Study guide
9.3 Initial Access (RDP/SSH), Persistence, Privilege Escalation
TryHackMe Security Analyst Level 1 SAL1
Track your progress as you read
Finished sections get a check mark.
1 Introduction & Exam Overview
1.1 Current SAL1 Exam Facts 1.2 24-Hour Window, Check-In, and Delivery 1.3 Scoring, Retakes, Validity, and Access 1.4 MCQ Section Strategy
2 SOC Simulator Exam Skills
2.1 Analyst VM, Splunk, and Dynamic Alerts 2.2 Classification and Escalation Scoring 2.3 Case Reports and Investigation Notes
3 Network Essentials
3.1 OSI, TCP/IP, Devices, and the Three-Way Handshake 3.2 HTTP, TLS, VPN, Web Browsing, and Email Transmission
4 Operating System Basics
4.1 Windows and Linux Architecture, Auth, Filesystems, Processes 4.2 Active Directory and Event Logs for Tracing Activity
5 Cryptography, Cloud, Web and Scripting Basics
5.1 Encoding, Encryption, Hashing, and Decoding Tools 5.2 VMs vs Hosts, Cloud vs Virtual Hosting, SaaS and IaaS 5.3 Web Apps, APIs, JSON/XML, Scripts vs Compiled Programs
6 Cybersecurity Fundamentals and MITRE ATT&CK
6.1 CIA, Least Privilege, Human Factors, Log4Shell, EternalBlue 6.2 Navigating MITRE ATT&CK: Tactics, Techniques, Sub-techniques 6.3 Mapping Real Attacks onto ATT&CK Techniques
7 Kill Chain, NIST CSF, and Attack Indicators
7.1 Cyber Kill Chain Stages vs MITRE ATT&CK 7.2 NIST CSF: Identify, Protect, Detect, Respond, Recover 7.3 IoC vs IoA and the Pyramid of Pain
8 Social Engineering and Network Attacks
8.1 Phishing: Impersonation, Typosquatting, Spoofing, Header Analysis 8.2 SPF, DKIM, DMARC, and Email Authentication Results 8.3 Port Scanning, DDoS, and Man-in-the-Middle 8.4 DNS Poisoning, ARP Spoofing, Exfiltration, and C2 Traffic Patterns
9 Web Exploitation and Endpoint Attacks
9.1 Client vs Server Vulnerabilities, XSS, and SQL Injection 9.2 Code Injection, Path Traversal, Input Validation, Patching, WAF 9.3 Initial Access (RDP/SSH), Persistence, Privilege Escalation 9.4 Credential Theft, Mimikatz, Sysmon, and Auditd
10 Command and Control, Malware, and LOLBAS
10.1 Forward vs Reverse Shells, Beaconing, Metasploit, Cobalt Strike 10.2 Malware Types, Static vs Dynamic Analysis, LOLBAS
11 EDR, Firewalls, and WAF
11.1 EDR vs AV, Telemetry, Containment, Remote Shell 11.2 Firewall Deployments, Limits, and Log Analysis 11.3 WAF Capabilities, Limits, and Rule Creation
12 SIEM and SOAR
12.1 SIEM Deployments, Parsing, and Raw Logs to Alerts 12.2 Alert Management, Threat Hunting, Triage, Reporting 12.3 SOAR Playbooks, Enrichment, and TI Integration
13 Threat Intelligence and Vulnerability Scanning
13.1 Feeds, Indicators, Classifying IPs, Domains, and Hashes 13.2 YARA and TI Integration with SIEM/SOAR 13.3 External vs Internal, Web vs Network Scanning
14 SOC Team, Activities, and Alert Triage
14.1 Blue/Red Teams, Hierarchy, and SOC Roles 14.2 Proactive vs Reactive: FP Remediation, Detection Engineering, Tabletop, DFIR, Threat Hunting 14.3 Workbooks; Ticket vs Alert vs Detection Rule 14.4 Triage Workflow, Severity, Status, and Verdicts
15 SOC Metrics, Escalation, and Communication
15.1 MTTA, MTTD, MTTR, SLA, and Lookups 15.2 Escalation Matrix, Urgent Remediation, and Cross-Team Communication
9.3 Initial Access (RDP/SSH), Persistence, Privilege Escalation
Key Takeaways Explain This Topic AI
Remote Desktop Protocol (RDP) initial access on Windows commonly appears as Security Event 4624 with Logon Type 10 (RemoteInteractive); SSH initial access on Linux appears as sshd Accepted password or publickey lines.
Persistence is recognized from surviving reboot or logoff: Windows Event 7045 (service installed), scheduled-task creation, Run keys, Linux cron, and SSH authorized_keys changes.
Privilege escalation is the increase of rights on an already compromised endpoint — local Administrators membership, sudoers changes, or token abuse — not the first packet of a scan.
Without host authentication, process, and persistence logging, an analyst can see a VPN login and still miss how the endpoint stayed owned after reboot.
Correlate initial-access logons with the next persistence event on the same account and host; a help-desk RDP session followed by 7045 is a different story from RDP alone.
Last updated: September 2026
Initial access over RDP and SSH
SAL1 Endpoint Attacks content focuses on how attackers gain access to endpoints and keep control. Two remote administration channels appear constantly in real SOC queues: Remote Desktop Protocol (RDP) on Windows and Secure Shell (SSH) on Linux and network devices. Both are legitimate tools. Both are initial-access methods when the account, the source network, or the timing is wrong.
RDP recognition. A successful Windows logon is Security Event 4624 . The Logon Type field tells you the class of session. Type 10 is RemoteInteractive — the type most associated with RDP (and similar interactive remote desktop paths). Type 2 is a local console. Type 3 is a network logon (shares, many remote management APIs). Type 7 is an unlock. Analysts who treat every 4624 as RDP will drown in file-share noise. Analysts who ignore Type 10 from unusual countries, disabled jump-host ranges, or accounts that never use RDP will miss initial access.
- Worked, sanitized Windows snippet: Time: 2026-09-18T02:14:33Z
- EventID: 4624
- LogonType: 10
- TargetUser: helpdesk.jlee
- IpAddress: 198.51.100.88
- WorkstationName: -
- LogonProcess: User32
- Auth: Negotiate
- Host: DESKTOP-FINANCE07
Questions that turn this into a case: does helpdesk.jlee RDP to finance workstations at 02:14 UTC? Is 198.51.100.88 a known VPN egress or a consumer ISP? Was there a 4625 failure burst before the 4624 (spray) or a single success (stolen password or brokered session)? Follow-on Event 4627 group membership and 4672 special privileges tell you whether the session already had admin-equivalent rights.
SSH recognition. On Linux, sshd writes to auth.log , secure , or the journal. The line you want is Accepted with the method ( password or publickey ), the account, the source address, and the port. Failed passwords ( Failed password ) are reconnaissance or spray. A success from a new key fingerprint after no change ticket is credential or key theft, not "the user learned SSH."
Worked, sanitized syslog: 2026-09-18T02:16:01Z sshd[21904]: Accepted publickey for deploy from 203.0.113.40 port 51122 ssh2: RSA SHA256:aaaaexamplefingerprint
2026-09-18T02:16:02Z systemd-logind: New session 882 of user deploy
Impact of initial access: the adversary now has a process and a home directory on a managed host. Data, lateral movement, and ransomware staging all become possible. Detection depends on whether 4624 Type 10 and sshd Accepted lines are forwarded to the SIEM with source IP preserved. Network firewall "allow 3389/22 from VPN" without account context is not a substitute.
Persistence at recognition level
Persistence is any mechanism that gives the adversary execution after reboot, logoff, or a killed process. SAL1 topics expect you to recognize common techniques, not to build them.
Windows service install is Event 7045 ("A service was installed in the system") in the System log. Fields that matter: service name, image path, service type, and account. A random 16-character name with an image path under \Users\Public\ or \Temp\ after a Type 10 logon is a classic pairing. Scheduled tasks show as Event 4698 (task created) when Task Scheduler auditing is on; also look for schtasks in process-creation logs. Run keys under HKLM\Software\Microsoft\Windows\CurrentVersion\Run and the current-user counterpart cause a program to start at logon. Recognition is a new value, an unsigned binary, or a user-writable path — not a lecture on registry editing.
Linux persistence that analysts actually catch: cron ( /etc/cron.* , user crontabs) with wget or interpreter one-liners; systemd user or system units dropped outside the package manager; and SSH keys appended to ~/.ssh/authorized_keys or /root/.ssh/authorized_keys . File-integrity or auditd watches on those paths turn persistence into an alert instead of a surprise at next login.
Mechanism Typical artefact Why it survives Analyst trap
Windows service Event 7045, unexpected ImagePath Starts with the machine Ignoring 7045 if the name looks "security related"
Scheduled task 4698, schtasks process create Time or event trigger Only hunting \Windows\Tasks XML and missing 4698
- Run key New Run/RunOnce value User logon Hunting HKLM only and missing HKCU
- cron New crontab line, cron.d file Time trigger Ignoring user crontabs
- SSH key authorized_keys append Next SSH success Assuming password auth is the only SSH risk
- Worked chain (same host as the RDP example): 02:14:33Z 4624 Type 10 helpdesk.jlee from 198.51.100.88
- 02:18:11Z 7045 ServiceName=WinUpdateSvc ImagePath=C:\Users\Public\wu.exe ServiceType=user-mode
- 02:18:40Z 4698 TaskName=\Microsoft\Windows\WUCheck
Initial access plus two persistence artefacts in four minutes is not a patch cycle. Isolate the host, disable the account, capture the image path, and check whether the same service name exists on other endpoints (a small worm or a copied playbook).
Privilege escalation conceptually
Privilege escalation is increasing rights on a host the adversary already uses. It is not the port scan and it is not the first phishing click. Conceptual Windows paths: adding an account to local Administrators (Event 4732 on the Administrators group when auditing is on); abusing an already-privileged token ( token impersonation / theft — you will see unusual processes running as SYSTEM or as another user); and exploiting a local misconfiguration. Conceptual Linux paths: a sudoers change ( NOPASSWD for a wide command), a SUID binary that was not in yesterday's inventory, or a user suddenly in the wheel or sudo group.
Recognition, not recipes:
4624 Type 10 as a help-desk user, then a 4732 adding that user to Administrators.
sudo in audit logs for /usr/sbin/visudo or unexpected usermod -aG sudo .
Processes accessing other users' tokens or spawning as SYSTEM without a Windows Update parent.
Impact: persistence planted as SYSTEM or root survives cleanup that only killed a user-level Run key. Data that was ACL-protected becomes readable. Credential theft against Local Security Authority Subsystem Service (LSASS) (next section) usually wants this higher context.
Why logging is the detection backbone
SAL1 endpoint content closes on the importance of activity logging. If 4624 Type 10 is not collected, RDP initial access is a rumor from a firewall allow. If 7045 and 4698 are off, persistence is a hunt through disk after ransomware. If sshd logs are rotated locally and never shipped, a stolen key is invisible. Enable and forward: Windows Security (4624/4625/4672/4732), System 7045, Task Scheduler 4698, process creation (4688 or Sysmon), Linux auth and auditd. Retention must outlast the attacker's dwell time. The next section adds credential theft, Mimikatz-class LSASS access, Sysmon, and auditd as the logging tools named in official SAL1 training content.