Systems as Attack Vectors

Learn how attackers exploit vulnerable and misconfigured systems, and how you can protect them.

TryHackMe | Systems as Attack Vectors

Introduction

Continue exploring the SOC role in protecting the digital world, now focusing on systems as attack vectors. In this room, you will learn what the systems are, why and how threat groups target them, and what you can do as a SOC analyst to keep your company secure.

Learning Objectives

• Learn the role of a system in a modern digital world
• Explore a variety of real-world attacks targeting systems
• Practice the acquired knowledge in two realistic scenarios

Prerequisites

• Complete the Junior Security Analyst room
• Complete the Humans as Attack Vectors room

Definition Of System

Imagine a castle again, but now with a trained gatekeeper who knows how to identify phishing and how to combat deepfakes. However, if the lock on the main gate is fragile and cheap, guardian skills do not matter, as the enemy can just sneak into the castle while no one is watching. In cyber terms, threat actors can attack insecure systems directly, without the users’ knowledge.

Definition of System

Where do the banks store your cards, or where are your emails stored? The answer — on a system: a physical server, a lab machine, or a cloud platform like Microsoft 365. Protecting such systems is crucial: if the attackers breach one user’s mailbox via phishing, they compromise a single mailbox, but if they breach a mail server, they now control all thousands of mailboxes. Each system type can have a different value for threat actors, for example:

Breached System

• A personal laptop of a school student
• A laptop of the bank’s senior IT administrator
• A mail server of a criminal law company
• A server at the heart of an industrial network
• A government website management panel

Attack Value

• Steal Steam profile and add the PC to a botnet
• Get access to the internal banking systems
• Dump all mailboxes and blackmail the victim
• Encrypt the whole network with ransomware

Q_00: Can cyber attacks happen without victim intervention (Yea/Nay)?

• Yea

Q_01: Can a breach of just a single system lead to disastrous consequences (Yea/Nay)?

• Yea

Attacks On System

In most serious attacks, the first goal is to gain access to the target system. What happens next depends on the attacker’s motivation: stealing data, deploying ransomware, or even destroying information without a way to recover. However, nearly all attacks begin the same way. Let’s look at three examples of how systems are attacked.

Human-Led Attacks

It’s no surprise that system users are often those who start the attack: By inserting a malicious USB found on a street, downloading malware from pirated resources, or simply reusing a weak password everywhere. 81%(opens in new tab) of breaches involve stolen or breached passwords — check out(opens in new tab) your passwords too!

Vulnerabilities

Every piece of software can have security flaws. In 2024, over 40,000(opens in new tab) software vulnerabilities were published and more than 300(opens in new tab) were actively exploited in major attacks. Moreover, IT administrators often increase the risks by setting weak passwords and allowing unrestricted access to their systems.

Supply Chain

Your PC is home to hundreds of apps, including web browsers, messengers, development, and entertainment software. Every app depends on thousands of libraries. If threat actors manage to breach one of the apps or libraries and push an update to all its users, all of them will be compromised. This technique is called a supply chain attack. The most famous examples are the SolarWinds(opens in new tab) and 3CX(opens in new tab) breaches which affected thousands of companies.

Emerging Threat of Supply Chain

It is hard to protect from supply chain attacks since you can’t always control all the software present on your laptops, servers, and web apps. Even TryHackMe once fell victim to a supply chain in Lottie Player, a library used for room animations. As a SOC analyst, you must be ready for such scenarios and know how to respond!

Q_02: What is the term for a security flaw that can be exploited to breach a system?

• Vulnerability

Q_03: What is the name of the attack when malware comes from a trusted app or library?

• Supply Chain

Vulnerabilities

Every piece of software has flaws, but some take years to be discovered. For example, Shellshock(opens in new tab), a major Linux vulnerability, existed since 1992 but wasn’t found until 2014. In the worst-case scenario, attackers discover the vulnerability before anyone else. This is known as a zero-day(opens in new tab), and only your SOC skills can determine whether it gets detected in time.

Once a vulnerability is made public, it is assigned a Common Vulnerabilities and Exposures (CVE(opens in new tab)) number. From that moment, it’s a race: attackers develop exploits while defenders rush to update their systems. Here is the timeline of how Windows vulnerabilities evolve every year:

Responding to Vulnerabilities

An answer to a CVE is always a patch — an update supplied by the software vendor. Even for zero-days, you’ll have to wait for a patch, vigilantly monitor for exploitation traces, and try to survive the stressful period before the patch is released. For example, by:

• Restricting access to the system to only trusted IPs
• Applying temporary measures provided by the vendor
• Blocking known attack patterns on IPS or WAF

Q_04: What is the CVE for the critical SharePoint vulnerability dubbed “ToolShell”?

• CVE-2025–53770

Q_05: How would you respond to a detected vulnerability on your system?

• Patch

Misconfigurations

On the other hand, a misconfiguration isn’t a bug in the software but a mistake in how the system was set up, often by the IT team. These errors happen frequently, usually to make things simpler, like using “1111” instead of typing a long password every time. Let’s take a look at some real-world examples.

• How “123456” password(opens in new tab) exposed chats for 64 million McDonald’s job applications
• How a misconfigured AWS cloud(opens in new tab) resulted in a breach of 106 million bank customers
• How improperly configured smart fridges(opens in new tab) are silently used in full-scale botnet attacks

Another common scenario is when the IT department unknowingly introduces new flaws into secure systems. Below is a simple example of how a critical database can be breached because of the insecure configuration:

Responding to Misconfigurations

Misconfigurations do not require a software update — just a better setup. As a SOC analyst, you’ll often spot them only after threat actors exploit them. However, in smaller companies, you might also be responsible for a more proactive response, for example:

• Penetration Testing: Hire ethical “hackers” who simulate an attack and report on discovered security flaws
• Vulnerability Scans: Periodically run tools that can detect default passwords or outdated software
• Configuration Audits: Manually review the systems to match best practices like CIS benchmarks

Q_06: Can a system patch or software update fix the misconfigurations (Yea/Nay)?

• Nay

Q_07: Which activity involves an authorized cyber attack to detect the misconfigurations?

• Penetration Testing

Practice

Remember our fortress analogy? Attackers are opportunists. They’ll often seek the easiest path, whether through a flaw in the building itself or by manipulating someone to open a door. Attackers don’t see “human hacking” and “system hacking” as separate, so you should apply equal effort into protecting both humans and systems, combining Mitigation and Detection:

Unlike humans, you can’t train the system to spot the attack. However, you can train your IT department to configure the systems and explain how to avoid simple mistakes. Below are the most common mitigation measures to protect your systems:

1. Patch Management

A process of tracking and patching the vulnerable systems significantly reduces the chance of a successful attack

2. Training for IT

If your IT knows the risks of misconfigurations, they are less likely to leave the systems unprotected

3. Network Protection

The system is much harder to breach if access to it is restricted to trusted people or IP addresses

4. Antivirus Protection

Same as with attacks on humans, a good antivirus can stop or at least detect many different attacks

Q_08: What flag did you receive after completing the “Systems at Risk” challenge?

• THM{patch_or_reconfigure?}

Q_09: What flag did you receive after completing the “Remediation Plan” challenge?

• THM{best_systems_defender!}

Conclusion

Even though SOC analysts don’t typically manage systems directly, understanding the common attacks and defenses, and sharing them with the IT department, is a key to broadening your cyber security perspective. If you want to grow quickly and be a strong team player, stay updated on the latest threats and always share the news with others!

• The DFIR Report: How Real Intrusions Happen(opens in new tab)
• CISA: Known Exploited Vulnerabilities Catalog(opens in new tab)
• BleepingComputer: Latest Supply Chain Attacks(opens in new tab)
• CheckPoint: Interactive Live Cyber Threat Map

سُبْحَانَكَ اللَّهُمَّ وَبِحَمْدِكَ، أَشْهَدُ أَنْ لَا إِلَهَ إِلَّا أَنْتَ، أَسْتَغْفِرُكَ وَأَتُوبُ إِلَيْكَ