independent practice example:

echo "Cybersecurity Lab"

Then:

whoami

This helped reinforce two fundamental ideas:

whoami
   ↓
Find identity

echo
   ↓
Produce output

These commands look basic, but they are building blocks for much more advanced Linux workflows.

Task 3 — Finding Your Way Around

The next task introduces filesystem navigation.

Instead of using a graphical file explorer, Linux lets us move around directories entirely from the terminal.

Four commands form the foundation:

ls
cd
cat
pwd

pwd — Where Am I?

pwd stands for:

Print Working Directory

Run:

pwd

It returns the full path of the directory I am currently inside.

Example:

/home/user

This is especially useful when I have moved through several directories and lose track of my current location.

My mental shortcut:

pwd
 =
Where am I?

ls — What Is Here?

To display the contents of the current directory:

ls

It may show:

Documents
Downloads
Pictures
notes.txt

So:

pwd
 ↓
Where am I?

ls
 ↓
What is here?

These two commands naturally work together.

More Detailed Listing

A commonly useful variation is:

ls -l

which displays more details about each file.

Another useful command is:

ls -la

which also includes hidden files.

Files beginning with:

.

are normally hidden from a basic ls listing.

This becomes especially useful later when looking for:

Configuration files
Shell history
Application settings
SSH files

cd — Change Directory

To enter another directory:

cd Documents

Then:

pwd

might show:

/home/user/Documents

To move back one directory:

cd ..

To return to the current user's home directory:

cd ~

or simply:

cd

Understanding Linux Paths

Linux uses:

/

as the root of the filesystem.

Conceptually:

/
├── home
│   └── user
├── etc
├── var
├── tmp
├── usr
└── root

A full path might be:

/home/user/Documents

Absolute vs Relative Paths

Suppose I am currently in:

/home/user

I could enter Documents using a relative path:

cd Documents

or using the absolute path:

cd /home/user/Documents

So:

Relative Path
=
Based on current location

while:

Absolute Path
=
Starts from /

cat — Read a File

To display the contents of a text file:

cat notes.txt

For example:

echo "Linux practice" > notes.txt
cat notes.txt

Output:

Linux practice

cat is extremely common during:

System enumeration
Log review
Configuration inspection
CTFs
Server administration

🛠️ Hands-On / Commands — Task 3

Commands Practiced

pwd

ls

cd <directory>

cd ..

cat <file>

A safe practice workflow:

pwd

ls

mkdir linux-practice

cd linux-practice

echo "My Linux notes" > notes.txt

ls

cat notes.txt

cd ..

This recreates the navigation workflow independently without revealing any TryHackMe challenge-file content.

Task 4 — Let the Machine Do the Searching

Real Linux systems can contain:

Thousands of directories

Millions of files

Huge log files

Large configuration trees

Searching manually would be extremely inefficient.

Linux gives us commands to do the searching for us.

Two especially important commands are:

find
grep

The distinction is:

find
 ↓
Search for files/directories

grep
 ↓
Search inside text

find — Search for Files

Suppose I need to locate:

notes.txt

Instead of manually browsing every directory, I can use:

find . -name "notes.txt"

Here:

.

means:

Start searching from the current directory

and:

-name

tells find to match the filename.

Searching From a Specific Directory

For example:

find /home -name "notes.txt"

means:

Search inside /home
for a file named notes.txt

Wildcards With find

Suppose I want every .txt file:

find . -name "*.txt"

The wildcard:

*

can represent any matching sequence of characters.

grep — Search Inside Files

Suppose I have a log containing hundreds of lines.

Instead of:

cat server.log

and manually reading everything, I can search for a term:

grep "failed" server.log

This returns only lines containing:

failed

Case-Insensitive Search

A useful option is:

grep -i "error" server.log

The:

-i

makes the search case-insensitive.

So it can match:

error
ERROR
Error

Why grep Matters in Cybersecurity

Security analysts regularly work with:

Authentication logs
Web server logs
Firewall logs
Application logs
Malware output
Large text datasets

Imagine a log has:

50,000 lines

and I need to locate activity involving an IP.

Instead of reading line by line:

grep "192.0.2.25" access.log

can instantly isolate relevant entries.

Combining find and grep

Later, these concepts can be combined.

For example:

find . -name "*.log"

locates log files.

Then:

grep "failed" example.log

searches inside one.

This gives me a reusable investigation pattern:

Locate file
    ↓
Inspect content
    ↓
Search interesting text

🛠️ Hands-On / Commands — Task 4

Commands Practiced

find . -name "filename.txt"

find . -name "*.txt"

grep "keyword" file.txt

grep -i "keyword" file.txt

Independent example:

echo "Successful login" > demo.log
echo "Failed login" >> demo.log
echo "Successful logout" >> demo.log

Now:

grep "Failed" demo.log

returns only the matching event.

That demonstrates the actual methodology without exposing the TryHackMe flag stored in its practice log.

Task 5 — Shell Operators (Combining Commands)

This task was where the Linux terminal started becoming much more powerful.

Instead of executing only one command at a time, shell operators allow commands to be:

Combined
Sequenced
Run in background
Redirected into files
Appended to files

The room introduces four important operators:

& — Run in the Background

A command normally occupies the terminal until it finishes.

For example:

some-command

Using:

some-command &

allows the process to run in the background while returning control of the shell.

Conceptually:

Command
   ↓
Background
   ↓
Terminal available again

This becomes useful for longer-running operations.

&& — Chain Commands

The operator:

&&

lets us execute one command after another when the first succeeds.

For example:

mkdir practice && cd practice

This means:

Create directory
      ↓
Success?
      ↓
Enter directory

This can make multi-step terminal workflows much faster.

> — Redirect Output

Normally:

echo "hello"

prints to the screen.

Using:

echo "hello" > message.txt

redirects the output into a file.

Then:

cat message.txt

shows:

hello

Important: > Overwrites

Suppose:

echo "first" > notes.txt

Then:

echo "second" > notes.txt

The previous contents are replaced.

The file now contains:

second

So:

>
=
Write / overwrite

>> — Append Output

Suppose I want to preserve what is already inside the file.

Use:

echo "first" > notes.txt
echo "second" >> notes.txt

Now:

cat notes.txt

shows:

first
second

Therefore:

>>
=
Append

This difference is extremely important when working with logs or notes.

Why Redirection Matters in Cybersecurity

Suppose I run:

whoami

and want to save the output.

Instead of manually copying it:

whoami > identity.txt

Or suppose I want to save enumeration results:

find /home -name "*.txt" > files-found.txt

This enables:

Command
   ↓
Useful output
   ↓
Store in file
   ↓
Review later

That is much more scalable than copying text by hand.

Combining Multiple Ideas

Now the commands from earlier tasks can work together.

Example:

mkdir investigation && cd investigation

Then:

echo "Starting investigation" > notes.txt

Then:

whoami >> notes.txt

Then:

cat notes.txt

This combines:

Directory creation
+
Navigation
+
Output
+
Redirection
+
Appending

into one practical workflow.

🛠️ Hands-On / Commands — Task 5

Operators Practiced

&
&&
>
>>

Independent practice:

mkdir shell-practice && cd shell-practice

echo "Linux Fundamentals" > notes.txt

echo "Shell Operators" >> notes.txt

cat notes.txt

Output:

Linux Fundamentals
Shell Operators

This demonstrates the same shell concepts without revealing the room's challenge submissions.

Complete Linux Fundamentals Pt1 Workflow

By the end of the room, the commands started connecting naturally:

                    LINUX TERMINAL
                          |
                          v
                       whoami
                          |
                          v
                         echo
                          |
                          v
                    FILESYSTEM
                          |
              ┌───────────┼───────────┐
              |           |           |
             pwd         ls          cd
                                      |
                                      v
                                     cat
                                      |
                                      v
                                  SEARCHING
                                /           \
                              find          grep
                                \           /
                                 \         /
                                  v       v
                              SHELL OPERATORS
                          &    &&    >    >>

Command Cheat Sheet

My Basic Linux Investigation Workflow

If I access an unfamiliar Linux system in an authorized environment, these basic commands already let me answer useful questions.

whoami

Who am I?

pwd

Where am I?

ls -la

What is here?

cat <file>

What does this file contain?

find . -name "<filename>"

Where is this file?

grep "<keyword>" <file>

Where does this text appear?

That gives a simple investigation sequence:

IDENTITY
   ↓
LOCATION
   ↓
FILES
   ↓
CONTENT
   ↓
SEARCH

Key Lessons Learned

1. Linux CLI Is a Core Cybersecurity Skill

Many security tools expect us to be comfortable working from a terminal.

Learning Linux is therefore not separate from cybersecurity.

It is part of the foundation.

2. Always Know Who You Are

whoami

may be one of the simplest commands in Linux, but the result determines what permissions we have.

Identity
   ↓
Privileges
   ↓
Available Actions

3. Navigation Becomes Fast With Four Commands

pwd
ls
cd
cat

are enough to begin exploring almost any Linux filesystem.

4. Searching Beats Manual Browsing

Instead of opening hundreds of files:

find
+
grep

can rapidly locate useful information.

This is particularly important when dealing with large logs.

5. Redirection Makes the Shell Much More Powerful

Without redirection:

Command
   ↓
Output on screen

With redirection:

Command
   ↓
Output
   ↓
File
   ↓
Reuse later

This is the beginning of automation.

6. > and >> Are Not the Same

This is worth remembering:

>
=
Overwrite

while:

>>
=
Append

Accidentally using > on an important file could destroy its existing contents.

7. Commands Become Powerful When Combined

The real strength of Linux is not knowing one command.

It is being able to combine small commands into workflows.

For example:

mkdir investigation && cd investigation

or:

echo "New finding" >> notes.txt

Linux tools are designed to work together.

My Final Mental Model

                        LINUX
                          |
                       TERMINAL
                          |
          ┌───────────────┼───────────────┐
          |               |               |
       IDENTITY        NAVIGATION       OUTPUT
          |               |               |
       whoami          pwd / ls          echo
                          |
                          cd
                          |
                          cat
                          |
                       SEARCH
                     /        \
                  find        grep
                     \        /
                      \      /
                       SHELL
                     OPERATORS
                 &   &&   >   >>

Ethical Learning Note

This article is a learning guide rather than an answer dump.

I included:

✅ Linux fundamentals
✅ Command syntax
✅ Independent examples
✅ Filesystem navigation
✅ Searching methodology
✅ Shell operators
✅ Cybersecurity relevance

while intentionally excluding:

❌ TryHackMe flags
❌ Challenge-file contents
❌ Folder-answer submissions
❌ access.log flag
❌ Direct task-question answers

The goal is to document what I learned while leaving the actual TryHackMe exercises for other learners to solve themselves.

Resources

• 🌐 TryHackMe Room: Linux Fundamentals (Pt1)

• 👨‍💻 TryHackMe Profile: sunnysharma11200

• 💻 GitHub Repository: tryhackme-writeups

• ✍️ Hashnode Blog: cybersecurity-learning.hashnode.dev

Connect with Me

• TryHackMe: sunnysharma11200

• GitHub: SunnySharma04

• Hashnode: cybersecurity-learning

• LinkedIn: Sunny Sharma

Happy Learning! 🚀

Spoiler-Free Learning Guide: This article contains no TryHackMe flags, dashboard-specific answers, usernames, phishing answers, or escalation-task solutions. It focuses on the reporting, escalation, and communication methodology I learned while completing the room.

Introduction

After completing SOC L1 Alert Triage, I moved to the next part of the SOC workflow:

Alert Reporting

Finding a suspicious alert is only part of an L1 analyst's job.

Once an alert has been investigated, several questions still remain:

How should I document what happened?

When should I escalate the alert?

Who should receive the escalation?

What information does L2 need?

How should I communicate during a critical incident?

The SOC L1 Alert Reporting room focuses on three important operational skills:

Reporting
     ↓
Escalation
     ↓
Communication

These skills allow an L1 analyst to transfer useful investigation context to senior analysts instead of simply marking an alert as a True Positive and moving on. TryHackMe specifically frames the room around proper alert reporting, escalation methods, and SOC communication. (TryHackMe)

The room follows this structure:

Task 1 — Introduction
Task 2 — Alert Funnel
Task 3 — Reporting Guide
Task 4 — Escalation Guide
Task 5 — SOC Communication
Task 6 — Conclusion

Task 1 — Introduction

The first task connects directly with the previous Alert Triage room.

During triage, an L1 analyst may reach several outcomes.

For example:

Clearly Benign
      ↓
False Positive
      ↓
Close Alert

But sometimes:

Suspicious Activity
      ↓
True Positive
      ↓
More Investigation Needed

Or:

Analyst Is Unsure
      ↓
Need Senior Support

Or even:

Confirmed Major Attack
      ↓
Immediate Remediation Needed

This is where reporting, escalation, and communication become necessary.

Reporting

Reporting means formally documenting:

What happened

What I investigated

What evidence I found

What conclusion I reached

Why I reached that conclusion

A good report allows someone who did not perform the original investigation to understand the alert.

Escalation

Escalation means passing an alert to someone with:

More experience
More authority
More technical capability
or
Responsibility for remediation

For an L1 analyst, that is commonly an:

L2 Analyst

Communication

Not every investigation can be completed using SIEM logs alone.

Sometimes the SOC may need information from:

IT
HR
System Owners
Management
Other Security Teams

Communication therefore becomes part of the investigation itself.

TryHackMe presents all three as core L1 capabilities, especially when the analyst is uncertain or when a real attack requires action. (TryHackMe)

🛠️ Hands-On / Workflow — Task 1

Tools Used

TryHackMe SOC Dashboard
Alert Queue
Alert Details
Analyst Comments
Assignment Workflow

My mental model became:

TRIAGE
   ↓
VERDICT
   ↓
REPORT
   ↓
ESCALATE if required
   ↓
COMMUNICATE

Task 2 — Alert Funnel

This task explains what happens to alerts after initial triage.

Not every alert travels through the entire SOC.

Instead, alerts move through a kind of:

Alert Funnel

Imagine L1 receives:

100 Alerts

Many may turn out to be:

False Positives

Some may be real but simple enough for L1 to handle.

A smaller group may need:

L2 Investigation

And only a very small number may become major incidents requiring:

DFIR
Incident Response
Management involvement

TryHackMe illustrates this as a funnel where L1 handles many alerts, escalates a much smaller set of True Positives, and only a few serious incidents require deeper response. (TryHackMe)

Why This Funnel Matters

A SOC cannot escalate every alert.

If L1 forwarded everything:

Every alert
    ↓
L2
    ↓
Overload
    ↓
Important incidents delayed

Instead:

L1
 ↓
Filters noise
 ↓
Validates alerts
 ↓
Adds context
 ↓
Escalates only when needed

This makes the SOC more efficient.

Alert Reporting

Before closing or escalating an alert, an analyst may need to document the investigation.

A good report should let another analyst understand:

What happened

Who was involved

Which systems were involved

What evidence supports the verdict

What should happen next

Alert Escalation

If the activity requires more investigation or remediation:

L1
 ↓
Alert Report
 ↓
Escalation
 ↓
L2

The L2 analyst should not need to restart the entire investigation from zero.

That is why good reporting directly improves escalation.

Communication

Sometimes the SOC needs external information.

Example:

Alert:
User gained administrator privileges

SOC question:
Was this approved?

Possible contact:
IT Team

Or:

Alert:
Suspicious new employee activity

Question:
Is this user's employment status correct?

Possible contact:
HR

So SOC analysis is not isolated technical work.

🛠️ Hands-On / Workflow — Task 2

Concepts Practiced

Alert funnel
L1 responsibilities
L2 responsibilities
DFIR escalation
Reporting
Communication

My simplified flow:

ALERT
   ↓
L1 TRIAGE
   ↓
 ┌───────────────┐
 │               │
FP / Simple     Complex TP
 │               │
Close         Report
                 ↓
              Escalate
                 ↓
                L2
                 ↓
           Major Incident?
                 ↓
               DFIR

Task 3 — Reporting Guide

This was one of the most important tasks in the room.

A verdict such as:

True Positive

is not enough by itself.

The next analyst needs to know:

Why is it a True Positive?

That requires a useful report.

TryHackMe recommends structuring reports using the:

Five Ws

Who
What
When
Where
Why

(TryHackMe)

Why Write Reports?

1. Provide Context for Escalation

Suppose L2 receives:

Verdict: True Positive

That tells them almost nothing.

Compare it with:

Affected user identified

Suspicious email received

Link accessed

Related endpoint activity found

Activity judged malicious because...

Now L2 has something useful to continue from.

2. Preserve Investigation Findings

Raw logs may not always remain available forever.

Alert records and investigation notes can provide long-term context.

That makes the report useful later during:

Incident Response
Audit
Threat Hunting
Repeat investigations
Case review

TryHackMe specifically notes that reports preserve context beyond the retention period of some raw logs. (TryHackMe)

3. Improve Analyst Thinking

Writing forces me to answer:

Do I actually understand this alert?

If I cannot explain:

What happened
and
Why I chose my verdict

my investigation may not be complete.

The Five Ws

Who?

Identify the affected person or account.

Examples:

Which user logged in?

Who downloaded the file?

Who executed the process?

Who received the suspicious email?

What?

Describe exactly what happened.

Avoid:

"Something suspicious occurred."

Prefer:

"A suspicious attachment was received and subsequently opened."

When?

Include useful timestamps.

For example:

Alert generated: 14:35

Suspicious event began: 14:31

Follow-up activity: 14:33

Timing helps reconstruct the sequence.

Where?

Identify the systems or infrastructure involved.

Examples:

Hostname
Source IP
Destination IP
Domain
Website
Mailbox
Cloud tenant

Why?

This is arguably the most important part.

The report should explain:

Why did I choose this verdict?

For example:

The sender domain was unrelated to the legitimate organization,
the message contained a suspicious external link,
and follow-up endpoint activity was observed.

The report should contain reasoning rather than merely repeating alert fields.

Weak vs Strong Report

Weak

Suspicious email detected.
True Positive.

Better

Who:
Corporate user received the email.

What:
The message contained a suspicious link impersonating a trusted service.

When:
Activity occurred during the alert window.

Where:
Email originated from an external sender and targeted the corporate mailbox.

Why:
Sender identity and message behavior were inconsistent with expected activity.
The alert is assessed as a True Positive and requires escalation.

The exact evidence obviously changes by investigation.

🛠️ Hands-On / Workflow — Task 3

Tools Used

SOC Dashboard
Alert Details
Analyst Comment
Five Ws
Related Events

My report-writing workflow became:

INVESTIGATE
     ↓
Collect evidence
     ↓
WHO?
     ↓
WHAT?
     ↓
WHEN?
     ↓
WHERE?
     ↓
WHY?
     ↓
Write concise report

I intentionally excluded the room's leaked-user answer, phishing sender, and report flag.

Task 4 — Escalation Guide

Once the investigation and report are complete, the next question is:

Should this alert be escalated?

Not every True Positive necessarily requires the same response.

TryHackMe recommends escalation when deeper investigation, remediation, external communication, or senior assistance is needed. (TryHackMe)

When Should L1 Escalate?

1. Major Cyberattack

If the activity suggests:

Significant compromise
Lateral movement
Credential theft
Data exfiltration
Widespread malware

the incident likely requires deeper investigation.

2. Remediation Is Required

Examples:

Host isolation
Malware removal
Password reset
Account disablement
Blocking infrastructure

L1 may not have the authority or responsibility to perform all of these actions.

3. External Communication Is Required

The incident may involve:

Customers
Partners
Management
Legal
Law enforcement

Those situations normally require escalation.

4. I Do Not Understand the Alert

This point is important.

Escalation is not only for huge incidents.

If an L1 analyst genuinely cannot determine what an alert means:

Unclear activity
     ↓
Ask L2

is safer than:

Unclear activity
     ↓
Guess
     ↓
Close

TryHackMe explicitly encourages L1 analysts to request senior support when something is unclear rather than blindly closing an alert. (TryHackMe)

Escalation Workflow

A simplified workflow is:

Alert
  ↓
Assign myself
  ↓
In Progress
  ↓
Investigate
  ↓
Write report
  ↓
Set intermediate verdict
  ↓
Escalation required?
        ↓
       Yes
        ↓
Reassign to L2
  ↓
Notify L2

The quality of the report matters because L2 will use it as their starting point.

What Happens After Escalation?

L2 may:

Validate L1 findings

Perform deeper log analysis

Perform remediation

Contact other departments

Start Incident Response

Request DFIR support

L1 therefore contributes to a larger response process.

🛠️ Hands-On / Workflow — Task 4

Tools Used

SOC Dashboard
Alert assignment
Verdict selection
Analyst comments
L2 escalation

My escalation checklist:

1. Complete initial investigation

2. Write the report

3. Set the most appropriate current verdict

4. Confirm escalation is necessary

5. Assign to the L2 on shift

6. Notify them according to SOC procedure

I intentionally excluded the L2 analyst's name and escalation flags from the room.

Task 5 — SOC Communication

This task showed that technical investigation alone is not enough.

A SOC analyst also needs to know:

Who should I contact?

How should I contact them?

When should I escalate communication?

What if normal procedures fail?

TryHackMe walks through several realistic communication problems that analysts may encounter. (TryHackMe)

Scenario 1 — Critical Alert but L2 Is Unavailable

Suppose:

Critical confirmed threat
      +
L2 not responding

Waiting indefinitely is not appropriate.

A communication chain might become:

Try L2
   ↓
Try L3 / senior analyst
   ↓
Contact SOC manager

The key lesson:

Know the emergency escalation path before the emergency happens.

Scenario 2 — User's Communication Account Is Compromised

Suppose the alert indicates that someone's:

Teams
Slack
or
Corporate chat

account may have been compromised.

It would be a mistake to message the potentially compromised account:

"Did you perform this login?"

because the attacker could be the one responding.

A safer approach is an alternative verified channel:

Phone
Approved secondary channel
In-person verification

Scenario 3 — Sudden Alert Surge

Suppose many alerts arrive simultaneously:

Low
Medium
High
Critical
Critical
Medium
...

The solution is not to panic or work randomly.

Use the triage process:

Filter
   ↓
Prioritise
   ↓
Investigate highest risk

but also inform L2 about the unusual volume.

A sudden surge itself may indicate:

Large-scale attack
Detection problem
Infrastructure issue

Scenario 4 — Realising an Earlier Alert Was Misclassified

Suppose I closed an alert yesterday.

Later, new evidence makes me think:

That may have been malicious.

The correct response is not:

Ignore it because it is already closed.

Instead:

Immediately notify L2
      ↓
Explain concern
      ↓
Reopen / investigate if required

Attackers can remain inside an environment for an extended period without obvious impact, so correcting a previous decision quickly matters. (TryHackMe)

Scenario 5 — SIEM Data Is Broken

Suppose:

Fields are not parsed

Search is failing

Logs appear incomplete

The wrong response is:

Skip the alert.

Instead:

Investigate available evidence
       ↓
Document the limitation
       ↓
Notify L2 or SOC engineer

Tool failure does not automatically make the alert unimportant.

Crisis Communication

A mature SOC should ideally have documented:

Emergency contacts
Escalation hierarchy
Communication channels
Roles and responsibilities

These procedures reduce confusion during a real incident.

🛠️ Hands-On / Methodology — Task 5

Concepts Practiced

Crisis communication
Emergency escalation
Alternative contact channels
Alert surges
Misclassification reporting
Tooling issues

My decision model became:

Problem occurs
     ↓
Can normal SOC process handle it?
       /          \
     Yes           No
      |             |
 Continue       Emergency escalation
                    ↓
             Correct contact path

Task 6 — Conclusion

By the end of this room, I understood that an L1 analyst's responsibility does not end with:

True Positive

A complete workflow looks more like:

ALERT
  ↓
TRIAGE
  ↓
VERDICT
  ↓
REPORT
  ↓
ESCALATE
  ↓
COMMUNICATE
  ↓
REMEDIATION / FURTHER INVESTIGATION

TryHackMe concludes the room by emphasizing that reporting preserves investigation context, escalation gets threats to the right level of analyst, and communication keeps the wider response coordinated. (TryHackMe)

Alert Report Cheat Sheet

When Should I Escalate?

Major attack?
      ↓ YES

Remediation required?
      ↓ YES

External communication required?
      ↓ YES

I don't understand the alert?
      ↓ YES

           ESCALATE

L1 → L2 Handoff

A poor handoff:

"Looks malicious. Please investigate."

A better handoff:

Affected Entity
      +
Timeline
      +
Suspicious Activity
      +
Evidence
      +
Reasoning
      +
Current Verdict
      +
Recommended Next Step

This reduces duplicated investigation effort.

Key Lessons Learned

1. A Verdict Without Reasoning Is Not Enough

True Positive

is a classification.

It is not an investigation report.

A useful report explains:

Why?

2. The Five Ws Provide a Simple Reporting Framework

WHO
WHAT
WHEN
WHERE
WHY

help ensure I do not leave out critical context.

3. Reporting Helps the Next Analyst

A strong report means L2 can continue from:

My investigation

instead of restarting from:

Raw logs

4. Escalation Is Not Failure

Asking L2 for help when something is unclear is better than making an unsupported decision.

Unsure
   ↓
Ask

is preferable to:

Unsure
   ↓
Guess

5. Communication Is Part of Incident Response

SOC analysts do not work in isolation.

An investigation may involve:

IT
HR
Management
Legal
PR
Customers
Other Security Teams

Technical findings must therefore be communicated clearly.

6. Never Use a Compromised Channel for Verification

If a user's chat account may be compromised:

Do not verify through the same account.

Use another trusted communication method.

7. Correct Mistakes Quickly

If later evidence shows that I may have misclassified an alert:

Report it immediately.

Hiding or ignoring a mistake creates more security risk than acknowledging it.

My Final Mental Model

                     SOC ALERT
                         |
                         v
                       TRIAGE
                         |
                         v
                      VERDICT
                         |
                         v
                       REPORT
                         |
              ┌──────────┴──────────┐
              |                     |
        No Escalation          Escalation
              |                     |
              v                     v
            CLOSE                  L2
                                    |
                                    v
                             DEEPER ANALYSIS
                                    |
                 ┌──────────────────┼─────────────────┐
                 |                  |                 |
            Remediation       Communication        DFIR
                 |                  |                 |
                 └──────────────────┼─────────────────┘
                                    |
                                    v
                              INCIDENT HANDLED

Ethical Learning Note

This article is a learning guide rather than an answer dump.

I included:

✅ Reporting methodology
✅ Five Ws framework
✅ Escalation workflow
✅ L1 → L2 handoff process
✅ Communication scenarios
✅ Practical SOC reasoning

while intentionally excluding:

❌ TryHackMe flags
❌ Leaked-user answer
❌ Phishing sender answer
❌ L2 analyst name
❌ Dashboard verdict answers
❌ Escalation flags
❌ Lab-specific submissions

The goal is to document the SOC methodology while leaving the actual dashboard exercises for other learners to solve themselves.

Resources

• 🌐 TryHackMe Room: SOC L1 Alert Triage

• 👨‍💻 TryHackMe Profile: sunnysharma11200

• 💻 GitHub Repository: tryhackme-writeups

• ✍️ Hashnode Blog: cybersecurity-learning.hashnode.dev

Connect with Me

• TryHackMe: sunnysharma11200

• GitHub: SunnySharma04

• Hashnode: cybersecurity-learning

• LinkedIn: Sunny Sharma

Happy Learning! 🚀

Spoiler-Free Learning Guide: This article contains no TryHackMe flags, dashboard-specific answers, usernames, alert-answer submissions, or final verdict solutions. It focuses on the SOC methodology, alert properties, prioritisation, triage workflow, and practical analyst mindset I learned while completing the room.

Introduction

After learning about SIEM, logs, detection rules, and alert generation, I moved on to one of the most important day-to-day responsibilities of a SOC Level 1 analyst:

Alert Triage

A SIEM may generate many alerts during a shift.

The analyst's job is not simply to open each alert and click:

True Positive

or:

False Positive

Instead, there is a structured process:

Alert Appears
      ↓
Understand the Alert
      ↓
Prioritise It
      ↓
Take Ownership
      ↓
Investigate Context
      ↓
Determine Verdict
      ↓
Document Findings
      ↓
Close / Escalate

The SOC L1 Alert Triage room introduces the alert lifecycle from event generation to final resolution. It also provides a simulated SOC dashboard where alerts can be assigned, investigated, classified, and closed. (TryHackMe)

The room follows this structure:

Task 1 — Introduction
Task 2 — Events and Alerts
Task 3 — Alert Properties
Task 4 — Alert Prioritisation
Task 5 — Alert Triage
Task 6 — Conclusion

Task 1 — Introduction

The first task introduces the role alerts play inside a Security Operations Center.

A SOC may receive information from technologies such as:

SIEM
EDR
NDR
SOAR
Ticketing Platforms

These systems can produce alerts when activity matches suspicious conditions.

The important lesson is:

An alert is not automatically a confirmed cyberattack.

An alert means that something happened which deserves an analyst's attention.

Role of a SOC L1 Analyst

SOC L1 analysts are usually the first analysts to review new detections.

A simplified workflow is:

Detection
   ↓
SOC L1
   ↓
Initial Triage
   ↓
False Positive?
      └── Close

True / Suspicious?
      └── Escalate

More advanced investigations may then be handled by:

SOC L2
SOC L3
Incident Response
DFIR

TryHackMe describes L1 analysts as the first line responsible for reviewing alerts and identifying which ones require deeper investigation. (TryHackMe)

Why Alert Triage Matters

Imagine a SOC receives:

1,000,000 raw events

during a day.

An analyst cannot manually inspect every log line.

Security tools therefore apply detection logic and reduce this enormous volume into:

A smaller set of alerts

that deserve attention.

This creates a funnel:

Millions of Events
       ↓
Detection Rules
       ↓
Hundreds of Alerts
       ↓
SOC Triage
       ↓
Few Real Incidents

This is what makes alert triage operationally important.

🛠️ Hands-On / Workflow — Task 1

Tools Used

TryHackMe SOC Dashboard
SIEM concepts
SOC alert queue
Alert lifecycle

My first action in the lab was simply getting familiar with the SOC dashboard.

Instead of immediately opening alerts randomly, I looked for:

Alert columns
Severity indicators
Alert status
Alert names
Assigned analyst
Verdict fields

My first mental model became:

Dashboard
   ↓
Queue
   ↓
Alert
   ↓
Analyst
   ↓
Investigation

Task 2 — Events and Alerts

This task clarified an important distinction:

Event ≠ Alert

A security event is simply something that happened.

Examples include:

User logged in
Process started
File downloaded
Network connection opened
Email received
USB device inserted

These events are recorded by systems such as:

Operating Systems
Firewalls
Cloud Services
Applications
EDR
Network Devices

From Event to Alert

The general flow is:

Activity Occurs
      ↓
System Records Event
      ↓
Log Generated
      ↓
Log Sent to SIEM / EDR
      ↓
Detection Logic Evaluates Event
      ↓
Suspicious Condition Matches
      ↓
Alert Generated

TryHackMe defines an alert as a notification created by a security solution when a particular event or sequence of events matches suspicious logic. This helps analysts focus on notable activity instead of manually reviewing huge volumes of normal logs. (TryHackMe)

Example

Suppose a user enters the wrong password once:

Failed Login

That is an event.

Usually, it is not interesting.

But suppose we see:

09:01 → Failed login
09:01 → Failed login
09:02 → Failed login
09:02 → Failed login
09:03 → Successful login

A detection rule might recognize:

Repeated failures
       +
Successful authentication

and create:

Possible Brute-Force Alert

So:

Event
   ↓
Detection Logic
   ↓
Alert

Alert Management Platforms

Alerts may appear in several types of systems.

SIEM

Examples include platforms such as:

Splunk
Elastic
Microsoft Sentinel

SIEM platforms centralize security logs and provide detection and alert-management capabilities.

EDR / NDR

These tools focus on:

Endpoint activity
or
Network activity

and commonly have their own alert dashboards.

SOAR

SOAR platforms can combine alerts from multiple sources and automate parts of the response process.

ITSM / Ticketing

Some organizations may also convert security alerts into cases or tickets using tools such as ticket-management platforms. TryHackMe discusses these as common ways SOC teams manage alert queues. (TryHackMe)

Who Handles Alerts?

Different SOC roles interact with alerts differently.

SOC L1
   ↓
Initial alert triage

SOC L2
   ↓
Deeper investigation

SOC Engineers
   ↓
Create / improve detections

SOC Manager
   ↓
Monitor triage quality & efficiency

This made it clear that SOC work is not just about technology.

It is a workflow involving people, processes, and tools.

🛠️ Hands-On / Workflow — Task 2

Tools Used

SOC Dashboard
Alert Queue
Alert statuses
SIEM concepts

In the simulated dashboard, I inspected the existing alerts and observed how they are organized.

Instead of documenting the room's alert names or counts, my methodology was:

Open dashboard
      ↓
Review queue
      ↓
Identify new alerts
      ↓
Observe status
      ↓
Observe severity
      ↓
Observe assignment

This made the difference between an event and an actionable alert much clearer.

Task 3 — Alert Properties

The next task focuses on reading an alert properly.

Before investigating anything, I need to understand the information already provided by the detection system.

TryHackMe introduces several common alert properties that appear across SIEM and SOC platforms. (TryHackMe)

1. Alert Time

This tells us when the alert was created.

For example:

Event Time : 10:32
Alert Time : 10:35

These timestamps may differ because:

Event happens
     ↓
Log generated
     ↓
Log ingested
     ↓
Rule processes log
     ↓
Alert created

That delay is normal.

2. Alert Name

The alert name gives a quick summary of the detection.

Examples might include:

Unusual Login Location
Potential Malware Execution
Suspicious PowerShell
Potential Data Exfiltration
RDP Brute Force

But the name alone is not enough to determine whether something is malicious.

It tells me:

What the detection rule thinks might have happened

not necessarily:

What definitely happened

3. Alert Severity

Severity communicates urgency.

A typical scale might be:

🟢 Low
🟡 Medium
🟠 High
🔴 Critical

Severity is usually initially defined by the detection engineers.

It helps answer:

Which alert deserves attention first?

But severity is not the same as verdict.

A critical alert can still turn out to be benign.

4. Alert Status

Status tells us where the alert is in the workflow.

Typical examples:

New
    ↓
In Progress
    ↓
Closed

This prevents several analysts from accidentally investigating the same alert.

5. Alert Verdict

The verdict answers:

Was this actually malicious?

Common classifications include:

True Positive
False Positive

True Positive

Alert triggered
+
Real suspicious activity exists

False Positive

Alert triggered
+
Activity is legitimate

6. Alert Assignee

The assignee is the analyst responsible for the alert.

Conceptually:

New Alert
   ↓
Analyst Assigns Self
   ↓
Analyst Owns Investigation

Ownership is important because it prevents confusion inside the SOC.

7. Alert Description

A useful alert description may explain:

What detection logic triggered

Why the activity might be suspicious

How the analyst should investigate

Reading this before starting the investigation can save a lot of time.

8. Alert Fields

Fields provide the actual values associated with the event.

Examples include:

Hostname
Username
IP Address
Command Line
Process Name
File Name
Domain
URL
Timestamp

These fields often become the starting points of the investigation.

My Alert Reading Checklist

Before investigating, I now ask:

When did it happen?

What alert triggered?

How severe is it?

Who owns the alert?

Which user is affected?

Which host is affected?

Which IPs are involved?

Which process / command appears?

What does the description say?

🛠️ Hands-On / Workflow — Task 3

Tools Used

SOC Dashboard
Alert Detail View
Alert fields
Alert verdicts
Alert metadata

My practical workflow was:

Open alert
   ↓
Read name
   ↓
Check severity
   ↓
Check status
   ↓
Check verdict if already handled
   ↓
Identify user / host / IP
   ↓
Read description

I intentionally excluded the user and verdict requested by the room questions.

Task 4 — Alert Prioritisation

A SOC analyst may have multiple unreviewed alerts at once.

The question becomes:

Which alert should I investigate first?

That process is:

Alert Prioritisation

TryHackMe presents a simple three-step approach: filter out alerts already being handled, prioritize higher severity first, and then work from the oldest alert toward newer ones. (TryHackMe)

Step 1 — Filter the Queue

First, I should only consider alerts that actually require my attention.

That means avoiding alerts that are already:

Assigned
In Progress
Resolved
Closed

The goal is:

Unassigned
+
Unresolved
+
New

alerts.

Step 2 — Sort by Severity

A simple priority order is:

Critical
   ↓
High
   ↓
Medium
   ↓
Low

Why?

Because higher-severity detections are generally designed to represent:

Higher confidence
or
Higher potential impact

Step 3 — Consider Alert Age

Suppose two alerts have the same severity.

Which one should I investigate first?

Usually:

Older Alert

because an attacker connected to an older compromise may have had more time to act.

Conceptually:

Critical — 20 minutes old
        ↓
Critical — 3 minutes old
        ↓
High — 30 minutes old
        ↓
Medium
        ↓
Low

Why Time Matters

Imagine two real intrusions.

Attack A

Started 40 minutes ago

Attack B

Started 2 minutes ago

If both are equally serious, Attack A may already have progressed through:

Initial Access
      ↓
Discovery
      ↓
Credential Access
      ↓
Lateral Movement

while Attack B may still be near the beginning.

That makes the older unresolved alert important.

Real SOC Prioritisation Is More Complex

In real environments, prioritisation may also consider:

Criticality of affected asset
VIP user involvement
Threat intelligence
Attack stage
Frequency
Business impact
Known active campaign

A later TryHackMe triage example similarly emphasizes severity, time, attack stage, and affected asset as useful dimensions for deciding what matters most. (TryHackMe)

🛠️ Hands-On / Workflow — Task 4

Tools Used

SOC Dashboard
Alert filtering
Severity
Timestamp
Assignment
Status management

My prioritisation process was:

1. Ignore alerts already being handled

2. Find highest severity

3. If tied, compare timestamps

4. Choose oldest unresolved one

5. Assign it to myself

6. Change status to In Progress

This was the first point where the simulated SOC dashboard started feeling like an actual analyst queue rather than just a learning interface.

Task 5 — Alert Triage

This was the core task of the room.

TryHackMe breaks alert triage into three broad stages:

Initial Actions
      ↓
Investigation
      ↓
Final Actions

(TryHackMe)

Stage 1 — Initial Actions

Before deeply investigating an alert, the analyst should formally take ownership.

That means:

Assign alert to yourself
       ↓
Change status to In Progress
       ↓
Read alert information

Why is this important?

Without ownership:

Analyst A investigates alert
        +
Analyst B investigates same alert
        =
Duplicated work

SOC processes exist partly to prevent this kind of confusion.

Stage 2 — Understand the Alert

Before searching through more logs, I should understand what the alert claims.

I ask:

Who is affected?

What happened?

When did it happen?

Where did it happen?

Which indicators are involved?

This connects closely with the 5 Ws used throughout SOC work:

Who
What
When
Where
Why

TryHackMe's SOC fundamentals material uses this same structure for alert triage and reporting. (TryHackMe)

Stage 3 — Identify the Affected Entity

Depending on the alert, the affected entity might be:

User
Hostname
IP Address
Cloud Account
Email Account
Website
Application
Network

For example:

Suspicious login
       ↓
User account

Malware execution
       ↓
Endpoint

Unusual network connection
       ↓
Host + IP

Phishing
       ↓
Email account

Understanding what is under threat helps narrow the investigation.

Stage 4 — Understand the Action

Next I ask:

What exactly triggered the alert?

Possible actions include:

Login
Process execution
File download
Email delivery
Command execution
Network connection
Credential attempt

The alert name may give an initial hint, but I need to inspect the underlying events.

Stage 5 — Review Surrounding Events

This was one of the most useful ideas from the room.

Never analyze a suspicious event in isolation.

Suppose an alert says:

Unusual Login

I would inspect activity shortly:

Before
and
After

the event.

Example:

14:01 → Login from unusual location
14:02 → MFA configuration changed
14:04 → Sensitive file accessed
14:06 → Large outbound transfer

The first event alone may be uncertain.

The sequence tells a much stronger story.

TryHackMe specifically recommends reviewing activity around the alert timestamp to find related suspicious behavior. (TryHackMe)

Stage 6 — Use Threat Intelligence When Needed

Some investigations involve indicators such as:

IP addresses
Domains
URLs
File hashes

Threat intelligence platforms can provide additional context.

For example:

Suspicious IP
     ↓
Check reputation / CTI
     ↓
Known malicious?
Associated campaign?
Previously observed?

But reputation alone should not automatically decide the verdict.

Context still matters.

Stage 7 — Determine the Verdict

After investigation, I decide:

True Positive
or
False Positive

True Positive

Example reasoning:

Suspicious alert
     +
Related malicious events
     +
Unexpected activity
     =
True Positive

False Positive

Example:

Alert triggered
     +
Activity confirmed legitimate
     =
False Positive

An important SOC lesson is:

Detection rule match ≠ confirmed incident.

Stage 8 — Document the Reasoning

Even if my verdict is correct, another analyst should be able to understand why.

A useful analyst comment might explain:

What happened

Which evidence was reviewed

Which entities were involved

Why the activity is malicious or benign

What action should happen next

This becomes especially important when escalating alerts to SOC L2.

Stage 9 — Close or Escalate

The final action depends on the investigation.

False Positive
      ↓
Document
      ↓
Close

or:

True Positive
      ↓
Document
      ↓
Escalate / Respond

A L1 analyst's job is generally initial validation, while deeper investigation and incident handling may move to higher SOC tiers. (TryHackMe)

🛠️ Hands-On / Workflow — Task 5

Tools Used

TryHackMe SOC Dashboard
SIEM event view
Alert metadata
Related logs
Verdict classification
Analyst comments
Status management

My repeatable workflow became:

ALERT ARRIVES
     ↓
PRIORITISE
     ↓
ASSIGN
     ↓
IN PROGRESS
     ↓
READ ALERT
     ↓
IDENTIFY USER / HOST / IP
     ↓
CHECK EVENT
     ↓
CHECK SURROUNDING EVENTS
     ↓
ADD CONTEXT
     ↓
TRUE OR FALSE POSITIVE
     ↓
DOCUMENT
     ↓
CLOSE / ESCALATE

I intentionally excluded the three room flags and the correct verdicts for the practical alerts.

Task 6 — Conclusion

By the end of the room, alert triage no longer looked like:

Open Alert
     ↓
Guess True / False

Instead, I now see it as a structured decision process:

                 ALERT
                   |
                   v
              PRIORITISE
                   |
                   v
                 CLAIM
                   |
                   v
              UNDERSTAND
                   |
                   v
              INVESTIGATE
                   |
        ┌──────────┴──────────┐
        |                     |
      BENIGN              MALICIOUS
        |                     |
        v                     v
 FALSE POSITIVE          TRUE POSITIVE
        |                     |
        v                     v
      CLOSE              ESCALATE

TryHackMe concludes this room by preparing learners for the next SOC workflow skills: better alert comments, case reporting, communication, and escalation. (TryHackMe)

Alert Triage Cheat Sheet

Important Alert Properties

Key Lessons Learned

1. Event and Alert Are Different

Event
=
Something happened

Alert
=
Security logic decided
the activity deserves attention

That distinction is fundamental.

2. Alert Severity Is Not the Verdict

A:

Critical Alert

does not automatically mean:

Confirmed Attack

Severity determines priority.

Investigation determines verdict.

3. Ownership Prevents Duplicate Work

Before investigation:

Assign
   ↓
In Progress

This simple workflow step is operationally important in a real SOC.

4. Prioritisation Matters

The queue should not be handled randomly.

A simple workflow is:

New unresolved alerts
      ↓
Highest severity
      ↓
Oldest first

This helps ensure serious attacks are not left waiting.

5. Context Is Everything

An isolated event may be harmless.

A sequence can reveal an attack.

Login
+
PowerShell
+
Credential access
+
Outbound connection

tells a very different story than:

Login

6. Alert ≠ Incident

This is probably my biggest takeaway.

Alert
     ↓
Investigation
     ↓
Verdict

An alert tells me where to start looking.

It does not give me the final answer.

7. L1 Triage Is About Efficient Validation

The L1 analyst does not necessarily perform full forensic analysis of every incident.

The goal is to determine:

Is this suspicious?

What evidence supports that?

Does someone senior need to investigate?

That makes triage both a technical and decision-making skill.

My Final Mental Model

                     SOC ALERT QUEUE
                           |
                           v
                       FILTER
                           |
                           v
                      PRIORITISE
                           |
                           v
                        ASSIGN
                           |
                           v
                     IN PROGRESS
                           |
                           v
                    READ ALERT DATA
                           |
            ┌──────────────┼──────────────┐
            |              |              |
          USER           HOST             IP
            |              |              |
            └──────────────┼──────────────┘
                           |
                           v
                 REVIEW RELATED EVENTS
                           |
                           v
                     BUILD CONTEXT
                           |
                    ┌──────┴──────┐
                    |             |
                  BENIGN       MALICIOUS
                    |             |
                    v             v
              FALSE POSITIVE  TRUE POSITIVE
                    |             |
                    v             v
                  CLOSE        ESCALATE

Ethical Learning Note

This article is a learning guide rather than an answer dump.

I included:

✅ Alert lifecycle
✅ SOC L1 methodology
✅ Alert properties
✅ Prioritisation workflow
✅ Investigation approach
✅ True/False Positive concepts
✅ Practical SOC workflow

while intentionally excluding:

❌ TryHackMe flags
❌ Dashboard alert counts
❌ Task-specific alert names
❌ User-answer values
❌ Practical alert verdicts
❌ Final triage submissions

The goal is to document the methodology while leaving the SOC dashboard exercises for other learners to investigate themselves.

✅ Room Completed

Platform : TryHackMe
Path     : SOC Level 1 → SOC Team Internals
Room     : SOC L1 Alert Triage
Duration : ~60 minutes
Progress : 100% ✅

This room made the SOC L1 workflow much more concrete for me.

Instead of seeing a SIEM alert as simply a warning message, I now think:

Alert
   ↓
Priority
   ↓
Ownership
   ↓
Investigation
   ↓
Evidence
   ↓
Verdict
   ↓
Action

Resources

• 🌐 TryHackMe Room: SOC L1 Alert Triage

• 👨‍💻 TryHackMe Profile: sunnysharma11200

• 💻 GitHub Repository: tryhackme-writeups

• ✍️ Hashnode Blog: cybersecurity-learning.hashnode.dev

Connect with Me

• TryHackMe: sunnysharma11200

• GitHub: SunnySharma04

• Hashnode: cybersecurity-learning

• LinkedIn: Sunny Sharma

Happy Learning! 🚀

Spoiler-Free Learning Guide: This article contains no TryHackMe flags, cracked passwords, task-specific module paths, vulnerability-answer submissions, or lab-specific values. It focuses on the methodology, tools, concepts, and safe command patterns I practiced while completing the room.

Introduction

After learning Windows fundamentals, command-line basics, networking, and defensive tools, I moved on to a more practical exploitation room:

Blue

The Blue room introduces a complete beginner-friendly Windows exploitation workflow.

Instead of only reading about vulnerabilities, the room takes us through several stages:

Reconnaissance
      ↓
Identify Vulnerability
      ↓
Gain Initial Access
      ↓
Upgrade the Shell
      ↓
Verify Privileges
      ↓
Credential Dumping
      ↓
Password Cracking
      ↓
Post-Exploitation Enumeration

TryHackMe describes Blue as an educational beginner room where we scan a Windows machine, identify a known vulnerability, gain access with Metasploit, work with Meterpreter, dump password hashes, and locate important files on the target. (TryHackMe)

The room is divided into five tasks:

Task 1 — Recon
Task 2 — Gain Access
Task 3 — Escalate
Task 4 — Cracking
Task 5 — Find Flags!

Task 1 — Recon

The first stage of almost any penetration test is:

Reconnaissance

Before attempting exploitation, we need to understand the target.

Questions I want to answer include:

Is the machine reachable?

Which ports are open?

Which services are running?

What operating system appears to be running?

Are any exposed services outdated or vulnerable?

This is where Nmap becomes useful.

The Blue room begins by asking us to scan the deployed Windows machine and determine which exposed service might lead to exploitation. TryHackMe also notes that the target may not respond to ICMP, which is a useful reminder that failed ping responses do not necessarily mean the host is offline. (TryHackMe)

Port Scanning

A simple scan against an authorized lab target could look like:

nmap <TARGET_IP>

A more useful enumeration scan is:

nmap -sC -sV <TARGET_IP>

Here:

-sC → Run default Nmap scripts
-sV → Detect service versions

Instead of seeing only:

Port open

we can obtain more context about the service behind that port.

Why Service Enumeration Matters

Imagine a scan returns:

PORT      STATE      SERVICE
--------------------------------
XXX/tcp   open       service-A
YYY/tcp   open       service-B
ZZZ/tcp   open       service-C

My next question should not immediately be:

Which exploit should I run?

A better process is:

Open Port
    ↓
Identify Service
    ↓
Determine Version / Protocol
    ↓
Research Known Vulnerabilities
    ↓
Validate Applicability

This prevents randomly launching exploits against services we do not understand.

SMB as an Attack Surface

One of the important technologies encountered in this room is SMB.

SMB stands for:

Server Message Block

Windows commonly uses SMB for capabilities such as:

File sharing
Printer sharing
Network resource access
Windows communication

Older SMB implementations have historically contained serious vulnerabilities.

The important lesson here was:

An exposed service is not automatically vulnerable, but its protocol, version, patch level, and configuration can reveal possible attack paths.

Vulnerability Research Workflow

Once I identify an interesting service, I can research it using:

Service name
Version
Operating system
Microsoft security bulletins
CVE databases
Metasploit modules
Nmap vulnerability scripts

A useful Metasploit search pattern is:

search <technology-or-vulnerability>

And Nmap can also run scripts targeted at specific protocols:

nmap --script "<relevant-script-pattern>" -p <PORT> <TARGET_IP>

I am intentionally not including the exact vulnerability identifier requested by the Blue room.

🛠️ Hands-On / Commands — Task 1

Tools Used

Nmap
TryHackMe AttackBox
Windows target VM
Service enumeration
Vulnerability research

Commands I practiced:

nmap <TARGET_IP>

nmap -sC -sV <TARGET_IP>

For more detailed service discovery:

nmap -sV -p <INTERESTING_PORT> <TARGET_IP>

My reconnaissance workflow became:

SCAN
  ↓
PORTS
  ↓
SERVICES
  ↓
VERSIONS
  ↓
VULNERABILITY RESEARCH
  ↓
VALIDATE

No room-specific port count or vulnerability-answer string is included here.

Task 2 — Gain Access

After identifying a potentially exploitable service, the next objective is:

Initial Access

The room uses:

Metasploit Framework

to demonstrate exploitation.

Metasploit provides modules for:

Reconnaissance
Scanning
Exploitation
Payload delivery
Post-exploitation
Session management

The Blue room explicitly guides learners through starting Metasploit, locating the appropriate exploitation module, configuring its required options, selecting a reverse-shell payload, and running it against the lab target. (TryHackMe)

Understanding Metasploit's Workflow

The process can be summarized as:

Start Metasploit
      ↓
Search for relevant module
      ↓
Select module
      ↓
Show options
      ↓
Configure target
      ↓
Configure payload
      ↓
Validate settings
      ↓
Run
      ↓
Receive session

Starting Metasploit

msfconsole

The prompt changes to something similar to:

msf6 >

From here I can search available modules.

Searching Modules

Generic syntax:

search <keyword>

For example:

search windows smb

The search results may contain:

auxiliary modules
exploit modules
post-exploitation modules
payloads

The important skill is identifying the difference between them.

Selecting a Module

The general syntax is:

use <MODULE_PATH>

I am intentionally not publishing the exact Blue module path because finding it is one of the room's tasks.

Reading Module Options

After selecting a module:

show options

This tells us which values are:

Required
Optional
Already configured
Missing

Common Metasploit parameters include concepts such as:

Remote host
Remote port
Local callback address
Local callback port
Payload

RHOST vs LHOST

This distinction is extremely important.

RHOST
=
Remote Host
=
Target machine

while:

LHOST
=
Local Host
=
Our attacking/listening machine

Conceptually:

Attacker                         Target
LHOST                            RHOST
  |                                |
  | <------ Reverse Shell ---------|

Mixing these values up is a common reason reverse shells fail.

Payloads

An exploit and a payload are different things.

Exploit
   ↓
Takes advantage of vulnerability

while:

Payload
   ↓
Code executed after exploitation succeeds

A reverse-shell payload causes the compromised machine to connect back to the attacker's listener.

Target
   |
   | Reverse connection
   v
Attacker

Backgrounding a Session

After receiving a shell, Metasploit allows sessions to be moved into the background so we can continue using the framework.

Conceptually:

Active shell
    ↓
Background
    ↓
Metasploit console
    ↓
Use post-exploitation module

Session management becomes very important in the next task.

🛠️ Hands-On / Commands — Task 2

Tools Used

Metasploit Framework
Reverse shell
Session management
Windows command shell

General workflow:

msfconsole

Inside Metasploit:

search <KEYWORD>

use <MODULE_PATH>

show options

set <REQUIRED_OPTION> <VALUE>

set payload <PAYLOAD>

run

or:

exploit

I deliberately excluded the exact exploit path and required task-answer value.

Task 3 — Escalate

This task teaches an important Metasploit concept:

Upgrading a Basic Shell to Meterpreter

A normal Windows shell may look like:

C:\Windows\system32>

It provides standard Windows commands.

Meterpreter provides a richer post-exploitation interface with functionality such as:

Process enumeration
Privilege inspection
File navigation
Credential collection
Session migration
System information
Shell spawning

The room guides learners through backgrounding the existing shell, using a post-exploitation module to upgrade the session, verifying the privilege level, listing processes, and migrating into another process. (TryHackMe)

Shell vs Meterpreter

A useful comparison is:

Sessions

Metasploit may maintain multiple active connections.

To view them:

sessions

or:

sessions -l

Conceptually:

Session 1 → Basic shell

Session 2 → Meterpreter

Session 3 → Another target

I need to know which session I am working with before launching post-exploitation modules.

Checking Identity

In a Windows shell:

whoami

In Meterpreter:

getuid

These commands answer:

Which security context am I currently running under?

This is one of the first checks I should perform after gaining access.

Why Privilege Level Matters

Windows permissions determine what actions the session can perform.

A low-privilege user may not be able to:

Read sensitive system files
Dump credential material
Modify protected resources
Access other users' data

A highly privileged security context has substantially more access.

Process Enumeration

Meterpreter can list processes:

ps

The process list helps identify:

PID
Process name
Architecture
User/security context

Process Migration

Meterpreter can sometimes migrate its execution into another process.

Generic syntax:

migrate <PID>

Conceptually:

Meterpreter
     |
     v
Current Process
     |
     | migrate
     v
Another Process

Why?

One reason is session stability or aligning the session with a desired privilege context.

But process migration can fail, and the Blue room explicitly warns that it may require multiple attempts. (TryHackMe)

🛠️ Hands-On / Commands — Task 3

Tools Used

Metasploit sessions
Meterpreter
Process enumeration
Privilege verification
Process migration
Windows shell

Useful commands:

sessions -l

getuid

sysinfo

ps

migrate <PID>

To temporarily enter a Windows shell:

shell

Then:

whoami

I have intentionally excluded the exact shell-upgrade module path, required session value, and process ID used in the room.

Task 4 — Cracking

After obtaining sufficient privileges, the room introduces:

Password Hashes

Operating systems should not normally store user passwords as readable plaintext.

Instead, password-derived values are stored using cryptographic mechanisms.

Conceptually:

Password
   ↓
Hashing
   ↓
Stored Hash

An attacker who obtains password hashes may attempt offline password cracking.

The Blue room demonstrates this by having learners dump Windows credential hashes from an elevated Meterpreter session and then research how to crack the non-default user's password. (TryHackMe)

Hash Dumping

Within a sufficiently privileged Meterpreter session, the room introduces:

hashdump

The resulting entries conceptually contain information such as:

Username
RID
LM-related field
NTLM hash

I am not publishing the actual username or hash from the lab.

Hashing Is Not Encryption

This distinction matters.

Encryption:

Plaintext
   ↓
Encryption + Key
   ↓
Ciphertext
   ↓
Decryption + Key
   ↓
Plaintext

Hashing:

Password
   ↓
Hash Function
   ↓
Hash

There is no ordinary:

Decrypt hash

operation.

Password cracking instead tests candidate passwords:

Candidate Password
        ↓
Hash it
        ↓
Compare
        ↓
Match?

Dictionary Attack

A dictionary attack uses a list of possible passwords.

Conceptually:

password1
football
welcome
example123
...

Each candidate is hashed and compared against the target hash.

Wordlist
   ↓
Candidate
   ↓
Hash
   ↓
Compare with captured hash
   ↓
Match → password identified

This also demonstrates why weak and common passwords are dangerous.

John the Ripper

A general learning syntax is:

john --format=<HASH_FORMAT> --wordlist=<WORDLIST> hashes.txt

Then:

john --show hashes.txt

can display successfully recovered results.

Hashcat

Hashcat follows a similar concept.

Generic syntax:

hashcat -m <MODE> hashes.txt <WORDLIST>

The correct hash mode depends on the hash format.

Cybersecurity Lesson

Strong password security depends on more than users choosing slightly complicated passwords.

Modern systems should also consider:

Strong password hashing
Unique salts
Appropriate work factors
MFA
Password policies
Detection of credential attacks

🛠️ Hands-On / Commands — Task 4

Tools Used

Meterpreter
hashdump
John the Ripper
Hashcat
Password wordlists

Generic workflow:

Privileged session
      ↓
Dump hash
      ↓
Identify hash type
      ↓
Save hash to file
      ↓
Choose cracking tool
      ↓
Select wordlist
      ↓
Attempt offline crack

No lab username, hash, or recovered password is included.

Task 5 — Find Flags!

The final task moves into:

Post-Exploitation Enumeration

After gaining access to a machine, exploitation itself is not necessarily the end goal.

A penetration tester may now investigate:

System configuration
User directories
Sensitive files
Credentials
Application data
Administrative resources

The Blue room places three educational flags in Windows locations chosen to reinforce knowledge of important parts of the filesystem. (TryHackMe)

Windows Filesystem Enumeration

A normal Windows shell can be used to explore the filesystem.

Useful commands include:

cd

dir

To check the current identity:

whoami

To view system information:

systeminfo

Meterpreter File Navigation

Meterpreter provides similar commands:

pwd

ls

cd <DIRECTORY>

cat <FILE>

This made it easier to connect what I had learned in the Windows Fundamentals rooms with actual post-exploitation enumeration.

Search Rather Than Guess

A good post-exploitation habit is:

Understand the hint
      ↓
Think about Windows structure
      ↓
Navigate logically
      ↓
Search when necessary

instead of randomly opening every folder.

Some useful questions are:

Where does Windows keep system-level data?

Where is credential-related information stored?

Where do administrator profiles live?

Which directories would contain interesting user documents?

I am intentionally leaving the actual flag paths and values for learners to discover themselves.

🛠️ Hands-On / Commands — Task 5

Tools Used

Meterpreter
Windows filesystem
Command Prompt
Directory enumeration
File searching

Useful generic commands:

cd \

dir

dir /a

Meterpreter:

pwd

ls

cd <DIRECTORY>

The practical workflow was:

Read hint
   ↓
Identify likely Windows area
   ↓
Navigate
   ↓
Inspect directory
   ↓
Locate interesting file
   ↓
Understand why that location matters

No flag paths or flag contents are included.

Full Attack Chain

This room gave me my first clear view of an end-to-end Windows exploitation workflow:

                   TARGET WINDOWS HOST
                           |
                           v
                     RECONNAISSANCE
                           |
                          Nmap
                           |
                           v
                  Identify Open Services
                           |
                           v
               Research Known Vulnerability
                           |
                           v
                      METASPLOIT
                           |
                           v
                    Initial Foothold
                           |
                           v
                   Background Session
                           |
                           v
                  Upgrade to Meterpreter
                           |
                           v
                  Verify Privilege Level
                           |
                           v
                  Enumerate Processes
                           |
                           v
                    Process Migration
                           |
                           v
                   Credential Dumping
                           |
                           v
                   Offline Cracking
                           |
                           v
                Post-Exploitation Search

Tools Used

Key Lessons Learned

1. Recon Comes Before Exploitation

A better workflow is:

Scan
 ↓
Understand service
 ↓
Research
 ↓
Validate
 ↓
Exploit

not:

Random exploit
 ↓
Hope

2. Open Ports Reveal Attack Surface

Every exposed service gives me something to investigate:

Port
  ↓
Service
  ↓
Version
  ↓
Configuration
  ↓
Possible vulnerability

3. Exploit and Payload Are Different

This became much clearer during Metasploit.

Exploit
=
How we gain execution

Payload
=
What executes afterwards

Understanding the difference makes Metasploit much easier to use.

4. Getting a Shell Is Only the Beginning

Initial access may provide only limited functionality.

The next questions are:

Who am I?

What privileges do I have?

What processes are running?

Can I improve the session?

What information is accessible?

5. Meterpreter Is a Post-Exploitation Environment

Meterpreter provides much more functionality than a basic command shell.

I practiced:

Session management
System enumeration
Process listing
Process migration
Credential collection
Filesystem navigation

6. Password Hashes Can Still Be Valuable to Attackers

Even when passwords are not stored as plaintext, weak passwords can sometimes be recovered through offline guessing.

That reinforces why:

Strong unique passwords
+
Modern password storage
+
MFA

matter.

7. Enumeration Continues After Exploitation

Reconnaissance is not only something done before exploitation.

After gaining access, we perform local enumeration:

Users
Files
Processes
Credentials
Configuration
System locations

That determines what can be done next.

Defensive Perspective

The Blue room is an exploitation lab, but it also teaches important lessons for defenders.

The attack chain begins with an exposed, vulnerable service.

A defensive strategy therefore includes:

Patch vulnerable operating systems
        ↓
Disable unnecessary legacy protocols
        ↓
Restrict exposed network services
        ↓
Segment networks
        ↓
Monitor suspicious SMB activity
        ↓
Use endpoint protection
        ↓
Use strong passwords
        ↓
Monitor credential dumping

The vulnerability family demonstrated by Blue became particularly well known because similar weaknesses were later abused at large scale, including during the WannaCry outbreak. TryHackMe's Metasploit material uses the same EternalBlue family to explain how an SMB vulnerability can lead to remote code execution on vulnerable Windows systems. (TryHackMe)

My Final Mental Model

                WINDOWS EXPLOITATION
                         |
                         v
                       NMAP
                         |
                         v
                  OPEN SERVICES
                         |
                         v
              VULNERABILITY RESEARCH
                         |
                         v
                    METASPLOIT
                         |
                         v
                      SHELL
                         |
                         v
                    METERPRETER
                         |
              ┌──────────┼──────────┐
              |          |          |
           SYSTEM     PROCESSES   FILES
              |          |          |
          Privilege   Migration   Search
              |          |          |
              └──────────┼──────────┘
                         |
                         v
                   CREDENTIALS
                         |
                         v
                 PASSWORD HASHES
                         |
                         v
                    CRACKING
                         |
                         v
                 POST-EXPLOITATION

Ethical Learning Note

Everything described here was practiced only inside the authorized TryHackMe lab environment.

This article includes:

✅ Recon methodology
✅ Generic Nmap commands
✅ Metasploit concepts
✅ Session-management workflow
✅ Meterpreter concepts
✅ Generic password-cracking syntax
✅ Post-exploitation methodology
✅ Defensive lessons

while intentionally excluding:

❌ TryHackMe flags
❌ Exact task-answer vulnerability ID
❌ Exact exploit module answer
❌ Lab target IP
❌ Lab process ID
❌ Password hash
❌ Cracked password
❌ Flag locations
❌ Direct room-question answers

The goal is to document how I approached the machine and what I learned, while leaving the actual TryHackMe challenges for other learners to solve.

Resources

• 🌐 TryHackMe Room: Blue

• 👨‍💻 TryHackMe Profile: sunnysharma11200

• 💻 GitHub Repository: tryhackme-writeups

• ✍️ Hashnode Blog: cybersecurity-learning.hashnode.dev

Connect with Me

• TryHackMe: sunnysharma11200

• GitHub: SunnySharma04

• Hashnode: cybersecurity-learning

• LinkedIn: Sunny Sharma

Happy Learning! 🚀

Spoiler-Free Learning Guide: This article contains no TryHackMe flags, challenge-file answers, or direct task solutions. It focuses on CyberChef concepts, methodology, operations, recipes, and hands-on examples using independent sample data.

Introduction

After learning about networking, Windows, command-line tools, and SIEM, I moved on to a tool that appears repeatedly across cybersecurity tasks:

CyberChef

CyberChef is often described as the:

Swiss Army knife of cybersecurity

It is a browser-based application that can perform a huge variety of data transformations without requiring us to write scripts for every small task.

Some examples include:

Base64 encoding / decoding
Hex conversion
URL encoding / decoding
ROT13
Binary conversion
Hashing
Encryption / decryption
Extracting IP addresses
Extracting email addresses
Extracting URLs
Working with timestamps

What makes CyberChef especially useful is that these operations can be combined into recipes.

For example:

Input
  ↓
From Base64
  ↓
From Hex
  ↓
ROT13
  ↓
Output

Instead of manually using three different websites or scripts, CyberChef can perform the whole sequence inside one interface.

TryHackMe's room introduces what CyberChef is, how to navigate its four main areas, how operations and recipes work, and how to apply common transformations and extractors. (TryHackMe)

The room follows this structure:

Introduction
      ↓
Accessing the Tool
      ↓
Navigating the Interface
      ↓
Thinking Before Cooking
      ↓
Practice
      ↓
Your First Official Cook
      ↓
Conclusion

Task 1 — Introduction

The first task introduces CyberChef as a general-purpose data transformation tool.

Cybersecurity regularly involves encountering data that does not immediately make sense.

For example:

SGVsbG8gV29ybGQ=

or:

48 65 6c 6c 6f

or:

https%3A%2F%2Fexample.com

These may initially appear unreadable, but they represent data encoded in different ways.

Instead of manually converting each format, CyberChef provides operations specifically designed for these tasks.

The Main CyberChef Idea

The workflow is:

DATA
  ↓
OPERATION
  ↓
RESULT

For example:

Text
  ↓
To Base64
  ↓
Base64-encoded text

But CyberChef becomes more powerful when several operations are chained:

Input
   ↓
Operation 1
   ↓
Operation 2
   ↓
Operation 3
   ↓
Final Output

This chain is called a:

Recipe

CyberChef officially describes recipes as a sequence of operations executed in order. (TryHackMe)

Why CyberChef Is Useful in Cybersecurity

CyberChef can help when working with:

Incident-response logs
Suspicious strings
Encoded URLs
Email artifacts
Malware indicators
Network data
CTF challenges
Forensic evidence
Obfuscated data

For example, an analyst might encounter:

Encoded PowerShell

or:

An unfamiliar hexadecimal string

or:

A block of text containing many IP addresses

CyberChef allows that data to be transformed or extracted quickly.

🛠️ Hands-On — Task 1

Tools Used

CyberChef
Web Browser
TryHackMe Room

A simple independent example:

Input:

Cyber Security

Apply:

To Base64

The output becomes an encoded representation.

Then add:

From Base64

after it.

The complete recipe becomes:

Cyber Security
      ↓
To Base64
      ↓
From Base64
      ↓
Cyber Security

This simple example demonstrates an important principle:

Operations are executed from top to bottom in the recipe.

Task 2 — Accessing the Tool

CyberChef does not require a complicated installation process.

TryHackMe introduces two convenient ways to use it:

Online
or
Local / Offline

(TryHackMe)

Online CyberChef

The easiest option is the browser version.

Conceptually:

Browser
   ↓
CyberChef
   ↓
Paste Input
   ↓
Create Recipe
   ↓
Get Output

This is useful when working with ordinary training data.

Offline CyberChef

CyberChef can also be downloaded and run locally.

This is important from a security perspective.

Imagine working with:

Sensitive incident logs
Confidential company data
Malware samples
Private forensic evidence

Uploading sensitive material to random online services may be inappropriate.

A local CyberChef copy allows processing to remain on the analyst's own machine.

Security Lesson

Whenever using online tools, I should ask:

Is this data safe to paste into a third-party website?

For public training data:

Usually fine

For confidential corporate evidence:

Think carefully

Offline tooling may be safer.

🛠️ Hands-On — Task 2

Tools Used

Web Browser
Online CyberChef
Offline CyberChef option

My workflow was simply:

Open CyberChef
      ↓
Confirm interface loads
      ↓
Locate Operations
      ↓
Locate Recipe
      ↓
Locate Input
      ↓
Locate Output

This prepared me for the next task.

Task 3 — Navigating the Interface

This was one of the most important tasks.

CyberChef is divided into four primary areas:

1. Operations
2. Recipe
3. Input
4. Output

(TryHackMe)

Understanding these four areas makes the entire tool much easier.

1. Operations Area

The Operations section contains CyberChef's available transformations.

Examples include:

From Base64
To Base64
From Hex
To Hex
ROT13
URL Encode
URL Decode
Extract IP addresses
Extract URLs
Extract email addresses
From Unix Timestamp

Instead of scrolling through everything, the search box can be used.

For example, search:

Base64

and relevant operations appear.

Operation Categories

Operations are organized into groups.

These may include areas such as:

Encoding / Decoding
Encryption
Hashing
Networking
Extractors
Data Formats
Compression
Date / Time

This organization becomes useful when I know roughly what kind of problem I am solving.

2. Recipe Area

The Recipe area is where operations are placed.

TryHackMe describes it as the heart of CyberChef because this is where operations are selected, ordered, and configured. (TryHackMe)

Example:

Recipe

From Base64
      ↓
URL Decode
      ↓
ROT13

The order matters.

For example:

From Base64
↓
From Hex

is not necessarily equivalent to:

From Hex
↓
From Base64

Auto Bake

CyberChef can process the recipe automatically whenever the input or recipe changes.

This is called:

Auto Bake

When enabled:

Change Input
     ↓
Recipe Runs Automatically
     ↓
Output Updates

BAKE!

If automatic processing is disabled, the recipe can be executed manually using:

BAKE!

Save / Load Recipe

CyberChef can also save recipes.

This is useful when repeatedly performing the same transformation.

For example:

From Base64
↓
Gunzip
↓
Extract URLs

could be saved and reused later.

3. Input Area

The Input area contains the data to be processed.

Data can typically be:

Typed
Pasted
Opened from a file
Dragged into the interface

TryHackMe also highlights options for multiple input tabs and loading files or folders. (TryHackMe)

4. Output Area

The Output area displays the result.

Conceptually:

INPUT
   ↓
RECIPE
   ↓
OUTPUT

The output can then be:

Copied
Saved
Reused as input

Replace Input With Output

One especially useful feature is:

Replace Input With Output

This is helpful when working through multiple layers.

For example:

Encoded String
      ↓
Decode Layer 1
      ↓
Replace Input
      ↓
Decode Layer 2
      ↓
Replace Input
      ↓
Continue

🛠️ Hands-On — Task 3

Operations Practiced

To Base64
From Base64
To Hex
ROT13
URL Encode

Example input:

Hello Analyst

Recipe:

To Hex

produces hexadecimal bytes.

Another independent example:

CyberChef
   ↓
ROT13
   ↓
Encrypted-looking text
   ↓
ROT13
   ↓
CyberChef

ROT13 is its own inverse.

The room uses operations such as Morse decoding, URL encoding, Base64, hexadecimal conversion, decimal conversion, and ROT13 to demonstrate the interface. (TryHackMe)

Task 4 — Before Anything Else

This task taught something more important than memorizing operations:

Think Before Using the Tool

CyberChef contains hundreds of operations.

Randomly dragging operations into the recipe is not an efficient investigation strategy.

Instead, the room encourages a structured thought process. (TryHackMe)

Step 1 — Define the Objective

First ask:

What am I trying to accomplish?

For example:

I found an unreadable string.

Goal:
Determine what the original message is.

Without a clear goal, I may waste time trying unrelated operations.

Step 2 — Understand the Input

Look at the data carefully.

Questions I can ask:

Does it contain only hexadecimal characters?

Does it end in "="?

Does it contain %20 or %2F?

Does it look like binary?

Does it contain URLs?

Does it contain IP addresses?

Is it a timestamp?

Recognizing patterns helps identify the correct operation.

Step 3 — Choose an Operation

Based on the evidence:

Looks like Base64
      ↓
Try From Base64

Looks like hexadecimal
      ↓
Try From Hex

Contains encoded URL characters
      ↓
Try URL Decode

Large text with indicators
      ↓
Try Extractors

Step 4 — Evaluate the Output

After running the recipe:

Did I achieve the objective?

If yes:

Finish

If not:

Re-evaluate input
      ↓
Modify recipe
      ↓
Try again

My CyberChef Investigation Workflow

1. Define objective
        ↓
2. Inspect input
        ↓
3. Identify likely format
        ↓
4. Select operation
        ↓
5. Run recipe
        ↓
6. Inspect output
        ↓
7. Repeat if necessary

This was one of the strongest lessons from the room.

🛠️ Hands-On — Task 4

Suppose I encounter:

SGVsbG8gQW5hbHlzdA==

I notice:

Letters
Numbers
Possible "=" padding

My thought process becomes:

Possible Base64
      ↓
Search "Base64"
      ↓
Use From Base64
      ↓
Check whether output is meaningful

The important skill is not memorizing the decoded result.

It is learning how to reason from the structure of the input.

Task 5 — Practice, Practice, Practice

This task introduces several highly useful CyberChef operations.

One category was especially relevant to defensive security:

Extractors

Extractors search large bodies of text and return specific types of information.

TryHackMe introduces extractors for IP addresses, URLs, and email addresses. (TryHackMe)

Extract IP Addresses

Imagine receiving a large incident log:

Thousands of lines
      ↓
Multiple IP addresses
      ↓
Need indicators quickly

Instead of manually searching every line:

Extract IP addresses

can locate valid IPv4 and IPv6 addresses.

Cybersecurity Use Case

Suppose a phishing email contains:

Text
URLs
Headers
IP addresses
Encoded content

An analyst can paste the material into CyberChef and extract network indicators quickly.

Extract Email Addresses

The:

Extract email addresses

operation finds patterns that resemble:

user@example.com

This can be useful when analyzing:

Phishing messages
Large text dumps
Incident logs
Email headers
Leaked datasets

Extract URLs

The:

Extract URLs

operation searches for URLs in the input.

For example, a suspicious document or email may contain multiple links hidden among other content.

Conceptually:

Large Input
      ↓
Extract URLs
      ↓
URL 1
URL 2
URL 3

Number-Base Conversion

CyberChef can also convert data between number systems.

Examples include:

Decimal
Binary
Hexadecimal

For example:

Decimal value
     ↓
To Binary
     ↓
Binary representation

This becomes useful in networking, reverse engineering, and low-level computing.

URL Encoding

URLs sometimes contain encoded characters.

For example:

space

may become:

%20

Other special characters can also be percent-encoded.

CyberChef provides:

URL Encode
URL Decode

for converting between these representations.

🛠️ Hands-On — Task 5

Operations Practiced

Extract IP addresses
Extract email addresses
Extract URLs
To Binary
URL Encode

Independent sample input:

SOC report:
Contact analyst@example.org.
Suspicious host: 192.0.2.55
Reference: https://example.org/report?id=15

Recipe:

Extract IP addresses

returns the IP indicator.

Switch the operation to:

Extract email addresses

and CyberChef returns the email.

Then:

Extract URLs

finds the URL.

This is the same methodology as the room without revealing its downloaded-file answers.

Task 6 — Your First Official Cook

This task combines everything learned earlier.

The goal is no longer:

Find one operation

but:

Understand the input
      ↓
Select the right operation
      ↓
Configure it
      ↓
Interpret the output

The room uses different operations involving IP extraction, Base64, URL decoding, Unix timestamps, and Base85. (TryHackMe)

I practiced each concept independently rather than publishing the exact challenge values.

Base64

Base64 is an encoding, not encryption.

This distinction is important:

Encryption
    ↓
Requires cryptographic protection/key

Encoding
    ↓
Changes representation

Base64 exists primarily to represent binary data using printable ASCII characters.

Hands-On Base64 Example

Input:

Learning CyberChef

Recipe:

To Base64

To reverse it:

From Base64

So:

Plaintext
   ↓
To Base64
   ↓
Encoded data
   ↓
From Base64
   ↓
Plaintext

URL Decoding

A URL may appear like:

https%3A%2F%2Fexample%2Ecom%2Ftraining

Recognizable patterns include:

%3A
%2F
%2E

That suggests:

URL Decode

The result becomes a normal readable URL.

Unix Timestamps

Unix timestamps represent time as the number of seconds since the Unix epoch.

CyberChef provides operations that can convert between:

Unix Timestamp
      ↕
Human-readable Date/Time

This is useful during:

Log analysis
Incident response
Forensics
Timeline analysis

because many systems record timestamps numerically.

Base85

CyberChef also supports less-common encodings such as:

Base85

The investigation approach remains the same:

Recognize / suspect encoding
      ↓
Select corresponding From operation
      ↓
Inspect output

The point is not memorizing every encoding.

It is knowing how to find and apply an operation.

🛠️ Hands-On — Task 6

Operations Used

Extract IP addresses
To Base64
From Base64
URL Decode
From Unix Timestamp
From Base85

Independent recipe example:

Input:

VHJ5SGFja01l

Possible process:

Input looks encoded
       ↓
Search Base64
       ↓
From Base64
       ↓
Inspect output

For more complicated data:

Input
   ↓
From Base64
   ↓
URL Decode
   ↓
Output

This demonstrates how operations can be chained into a recipe.

The Magic Operation

Another useful CyberChef feature worth remembering is:

Magic

If I do not know what encoding I am looking at, Magic can attempt to identify likely transformations.

Conceptually:

Unknown-looking Data
        ↓
       Magic
        ↓
Possible Interpretation

CyberChef documentation used in other TryHackMe material also presents Magic as a way to guess useful decoding operations. (TryHackMe)

However:

Magic should support analysis, not replace understanding.

I still want to recognize patterns myself.

Task 7 — Conclusion

By the end of this room, CyberChef no longer felt like a website with hundreds of random buttons.

I now understand its structure:

                    CYBERCHEF
                         |
       ┌─────────────────┼─────────────────┐
       |                 |                 |
   OPERATIONS         RECIPE            INPUT
       |                 |                 |
 Encoding            Chain Ops          Text
 Decoding            Configure          Files
 Extractors          Reorder            Data
 Conversion          Save               Logs
       |                 |                 |
       └─────────────────┼─────────────────┘
                         |
                       BAKE
                         |
                         v
                       OUTPUT

The room concludes that CyberChef is useful for data transformations ranging from common encodings to extracting indicators, while reminding learners that very large-scale processing may require other tools. (TryHackMe)

Complete CyberChef Workflow

My final workflow is:

Unknown / Interesting Data
          ↓
Define Objective
          ↓
Inspect Pattern
          ↓
Search Operations
          ↓
Build Recipe
          ↓
Bake
          ↓
Inspect Output
          ↓
Expected Result?
       /        \
     Yes         No
      |           |
   Finish     Modify Recipe
                  |
                  └───────→ Repeat

Useful CyberChef Operations

Key Lessons Learned

1. Encoding Is Not Encryption

This is one of the most important distinctions.

Base64
Hex
URL Encoding

do not inherently provide confidentiality.

They change how data is represented.

Someone who knows the encoding can reverse it.

2. CyberChef Recipes Save Time

Instead of:

Use Tool 1
Copy result
Use Tool 2
Copy result
Use Tool 3

CyberChef allows:

Operation 1
     ↓
Operation 2
     ↓
Operation 3
     ↓
Final Result

inside a single workflow.

3. Pattern Recognition Matters

Examples:

SGVsbG8=
      ↓
Possibly Base64

48 65 6c 6c 6f
      ↓
Possibly Hex

%3A%2F%2F
      ↓
Likely URL Encoding

Recognizing these patterns makes analysis much faster.

4. Extractors Are Extremely Useful for SOC Work

Large logs may contain thousands of characters.

Instead of manually searching for indicators:

Extract IPs
Extract URLs
Extract Emails

can quickly isolate useful evidence.

5. Always Define the Goal First

The biggest mistake would be:

Randomly try operations

A better approach is:

What do I want?
      ↓
What does the input look like?
      ↓
Which operation fits?

6. Output Can Become New Input

Cybersecurity data often has multiple encoding layers.

For example:

Layer 1
  ↓
Decode
  ↓
Layer 2
  ↓
Decode
  ↓
Final Message

CyberChef's recipes and Replace Input With Output functionality make this much easier.

My Final Mental Model

                 SUSPICIOUS DATA
                       |
                       v
                RECOGNIZE FORMAT
                       |
        ┌──────────────┼──────────────┐
        |              |              |
      Base64          Hex            URL
        |              |              |
        └──────────────┼──────────────┘
                       |
                  OPERATIONS
                       |
                       v
                    RECIPE
                       |
                       v
                     BAKE
                       |
                       v
                    OUTPUT
                       |
               ┌───────┴───────┐
               |               |
            Useful?           No
               |               |
             Done          Modify Recipe

Ethical Learning Note

This article is a learning guide rather than an answer dump.

I included:

✅ CyberChef concepts
✅ Generic operation examples
✅ Recipe methodology
✅ Encoding recognition
✅ Extractor workflows
✅ Defensive-security use cases

while intentionally excluding:

❌ TryHackMe flags
❌ Task-file email answer
❌ Task-file IP answers
❌ Domain answer
❌ Exact conversion answers
❌ First Cook challenge outputs
❌ Direct task submissions

The goal is to document how I used CyberChef while leaving the actual TryHackMe exercises for other learners to solve themselves.

Resources

• 🌐 TryHackMe Room: CyberChef: The Basics

• 👨‍💻 TryHackMe Profile: sunnysharma11200

• 💻 GitHub Repository: tryhackme-writeups

• ✍️ Hashnode Blog: cybersecurity-learning.hashnode.dev

Connect with Me

• TryHackMe: sunnysharma11200

• GitHub: SunnySharma04

• Hashnode: cybersecurity-learning

• LinkedIn: Sunny Sharma

Happy Learning! 🚀

Spoiler-Free Learning Guide: This article contains no TryHackMe flags, lab-specific answers, or direct task solutions. It focuses on the concepts, tools, investigation methodology, and practical skills I learned while completing the room.

Introduction

After learning Windows, command-line basics, and networking concepts, I moved into an important area of defensive cybersecurity:

SIEM

SIEM stands for:

Security Information and Event Management

A SIEM is one of the core technologies used inside a:

SOC
=
Security Operations Center

Modern organizations have hundreds or thousands of systems constantly generating security information.

For example:

Windows Workstations
Linux Servers
Firewalls
VPN Gateways
Web Servers
Routers
IDS / IPS
Applications
Cloud Services

Every one of these systems generates logs.

The challenge is:

How can a security analyst monitor all of these logs without manually checking every machine?

That is where SIEM becomes useful.

TryHackMe's Introduction to SIEM room explains how SIEM solutions collect logs from different devices, normalize them, correlate activity, trigger alerts, and help SOC analysts investigate suspicious behavior. (TryHackMe)

The room follows this learning path:

Introduction
     ↓
Logs Everywhere, Answers Nowhere
     ↓
Why SIEM?
     ↓
Log Sources & Ingestion
     ↓
Alerting Process & Analysis
     ↓
Hands-On SIEM Lab
     ↓
Conclusion

Task 1 — Introduction

The first task introduces SIEM from the perspective of a SOC analyst.

A typical organization's network may contain:

Endpoints
Servers
Network Devices
Security Appliances
Applications
Cloud Infrastructure

Each device records events.

Those events might tell us:

Who logged in?

Which file was accessed?

Which process executed?

What website was visited?

Which IP made a connection?

Was authentication successful?

Was a security rule triggered?

Individually, these are just logs.

When brought together, they can describe an entire security incident.

What Problem Does SIEM Solve?

Imagine a small company with:

100 Windows endpoints
20 Linux servers
5 firewalls
2 VPN gateways
10 web servers

Suppose each device produces hundreds of events every minute.

Without centralization:

Incident occurs
      ↓
Analyst logs into Server 1
      ↓
Checks logs
      ↓
Logs into Server 2
      ↓
Checks logs
      ↓
Checks firewall
      ↓
Checks endpoint
      ↓
Checks VPN

This is extremely inefficient.

Instead:

Windows ─────┐
Linux ───────┤
Firewall ────┤
VPN ─────────┤
Web Server ──┤
             ↓
            SIEM
             ↓
     Centralized Analysis

That is the core idea behind the entire room. (TryHackMe)

🛠️ Hands-On / Tools — Task 1

Tools / Concepts Used

TryHackMe Room
SIEM concepts
SOC workflow
Log-source identification

This task was mainly conceptual.

My first mental model became:

Devices
   ↓
Generate Logs
   ↓
SIEM Collects Them
   ↓
Analyst Investigates

No task-specific answer or flag is included here.

Task 2 — Logs Everywhere, Answers Nowhere

This task explains where security logs come from.

TryHackMe divides log sources into two broad categories:

Host-Centric Logs
        +
Network-Centric Logs

Understanding this distinction is important because each source provides a different part of the security story. (TryHackMe)

Host-Centric Log Sources

Host-centric logs describe activity occurring:

On a computer
or
directly related to that computer

Common sources include:

Windows workstations
Linux hosts
Application servers
Database servers

Examples of host activity include:

User authentication
File access
Process execution
Registry changes
PowerShell execution
Service activity

Example

Suppose a workstation records:

10:10 → User logs in

10:12 → powershell.exe starts

10:13 → New registry key created

10:15 → Sensitive file opened

These events tell us what happened inside the endpoint.

Network-Centric Log Sources

Network-centric logs describe communication taking place across the network.

Typical sources include:

Firewalls
Routers
VPN devices
IDS
IPS
Proxy servers

Examples include:

SSH connections
FTP activity
Web traffic
VPN access
Network file sharing
Firewall connections

Example

A firewall might record:

Source IP      : 10.10.20.15
Destination IP : 192.0.2.50
Destination Port: 443
Action         : Allowed

That tells us something about the network communication, but not necessarily what happened inside the endpoint.

This is why multiple sources matter.

The Problem With Isolated Logs

The task then explains why checking individual logs manually does not scale.

TryHackMe highlights several major problems. (TryHackMe)

1. Too Many Log Sources

Organizations may have thousands of devices.

Each device may generate:

Hundreds
or
Thousands

of events every second.

Manually reading everything is unrealistic.

2. No Centralization

Without SIEM, logs may remain on the systems that produced them.

The analyst might need:

SSH → Linux Server

RDP → Windows Host

Web UI → Firewall

VPN Console → VPN Logs

just to investigate one incident.

3. Limited Context

This is one of the most important lessons from the task.

Consider the event:

User accessed confidential.pdf

By itself, this may be normal.

But now correlate it with:

09:01 → Login from unfamiliar VPN IP
09:03 → Access to shared drive
09:05 → PowerShell execution
09:06 → Large outbound transfer

Suddenly:

One harmless-looking event
        +
Other related events
        =
Potential security incident

Context changes everything.

4. Too Much Data for Manual Analysis

Humans cannot realistically inspect every event manually.

Important activity would inevitably be missed.

This creates a need for:

Automation
Detection Rules
Correlation
Alerting

5. Different Log Formats

Another major problem is that different systems represent information differently.

For example:

Windows

Event ID
Account Name
Process Name
Computer

Linux

Timestamp Host Process PID Message

Web Server

IP
Request
Status Code
User-Agent

An analyst should not have to manually interpret dozens of incompatible formats every time an incident happens.

🛠️ Hands-On / Tools — Task 2

Concepts Practiced

Host-centric logs
Network-centric logs
Log-source classification
Incident correlation

A useful exercise is asking:

Where did this event occur?

If it describes activity inside the host, I think:

Host-centric

If it describes network communication, I think:

Network-centric

The exact TryHackMe task answers are intentionally not included.

Task 3 — Why SIEM?

Now the room introduces the solution.

A SIEM collects logs from multiple systems and gives analysts a centralized place to work with them.

The high-level flow is:

Log Sources
     ↓
Collection
     ↓
Parsing
     ↓
Normalization
     ↓
Correlation
     ↓
Detection
     ↓
Alert
     ↓
Investigation

TryHackMe introduces five especially important SIEM capabilities: centralized collection, normalization, correlation, real-time alerting, and dashboards/reporting. (TryHackMe)

1. Centralized Log Collection

Instead of investigating every system separately:

Endpoint 1 ───┐
Endpoint 2 ───┤
Linux ────────┤
Firewall ─────┤
VPN ──────────┤
Web Server ───┤
              ↓
             SIEM

Everything becomes accessible from one location.

This significantly improves investigation speed.

2. Parsing

A raw log might look like:

2026-09-07 18:22:14 user=alice src=10.0.0.5 action=login status=failed

A parser breaks this into fields:

Time   = 18:22:14
User   = alice
Source = 10.0.0.5
Action = login
Status = failed

That process is called:

Parsing

3. Normalization

Different products may use different field names.

For example:

src_ip
source_ip
client_ip
remote_address

might all represent the same concept.

A SIEM can convert them into a consistent structure.

Different Log Formats
         ↓
    Normalization
         ↓
Common Representation

Normalization makes searching and correlation much easier.

4. Correlation

Correlation is where SIEM becomes especially powerful.

Imagine four different systems report:

VPN:
Unusual login

File Server:
Sensitive document accessed

Windows:
PowerShell executed

Firewall:
Large outbound connection

Each event alone may not trigger concern.

Together:

VPN
 +
File Access
 +
PowerShell
 +
Outbound Connection
       ↓
Potential Account Compromise / Data Exfiltration

SIEM helps connect these events.

TryHackMe demonstrates the same idea by showing how individually normal-looking events can become suspicious when combined. (TryHackMe)

5. Real-Time Alerting

SIEM platforms contain:

Detection Rules

When log activity matches rule conditions:

Events
   ↓
Detection Rule
   ↓
Condition Matched
   ↓
Alert Created

A SOC analyst then investigates the alert.

6. Dashboards

SIEM dashboards summarize security information.

Examples include:

Triggered alerts
Failed logins
Events ingested
Top domains
System health
Rule triggers
Security trends

This gives analysts fast visibility into the environment.

Examples of SIEM Platforms

Common technologies include:

Splunk
Microsoft Sentinel
Elastic Security
IBM QRadar
Google Security Operations

The exact products differ, but the fundamental SIEM workflow remains similar.

🛠️ Hands-On / Tools — Task 3

Tools / Concepts Used

SIEM architecture
Parsing
Normalization
Correlation
Detection rules
Dashboards
Alerting

My quick revision flow:

Collect
   ↓
Parse
   ↓
Normalize
   ↓
Correlate
   ↓
Detect
   ↓
Alert
   ↓
Investigate

This is probably the most important sequence I took away from the room.

Task 4 — Log Sources and Ingestion

This task moves from SIEM theory to actual log sources.

The room explores examples from:

Windows
Linux
Web Servers

and then explains how those logs reach the SIEM. (TryHackMe)

Windows Logs

Windows records operating-system and application events that can be viewed using:

Event Viewer

Windows events often contain information such as:

Event ID
Timestamp
Account
Computer Name
Process
Logon Information
Security Activity

🛠️ Windows Hands-On

On a Windows machine:

Start Menu
   ↓
Search "Event Viewer"

Typical categories include:

Windows Logs
├── Application
├── Security
├── Setup
└── System

From a cybersecurity perspective, I may look for:

Login attempts
Account changes
Process-related activity
Service events
Security-policy changes

Linux Logs

Linux commonly stores logs under:

/var/log/

The room introduces examples including authentication, kernel, cron, and web-server logs. (TryHackMe)

Common examples:

/var/log/auth.log
/var/log/secure
/var/log/cron
/var/log/kern
/var/log/httpd/

Exact files vary by distribution and installed services.

🛠️ Linux Hands-On

List available logs:

ls -lah /var/log/

Read a log:

cat /var/log/auth.log

For long output:

less /var/log/auth.log

Watch new entries:

tail -f /var/log/auth.log

Search for a keyword:

grep "failed" /var/log/auth.log

These are general Linux log-analysis commands rather than room-specific answers.

Web Server Logs

Web servers generate extremely valuable security information.

A simplified request log might look like:

192.0.2.25 - - [07/Sep/2026:18:30:00] "GET /login HTTP/1.1" 200

From this we might extract:

Source IP
Timestamp
HTTP Method
Requested Resource
Status Code
User-Agent

These fields can help investigate:

Brute-force attempts
Web attacks
Reconnaissance
Suspicious scanning
Abnormal requests

Log Ingestion

Logs need to reach the SIEM somehow.

TryHackMe introduces four common ingestion approaches. (TryHackMe)

1. Agent / Forwarder

A lightweight program is installed on the endpoint.

Endpoint
   |
 Agent
   |
   v
 SIEM

The agent monitors relevant logs and forwards them.

Splunk commonly refers to this type of component as a:

Forwarder

2. Syslog

Syslog is widely used for centralized logging.

Conceptually:

Router ─────┐
Firewall ───┤
Linux ──────┤
Server ─────┤
            ↓
          Syslog
            ↓
           SIEM

3. Manual Upload

Sometimes analysts already have an offline log file.

A SIEM may allow:

Upload Log
     ↓
Parse Data
     ↓
Search / Analyze

This can be useful during investigations and training.

4. Port-Based Forwarding

A SIEM can listen on a configured network port.

Endpoint
    |
    | Log Data
    v
SIEM Listening Port

Logs received on that port are then processed.

🛠️ Hands-On / Commands — Task 4

Tools Used

Windows Event Viewer
Linux /var/log
Web-server logs
Agent / Forwarder
Syslog
Manual ingestion
Port-based ingestion

Useful Linux commands:

ls /var/log

less /var/log/auth.log

tail -f /var/log/auth.log

grep -i "error" <logfile>

A useful investigation habit is:

Identify log source
       ↓
Understand fields
       ↓
Determine ingestion method
       ↓
Normalize data
       ↓
Search centrally

Task 5 — Alerting Process and Analysis

Collecting logs is useful.

But a SOC analyst cannot manually inspect every event.

That is why SIEM solutions use:

Detection Rules

A detection rule contains logic describing activity we want to identify.

TryHackMe uses examples such as repeated failed logins, successful login after multiple failures, USB insertion, and unusually large outbound transfers. (TryHackMe)

Detection Rule Logic

A simplified rule might say:

IF
failed_login_count >= threshold

WITHIN
short_time_window

THEN
Create Alert

Another example:

Multiple Failed Logins
          +
Successful Login
          ↓
Possible Account Compromise

Why Normalization Matters

Suppose one system records:

username=alice

another records:

user=alice

and another records:

account_name=alice

Detection rules become much easier when normalization converts them into a consistent field such as:

user = alice

Therefore:

Raw Logs
   ↓
Normalization
   ↓
Consistent Fields
   ↓
Detection Rules

Alert Investigation

Once an alert appears, the analyst does not immediately assume:

Alert = Attack

Instead:

Alert
   ↓
Open related events
   ↓
Check detection rule
   ↓
Review user / host / IP / process
   ↓
Build context
   ↓
Determine verdict

True Positive vs False Positive

This distinction is extremely important.

True Positive

The SIEM raised an alert and actual suspicious/malicious activity exists.

Alert Raised
     +
Threat Exists
     =
True Positive

False Positive

The SIEM raised an alert, but the activity was legitimate.

Alert Raised
     +
No Real Threat
     =
False Positive

False positives are not useless.

They can indicate that the detection logic needs:

Rule Tuning

TryHackMe specifically notes that false positives may require rule adjustments to avoid repeatedly alerting on expected behavior. (TryHackMe)

Possible Analyst Actions

After investigation, actions might include:

Close benign alert

Tune detection rule

Investigate further

Contact asset owner

Block malicious IP

Isolate infected host

Escalate incident

The action depends on context.

🛠️ Hands-On / Methodology — Task 5

Tools / Concepts Used

Detection rules
Event correlation
Alert investigation
True positives
False positives
Rule tuning
Response actions

My investigation checklist became:

1. What rule triggered?

2. Which event matched?

3. Which user was involved?

4. Which host was involved?

5. Which process was involved?

6. What source/destination IPs exist?

7. What happened before and after?

8. Is the activity expected?

9. True Positive or False Positive?

10. What response is appropriate?

This is a workflow I can reuse in future SIEM labs.

Task 6 — Lab Work

This was the practical part of the room.

TryHackMe provides a simulated SIEM dashboard where suspicious activity can be generated and investigated. (TryHackMe)

The goal is not simply to identify an alert.

The real workflow is:

Suspicious Activity
        ↓
Alert Triggered
        ↓
Open Alert
        ↓
Inspect Related Event
        ↓
Identify Process
        ↓
Identify User
        ↓
Identify Host
        ↓
Inspect Detection Rule
        ↓
Find Matching Condition
        ↓
Determine Verdict
        ↓
Choose Response

Step 1 — Start With the Alert

When the alert appears, I first ask:

What exactly triggered?

Useful fields may include:

Alert name
Timestamp
Rule
Severity
Host
User
Process

Step 2 — Examine the Event

Next:

Alert
   ↓
Related Event

I inspect fields such as:

process_name
user
hostname
command_line
timestamp

depending on what the platform provides.

Step 3 — Inspect the Detection Rule

A detection rule may contain something conceptually like:

IF process_name contains suspicious_term
THEN raise alert

I compare:

Actual event
     vs
Rule condition

to understand why the SIEM generated the alert.

Step 4 — Build Context

An isolated process name is not enough.

I ask:

Who executed it?

On which machine?

When?

Was the action expected?

What else happened around the same time?

Context determines whether an alert is actually malicious.

Step 5 — Classify the Alert

After investigation:

Legitimate activity?
      ↓
False Positive

or:

Confirmed suspicious activity?
      ↓
True Positive

Step 6 — Take the Correct Action

A SIEM analyst does more than observe.

Depending on the incident:

False Positive
      ↓
Close / Tune

True Positive
      ↓
Investigate / Contain / Escalate

The lab reinforces this complete alert-analysis cycle.

I am intentionally not publishing the lab's process name, username, hostname, matching term, classification answer, action choice, or flag.

🛠️ Hands-On / Tools — Task 6

Tools Used

TryHackMe SIEM simulator
Dashboard
Alert view
Event details
Detection rule
Process information
User information
Host information
Alert classification
Response action

My repeatable SOC workflow:

ALERT
  ↓
EVENT
  ↓
RULE
  ↓
CONTEXT
  ↓
VERDICT
  ↓
ACTION

That is probably the most valuable practical takeaway from the room.

Task 7 — Conclusion

By the end of Introduction to SIEM, SIEM no longer felt like simply:

"A dashboard containing logs"

Instead, I understand it as an entire security workflow:

Endpoints
Servers
Firewalls
Routers
VPN
Web Servers
      |
      v
   LOG SOURCES
      |
      v
   INGESTION
      |
      v
    PARSING
      |
      v
 NORMALIZATION
      |
      v
  CORRELATION
      |
      v
DETECTION RULES
      |
      v
     ALERT
      |
      v
 INVESTIGATION
      |
      v
 TRUE / FALSE POSITIVE
      |
      v
   RESPONSE

The room concludes by pointing learners toward more advanced SOC and SIEM material including Splunk and incident-investigation rooms. (TryHackMe)

Tools & Concepts Practiced

Key Lessons Learned

1. Logs Are Evidence

A single log may appear insignificant.

But logs can reconstruct:

Who
Did What
Where
When
From Which System
Using Which Process

That makes logging fundamental to cybersecurity investigations.

2. Centralization Saves Investigation Time

Without SIEM:

Check Host A
Check Host B
Check Firewall
Check VPN
Check Web Server

With SIEM:

Search One Central Platform

That is a huge operational advantage.

3. Correlation Creates Context

This was one of my biggest takeaways.

Event A
+
Event B
+
Event C
+
Event D
=
Security Story

Individual events may look harmless.

Together they may expose malicious behavior.

4. Normalization Enables Detection

Detection rules need consistent data.

Different formats
      ↓
Normalization
      ↓
Consistent fields
      ↓
Reliable searching & detection

Without normalization, SIEM analysis would be much harder.

5. An Alert Is the Beginning, Not the Answer

One of the most important SOC lessons:

Alert ≠ Incident

An alert means:

Something matched a detection rule.

The analyst still needs to investigate.

6. False Positives Are Part of Detection Engineering

A false positive does not automatically mean the rule is useless.

Instead:

False Positive
      ↓
Understand cause
      ↓
Tune rule
      ↓
Better future detection

Detection improves continuously.

My Final Mental Model

                    SECURITY ENVIRONMENT
                            |
         ┌──────────────────┼──────────────────┐
         |                  |                  |
      ENDPOINTS          NETWORK           SERVERS
         |                  |                  |
         └──────────────────┼──────────────────┘
                            |
                           LOGS
                            |
                            v
                           SIEM
                            |
          ┌─────────────────┼─────────────────┐
          |                 |                 |
       COLLECT           NORMALIZE         CORRELATE
          |                 |                 |
          └─────────────────┼─────────────────┘
                            |
                       DETECTION RULE
                            |
                            v
                          ALERT
                            |
                            v
                       SOC ANALYST
                            |
                    ┌───────┴───────┐
                    |               |
              FALSE POSITIVE   TRUE POSITIVE
                    |               |
                 TUNE           RESPOND

Ethical Learning Note

This article is a learning guide, not an answer dump.

I included:

✅ SIEM concepts
✅ Log-analysis methodology
✅ Generic commands
✅ Alert-investigation workflow
✅ Detection concepts
✅ Defensive-security lessons

while intentionally excluding:

❌ TryHackMe flags
❌ Direct room-question answers
❌ Lab-specific usernames
❌ Lab hostnames
❌ Suspicious-process answer
❌ Detection-rule answer
❌ Final lab flag

The goal is to document what I learned while still allowing other students to solve the TryHackMe room independently.

Resources

• 🌐 TryHackMe Room: Introduction to SIEM

• 👨‍💻 TryHackMe Profile: sunnysharma11200

• 💻 GitHub Repository: tryhackme-writeups

• ✍️ Hashnode Blog: cybersecurity-learning.hashnode.dev

Connect with Me

• TryHackMe: sunnysharma11200

• GitHub: SunnySharma04

• Hashnode: cybersecurity-learning

• LinkedIn: Sunny Sharma

Happy Learning! 🚀

Spoiler-Free Learning Guide: This article contains no TryHackMe flags, lab-specific answers, or direct task solutions. It focuses on the networking concepts, practical methodology, and commands I learned while completing the room.

Introduction

After working with Windows and the command line, I moved on to one of the most important foundations of cybersecurity: computer networking.

Almost everything we do in cybersecurity eventually involves a network.

When we:

Open a website
Connect through SSH
Use a VPN
Scan a server
Send an email
Access an API
Investigate suspicious traffic

data needs to travel between different systems.

The Networking Concepts room is the first room in TryHackMe's networking series and introduces the foundations needed to understand how that communication happens. The main topics are the OSI model, TCP/IP model, IPv4 addressing and subnets, routing, TCP and UDP, encapsulation, ports, and basic TCP communication using Telnet. (TryHackMe)

The room follows this learning flow:

Introduction
      ↓
OSI Model
      ↓
TCP/IP Model
      ↓
IP Addresses & Subnets
      ↓
UDP & TCP
      ↓
Encapsulation
      ↓
Telnet
      ↓
Conclusion

Task 1 — Introduction

The first task establishes an important idea:

A network is not simply computers connected together. Multiple protocols and layers work together to make communication possible.

When I open a website, my browser does not simply send:

"Give me this webpage"

directly to another computer.

Several things have to happen.

For example:

Application creates data
        ↓
Transport protocol handles communication
        ↓
IP handles addressing and routing
        ↓
Link technology moves data locally
        ↓
Physical network carries the bits

Understanding these steps is important because cybersecurity tools often operate at different parts of this process.

For example:

Nmap        → Ports / network services
Wireshark   → Packets and protocols
ping        → Network reachability
traceroute  → Routing path
netstat     → Connections and ports

The room therefore starts by building the networking model before introducing more protocols. (TryHackMe)

Why Networking Matters in Cybersecurity

Suppose an unknown system connects to a server.

A security analyst may need to determine:

Where did the traffic come from?

Which IP address was involved?

Which protocol was used?

Which destination port was contacted?

Was the connection TCP or UDP?

What application generated the traffic?

Without networking fundamentals, these questions become difficult to answer.

🛠️ Hands-On / Commands — Task 1

Tools Used

TryHackMe Room
AttackBox
Terminal
Networking diagrams

No major terminal command was required in the introductory task.

The important goal was understanding the communication stack before moving into individual protocols.

Task 2 — OSI Model

The OSI model was one of the main concepts in this room.

OSI stands for:

Open Systems Interconnection

It is a conceptual networking model created to describe network communication using seven layers. (TryHackMe)

The seven layers are:

Layer 1 — Physical

The Physical layer deals with the actual transmission medium.

Examples include:

Electrical signals
Fiber-optic signals
Radio waves
Ethernet cabling
Wireless transmission

At this level we are mainly concerned with transmitting bits.

1 0 1 1 0 1 0 0

Layer 2 — Data Link

The Data Link layer handles communication between devices on the same local network segment.

Common examples include:

Ethernet
Wi-Fi

MAC addresses are important at this layer.

A useful mental model is:

Layer 2
   ↓
Local delivery
   ↓
Device-to-device communication

Layer 3 — Network

The Network layer handles:

Logical addressing
Routing
Moving packets between networks

The most important protocol here is:

IP

Routers primarily operate using Layer 3 information.

Conceptually:

Source Network
      ↓
    Router
      ↓
Another Network
      ↓
Destination

Layer 4 — Transport

The Transport layer provides communication between applications running on different hosts.

Two protocols dominate this layer:

TCP
UDP

Layer 4 introduces the idea of:

Port numbers

which helps identify which application or service should receive network traffic. (TryHackMe)

Layer 5 — Session

The Session layer manages communication sessions between applications.

It is concerned with operations such as:

Starting sessions
Maintaining sessions
Synchronizing communication
Recovering sessions

Layer 6 — Presentation

The Presentation layer handles how data is represented.

Examples include:

Encoding
Encryption
Compression
Data formatting

Common examples may involve formats such as:

JPEG
PNG
Unicode
MPEG

Layer 7 — Application

The Application layer is closest to the software used by the user.

Protocols include:

HTTP
HTTPS
DNS
FTP
SMTP
IMAP

For example:

Web Browser
     ↓
HTTP / HTTPS
     ↓
Application Layer

The room emphasizes that remembering the layer numbers is useful because security terminology commonly refers to things such as Layer 3 switches or Layer 7 firewalls. (TryHackMe)

Remembering the OSI Layers

One mnemonic presented in the room is:

Please
Do
Not
Throw
Spinach
Pizza
Away

From bottom to top:

Physical
Data Link
Network
Transport
Session
Presentation
Application

🛠️ Hands-On / Commands — Task 2

Tools Used

OSI layer diagrams
TryHackMe interactive questions
Networking protocol mapping

This task was mostly conceptual.

I created this quick reference for myself:

7 Application     → HTTP / DNS
6 Presentation    → Encoding / encryption
5 Session         → Sessions
4 Transport       → TCP / UDP
3 Network         → IP / routing
2 Data Link       → Ethernet / Wi-Fi
1 Physical        → Signals / cables

This became useful throughout the rest of the room.

Task 3 — TCP/IP Model

The OSI model is useful conceptually, but actual Internet communication is commonly described using the TCP/IP model.

TCP/IP stands for:

Transmission Control Protocol
/
Internet Protocol

TryHackMe presents the TCP/IP model using four major layers and explains how they correspond to the seven OSI layers. (TryHackMe)

TCP/IP Layers

Application
Transport
Internet
Link

The mapping looks approximately like this:

Some textbooks present a five-layer Internet model by separating the Physical layer. (TryHackMe)

Application Layer

The TCP/IP Application layer combines three OSI layers:

OSI Layer 7
OSI Layer 6
OSI Layer 5

Protocols include:

HTTP
HTTPS
DNS
SSH
FTP
SMTP

Transport Layer

This corresponds closely with OSI Layer 4.

The important protocols are:

TCP
UDP

Their job is to provide communication between processes running on hosts.

Internet Layer

This roughly corresponds to the OSI Network layer.

Its major responsibility is:

IP addressing
+
Routing

Important protocols include:

IP
ICMP

Link Layer

This handles communication over the local network medium.

Examples include:

Ethernet
Wi-Fi

OSI vs TCP/IP

The way I remember the difference is:

OSI
=
Conceptual 7-layer learning model

while:

TCP/IP
=
Practical Internet protocol model

Both describe network communication, but TCP/IP more closely reflects the protocols used on modern networks.

🛠️ Hands-On / Commands — Task 3

Tools Used

OSI/TCP-IP mapping
Protocol identification
TryHackMe diagrams

My quick revision table became:

Application → HTTP, HTTPS, DNS, SSH

Transport   → TCP, UDP

Internet    → IP, ICMP

Link        → Ethernet, Wi-Fi

No terminal command was necessary in this task.

Task 4 — IP Addresses and Subnets

This task introduced one of the most important networking concepts:

IP Addresses

An IP address identifies a host on a TCP/IP network.

A common IPv4 address looks like:

192.168.1.10

IPv4 addresses contain:

32 bits

divided into four 8-bit sections called octets. (TryHackMe)

192 . 168 . 1 . 10
 ↓     ↓    ↓    ↓
8bit  8bit 8bit 8bit

Total = 32 bits

Each octet can represent values from:

0 to 255

Why Do We Need IP Addresses?

Think of an IP address like a postal address.

If I want to send a parcel, the postal service needs to know:

Where should this parcel go?

Similarly, networks need:

Destination IP Address

to determine where a packet should be delivered.

Subnets

A subnet divides a larger IP network into smaller logical networks.

For example:

192.168.1.0/24

The /24 tells us that:

24 bits represent the network portion

leaving the remaining bits for host addresses.

For a typical /24 example:

Network:
192.168.1.0/24

Potential host range:
192.168.1.1
...
192.168.1.254

Broadcast:
192.168.1.255

The exact usable range depends on the subnet.

TryHackMe uses the /24 example to explain how subnet masks separate network and host portions of an IPv4 address. (TryHackMe)

Subnet Mask

A /24 network can also be represented as:

255.255.255.0

So:

192.168.1.10/24

and a system using:

IP:   192.168.1.10
Mask: 255.255.255.0

describe the same prefix length.

Public vs Private IP Addresses

Not every IP address is directly routable across the public Internet.

Private IPv4 addresses are reserved for internal networks.

The three major private ranges are:

10.0.0.0/8

172.16.0.0/12

192.168.0.0/16

These ranges were defined for private networking. (TryHackMe)

Examples might include:

10.10.20.5

172.20.10.15

192.168.1.100

These are common inside:

Homes
Companies
Labs
Virtual networks
Cloud environments

Why Private IP Addresses Exist

IPv4 contains roughly:

2^32

possible addresses.

That sounds large, but it is not enough to give every modern device a permanently unique public IPv4 address.

Private addressing, along with technologies such as NAT, helps reuse address space.

Routing

Once IP addresses identify networks and hosts, we still need a way to move packets between networks.

That is the job of:

Routers

A router examines Layer 3 information and determines where a packet should go next. (TryHackMe)

Conceptually:

Computer A
    |
    v
Router 1
    |
    v
Router 2
    |
    v
Router 3
    |
    v
Computer B

The packet may cross several routers before reaching its destination.

🛠️ Hands-On / Commands — Task 4

Tools Used

ipconfig
ifconfig
ip
Subnet notation
IPv4 addressing

On Windows:

ipconfig

can show local network information.

A more detailed version is:

ipconfig /all

On Linux:

ip address show

or the shorter:

ip a

can display configured addresses.

An older Linux command is:

ifconfig

Example information I look for:

IPv4 address
Subnet mask / prefix
Interface
Broadcast address
Default gateway

Task 5 — UDP and TCP

An IP address tells us which host should receive traffic.

But one computer can run many network applications simultaneously.

For example:

Web Browser
SSH Server
DNS Service
Email Client
Game

So we also need to identify:

Which application/process should receive the data?

This is where ports and transport protocols become important.

TryHackMe introduces both UDP and TCP as Layer 4 protocols and explains how port numbers identify processes. (TryHackMe)

Port Numbers

A port number identifies a network service or process on a host.

Think of:

IP Address = Building Address

Port       = Apartment Number

The IP finds the computer.

The port finds the application.

Port numbers use 16 bits and therefore extend up to:

65535

with port 0 reserved. (TryHackMe)

UDP — User Datagram Protocol

UDP is:

Connectionless

This means it does not establish a formal connection before sending data.

Conceptually:

Sender
  |
  | Datagram
  v
Receiver

There is no built-in guarantee that the receiver actually received the datagram.

UDP Advantages

Because there is less overhead, UDP can be:

Fast
Simple
Low latency

This makes it useful for applications where speed may matter more than guaranteed delivery.

Examples can include:

Streaming
Voice communication
Online gaming
DNS queries

depending on the protocol/application.

TCP — Transmission Control Protocol

TCP takes a different approach.

TCP is:

Connection-oriented

Before normal application data is exchanged, a connection is established.

TCP also uses mechanisms such as:

Sequence numbers
Acknowledgements
Retransmission

to provide reliable ordered communication. (TryHackMe)

TCP Three-Way Handshake

A TCP connection begins conceptually with:

Client                  Server

  SYN   ---------------->

        <-------------- SYN-ACK

  ACK   ---------------->

After that:

Connection Established

and application data can be exchanged.

TCP vs UDP

The correct protocol depends on the application's needs.

🛠️ Hands-On / Commands — Task 5

Tools Used

TCP
UDP
Port numbers
netstat
ss

On Windows, I can inspect connections using:

netstat -ano

On Linux:

ss -tuln

The options can help reveal:

TCP sockets
UDP sockets
Listening ports
Local addresses

A useful security question is:

What application is listening on this port?

because exposed services form part of a system's network attack surface.

Task 6 — Encapsulation

This was one of the most important conceptual tasks.

When application data moves down through the networking stack, each layer adds information required for its job.

This is called:

Encapsulation

TryHackMe explains encapsulation as each layer adding its own header, and sometimes a trailer, before passing the resulting unit to the layer below. (TryHackMe)

Starting With Application Data

Suppose I type a message into an application.

Initially we have:

Application Data

The application sends this downward.

Transport Layer

TCP or UDP adds transport information.

Conceptually:

[TCP Header | Application Data]

or:

[UDP Header | Application Data]

Internet / Network Layer

IP adds another header.

Now we have:

[IP Header | Transport Header | Application Data]

The IP header contains information required for routing, including source and destination addresses.

Data Link Layer

Ethernet or Wi-Fi adds link-layer information.

Conceptually:

[Link Header
     |
     IP Header
     |
     TCP/UDP Header
     |
     Application Data
     |
 Link Trailer]

That complete structure can then be transmitted over the network.

Encapsulation Flow

The easiest way I remember it is:

Application Data
       ↓
Transport
       ↓
Segment / Datagram
       ↓
Internet
       ↓
Packet
       ↓
Link
       ↓
Frame

The receiving machine performs the reverse operation:

Decapsulation

Frame
   ↓
Packet
   ↓
Transport data unit
   ↓
Application Data

Life of a Web Request

A simplified HTTPS request can be thought of as:

Browser creates request
        ↓
Transport layer handles connection
        ↓
IP adds source/destination addressing
        ↓
Ethernet/Wi-Fi prepares local frame
        ↓
Router receives traffic
        ↓
Routers forward packet
        ↓
Destination network
        ↓
Server receives data

Routers repeatedly inspect the IP-level information while forwarding packets toward their destination. (TryHackMe)

Why Encapsulation Matters in Cybersecurity

Packet-analysis tools such as Wireshark expose these layers.

A captured packet may show:

Ethernet
   ↓
IP
   ↓
TCP
   ↓
HTTP

Understanding encapsulation makes packet captures much easier to read.

Instead of seeing unrelated sections, I can understand:

Each protocol belongs to a different layer.

🛠️ Hands-On / Commands — Task 6

Tools Used

OSI/TCP-IP model
Packet diagrams
Encapsulation
Decapsulation

No major command was required.

My revision diagram was:

Application
    ↓
TCP / UDP
    ↓
IP
    ↓
Ethernet / Wi-Fi
    ↓
Network

And on receipt:

Network
    ↓
Ethernet / Wi-Fi
    ↓
IP
    ↓
TCP / UDP
    ↓
Application

Task 7 — Telnet

This was the practical networking task of the room.

The room introduces:

Telnet

TELNET was originally designed for remote terminal communication, but a Telnet client can also be used to connect manually to a service listening on a TCP port. (TryHackMe)

This makes it useful for understanding a very simple idea:

A TCP service is something listening on an IP address and port that we can connect to and exchange data with.

Basic Telnet Syntax

The general syntax is:

telnet <TARGET_IP> <PORT>

For example:

telnet 192.0.2.10 80

would attempt to establish a TCP connection to port 80 on that example host.

I am intentionally using a documentation/example IP rather than the TryHackMe lab address.

What Telnet Helps Demonstrate

Conceptually:

My Machine
     |
     | TCP connection
     v
Target IP : Target Port
     |
     v
Network Service

If something is listening on the specified TCP port, the client can communicate with it according to that service's protocol.

Talking to an HTTP Server Manually

One of the most interesting exercises is realizing that a browser is not required to send a basic HTTP request.

After connecting to an authorized HTTP server with Telnet, a manually typed request can look like:

GET / HTTP/1.1
Host: example.com

The server may then return an HTTP response.

This makes protocols feel much less mysterious.

A web browser is ultimately performing structured network communication on our behalf.

Closing a Telnet Session

Telnet provides an escape sequence that lets us leave the active connection and return to the client prompt.

I practiced this in the TryHackMe lab rather than reproducing any task-specific server response or challenge answer here.

Why Telnet Is Not Used for Secure Remote Administration

Traditional Telnet does not provide modern encrypted remote administration.

That means credentials and transmitted data may be exposed on the network.

For remote shell access today, a secure protocol such as:

SSH

is preferred.

The room uses Telnet primarily as an educational tool to demonstrate raw TCP communication with services. (TryHackMe)

🛠️ Hands-On / Commands — Task 7

Tools Used

TryHackMe AttackBox
Lab Machine
Terminal
telnet
TCP services
HTTP

Basic connection syntax:

telnet <TARGET_IP> <PORT>

Example using non-lab data:

telnet 192.0.2.10 80

The practical workflow was:

Identify target
      ↓
Identify TCP port
      ↓
Connect with Telnet
      ↓
Send protocol-appropriate text
      ↓
Observe server response
      ↓
Close connection

I am intentionally leaving out the TryHackMe lab's returned messages and submission values.

Task 8 — Conclusion

By the end of the room, the pieces started connecting.

Initially, networking looked like:

Computer A → Computer B

Now I see a much richer process:

Application
     ↓
Application Protocol
     ↓
TCP / UDP + Port
     ↓
IP Address
     ↓
Routing
     ↓
Ethernet / Wi-Fi
     ↓
Physical Network
     ↓
Destination

The room concludes by reviewing the OSI and TCP/IP models, IPv4 addressing and subnets, routing, TCP and UDP, encapsulation, ports, and Telnet-based TCP communication. (TryHackMe)

Complete Learning Flow

                 NETWORKING
                     |
                     v
                 OSI Model
                     |
                     v
                TCP/IP Model
                     |
          ┌──────────┴──────────┐
          |                     |
       Addressing            Transport
          |                     |
      IP Address             TCP / UDP
          |                     |
        Subnet                 Ports
          |                     |
        Routing                 |
          └──────────┬──────────┘
                     |
               Encapsulation
                     |
                     v
               Network Traffic
                     |
                     v
              TCP Communication
                     |
                     v
                   Telnet

Commands / Tools Practiced

Key Lessons Learned

1. The OSI Model Is a Troubleshooting Framework

Instead of memorizing seven names without context, I now think:

Application problem?
        ↓
Layer 7

TCP/UDP or port problem?
        ↓
Layer 4

Routing/IP problem?
        ↓
Layer 3

Local Ethernet/Wi-Fi problem?
        ↓
Layer 2

The layers give us a structured way to reason about network problems.

2. IP Address and Port Solve Different Problems

This distinction became much clearer.

IP Address
    ↓
Which host?

while:

Port
   ↓
Which application/service?

Together:

IP : Port

identifies a network endpoint.

3. Routers Care About Networks

A router's job is not to understand every application.

Its key responsibility is forwarding packets toward the correct network using Layer 3 addressing.

4. TCP and UDP Have Different Goals

TCP is designed around reliable connection-oriented communication.

UDP provides a simpler connectionless transport.

Neither is universally "better."

The choice depends on what the application needs.

5. Encapsulation Explains Packet Captures

Before understanding encapsulation, a packet could look like a confusing collection of headers.

Now I can see:

Ethernet
contains
   ↓
IP
contains
   ↓
TCP/UDP
contains
   ↓
Application Data

That is going to be especially useful later when learning Wireshark and packet analysis.

6. Telnet Made Ports Feel Real

Before this task, a port number could feel like just another number.

Using:

telnet <IP> <PORT>

made the idea much more concrete:

A service is listening there,
and I can communicate with it
using the appropriate protocol.

My Final Mental Model

                  APPLICATION
                      |
                      v
               HTTP / DNS / SSH
                      |
                      v
                  TRANSPORT
                 /         \
               TCP         UDP
                 \         /
                    PORT
                      |
                      v
                    IP
                      |
                  IP ADDRESS
                      |
                      v
                   ROUTER
                      |
                      v
              ETHERNET / WI-FI
                      |
                      v
               PHYSICAL NETWORK

Ethical Learning Note

This article is a learning guide rather than an answer dump.

I included:

✅ Networking concepts
✅ Commands
✅ Generic examples
✅ Packet-flow methodology
✅ Telnet syntax
✅ Cybersecurity relevance

while intentionally excluding:

❌ TryHackMe flags
❌ Lab-specific IP answers
❌ Direct room-question submissions
❌ Telnet challenge responses
❌ Task-specific secret values

The goal is to document what I learned without removing the actual problem-solving experience for someone completing the room.

Resources

• 🌐 TryHackMe Room: Networking Concepts

• 👨‍💻 TryHackMe Profile: sunnysharma11200

• 💻 GitHub Repository: tryhackme-writeups

• ✍️ Hashnode Blog: cybersecurity-learning.hashnode.dev

Connect with Me

• TryHackMe: sunnysharma11200

• GitHub: SunnySharma04

• Hashnode: cybersecurity-learning

• LinkedIn: Sunny Sharma

Happy Learning! 🚀

Spoiler-Free Learning Guide: This article contains no TryHackMe flags, lab-specific values, or direct task answers. It focuses on the concepts, methodology, and Windows commands I practiced while completing the room.

Introduction

After learning the Windows GUI and administrative tools in the Windows Fundamentals rooms, I moved on to the Windows Command Line room.

This room introduced me to cmd.exe, the default Windows command-line interface, and showed how common system-administration tasks can be performed without navigating through graphical menus.

The command line is especially useful in cybersecurity because it is:

Fast
Efficient
Scriptable
Remote-friendly
Low on resource usage

TryHackMe focuses this room on four practical command-line skills: viewing system information, troubleshooting networking, managing files and directories, and working with running processes. (TryHackMe)

The room follows this learning path:

Introduction
     ↓
Basic System Information
     ↓
Network Troubleshooting
     ↓
File & Disk Management
     ↓
Task & Process Management
     ↓
Conclusion

Task 1 — Introduction

What Is the Windows Command Line?

Windows provides a graphical interface for most everyday tasks, but many of the same operations can also be performed by entering commands.

The traditional Windows command-line interpreter is commonly referred to as:

Command Prompt

or:

CMD

Conceptually:

User
  |
  | Types command
  v
Command-Line Interpreter
  |
  v
Windows Operating System
  |
  v
Result

Instead of navigating through several menus to retrieve information, we can often get the same result with a single command.

Why Learn the CLI?

One of the most useful lessons from this task was understanding why security professionals spend so much time in terminals.

Speed

Typing a known command can be significantly faster than navigating through several windows.

Automation

Commands can be placed inside:

Batch files
Scripts
Automation workflows

which makes repetitive operations easier.

Remote Administration

A CLI works particularly well when managing remote machines because it requires far less bandwidth than a complete graphical desktop.

Low Resource Usage

Command-line interfaces generally require fewer CPU, memory, and graphical resources than GUI applications. These are some of the advantages TryHackMe highlights when introducing the room. (TryHackMe)

🛠️ Hands-On / Commands — Task 1

Tools Used

TryHackMe Windows VM
AttackBox
Windows Command Prompt
SSH

A simple way to open Command Prompt on a normal Windows machine is:

Start Menu
   ↓
Search "Command Prompt"

or:

Windows + R

followed by launching the terminal.

Once inside the shell, I started getting comfortable with the prompt:

C:\Users\user>

The path displayed before > tells us our current location.

Task 2 — Basic System Information

Before investigating any machine, one of the first things I want to know is:

What system am I working on?

This task introduces commands for discovering basic Windows information.

TryHackMe covers environment variables, the Windows version, detailed system information, installed drivers, command help, and handling long terminal output. (TryHackMe)

Environment Variables

Windows stores useful configuration information inside environment variables.

These can contain information about:

Operating system
User profile
Temporary folders
Processor
Executable search paths
System directories

A particularly important variable is:

PATH

The PATH tells Windows which directories it should search when we type a command without specifying its full location.

Conceptually:

Type command
     ↓
Windows checks PATH
     ↓
Find executable
     ↓
Run executable

Viewing Environment Variables

A useful command is:

set

This prints the currently defined environment variables.

For example, the output may contain entries such as:

USERNAME=...
OS=Windows_NT
Path=...
TEMP=...

This becomes useful later when investigating system configuration.

Checking the Windows Version

A simple command can display the operating-system version.

The important concept is not memorizing a particular lab value but understanding why version information matters.

Different Windows versions can have:

Different features
Different patches
Different vulnerabilities
Different security protections

During cybersecurity enumeration, identifying the exact operating system and build is often an early step.

Detailed System Information

A much more useful command for system enumeration is:

systeminfo

It provides information such as:

Host name
OS name
OS version
System manufacturer
System type
Processor information
Memory
Boot information
Installed updates
Network information

This makes systeminfo a useful first-look command when working on an unfamiliar Windows host. TryHackMe uses it in this task to demonstrate deeper host enumeration. (TryHackMe)

Working With Long Output

Some commands produce more information than fits in one terminal window.

Instead of rapidly scrolling through everything, output can be piped into:

more

For example:

systeminfo | more

The pipe symbol:

|

takes the output from the command on the left and sends it as input to the command on the right.

Conceptually:

Command A
   |
   | Output
   v
   |
   v
Command B

This was my first useful example of command chaining in Windows.

Getting Help

One of the most valuable habits in command-line work is learning how to retrieve built-in documentation.

For many commands:

command /?

shows available options.

Windows also provides:

help

for supported commands.

This means I do not need to memorize every parameter.

Clearing the Terminal

When the terminal becomes cluttered, it can be cleared using the standard clear-screen command taught in the room.

The broader lesson is simple:

The command line becomes much easier when you learn navigation, help, and output-control commands alongside the main administrative commands.

🛠️ Hands-On / Commands — Task 2

Tools Used

Command Prompt
Environment variables
systeminfo
driverquery
more
Built-in command help

Useful practice:

set

systeminfo

systeminfo | more

driverquery | more

systeminfo /?

These commands use only generic system information and do not reveal the TryHackMe VM's task answers.

Task 3 — Network Troubleshooting

This was one of the most useful tasks from a cybersecurity perspective.

A Windows machine can be investigated entirely from the command line to answer questions such as:

What is my IP address?

What is my default gateway?

Which DNS server am I using?

Can I reach another system?

What route does traffic follow?

Which ports are listening?

Which process owns a connection?

TryHackMe introduces ipconfig, ping, tracert, nslookup, and netstat in this task. (TryHackMe)

Viewing Network Configuration

The basic Windows networking utility provides information about network interfaces.

A standard view may contain:

IPv4 Address
Subnet Mask
Default Gateway

A more detailed view can additionally show:

MAC address
DHCP configuration
DNS servers
Adapter information
Lease information

This is useful when determining how a Windows host is connected to a network.

Understanding the Basic Fields

IP Address

Identifies the host on an IP network.

Computer
   ↓
IP Address
   ↓
Network Identity

Subnet Mask

Helps determine which portion of the IP address represents the local network.

Default Gateway

The router the machine normally uses to reach systems outside its local network.

Conceptually:

Windows PC
    |
    v
Default Gateway
    |
    v
Other Networks / Internet

Testing Connectivity With Ping

ping is one of the most commonly used network troubleshooting tools.

Example:

ping example.com

It sends ICMP echo requests and waits for responses.

A successful response can provide information such as:

Round-trip time
Packet loss
Basic reachability

Conceptually:

My Machine
    |
    | Echo Request
    v
Target
    |
    | Echo Reply
    v
My Machine

A failed ping does not automatically mean the destination is offline, because firewalls may block ICMP traffic.

Tracing the Route

Sometimes knowing that a destination is unreachable is not enough.

We may want to see where the traffic travels.

Windows provides a route-tracing utility that reveals intermediate hops between the source and destination.

Example methodology:

My Computer
     ↓
Router 1
     ↓
Router 2
     ↓
Router 3
     ↓
Destination

TryHackMe demonstrates this with tracert, which uses TTL behaviour to reveal intermediate routers. (TryHackMe)

DNS Lookups

Humans prefer names such as:

example.com

Computers communicate using IP addresses.

DNS provides the mapping:

Domain Name
     ↓
DNS Resolution
     ↓
IP Address

Windows includes:

nslookup example.com

for performing DNS queries.

A different DNS server can also be specified when troubleshooting resolution problems.

For example:

nslookup example.com 1.1.1.1

This is helpful when checking whether a problem comes from:

The domain
The configured DNS server
The local machine
The network

TryHackMe uses nslookup specifically to demonstrate querying both the default and a specified DNS server. (TryHackMe)

Viewing Network Connections

The room also introduces:

netstat

which can display network connections and listening ports.

A basic conceptual output contains:

Protocol
Local Address
Foreign Address
Connection State

For example:

TCP    Local-IP:Port    Remote-IP:Port    ESTABLISHED

Listening vs Established

A port in:

LISTENING

state means an application is waiting for incoming connections.

An:

ESTABLISHED

connection indicates that communication is currently active between two endpoints.

Why netstat Matters in Cybersecurity

An analyst may want to know:

Which ports are open?

Which machine is this host connected to?

Which process opened the connection?

Which PID owns the socket?

TryHackMe demonstrates combining several netstat options to include listening ports, associated executables, PIDs, and numerical addresses. (TryHackMe)

A spoiler-free practice example is:

netstat -ano

which lets me inspect connection state and associated process identifiers without reproducing any room-specific service answers.

🛠️ Hands-On / Commands — Task 3

Tools Used

ipconfig
ping
tracert
nslookup
netstat

Useful independent examples:

ipconfig

ipconfig /all

ping example.com

tracert example.com

nslookup example.com

netstat -ano

The most important learning workflow was:

Check local configuration
        ↓
Test connectivity
        ↓
Trace network path
        ↓
Check DNS
        ↓
Inspect active connections

This is a troubleshooting sequence I can reuse outside this room.

Task 4 — File and Disk Management

After learning system and network enumeration, the next task moves into filesystem navigation.

This is where the command line starts replacing basic File Explorer actions.

TryHackMe covers directory navigation, directory creation and removal, viewing text files, copying and moving files, deleting files, and wildcard matching. (TryHackMe)

Finding My Current Location

When using the GUI, I can visually see which folder I am inside.

In the CLI, I need commands to answer:

Where am I?

The Windows prompt often displays this already:

C:\Users\Example>

The current-directory command can also show it explicitly.

Listing Files and Folders

The basic directory-listing command displays the contents of the current folder.

This may include:

Files
Directories
File sizes
Modification dates
Free disk space

Useful options can also include hidden/system items or recursively search subdirectories. TryHackMe specifically introduces options for hidden/system files and recursive listing. (TryHackMe)

Visualizing Directory Structure

Another useful command displays folders as a tree.

Conceptually:

C:\
├── Users
│   ├── Alice
│   └── Bob
├── Windows
└── Program Files

This is particularly useful when learning an unfamiliar directory structure.

Changing Directories

To move into another folder:

cd Example

To move one level upward:

cd ..

This is the command-line equivalent of double-clicking a folder and then pressing the Back button in File Explorer.

Creating Directories

A new directory can be created with:

mkdir Practice

Conceptually:

Current Directory
       |
       +── Practice

Removing Directories

An empty practice directory can be removed with the matching directory-removal command.

I treated these commands carefully because deletion operations can obviously destroy real data outside a lab.

Reading Text Files

One of the most useful commands in the task prints a text file directly inside the terminal.

This is convenient for small files.

For longer documents, more can display content page by page. TryHackMe explicitly introduces both approaches. (TryHackMe)

Copying Files

A generic example:

copy notes.txt notes-backup.txt

Conceptually:

notes.txt
    |
    | copy
    v
notes-backup.txt

Moving Files

A generic example:

move notes.txt C:\Practice

This changes the file's location rather than creating an additional copy.

TryHackMe demonstrates both copy and move as part of the room's file-management workflow. (TryHackMe)

Deleting Files

Windows Command Prompt provides commands for deleting files.

Unlike normal File Explorer usage, command-line deletion can sometimes bypass the familiar Recycle Bin workflow.

That makes this a command to use carefully.

Wildcards

One particularly useful concept is:

*

The * wildcard can represent multiple matching filenames.

For example:

copy *.txt C:\Practice

means:

Copy every matching .txt file

TryHackMe demonstrates the same wildcard concept with a different file extension. (TryHackMe)

This becomes extremely useful for:

Batch operations
Searching
Copying groups of files
Automation

🛠️ Hands-On / Commands — Task 4

Tools Used

cd
dir
tree
mkdir
rmdir
type
more
copy
move
del / erase
Wildcards

A safe local practice workflow:

mkdir CLI-Practice

cd CLI-Practice

echo Learning Windows CLI > notes.txt

dir

type notes.txt

copy notes.txt backup.txt

dir

move backup.txt ..

This demonstrates the methodology without reading or reproducing the contents of TryHackMe's challenge file.

Task 5 — Task and Process Management

The next task moves from files to running programs.

In Windows Fundamentals, I used Task Manager graphically.

This room shows how similar operations can be performed directly from Command Prompt.

The two main goals are:

View running processes
        ↓
Identify a process
        ↓
Use its PID
        ↓
Manage the process

TryHackMe teaches tasklist, filtering processes, and process termination with taskkill. (TryHackMe)

What Is a Process?

When a program runs, Windows creates a process.

Examples might include:

Web Browser
Text Editor
Windows Service
Security Software
Background Application

Each process has a:

PID

or:

Process Identifier

which uniquely identifies that running instance.

Listing Running Processes

A process-listing command displays information such as:

Image Name
PID
Session
Memory Usage

Conceptually:

Image Name      PID
-------------------
program.exe     1234
service.exe     2345
app.exe         3456

Filtering Processes

A real system may have hundreds of processes.

Searching manually through all of them is inefficient.

Command-line filtering allows us to ask Windows for only the process information we care about.

A generic example could search for:

example.exe

rather than reproducing the specific process requested by the room.

TryHackMe demonstrates process filtering using the /FI option. (TryHackMe)

Terminating a Process

If we know a process PID, Windows provides a command-line mechanism to terminate it.

Conceptually:

Find process
     ↓
Identify PID
     ↓
Terminate PID

This performs a function similar to:

Task Manager
     ↓
Select Process
     ↓
End Task

The room demonstrates this workflow but I am intentionally not reproducing its task-specific PID command. (TryHackMe)

Why Process Management Matters in Cybersecurity

Process enumeration is extremely useful during:

Incident Response
Malware Analysis
Privilege Escalation
System Administration
Threat Hunting
Troubleshooting

Some of the questions a security analyst may ask are:

What is currently running?

Is this executable expected?

Which PID owns a network connection?

Who started this process?

How much memory is it using?

This task also connected nicely with the previous networking task:

netstat
    ↓
Find connection + PID
    ↓
Process listing
    ↓
Identify executable

That connection between network activity and processes is especially useful.

🛠️ Hands-On / Commands — Task 5

Tools Used

tasklist
tasklist filtering
taskkill
PID
Built-in help

Safe examples:

tasklist

tasklist /?

A generic filter:

tasklist /FI "imagename eq explorer.exe"

This teaches the syntax without publishing the exact command requested by the TryHackMe question.

The same rule applies to process termination: understand the syntax and practice only on a process you intentionally started in your own authorized lab.

Task 6 — Conclusion

By the end of the room, I had moved from basic Windows GUI familiarity to being able to investigate a system almost entirely from the terminal.

The complete workflow now looks like:

Windows Command Prompt
        |
        ├── System Enumeration
        │      └── systeminfo
        |
        ├── Network Investigation
        │      ├── ipconfig
        │      ├── ping
        │      ├── tracert
        │      ├── nslookup
        │      └── netstat
        |
        ├── Filesystem Management
        │      ├── cd
        │      ├── dir
        │      ├── tree
        │      ├── copy
        │      └── move
        |
        └── Process Management
               └── tasklist / taskkill

TryHackMe also introduces a few additional Windows utilities in the conclusion, including tools for disk checking, driver enumeration, and system-file integrity checking. (TryHackMe)

Additional Commands Worth Knowing

Check Disk

Windows provides a disk-checking utility that can inspect filesystems and disk volumes for errors.

Driver Enumeration

Installed device drivers can also be listed from the command line.

This can help with:

System inventory
Troubleshooting
Driver investigation

System File Checker

Windows includes a built-in mechanism for checking protected system files for corruption and, when possible, repairing them.

These commands should be understood before being run with administrative privileges on important production systems.

Command Help Is More Important Than Memorization

One of my biggest takeaways from the room was:

I do not need to memorize every Windows command option.

For many commands:

command /?

provides help.

And if the output is too long:

command /? | more

combines two techniques from the room.

TryHackMe explicitly reinforces both /? and the two uses of more in its conclusion. (TryHackMe)

🛠️ Hands-On / Commands — Task 6

Tools Used

Command help
more
chkdsk
driverquery
System File Checker
Windows shutdown utility

Instead of including the exact restart/abort commands asked in the final task, I used:

shutdown /?

to explore the available options myself.

This keeps the guide useful while leaving the room questions for other learners to solve.

Commands I Practiced

Key Lessons Learned

1. Command Line Makes Windows Enumeration Faster

Instead of navigating through multiple windows, I can quickly gather information about:

Operating system
Network
Files
Processes

from one terminal.

2. Networking Commands Work Best as a Workflow

Rather than randomly running commands, I now think in this order:

Check IP configuration
        ↓
Test connectivity
        ↓
Trace route
        ↓
Test DNS
        ↓
Inspect connections

That makes troubleshooting much more systematic.

3. PIDs Connect Processes to Network Activity

This was one of my favorite connections from the room.

A network connection may provide:

PID

and process-management tools can then tell me:

Which executable owns that PID?

So:

Network Connection
       ↓
PID
       ↓
Process

This is directly useful in security investigations.

4. CLI File Management Is Powerful

Commands such as:

copy
move
wildcards

can perform operations across many files much faster than repetitive GUI actions.

That power also means destructive commands need to be used carefully.

5. Built-In Help Is a Skill

Knowing:

command /?

is more useful than trying to memorize every switch.

This makes unfamiliar Windows commands much easier to explore independently.

My Final Mental Model

                 WINDOWS CMD
                      |
        ┌─────────────┼─────────────┐
        |             |             |
      SYSTEM        NETWORK       FILES
        |             |             |
   systeminfo      ipconfig        dir
   environment      ping           cd
   drivers         tracert         tree
                  nslookup        copy
                  netstat         move
        |             |             |
        └─────────────┼─────────────┘
                      |
                   PROCESSES
                      |
                   tasklist
                      |
                     PID
                      |
                  taskkill

Ethical Learning Note

This article is a learning guide, not an answer dump.

I included:

✅ Concepts
✅ Command syntax
✅ Independent examples
✅ Practical methodology
✅ Troubleshooting workflows
✅ Cybersecurity relevance

while intentionally excluding:

❌ TryHackMe flags
❌ Lab-specific system values
❌ Challenge-file contents
❌ Direct answers to task questions
❌ Task-specific PID/service answers

Commands themselves are part of learning Windows administration; examples here use generic targets and values rather than reproducing challenge submissions.

Resources

• 🌐 TryHackMe Room: Windows Command Line

• 👨‍💻 TryHackMe Profile: sunnysharma11200

• 💻 GitHub Repository: tryhackme-writeups

• ✍️ Hashnode Blog: cybersecurity-learning.hashnode.dev

Connect with Me

• TryHackMe: sunnysharma11200

• GitHub: SunnySharma04

• Hashnode: cybersecurity-learning

• LinkedIn: Sunny Sharma

Happy Learning! 🚀

Spoiler-Free Learning Guide: This article contains no TryHackMe flags or direct room-question answers. It focuses on the concepts, Windows utilities, practical methodology, and safe commands I used while completing the room.

Introduction

After completing Windows Fundamentals 1, I moved on to Windows Fundamentals 2 to understand some of the more administrative and diagnostic tools built into Windows.

While the first room focused on areas such as the desktop, NTFS, users, UAC, Control Panel, and Task Manager, this room goes further into utilities used for system configuration, troubleshooting, resource monitoring, system information, command-line administration, and the Windows Registry. (TryHackMe)

The room follows this learning path:

System Configuration
        ↓
UAC Settings
        ↓
Computer Management
        ↓
System Information
        ↓
Resource Monitor
        ↓
Command Prompt
        ↓
Windows Registry

These tools are useful not only for Windows administration but also for cybersecurity activities such as system enumeration, troubleshooting, incident investigation, and understanding how a Windows host is configured.

Task 1 — Introduction

The first task continues directly from Windows Fundamentals 1.

The aim of this room is to explore several Windows utilities that can be used to understand and manage the operating system.

Instead of treating Windows as only a graphical desktop, this room starts showing the operating system from an administrator's perspective.

Some of the major questions we begin asking are:

What starts when Windows boots?

Which services are running?

What hardware is installed?

What resources are processes consuming?

What information does Windows store about itself?

How can we investigate the system from the command line?

The attached lab machine provides a safe Windows environment in which these utilities can be explored. (TryHackMe)

🛠️ Hands-On / Commands — Task 1

Tools Used

TryHackMe Lab Machine
Windows GUI
Start Menu
Run Dialog
Remote Desktop / Browser Lab

This task mainly involved starting the lab environment and preparing to explore Windows administrative utilities.

A useful general workflow throughout the room was:

Windows Search
      ↓
Find utility
      ↓
Open utility
      ↓
Explore tabs / categories
      ↓
Understand what information Windows exposes

No room-specific answers are included here.

Task 2 — System Configuration and Advanced System Settings

One of the main tools introduced in this room is System Configuration.

System Configuration is primarily intended for advanced troubleshooting, particularly when diagnosing startup-related problems. (TryHackMe)

It contains several important tabs:

General
Boot
Services
Startup
Tools

Each one gives us a different view of how Windows starts and what components participate in that startup process.

General

The General tab controls the broad startup configuration.

The available modes include concepts such as:

Normal Startup
Diagnostic Startup
Selective Startup

The idea is useful during troubleshooting.

If Windows behaves incorrectly during a normal startup, an administrator can reduce what loads and determine whether a particular service or component is responsible.

Boot

The Boot tab contains options related to how Windows starts.

This becomes useful when diagnosing operating-system problems.

Conceptually:

Normal Boot
     ↓
Windows loads normally

Troubleshooting Boot
     ↓
Load restricted components
     ↓
Identify possible cause

Services

A Windows service is a special type of application that usually runs in the background.

Unlike an ordinary application that a user launches manually, services often start automatically and provide functionality required by Windows or installed applications. (TryHackMe)

Examples of the types of functionality provided by services include:

Networking
Updates
Logging
Printing
Security
Remote management
Application support

From a cybersecurity perspective, services are extremely important.

During system investigation we may want to know:

Which services exist?

Which services are running?

Which executable launches the service?

What privileges does the service use?

Does it start automatically?

Startup

Startup applications run when a user logs in or when Windows starts.

Modern Windows versions commonly direct users toward Task Manager to manage these startup items. (TryHackMe)

From a security perspective, startup locations are important because legitimate software and malicious software can both attempt to maintain persistence by starting automatically.

Tools

The Tools section acts almost like a launcher for several administrative utilities.

This room explores a number of those utilities individually in later tasks.

That helped me understand that Windows tools are connected rather than completely isolated applications.

Advanced System Settings

Windows also provides advanced settings related to areas such as:

Performance
User Profiles
Startup and Recovery
Environment Variables

Environment variables are particularly useful because they store values that programs and Windows itself can reference.

Examples conceptually include:

Windows installation location
Temporary directories
User directories
Executable search paths

🛠️ Hands-On / Commands — Task 2

Tools Used

System Configuration
Services list
Startup configuration
Advanced System Settings
Environment Variables

For spoiler-free learning, I opened the utility through:

Start Menu
    ↓
Search for "System Configuration"

rather than publishing the specific command where it overlaps with a room question.

A safe terminal exercise is viewing environment variables:

set

PowerShell equivalent:

Get-ChildItem Env:

This lets us see the environment information available to programs running on the machine.

Task 3 — Change UAC Settings

The next task expands on User Account Control, or UAC.

Windows Fundamentals 1 introduced the basic concept.

Windows Fundamentals 2 goes further by showing that UAC itself has configurable notification levels. (TryHackMe)

Why UAC Exists

Suppose a user belongs to the Administrators group.

Without additional controls:

User launches application
        ↓
Application receives powerful privileges
        ↓
Potential system-wide changes

UAC introduces an elevation boundary.

Application needs elevated action
            ↓
        UAC mechanism
            ↓
       User approval
            ↓
     Elevated operation

This reduces the likelihood of programs making administrative changes silently.

UAC Notification Levels

Windows allows the amount of UAC prompting to be adjusted.

Conceptually, the levels range from:

More notification
       ↑
       |
       |
       |
       ↓
Less notification

Reducing notification may feel convenient, but it also reduces visibility into applications attempting to make system-level changes.

Cybersecurity Connection

UAC is not a replacement for:

Antivirus
Application security
Strong passwords
Patch management
Least privilege

Instead, it is another security layer.

This is an important cybersecurity principle:

Defense in Depth

Rather than trusting one protection mechanism, secure systems use multiple controls together.

🛠️ Hands-On / Commands — Task 3

Tools Used

Windows Search
UAC Settings interface
Administrative elevation prompt

The practical activity involved opening the UAC configuration interface and observing the notification slider.

Because the room directly asks learners to identify the executable used to launch this utility, I am intentionally not publishing that executable name.

The goal here is understanding:

Higher notification
        ↓
More visibility into elevation attempts

Lower notification
        ↓
Fewer prompts

rather than copying an answer.

Task 4 — Computer Management

This was one of the most useful tasks in the room.

Computer Management groups several important administrative tools into one interface.

It contains three major categories:

Computer Management
│
├── System Tools
│
├── Storage
│
└── Services and Applications

TryHackMe introduces tools including Task Scheduler, Event Viewer, Device Manager, Disk Management, services, and WMI through this interface. (TryHackMe)

System Tools

Task Scheduler

Task Scheduler allows Windows to automatically execute actions according to configured triggers.

For example:

At system startup
       ↓
Run application

At user login
       ↓
Run script

At scheduled time
       ↓
Perform maintenance task

This is useful for legitimate administration.

It is also extremely important in cybersecurity because scheduled tasks can sometimes be abused for persistence.

An investigator may therefore ask:

Which scheduled tasks exist?

Who created them?

What executable do they launch?

When do they run?

Event Viewer

Windows continuously records many operating-system and application events.

These can be inspected through Event Viewer.

Conceptually:

Something happens
       ↓
Windows records event
       ↓
Event Log
       ↓
Administrator / Analyst investigates

Important Windows log categories include areas such as:

Application
Security
System
Setup

Event logs become extremely important later in:

SOC Analysis
Incident Response
Digital Forensics
Threat Hunting

Device Manager

Device Manager shows hardware recognized by Windows.

It can be used to inspect and configure devices such as:

Network adapters
Storage controllers
Displays
Keyboards
USB devices
Audio devices

This is useful for both troubleshooting and system inventory.

Disk Management

Disk Management provides a graphical interface for managing storage.

Typical tasks include:

Viewing disks
Viewing partitions
Creating volumes
Changing drive letters
Extending partitions
Shrinking partitions

This helped connect the Windows drive letters seen in File Explorer with the actual disk and partition structure underneath.

Services

Computer Management also provides another way to inspect Windows services.

A service typically has properties such as:

Display Name
Service Name
Status
Executable Path
Startup Type

Startup types include concepts such as:

Automatic
Manual
Disabled

Understanding services becomes very important later when studying Windows privilege escalation and persistence.

Windows Management Instrumentation

The room also introduces Windows Management Instrumentation, commonly called WMI.

WMI allows Windows information and management functionality to be accessed programmatically.

It can be used locally or remotely and integrates particularly well with PowerShell. TryHackMe also notes that the older WMIC command-line tool has been deprecated in favor of newer management approaches such as PowerShell. (TryHackMe)

🛠️ Hands-On / Commands — Task 4

Tools Used

Computer Management
Task Scheduler
Event Viewer
Device Manager
Disk Management
Services
WMI

Rather than publishing the exact .msc command requested by the room, I opened Computer Management through:

Start Menu
      ↓
Search "Computer Management"

Safe supplementary commands include:

tasklist

to view running processes, and:

Get-Service

to inspect services from PowerShell.

For example:

Get-Service | Select-Object -First 10

This demonstrates how the graphical Services interface and the command line expose the same underlying Windows information.

Task 5 — System Information

The next utility is System Information.

It provides a much deeper description of the Windows host than simply knowing the operating-system version.

Information is organized into major categories such as:

System Summary
Hardware Resources
Components
Software Environment

The room also revisits environment variables through this utility. (TryHackMe)

System Summary

The summary can reveal information such as:

Operating system
System manufacturer
Computer model
Processor
BIOS information
Installed memory
System architecture

This kind of system inventory can be useful during both troubleshooting and security investigations.

Components

The Components section provides details about hardware and system components.

Examples include information related to:

Display
Network
Storage
Input
Multimedia

Software Environment

The Software Environment area contains information related to software and the operating environment.

This may include areas such as:

Drivers
Environment variables
Running components
Network connections

Why System Information Matters in Cybersecurity

During system enumeration, knowing the exact environment helps answer questions such as:

Which operating system is running?

Is the machine 32-bit or 64-bit?

What hardware is present?

Which drivers exist?

How much memory is installed?

This information can guide later investigation.

🛠️ Hands-On / Commands — Task 5

Tools Used

System Information
Windows GUI
Command Prompt
PowerShell

I used the GUI to explore the different categories rather than publishing any room-answer strings.

For additional system information from Command Prompt:

systeminfo

PowerShell provides another useful option:

Get-ComputerInfo

These commands show how the same machine can be investigated through both graphical and command-line tools.

Task 6 — Resource Monitor

Task Manager gives a quick overview of processes and system usage.

Resource Monitor goes deeper.

The room separates resource information into four major categories:

CPU
Memory
Disk
Network

and provides real-time graphs and detailed process activity. (TryHackMe)

CPU

The CPU section helps identify which processes are consuming processor time.

A troubleshooting workflow might look like:

System feels slow
      ↓
CPU usage is high
      ↓
Identify consuming process
      ↓
Investigate why

Memory

The Memory section shows how RAM is being used.

This helps answer questions such as:

Which process uses the most memory?

How much memory is available?

Is the system under memory pressure?

Disk

Disk monitoring provides information about processes reading from or writing to storage.

This can be useful when a machine appears slow because of heavy disk activity.

Network

The Network section shows network activity associated with processes.

This is especially interesting from a cybersecurity perspective.

An analyst may investigate:

Which process is communicating?

How much data is it transferring?

Which connections are active?

Resource Monitor is therefore a useful bridge between simple Task Manager usage and more advanced monitoring tools.

🛠️ Hands-On / Commands — Task 6

Tools Used

Resource Monitor
CPU tab
Memory tab
Disk tab
Network tab

Because identifying the executable used to launch Resource Monitor is one of the room's questions, I am intentionally not including that executable here.

Instead:

Start Menu
      ↓
Search "Resource Monitor"

is enough to access the tool without turning this guide into an answer sheet.

A safe command-line complement is:

tasklist

or in PowerShell:

Get-Process

For example:

Get-Process | Sort-Object CPU -Descending | Select-Object -First 10

This can help identify processes that have accumulated significant CPU usage.

Task 7 — Command Prompt

This task introduces the Windows Command Prompt more directly.

Even though Windows is primarily graphical, many administrative and troubleshooting operations are much faster from the command line.

TryHackMe focuses on several simple information-gathering commands and the net command family. (TryHackMe)

hostname

One simple command is:

hostname

This displays the computer's hostname.

Conceptually:

Windows machine
      ↓
Computer identity
      ↓
Hostname

Hostnames are important when managing multiple systems or investigating network environments.

whoami

Another extremely useful command is:

whoami

It shows the currently logged-in security identity.

This command appears repeatedly in cybersecurity labs because one of the first questions after obtaining access to a system is:

Which user am I currently operating as?

Getting Help

Windows commands often provide built-in help.

A common pattern is:

command /?

For example:

whoami /?

This is an important habit:

Learn how to ask a command for help instead of trying to memorize every option.

The net Command

The net command provides several subcommands for managing and inspecting Windows resources.

Running:

net

shows available functionality.

TryHackMe explains that help for this command family can be accessed with:

net help

and more specific help can be requested for individual subcommands. (TryHackMe)

For example:

net help user

Useful areas in the net family include concepts such as:

Users
Local groups
Shares
Sessions
Network resources

🛠️ Hands-On / Commands — Task 7

Tools Used

Command Prompt
hostname
whoami
net
Built-in help

Commands I practiced:

hostname

whoami

net

net help

net help user

I deliberately left out the exact networking command/options requested by the room questions.

The point of this section is learning the command-line workflow rather than copying submissions.

Task 8 — Registry Editor

The final major utility introduced is one of the most important Windows components:

The Windows Registry

The Registry is a hierarchical database that Windows uses to store configuration information.

The room describes it as containing information related to areas such as user profiles, installed applications, hardware, application settings, and other system configuration. (TryHackMe)

Registry Structure

At a conceptual level:

Registry
   |
   ├── Root Keys
   |      |
   |      ├── Keys
   |      |    |
   |      |    └── Subkeys
   |      |
   |      └── Values

It behaves somewhat like a hierarchical filesystem, although it is a configuration database rather than a normal collection of files.

Why the Registry Matters

Windows and applications constantly reference Registry information.

Examples include settings related to:

Users
Applications
Hardware
Services
Startup behavior
File associations
System configuration

Registry and Cybersecurity

The Registry becomes extremely important later in cybersecurity.

Attackers may attempt to modify certain Registry locations to:

Establish persistence
Change security configuration
Modify application behavior
Influence startup

Defenders inspect those same locations while investigating systems.

Be Careful With Registry Changes

One of the most important lessons from this task is:

Do not modify Registry values simply because you can.

Incorrect Registry modifications can cause:

Applications to stop working
Windows settings to break
Services to fail
The operating system to behave incorrectly

TryHackMe explicitly warns learners that Registry editing is intended for advanced users and that incorrect changes can affect normal computer operation. (TryHackMe)

🛠️ Hands-On / Commands — Task 8

Tools Used

Registry Editor
Windows Search
Registry hierarchy
Keys
Values

The room directly asks for the executable used to launch Registry Editor, so I am intentionally not publishing that answer here.

Instead:

Start Menu
      ↓
Search "Registry Editor"
      ↓
Open
      ↓
Browse safely

For this beginner room, I focused on viewing and understanding the structure rather than changing Registry values.

Task 9 — Conclusion

The major theme of Windows Fundamentals 2 is that Windows contains a large set of utilities for investigating and managing the operating system.

Many of these utilities can be opened from multiple places:

Start Menu

Windows Search

System Configuration

Run Dialog

Command Prompt

PowerShell

TryHackMe finishes by reinforcing that the utilities explored in the room can be launched independently rather than always going through System Configuration. (TryHackMe)

Full Learning Flow

Windows Fundamentals 1
        ↓
Basic Windows Knowledge
        ↓
Windows Fundamentals 2
        ↓
System Configuration
        ↓
Services & Startup
        ↓
UAC Configuration
        ↓
Computer Management
        ↓
Task Scheduler
        ↓
Event Viewer
        ↓
Disk & Device Management
        ↓
System Information
        ↓
Resource Monitoring
        ↓
Command Prompt
        ↓
Windows Registry

Tools Used

Key Lessons Learned

1. Windows Has Powerful Built-In Administrative Tools

Before this room, many Windows utilities seemed separate.

Now I see them as parts of the same administrative ecosystem:

Configuration
Monitoring
Logging
Storage
Users
Services
Hardware
Registry

2. Event Logs Are Extremely Important

Windows records a huge amount of information about system activity.

That makes Event Viewer particularly relevant for:

Incident Response
SOC Analysis
Forensics
Troubleshooting
Threat Hunting

3. Services and Scheduled Tasks Deserve Attention

Both mechanisms perform legitimate administrative work.

But because they can execute programs automatically, they are also important locations to inspect during security investigations.

4. Resource Usage Can Reveal Suspicious Activity

Unexpected:

CPU usage
Memory usage
Disk activity
Network activity

can provide an early clue that something deserves investigation.

Resource Monitor gives much more detail than simply noticing that a computer is "slow."

5. Command-Line Knowledge Is Essential

GUI tools are useful, but commands such as:

hostname
whoami
net

allow information to be gathered quickly.

The more Windows security I learn, the more important the command line becomes.

6. The Registry Is Central to Windows

The Registry is not just another configuration application.

It is deeply integrated with how Windows and installed applications operate.

Understanding its structure is therefore important for both attackers and defenders.

My Final Mental Model

                     WINDOWS
                        |
        ┌───────────────┼────────────────┐
        |               |                |
 Configuration      Monitoring       Management
        |               |                |
   MSConfig          Resources       Computer Mgmt
        |               |                |
   Services           CPU          Task Scheduler
   Startup            RAM          Event Viewer
   UAC                Disk         Devices
                      Network       Storage
        |               |                |
        └───────────────┼────────────────┘
                        |
                  System Information
                        |
                        v
                    Registry
                        |
                        v
                Windows Configuration

Ethical Learning Note

This article is a learning guide, not an answer sheet.

I included:

✅ Concepts
✅ Tools
✅ Safe commands
✅ Practical methodology
✅ Cybersecurity relevance
✅ My learning observations

while intentionally excluding:

❌ TryHackMe flags
❌ Direct room answers
❌ Question-specific executable names
❌ Lab-specific submissions

This way, other learners can understand the tools while still completing the actual TryHackMe exercises themselves.

Resources

• 🌐 TryHackMe Room: Windows Fundamentals 2

• 👨‍💻 TryHackMe Profile: sunnysharma11200

• 💻 GitHub Repository: tryhackme-writeups

• ✍️ Hashnode Blog: cybersecurity-learning.hashnode.dev

Connect with Me

• TryHackMe: sunnysharma11200

• GitHub: SunnySharma04

• Hashnode: cybersecurity-learning

• LinkedIn: Sunny Sharma

Happy Learning! 🚀

Spoiler-Free Learning Guide: This article contains no TryHackMe flags or direct task answers. It focuses on the concepts, tools, navigation, and commands I used while completing the room.

Introduction

Windows is one of the most widely used operating systems in personal computers and enterprise environments, which also makes understanding Windows essential for anyone learning cybersecurity.

The Windows Fundamentals 1 room introduces the basic structure of Windows before moving toward more advanced topics such as Windows security, Active Directory, privilege escalation, and system administration.

The room covers:

Windows Editions
        ↓
Windows Desktop & GUI
        ↓
Windows File System
        ↓
Windows & System32 Directories
        ↓
Users, Groups & Permissions
        ↓
User Account Control
        ↓
Settings & Control Panel
        ↓
Task Manager

TryHackMe describes this first Windows Fundamentals room as an introduction to the Windows desktop, NTFS file system, UAC, Control Panel, Settings, and Task Manager. (TryHackMe)

Task 1 — Windows Editions

The first task introduces the history and different editions of Microsoft Windows.

Windows has evolved through many generations:

Windows XP
    ↓
Windows Vista
    ↓
Windows 7
    ↓
Windows 8 / 8.1
    ↓
Windows 10
    ↓
Windows 11

Different Windows editions are designed for different types of users.

For example:

Home Users
    ↓
Everyday personal computing

Professional Users
    ↓
Additional management and security features

Enterprise Environments
    ↓
Centralized management and organizational features

Servers
    ↓
Hosting services, applications, users and networks

The room also introduces the idea that Windows editions may have different features depending on their intended use. (TryHackMe)

Why Windows Versions Matter in Cybersecurity

Knowing the exact Windows version running on a system is important.

Different versions can have:

• Different security features

• Different default configurations

• Different vulnerabilities

• Different patch levels

• Different administrative tools

• Different end-of-support dates

During security assessments, identifying the operating system is therefore an important part of reconnaissance.

🛠️ Hands-On / Commands — Task 1

Tools Used

Windows GUI
System Information
Command Prompt
PowerShell

Check Windows Version

A useful command is:

winver

This opens the Windows version information window.

View Detailed System Information

systeminfo

This provides information such as:

OS Name
OS Version
System Manufacturer
System Type
Installed Memory
Boot Time
Network Information

PowerShell Alternative

Get-ComputerInfo

This can provide much more detailed information about the system.

The important cybersecurity habit is:

Before investigating a Windows machine, understand exactly what operating system you are dealing with.

Task 2 — The Desktop (GUI)

After logging into Windows, we interact with the Graphical User Interface (GUI).

The Windows desktop contains several major components. TryHackMe highlights the Desktop, Start Menu, Search, Task View, Taskbar, toolbars, and Notification Area. (TryHackMe)

The Desktop

The Desktop acts as the main workspace.

It can contain:

Files
Folders
Application shortcuts
Recycle Bin
Documents

Users often place frequently accessed items here.

Start Menu

The Start Menu provides quick access to:

Applications
Settings
User options
Power controls
Files
Search

It is one of the primary navigation points in Windows.

Search

Windows Search allows us to quickly locate:

Applications
Files
Folders
System settings
Administrative utilities

For example, instead of manually navigating through menus, we can search:

Task Manager
Control Panel
Computer Management
Services

Taskbar

The Taskbar shows running and pinned applications.

It also provides quick access to system components.

Notification Area

The Notification Area usually appears on the right side of the taskbar.

It contains information and controls related to things such as:

Network
Audio
Date & Time
Notifications
Background applications

Why the GUI Matters for Cybersecurity

A cybersecurity analyst frequently needs to move between:

GUI Tools
   +
Command-Line Tools

For example:

Task Manager
Computer Management
Event Viewer
Registry Editor
Windows Security
Services

are all Windows GUI tools that appear frequently in security investigations.

🛠️ Hands-On / Commands — Task 2

Tools Used

Windows Desktop
Start Menu
Search
Taskbar
Notification Area

A useful command for opening Windows Explorer is:

explorer.exe

You can also quickly open common Windows components through the Run dialog.

Press:

Windows Key + R

For example:

control

opens Control Panel.

And:

taskmgr

opens Task Manager.

The important lesson here was learning that Windows tools can often be accessed in multiple ways:

GUI
Search
Run dialog
Command Prompt
PowerShell

Task 3 — Introduction to Windows

This task moves from theory to the practical Windows lab.

The room provides a Windows machine that can be accessed directly through the browser or remotely. (TryHackMe)

Instead of simply reading about Windows, the goal is to explore an actual system.

Why a Windows Lab Is Useful

Understanding Windows from a cybersecurity perspective requires practical interaction.

For example, it is much easier to understand:

File permissions
User accounts
Processes
System folders
UAC

when working with a real Windows environment.

Remote Desktop

Windows systems can commonly be accessed remotely through:

RDP

or:

Remote Desktop Protocol

RDP provides a graphical session on a remote Windows computer.

Conceptually:

Your Computer
     |
     | RDP
     v
Remote Windows Machine

🛠️ Hands-On / Commands — Task 3

Tools Used

TryHackMe Lab Machine
AttackBox
Remote Desktop
Windows GUI

From a Linux machine, RDP clients such as xfreerdp can be used in authorized labs:

xfreerdp /v:<LAB_IP> /u:<USERNAME>

The actual lab values are intentionally not included here.

From Windows, the built-in Remote Desktop client can be started with:

mstsc

This opens:

Remote Desktop Connection

Task 4 — The File System

One of the most important topics in this room is the Windows file system.

Modern Windows installations commonly use:

NTFS

NTFS provides capabilities beyond older Windows file systems, including permissions, large-file support, compression, encryption-related functionality, and journaling. (TryHackMe)

File-System Structure

Windows commonly organizes files through drive letters.

For example:

C:\

A path might look like:

C:\Users\Example\Documents

Breaking this down:

C:
│
└── Users
    │
    └── Example
        │
        └── Documents

NTFS Permissions

NTFS allows access controls to be applied to files and directories.

Common permissions include:

Full Control
Modify
Read & Execute
List Folder Contents
Read
Write

These permissions become extremely important in cybersecurity.

A poorly configured file permission can sometimes allow:

Unauthorized file access
File modification
Sensitive-data exposure
Privilege escalation

The room demonstrates how these permissions can be viewed from a file or folder's Properties → Security tab. (TryHackMe)

Alternate Data Streams

Another interesting NTFS concept introduced in the room is:

ADS

or:

Alternate Data Streams

ADS allows additional data streams to exist alongside a file's normal content.

This is particularly interesting from a cybersecurity perspective because hidden streams have historically been abused to conceal information, although ADS also has legitimate Windows uses. (TryHackMe)

🛠️ Hands-On / Commands — Task 4

Tools Used

File Explorer
File Properties
Security tab
Command Prompt
PowerShell

Check the Current Directory

cd

List Files

dir

PowerShell equivalent:

Get-ChildItem

or simply:

ls

Move Into a Directory

cd Documents

Go Back One Level

cd ..

View Available Drives

PowerShell:

Get-PSDrive

Inspect File Permissions

Windows includes the useful command:

icacls example.txt

For a directory:

icacls C:\Example

This displays access-control information for the object.

Task 5 — The Windows\System32 Folders

The next task introduces one of the most important locations in Windows:

C:\Windows

This directory contains core Windows operating-system files.

Inside it is another especially important directory:

System32

TryHackMe warns that System32 contains critical operating-system files and that modifying or deleting its contents carelessly can break Windows. (TryHackMe)

Why System32 Matters

System32 contains many important:

Executables
DLL files
System utilities
Configuration components
Administrative tools

A large number of commands frequently used in cybersecurity originate from this area.

Examples include utilities for:

Networking
Process management
User management
System configuration
Diagnostics

Environment Variables

Windows also uses environment variables.

Instead of hard-coding a particular directory location, programs can reference system variables.

Conceptually:

Environment Variable
        ↓
Represents a system value
        ↓
Application uses the value

These variables may contain:

System paths
User directories
Temporary directories
Processor information
Configuration locations

The room introduces Windows-directory environment variables in this task. (TryHackMe)

🛠️ Hands-On / Commands — Task 5

Tools Used

File Explorer
Command Prompt
Environment Variables
System32

View Environment Variables

set

Instead of looking for a specific room answer, this command lets us explore all currently defined variables ourselves.

PowerShell:

Get-ChildItem Env:

Enter the Windows Directory

cd C:\Windows

List files:

dir

Explore System32 Safely

cd C:\Windows\System32

Then:

dir

For a learning lab, browsing the folder is useful.

Deleting or modifying random System32 files is definitely not.

Task 6 — User Accounts, Profiles, and Permissions

Windows systems commonly differentiate between privileged and regular users.

The room introduces two important local account types:

Administrator
Standard User

Administrators can perform system-wide operations, while standard users are more restricted. (TryHackMe)

Administrator Account

An administrator may be allowed to:

Install software
Add/remove users
Modify groups
Change system configuration
Manage permissions
Perform administrative operations

Standard User

A standard user generally works mainly within their own account context.

This follows an important cybersecurity idea:

Principle of Least Privilege

A user should receive:

Only the privileges necessary to perform their job.

If everyone operates permanently with maximum privileges, malware or compromised applications may inherit far more power than necessary.

User Profiles

Windows stores user profiles under:

C:\Users\

Conceptually:

C:\Users
│
├── User1
│   ├── Desktop
│   ├── Documents
│   ├── Downloads
│   └── Pictures
│
└── User2
    ├── Desktop
    ├── Documents
    └── Downloads

The room explains that Windows creates a profile for a user during the user's first login. (TryHackMe)

Users and Groups

Instead of assigning every permission individually, administrators can organize users into groups.

User
  ↓
Group
  ↓
Permissions

A user can also belong to multiple groups.

This model becomes extremely important later when learning:

Windows Administration
Active Directory
Privilege Escalation
Domain Security

🛠️ Hands-On / Commands — Task 6

Tools Used

Local Users and Groups
Windows Settings
Command Prompt
PowerShell

Open Local Users and Groups

From Run:

lusrmgr.msc

This opens:

Local Users and Groups

where we can inspect:

Users
Groups
Memberships
Account properties

TryHackMe specifically introduces this console for exploring local users and groups. (TryHackMe)

Display Current User

whoami

List Local Users

net user

Inspect One Account

net user <USERNAME>

List Local Groups

net localgroup

PowerShell Alternative

Get-LocalUser

and:

Get-LocalGroup

These commands are very useful during Windows enumeration.

Task 7 — User Account Control

This task introduces:

User Account Control (UAC)

Being logged in with an administrator account does not mean every application should automatically execute with maximum privileges.

UAC helps create an additional boundary.

When an operation requires elevated privileges, Windows can ask for approval or administrative credentials. (TryHackMe)

Why UAC Exists

Imagine malware running under a highly privileged account.

Without safeguards:

Malware starts
     ↓
User has administrative privileges
     ↓
Malware gains powerful system access

UAC helps interrupt this process:

Application requests elevated action
             ↓
          UAC Prompt
             ↓
     User approval required

The Shield Icon

You may notice a small shield icon on certain Windows applications.

That usually indicates the program may require elevated privileges.

For example:

Normal program
     ↓
Runs with normal user context

Administrative operation
     ↓
UAC prompt
     ↓
Elevation

🛠️ Hands-On / Commands — Task 7

Tools Used

UAC Prompt
User Accounts
Application Installer
Windows GUI

A common way to intentionally launch something with elevated privileges is:

Right-click application
        ↓
Run as administrator

From PowerShell, a process can request elevation with:

Start-Process powershell -Verb RunAs

Windows then displays the UAC confirmation prompt.

This was useful for understanding the difference between:

Being an administrator

and:

Running a process with elevated privileges

Task 8 — Settings and the Control Panel

Windows currently provides two major interfaces for configuring the operating system:

Settings

and:

Control Panel

TryHackMe explains that Settings is the newer configuration interface while Control Panel remains important for many traditional and advanced Windows settings. (TryHackMe)

Windows Settings

Settings provides modern configuration categories such as:

System
Devices
Network
Personalization
Accounts
Privacy
Updates

Control Panel

Control Panel is the older management interface but is still extremely useful.

It provides access to areas such as:

Programs
User Accounts
Network Settings
System Configuration
Hardware
Administrative Options

Some operations begin inside Settings but eventually open an older Control Panel component. (TryHackMe)

Why Both Matter in Cybersecurity

When investigating Windows systems, documentation might instruct you to navigate through either interface.

Knowing both is useful because:

Modern settings → Settings

Legacy / advanced configuration → Control Panel

🛠️ Hands-On / Commands — Task 8

Tools Used

Windows Settings
Control Panel
Windows Search
Run Dialog

Open Settings

Keyboard shortcut:

Windows + I

Open Control Panel

control

Installed Applications

One way to inspect installed software is:

Control Panel
    ↓
Programs
    ↓
Programs and Features

TryHackMe uses this interface to demonstrate how applications installed on the system can be reviewed. (TryHackMe)

PowerShell can also provide software-related information through various system-management approaches, although later Windows rooms explore administration in greater depth.

Task 9 — Task Manager

Task Manager is one of the most useful built-in Windows tools.

It provides visibility into what is currently happening on the machine.

TryHackMe introduces Task Manager as a way to inspect running applications/processes and system resource usage such as CPU and RAM. (TryHackMe)

What Can Task Manager Show?

Depending on the Windows version, Task Manager can expose areas including:

Processes
Performance
Users
Details
Services
Startup Applications

Processes

Processes show programs currently executing.

Example:

Browser
Explorer
Background services
Security software
System processes

Performance

Performance provides information about:

CPU
Memory
Disk
Network
GPU

This can help identify unusual behavior.

For example:

CPU suddenly at 100%
        ↓
Check Task Manager
        ↓
Identify responsible process

Why Task Manager Matters in Cybersecurity

Task Manager can provide quick clues during investigation.

For example:

Unknown process
Unexpected resource usage
Suspicious startup application
Unexpected user session

It is not a complete forensic tool, but it is an excellent first place to look.

🛠️ Hands-On / Commands — Task 9

Tools Used

Task Manager
Windows GUI
Command Prompt
PowerShell

Open Task Manager from Run:

taskmgr

Another common method is:

Right-click Taskbar
        ↓
Task Manager

The room also encourages learning the dedicated keyboard shortcut, which I am leaving for learners to discover during the room rather than publishing the task answer. (TryHackMe)

Command-Line Process Listing

tasklist

Example structure:

Image Name        PID      Memory Usage
----------------------------------------
process.exe       1234     ...

PowerShell equivalent:

Get-Process

This shows how the GUI and command line expose the same underlying idea:

Task Manager
       ↕
Processes
       ↕
tasklist / Get-Process

Task 10 — Conclusion

Windows Fundamentals 1 provides a broad introduction rather than a deep dive into every Windows subsystem.

The room finishes by pointing toward more advanced Windows concepts and security tools covered later in the Windows Fundamentals series. (TryHackMe)

The complete learning flow for me was:

Windows Editions
       ↓
Desktop & GUI
       ↓
Windows Lab
       ↓
NTFS
       ↓
System Directories
       ↓
Users & Groups
       ↓
Permissions
       ↓
UAC
       ↓
Settings & Control Panel
       ↓
Task Manager

🛠️ Hands-On / Commands — Task 10

No new tool was required in the final task.

Instead, I reviewed the commands encountered throughout the room.

winver
systeminfo
explorer.exe
taskmgr
control
whoami
net user
net localgroup
lusrmgr.msc
tasklist

And some useful PowerShell equivalents:

Get-ComputerInfo
Get-ChildItem
Get-LocalUser
Get-LocalGroup
Get-Process
Get-ChildItem Env:

Tools Used

Key Lessons Learned

1. Windows Knowledge Is Essential for Cybersecurity

Windows is not simply a desktop operating system.

Enterprise environments heavily depend on:

Windows Servers
User Accounts
Permissions
Active Directory
Windows Services
Security Policies

Understanding the fundamentals makes later security topics much easier.

2. File Permissions Matter

NTFS permissions determine:

Who can read?
Who can write?
Who can modify?
Who has full control?

Misconfigured permissions can become security vulnerabilities.

3. Users and Groups Control Access

Instead of looking only at usernames, security professionals also need to ask:

Which groups does this user belong to?

What privileges does that group have?

This becomes especially important in privilege-escalation and Active Directory investigations.

4. Administrative Access Should Be Controlled

The principle of least privilege matters.

More privileges
      =
More potential impact if compromised

UAC is one mechanism Windows uses to reduce unnecessary elevation.

5. GUI and CLI Skills Complement Each Other

I could inspect processes using:

Task Manager

or:

tasklist

I could inspect users through:

Local Users and Groups

or:

net user

Cybersecurity requires being comfortable with both approaches.

My Final Mental Model

                   WINDOWS
                      |
      ┌───────────────┼────────────────┐
      |               |                |
   Filesystem        Users          Processes
      |               |                |
    NTFS          Accounts           Task Manager
      |             Groups              |
 Permissions      Permissions        CPU / RAM
      |               |                |
      └───────────────┼────────────────┘
                      |
                  Security
                      |
              Least Privilege
                      |
                     UAC

Ethical Learning Note

This article is intended as a learning guide, not an answer dump.

I included:

✅ Concepts
✅ Tools
✅ Windows commands
✅ Navigation methods
✅ Practical methodology
✅ Cybersecurity relevance

while intentionally excluding:

❌ TryHackMe answers
❌ Flags
❌ Lab-specific credentials
❌ Direct responses to room questions

The goal is to document what I learned without removing the problem-solving experience for other learners.

Resources

• 🌐 TryHackMe Room: Windows Fundamentals 1

• 👨‍💻 TryHackMe Profile: sunnysharma11200

• 💻 GitHub Repository: tryhackme-writeups

• ✍️ Hashnode Blog: cybersecurity-learning.hashnode.dev

Connect with Me

• TryHackMe: sunnysharma11200

• GitHub: SunnySharma04

• Hashnode: cybersecurity-learning

• LinkedIn: Sunny Sharma

Happy Learning! 🚀

The small padlock beside a website URL looks simple, but there is a lot happening behind it.

When we send passwords, messages, banking information, or other sensitive data across the Internet, that data does not travel directly from our computer to its final destination. It passes through multiple network devices along the way.

So an important security question is:

How can two systems communicate when someone might be able to observe the network between them?

That is one of the problems cryptography helps solve.

The TryHackMe Cryptography Concepts room introduces cryptography without diving immediately into difficult mathematics. Instead, it focuses on plaintext, ciphertext, algorithms, keys, symmetric encryption, asymmetric encryption, the key-distribution problem, certificates, and the way these techniques work together in HTTPS. (TryHackMe)

I have structured these notes task-by-task, similar to the practical phase-oriented format commonly used in detailed TryHackMe write-ups, while deliberately removing the flag/answer-dump aspect.

Task 1 — Introduction

Why Cryptography Matters

The first task connects cryptography with the CIA Triad.

The three major ideas are:

Confidentiality
Integrity
Availability

Cryptography primarily helps us protect confidentiality and detect problems affecting integrity.

Imagine sending confidential information across the Internet:

Sender
   |
   v
Router
   |
   v
ISP
   |
   v
More Routers
   |
   v
Receiver

Without protection, someone who can observe traffic at one of these intermediate points might be able to:

Read the information
Modify the information
Impersonate another system

Cryptography introduces mathematical mechanisms that make this much harder. The room illustrates this using a real-world example of sensitive records being transmitted over networks. (TryHackMe)

Plaintext and Ciphertext

Consider this message:

HELLO

It is understandable to us.

This is plaintext.

After applying encryption, it might appear as something like:

KHOOR

That transformed representation is ciphertext.

The general idea is:

Plaintext
   |
   | Encryption
   v
Ciphertext

At the receiving end:

Ciphertext
   |
   | Decryption
   v
Plaintext

Algorithm and Key

Two important components appear in this process.

Algorithm

The algorithm defines how encryption works.

Think of it as a recipe:

Take the input
Perform certain operations
Use the supplied key
Produce ciphertext

The algorithm itself usually does not need to be secret.

Key

The key controls the particular transformation performed by the algorithm.

An analogy that helped me was:

Algorithm = How a lock works

Key       = The particular metal key
            that opens that lock

Anyone can understand the mechanical design of the lock.

But that does not mean they possess the correct key.

This principle is important in modern cryptography:

Security should come from protecting the key rather than trying to hide how the entire cryptographic algorithm works.

The room explicitly introduces the algorithm as the public method and the key as the secret ingredient controlling encryption and decryption. (TryHackMe)

Encryption Model

A simple model is:

Plaintext
   +
Algorithm
   +
Key
   |
   v
Ciphertext

Or:

P + Algorithm + K → C

The receiver performs:

Ciphertext
   +
Algorithm
   +
Key
   |
   v
Plaintext

This basic pattern continues throughout the rest of the room.

🛠️ Hands-On / Commands — Task 1

Tools Used

TryHackMe browser interface
Web browser
Browser HTTPS / padlock indicator

There was no need for a terminal command in this introductory task.

The important practical observation was something I normally see every day without thinking about it:

https://...

and the security indicator in the browser.

The room starts from this everyday observation and asks what actually protects data as it moves across the Internet. (TryHackMe)

Optional Local Experiment

I also like this simple command for understanding the difference between representation and encryption:

echo -n "HELLO" | xxd -p

This produces hexadecimal data.

To reverse it:

echo "48454c4c4f" | xxd -r -p

Result:

HELLO

This reinforces: