Itsybitsy Walkthrough

ItsyBitsy - TryHackMe Walkthrough#

Challenge Information#

Scenario#

During routine SOC monitoring, Analyst John observed an IDS alert indicating potential Command and Control (C2) communication originating from a user named Browne in the HR department.

A suspicious file containing a pattern matching:

THM{________}

was reportedly accessed.

Due to limited resources, only HTTP connection logs were collected and ingested into Kibana under the index:

connection_logs

Our task is to investigate the logs and answer the provided questions.

Initial Investigation#

Access the Kibana dashboard and select:

connection_logs

Since the scenario references activity occurring during March 2022, configure the date range accordingly.

March 1, 2022
to
March 31, 2022

This ensures the investigation focuses on the relevant timeframe.

Question 1#

How many events were returned for the month of March 2022?#

After setting the correct time filter and reviewing the event count, Kibana returns:

1482

Answer#

1482

Analysis#

This provides the total number of HTTP events available for investigation during the specified period.

Question 2#

What is the IP associated with the suspected user in the logs?#

To identify the user’s machine, examine the:

source_ip

field within Kibana.

Top values observed:

192.166.65.52
192.166.65.54

Reviewing the suspicious activity reveals that the compromised host is:

Answer#

192.166.65.54

Analysis#

This source IP appears repeatedly throughout the malicious activity timeline and is responsible for the suspicious outbound connections.

Question 3#

The user’s machine used a legitimate Windows binary to download a file from the C2 server. What is the name of the binary?#

Filtering activity associated with the infected host reveals the following user agent:

bitsadmin

Answer#

bitsadmin

Analysis#

Bitsadmin is a legitimate Microsoft utility used for file transfers.

Attackers frequently abuse it because:

• It is trusted by Windows
• It can download payloads
• It often bypasses basic security controls

This technique maps closely to:

MITRE ATT&CK T1197
BITS Jobs

Question 4#

The infected machine connected with a famous file-sharing site that also acted as a C2 server. What is the name of the site?#

Filtering the logs associated with:

192.166.65.54

reveals outbound HTTP connections to:

pastebin.com

Answer#

pastebin.com

Analysis#

Pastebin is frequently abused by attackers for:

• Payload hosting
• Command retrieval
• Data exfiltration
• Malware configuration storage

Because it is a legitimate service, traffic to it often blends into normal network activity.

Question 5#

What is the full URL of the C2 to which the infected host connected?#

Reviewing the relevant HTTP request reveals:

Host: pastebin.com
URI: /yTg0Ah6a

Combining these values gives the complete URL.

Answer#

pastebin.com/yTg0Ah6a

Analysis#

The event details show:

Source IP: 192.166.65.54
User Agent: bitsadmin
Status: 200 OK

This strongly suggests the host successfully retrieved content from the remote server.

Question 6#

A file was accessed on the file-sharing site. What is the name of the file?#

Visiting the identified Pastebin location reveals the referenced file.

Answer#

secret.txt

Analysis#

The retrieved file appears to contain the malicious content referenced in the investigation scenario.

Question 7#

What is the flag contained within the file?#

Opening the contents of:

secret.txt

reveals the challenge flag.

Answer#

THM{SECRET__CODE}

Timeline of Activity#

March 2022
       │
       ▼
IDS Alert Triggered
       │
       ▼
Suspicious Host Identified
       │
       ▼
192.166.65.54
       │
       ▼
Outbound HTTP Traffic
       │
       ▼
bitsadmin Activity
       │
       ▼
Connection to pastebin.com
       │
       ▼
Accessed /yTg0Ah6a
       │
       ▼
Retrieved secret.txt
       │
       ▼
Flag Discovered

Indicators of Compromise (IOCs)#

Source IP#

192.166.65.54

User Agent#

bitsadmin

Domain#

pastebin.com

URL#

pastebin.com/yTg0Ah6a

Retrieved File#

secret.txt

Final Answers#

Key Takeaways#

• Kibana provides powerful visibility into HTTP traffic and user activity.
• Time-based filtering significantly reduces investigation noise.
• Legitimate administrative utilities such as Bitsadmin are frequently abused by attackers.
• Public services like Pastebin are often leveraged as low-cost command-and-control infrastructure.
• User-agent analysis can quickly reveal attacker tooling.
• Correlating source IPs, URLs, and file access patterns is essential during network investigations.

Challenge completed successfully.

Adapted from naval0505/TryHackMe—Writeups under MIT.