Detection and Analysis (THM) Tryhackme Walkthrough
Description : Understand the Detection and Analysis phase of the Incident Response Lifecycle.
Difficulty : Medium
Note : All of the content and images are from https://tryhackme.com/
Room : https://tryhackme.com/room/detectionandanalysis
Enjoy.
Task 1 Introduction
The Detection and Analysis phase is where the incident response process begins. An alert has been raised at Nexus Financial. Your job is to confirm whether a security incident has occurred, understand how the attacker got in, and determine the full extent of the damage. Every decision that you make in the upcoming rooms depends on how thoroughly this phase is completed.
Learning Objectives
- Understand what Detection and Analysis means as a NIST IR phase
- Understand how detection and analysis work together to build the full picture of an incident
- Recognize the feedback loop between detection and analysis
- Explore the common IR triggers
- Learn about team communication during an IR
- Apply detection and analysis to investigate a compromised account using Splunk
Prerequisites
Familiarity with Splunk SPL queries is required for the practical tasks. It is also recommended to complete the Microsoft 365 for the SOC module before starting this room
Note: This is Room 2 of 4 in the Incident Response module. The preparation gaps identified in the Preparation room are the exact vulnerabilities the attacker exploits here. What you find in this room feeds directly into the Response and Recovery room.
Answer the questions below
Q1.) I am ready to start!
Answer : No answer needed
Task 2 Detection and Analysis
According to NIST SP 800–61r2, Detection and Analysis is the phase where the team responsible for incident response determines whether a security incident has occurred and builds a complete understanding of it. In large organizations, this work is handled by a dedicated IR team that is separate from the SOC. However, in many organizations, particularly smaller ones like Nexus Financial, there is no dedicated IR function. Instead, SOC analysts take on the IR role themselves. L1 analysts handle initial triage and escalation. L2 and L3 analysts lead the deeper investigation and response. The SOC team effectively becomes the IR team. At Nexus Financial, this is exactly the case.
This phase answers two fundamental questions:
- Did a security incident occur, and how did the attacker get in?
- What is the full extent of the damage?
Think of it like a fire investigation. Detection confirms that a fire has started and is real, not a false alarm. Analysis is understanding how it started, which rooms it reached, and what damage it caused. Skipping either step means risking a fire that reignites somewhere you never checked.
Detection
Detection is the process of confirming that a security incident has actually occurred. It begins the moment a potential threat is noticed, whether through a SIEM alert, a user report, or an automated detection. Not every alert represents a real incident. The first step is always determining whether the alert is a true positive or a false positive.
The L1 analyst does not investigate the full incident. They confirm it exists and pass it up with enough context for the next level to take over. Your first job as the assigned L2 analyst is to validate the L1 analyst’s finding without assuming it is entirely correct. From there, you extend the investigation, find what the L1 could not see from triage alone, and confirm the incident is real.
Analysis
Once an incident is confirmed, the analysis begins. Analysis is the process of understanding the full picture of what happened. This goes beyond simply confirming the incident exists. It means answering deeper questions about the attack:
- How did the attacker gain initial access?
- Which accounts and systems were affected?
- What data may have been accessed or exfiltrated?
- What actions did the attacker take after gaining access?
Scoping is a core part of analysis. It means identifying every affected account, every system accessed, and every piece of data that may have been compromised. But analysis is broader than scoping alone. It also includes correlating evidence across multiple log sources, mapping attacker behavior to known techniques, and building the complete narrative of what happened from the first malicious action to the point of detection.
Poor analysis is one of the most common causes of failed incident response. If the team does not fully understand what was compromised and how, they cannot fully eradicate the threat. An attacker who retains access to even one overlooked account or persistence mechanism can undo weeks of remediation work.
The Feedback Loop
Detection and analysis feed into each other continuously. A new IOC uncovered during analysis may reveal an additional compromised account. That account may lead to further detection of attacker activity that was previously unknown. This cycle continues until no new evidence is emerging and the full picture is confirmed with confidence.
Answer the questions below
Q1.) What term describes the process of confirming a security incident has actually occurred?
Answer : Detection
Q2.) What term describes the process of understanding the full extent of an incident, including affected accounts, systems, and data?
Answer : Analysis
Task 3 IR Triggers and Communication
Common IR Triggers
Each trigger source has a different detection window. A SIEM alert fires within minutes of suspicious activity. A user report may come hours later. A third-party notification could arrive days after a breach has already occurred. This is why organizations that rely on a single trigger source will always have a longer dwell time than those with multiple detection channels active. In the Nexus Financial incident covered in the upcoming tasks, the trigger was a SOC alert escalation. The alert itself was only possible because a basic geo-location detection rule existed in Splunk. Without that rule, the incident may have gone undetected entirely, which connects directly to the detection gap identified in the pentest report you reviewed in the Preparation room.
Team Communication During IR
Effective communication is as important as technical skill during an active incident. Common communication failures that slow down IR investigations include:
- Delayed escalation because no clear escalation path is defined
- Key people not being notified because contact lists are outdated
- IT teams unable to provide log access for hours due to approval processes
- MSSP or third-party providers taking days to respond to access requests
- Verbal updates that are never documented, creating gaps in the evidence trail
These delays have real consequences. Every hour an attacker remains uncontained is an hour they can use to deepen their access, exfiltrate more data, or establish additional persistence. A well-defined communication plan with clear escalation timelines directly reduces the time between detection and containment. As you saw in the Preparation room, Nexus Financial’s IR policy does not currently define a maximum response time between incident declaration and initial containment, a gap that will matter in this investigation.
Ticketing systems play an important role in keeping communication organized. Every action taken, every finding made, and every decision reached during the investigation should be logged in a ticket. This creates an auditable trail that supports post-incident review and lessons learned documentation.
Answer the questions below
Q1.) What type of IR trigger would a threat intelligence provider notifying an organization of a compromise be classified as?
Answer : Third-party notification
Q2.) What system should be used to log every action, finding, and decision made during an IR investigation?
Answer : Ticketing System
Task 4 Asset Inventory and IOC Tracker
Two tools are essential throughout the Detection and Analysis phase: the asset inventory and the IOC Tracker. Together, they provide a structured way to map what exists in the environment and track every malicious indicator found during the investigation.
The Asset Inventory
The asset inventory is a reference document that lists all systems, devices, and platforms within the organization. During analysis, the IR team uses it to answer questions like: which systems did this account have access to? Who owns this IP address? What other accounts are associated with this workstation?
Without an accurate asset inventory, analysis becomes difficult. The team may miss affected systems simply because they did not know they existed. This is why maintaining an up-to-date asset inventory is a core preparation requirement, a gap that Nexus Financial’s own inventory acknowledges, noting that mobile devices are not currently tracked.
The IOC Tracker is a living document. It is updated throughout every phase of the investigation. Every IOC you find in this room will carry forward into the rooms that follow.
Answer the questions below
Q1.) What does IOC stand for?
Answer : Indicator of Compromise
Q2.) What IR tool provides a running record of every malicious indicator discovered during an investigation?
Answer : IOC Tracker
Task 5 Current Incident Context
In the Preparation room, you reviewed Nexus Financial’s preparation state and found an organization with critical gaps left unaddressed. No MFA on standard user accounts, missing email authentication controls, a previous phishing incident closed without fixing the root cause, and detection rules that did not cover key threat scenarios. It looks like those gaps have now been exploited.
Get Lawvye’s stories in your inbox
Join Medium for free to get updates from this writer.
An anomalous sign-in alert was raised by the SIEM platform and triaged by Marcus Webb, Nexus Financial’s L1 Security Analyst. Marcus confirmed the alert as a true positive and escalated it. You have been assigned to the investigation as the L2 analyst responsible for validating Marcus’s findings and leading the full IR investigation.
Below is the SIEM alert that Marcus Webb received and triaged.
Alert Details:
- Alert Name: Anomalous Sign-in Detected
- Time: 2026–03–30 16:41:30
- Affected Account: l.chen@nexusfinancial.thm
- Corporate IP: 197.32.45.112
After triaging the alert, Marcus marked the alert as a true positive and raised the following escalation ticket.
A SIEM alert triggered on a successful sign-in to a Nexus Financial user account from an IP address that was never observed in the environment before. All Nexus Financial employees work from the London office (IP: 197.32.45.112) and are expected to sign in from the corporate network. This sign-in came from outside the United Kingdom. Laura Chen (Finance Manager) has confirmed she did not initiate this sign-in. Initial triage indicates this is a true positive requiring full IR investigation.
Escalation Details:
- Ticket ID: NXF-SOC-2026–0312
- Raised by: Marcus Webb, Security Analyst (L1)
- Assigned to: IR Analyst (L2)
- Severity: High
- Affected Account: l.chen@nexusfinancial.thm
That is all you have been given. The rest is yours to find.
Answer the questions below
Q1.) I am ready for the Practical tasks!
Answer : No answer needed
Task 6 Detection Practical
You have been handed an escalation from Marcus Webb confirming a suspicious sign-in on the Nexus Financial account l.chen@nexusfinancial.thm, belonging to Laura Chen, Finance Manager. The escalation ticket provides the corporate IP address and confirms that this sign-in originated entirely outside the United Kingdom.
This task focuses on the detection side of the phase. Your job is to confirm the suspicious activity in the logs, validate Marcus’s finding, and trace the attack back to its origin. Start with the Entra ID sign-in logs. Filter for sign-in activity on Laura Chen’s account and look for anything that does not match the corporate IP. Once you have confirmed the suspicious sign-in, think about how the attacker obtained Laura’s credentials in the first place. Pivot to the Message Trace and look at what was delivered to her account before the suspicious sign-in occurred.
Use the log sources, sourcetypes, and fields listed in Task 5 to build your queries. The questions below will guide your investigation.
Answer the questions below
Q1.) What was the IP address from which these suspicious sign-in events originated?
Query :
index=ir sourcetype="azure:aad:signin" userPrincipalName="l.chen@nexusfinancial.thm" ipAddress!="197.32.45.112"
Answer : 223.123.4.50
Q2.) What city did the suspicious sign-in originate from?
Answer : Amsterdam
Q3.) What was the exact timestamp of the first suspicious sign-in on Laura Chen’s account? (Format: YYYY-MM-DD HH:MM:SS)
Answer : 2026–03–30 16:41:30
Q4.) What was the subject line of the email delivered to Laura Chen before the suspicious sign-in?
Query :
index=ir sourcetype="o365:reporting:messagetrace" RecipientAddress="l.chen@nexusfinancial.thm"
Answer : HR Policy Update — Immediate Action Required
Q5.) What was the sender domain of the phishing email?
Answer : nexus-verify.thm
Task 7 Analysis Practical
You have confirmed the initial compromise of Laura Chen’s account and identified the phishing email that delivered it. This task focuses on the analysis side of the phase. Now that detection is confirmed, you need to analyze the full extent of the incident, understanding exactly what the attacker did, which other accounts were affected, and what actions were taken inside the environment after gaining access.
Search across all Nexus Financial accounts for sign-in activity from the attacker’s IP. Then look beyond the sign-in logs. A threat actor who has just gained access to a mailbox will typically act quickly to secure their position before being detected. Review the Unified Audit Logs to see which operations were performed from the attacker’s IP address within the environment.
Finally, go back to the Message Trace. The phishing email that compromised Laura Chen’s account may not have been the only one sent. Understanding the full delivery scope tells you how many accounts were at risk from the very beginning.
Use the log sources, sourcetypes, and fields listed in Task 5 to build your queries. The questions below will guide your investigation.
Answer the questions below
Q1.) How many Nexus Financial accounts show sign-in activity from the attacker’s IP?
Query :
index=ir sourcetype="azure:aad:signin" ipAddress="223.123.4.50"
| stats count by userPrincipalName
Answer : 2
Q2.) What is the email address of the second compromised account?
Answer : k.patel@nexusfinancial.thm
Q3.) What is the name of the inbox rule created on Laura Chen’s account?
Query :
index=ir sourcetype="o365:management:activity" Operation="New-InboxRule" UserId="l.chen@nexusfinancial.thm"
| table _time, UserId, Operation, Name, ClientIP
Answer : Junk Filter Update
Q4.) How many Nexus Financial employee accounts received the initial phishing email?
Query :
index=ir sourcetype="o365:reporting:messagetrace" SenderAddress="*@nexus-verify.thm"
| stats count by RecipientAddress
Answer : 2
Task 8 Conclusion
In this room, we covered the Detection and Analysis phase of the NIST SP 800–61r2 incident response framework. We explored how detection and analysis work together to build the full picture of an incident. Detection confirms what happened and how the attacker got in, and analysis determines the full extent of the damage. We also saw how these two activities feed into each other continuously, how the L1 to L2 handoff works, and why communication failures during IR directly increase the time an attacker has to operate undetected.
In the practical tasks, starting with a single escalation ticket, we traced the attacker’s IP address through sign-in logs, identified the phishing email that delivered the initial compromise, identified every account targeted by the campaign, and discovered the attacker’s first post-compromise action within the Nexus Financial environment.
In the next room, Response and Recovery (coming soon!), the scope is confirmed. Your role shifts from understanding the incident to stopping it from getting worse and removing the attacker from the environment entirely.
Answer the questions below
Q1.) Great work! You are now ready for the next room: Response and Recovery (coming soon!).
Answer : No answer needed
I hope you enjoyed reading this post as much as I enjoyed writing it.
Thanks for reading my blog sir ;)
Lawvye
