Has Anyone Ever Heard of Threat Hunting Labs?
Source Reddit Cybersecurity
Discussion
This report discusses a user experience with a subscription-based threat hunting lab environment called Threat Hunting Labs. The user found the platform's lab environments inaccessible via typical SIEM tools and noted that the training questions were sometimes unclear or overly complex. The platform provided answers after multiple incorrect attempts, which the user felt undermined the learning process. There is no indication of a security vulnerability or threat associated with the platform itself.
r/cybersecurity (opens in a new tab)u/Baller29080 points0 comments
BLUF: Used a subscription-based lab environment that made me completely doubt my experience in threat hunting. I have used SIEM and threat hunting tools in the past through other lab environments and on the job. Am I the only one?
Website: https://www.threathuntinglabs.com/
I could not find anything about it but from some colleagues of mine and was interested in increasing my threat hunting skills.
At first, the website was very flashy and had a lot going on. It even looked pretty well structured. I decided to get a membership since it looked like it was right up my alley (big mistake).
I purchased a subscription and everything kinda fell apart from there. They provided "lab" environments (either Elastic or Splunk) which I could not even access and made me do everything via a query language in a console. I was really hoping to do the labs with a SIEM, but that wasn't the case.
After that, some of the questions were not straight-forward. Some of them were not simple, for example, what was the process used for LOTL? Those was easy to figure out.
Then another question asked was along the lines of what does powershell command is used for running code? Easy, IEX, right? Wrong. It was a whole sentence needing to explain PowerShell and the use of IEX. I understand context helps, but it was irrelevant to looking through the logs.
Last thing that took the cake was answering the questions. I would give two wrong answers then it would just flat out give me the correct answer, which removes the point of learning? At that point you will just remember answers and get them all correct.
Please let me know if either I just need to "get good" or if you have had a similar experience. Thanks!
Edit: added some context to the labs