# CDSA Preparation

<figure><img src="https://4024756925-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FZbLrq3t9Su3CqGmkXz7o%2Fuploads%2FiiAXuUb4phefZDxzdy8K%2Fimage.png?alt=media&#x26;token=16f1bf9b-6165-46de-9033-090e282342b5" alt=""><figcaption></figcaption></figure>

By working through realistic defensive scenarios and hands-on challenges, participants will strengthen their ability to detect, analyze, and respond to security incidents with confidence.

— [Hack The Box](https://app.hackthebox.com/tracks/CDSA-Preparation)

<table><thead><tr><th>HTB Machine</th><th width="219.4000244140625">Difficulty</th><th>Walkthrough </th><th>Notes</th></tr></thead><tbody><tr><td><strong>Unit42</strong></td><td>Very Easy</td><td><a href="https://youtube.com/watch?themeRefresh=1&#x26;v=1qbkZn8JAw8">Unit42 - walkthrough</a></td><td>Using Sysmon logs / Windows event analysis / "backdoored UltraVNC" malware for persistence and initial access.</td></tr><tr><td><strong>Campfire-1</strong></td><td>Very Easy</td><td><a href="https://0xdf.gitlab.io/2024/06/24/htb-sherlock-campfire-1.html?">Campfire-1 - walkthrough</a></td><td>Kerberoasting attack via AD logs and Prefetch/events.</td></tr><tr><td><strong>Recollection</strong></td><td>Easy</td><td><a href="https://medium.com/%40chaoskist/htb-sherlocks-write-up-recollection-f1778e2fe0d9">Recollection -walkthrough </a> </td><td>Memory forensics analysis in Windows 7; obfuscated PowerShell; abandoned "passwords.txt" file; clipboard/history analysis.</td></tr><tr><td><strong>RogueOne</strong></td><td>Easy</td><td><a href="https://www.byteberzerker.com/p/hackthebox-rogueone">RogueOne -walkthrough </a> </td><td>Memory forensics; malicious process identification; C2; netscan analysis of dumps.</td></tr><tr><td><strong>LogJammer</strong></td><td>Easy</td><td><a href="https://0xdf.gitlab.io/2024/05/16/htb-sherlock-logjammer.html"> LogJammer-walkthrough </a> </td><td>Log analysis (Security, System, Defender, Firewall, PowerShell); changes to firewall rules; scheduled tasks; log cleanup.</td></tr><tr><td><strong>Trojan</strong></td><td>Easy</td><td><a href="https://medium.com/%40izzatkhilfi/trojan-htb-15ddde95a712">Trojan - walkthrough </a> </td><td>Memory analysis with Volatility 3; malicious ZIP file; installation of recovery software; investigation of a compromised workstation.</td></tr><tr><td><strong>Tracer</strong></td><td>Easy</td><td><a href="https://medium.com/%40chaoskist/htb-sherlocks-write-up-tracer-126aa22b415e">Tracer - walkthrough  </a></td><td>Use of PsExec lateral movement; Prefetch analysis; “PsExeSvc” service; execution counting; endpoint forensics</td></tr><tr><td><strong>ReliableThreat</strong></td><td>Medium</td><td><a href="https://medium.com/%40chaoskist/hackthebox-sherlocks-write-up-reliablethreat-vscode-extension-leads-to-reverse-shell-and-24cad7896717">ReliableThreat - walkthrough  </a></td><td>Exploitation of a malicious VSCode extension → reverse shell; COM hijack for persistence.</td></tr><tr><td><strong>Jinkies</strong></td><td>Medium</td><td><a href="https://mwalkowski.com/post/sherlock-jinkies/">Jinkies - walkthrough  </a></td><td>Investigation using “LiveResponse / TriageData” artifacts; analysis of folder sharing, use of process logs/registry; OSINT element.</td></tr><tr><td><strong>Detroit Becomes Human</strong></td><td>Hard</td><td><a href="https://medium.com/%40mattv0/htb-detroit-becomes-human-e692300fdec4">Detroit Becomes Human - walkthrough  </a></td><td>Malware via social-media link → execution of malicious installer → staging in “C:\Program Files (x86)\Google\Install\” → script execution → forensic analysis of event logs and PowerShell.</td></tr><tr><td><strong>Streamer</strong></td><td>Hard</td><td>-— </td><td>--— </td></tr></tbody></table>
