This repository contains my personal TryHackMe writeups, study notes and walkthroughs from the Defending Azure Learning Path.
The purpose of this repository is to document my investigation methodology, queries, observations, mistakes and defensive conclusions in a way that supports revision, portfolio development and future reference.
Each writeup is based on activity completed within an authorised TryHackMe training environment. The Azure tenants, endpoints, identities, logs and supporting infrastructure used by these rooms are intentionally configured for cyber security education and practical experimentation.
The learning path is primarily defensive and focuses on security monitoring, threat detection, incident investigation, threat hunting and response using Microsoft Sentinel, Kusto Query Language and Microsoft Defender XDR. The final module also contains mixed red-team and blue-team Azure challenges, so individual writeups may include authorised cloud enumeration or attack-path analysis where required by the room.
Lab access may be provided through the browser, a TryHackMe cloud environment, the TryHackMe AttackBox or a personal Kali Linux virtual machine connected through the TryHackMe VPN. Environment-specific details will be recorded only where they are relevant to explaining the methodology.
Important
This repository will NEVER contain material taken from TryHackMe professional certification examinations or other restricted assessments. It will not intentionally provide flags, answer strings, passwords, reusable tokens, cracked credentials or confidential lab material.
These writeups are intended to explain the reasoning, investigation process and lessons learned. They are not designed to replace completing the rooms independently.
Depending on the room and learning objective, a writeup may include:
- Room overview and learning objectives
- Azure lab and tenant context
- Relevant security operations concepts
- Microsoft Sentinel deployment and configuration notes
- Log Analytics workspace and data connector observations
- Data ingestion and normalisation concepts
- KQL queries with explanations
- Analytics rules and detection logic
- Alert and incident triage
- Entity, timeline and investigation-map analysis
- Threat hunting methodology
- Microsoft Defender XDR alert investigation
- Endpoint, identity and cross-domain evidence correlation
- MITRE ATT&CK technique mapping
- Azure identity, role and resource enumeration
- DevSecOps and pipeline security observations
- Evidence and sanitised output
- Challenges, mistakes and troubleshooting steps
- Lessons learned
- Defensive recommendations and remediation notes
- References and supporting documentation
Sensitive values, credentials, hashes, tokens, answers and flags will be removed or replaced with <REDACTED>.
Learning Path: Defending Azure
The intermediate path contains four modules, nineteen hands-on rooms and an estimated completion time of approximately nineteen hours. It develops practical experience with Azure-native security tooling and covers:
- Microsoft Sentinel deployment, ingestion, detection and investigation
- Kusto Query Language for log analysis and threat hunting
- Microsoft Defender XDR investigations across common adversary techniques
- Azure security challenges covering defensive analysis, DevSecOps and authorised cloud attack-path assessment
This section introduces Microsoft Sentinel as a cloud-native SIEM and SOAR platform. It covers deployment, data ingestion, analytics rules, threat detection and incident investigation.
- MS Sentinel: Introduction
- MS Sentinel: Deploy
- MS Sentinel: Ingest Data
- MS Sentinel: Detect
- MS Sentinel: Investigate
This section develops the Kusto Query Language skills required to filter, transform, correlate and analyse security telemetry within Microsoft Sentinel and Log Analytics.
This section explores how Microsoft Defender XDR correlates endpoint, identity, email, application and cloud signals. The rooms follow common stages of an attack and focus on detecting, investigating and responding to malicious activity.
- XDR: Introduction
- XDR: Defense Evasion
- XDR: Privilege Escalation
- XDR: Lateral Movement
- XDR: Execution
- XDR: Credential Access
This section applies the knowledge developed throughout the path to realistic Azure scenarios. It includes a mixture of SOC investigation, threat hunting, DevSecOps security and authorised cloud attack-path challenges.
| No. | Section | Challenge | Difficulty | Status |
|---|---|---|---|---|
| 1 | Azure Security Challenges | MS Sentinel: Just Looking |  |
 |
| 2 | Azure Security Challenges | Azure: Eyes Wide Shut |  |
 |
| 3 | Azure Security Challenges | Azure: Hoppity Hop | |
|
| 4 | Azure Security Challenges | Azure: Tapper |  |
|
| Status | Meaning |
|---|---|
|
The room has been identified, but its writeup has not started. |
 |
The room is being completed or its documentation is being prepared. |
|
The writeup has been published and linked in this README. |
 |
The room or writeup is no longer actively maintained. |
 |
A room, lab or documentation issue has been identified and reported. |
The tools and services used will vary by room. The following list is representative rather than exhaustive.
| Azure Security Operations | Querying and Investigation | Endpoint and Identity | Cloud and DevSecOps |
|---|---|---|---|
| Microsoft Sentinel | Kusto Query Language | Microsoft Defender XDR | Microsoft Azure portal |
| Log Analytics | Advanced Hunting | Microsoft Defender for Endpoint | Azure CLI |
| Microsoft Sentinel Content Hub | CyberChef | Microsoft Defender for Identity | Azure PowerShell |
| Analytics rules | MITRE ATT&CK | Windows Event Viewer | Azure DevOps |
| Workbooks | VirusTotal | Microsoft Entra ID | Git |
| Threat hunting | WHOIS | PowerShell | YAML |
| Logic Apps | jq | Sysinternals | Kali Linux |
My general workflow is:
- Review the room objectives, prerequisites and authorised scope.
- Confirm how the lab is accessed and record the relevant tenant, subscription, workspace, endpoint or VPN details.
- Establish an investigation question or hypothesis before searching the available telemetry.
- Identify the relevant data sources, tables, alerts, incidents, entities and time range.
- Build KQL queries progressively, beginning with broad validation before narrowing the results.
- Correlate evidence across Sentinel, Defender XDR, endpoint, identity and cloud records where available.
- Construct a clear timeline and map observed behaviour to relevant MITRE ATT&CK techniques.
- Distinguish confirmed malicious activity from benign activity, expected administration and false positives.
- Record containment, remediation and security-hardening recommendations.
- For mixed or offensive Azure challenges, follow the room's rules of engagement and document each authorised action carefully.
- Redact flags, answers, credentials, tokens, tenant identifiers and other restricted values.
- Review the completed writeup for technical accuracy, clarity and compliance with TryHackMe rules.
These notes may contain spoilers, query examples, investigation logic, vulnerability details and complete defensive or authorised attack paths. Anyone actively completing a room should attempt it independently before reading the associated writeup.
This repository will not intentionally publish:
- TryHackMe flags or answer strings
- Passwords or cracked credentials
- Reusable session tokens or temporary access passes
- Private keys, secrets or sensitive certificates
- Azure tenant, subscription or resource identifiers that should remain private
- Professional certification examination content
- Copied room instructions or substantial portions of TryHackMe material
- Material that TryHackMe or a room author has asked learners not to share
Note
Values may be intentionally redacted to protect the integrity of a challenge and prevent unintended spoilers. Placeholders such as <TENANT_ID>, <SUBSCRIPTION_ID>, <WORKSPACE_NAME>, <TARGET_IP> and <TUN0_IP> may be used where environment details are required to explain the methodology.
Other sensitive or challenge-revealing information will be replaced with <REDACTED>. TryHackMe-style flags will be shown only as THM{...}.
If restricted or sensitive information is included accidentally, please report it through the repository's GitHub Discussions area so it can be reviewed and removed.
These writeups are for educational purposes only and are based on authorised TryHackMe lab environments.
All tools, queries, commands, techniques and methodologies referenced in this repository were used within controlled training environments where permission was provided by the owner or operator of the lab platform. The tenants, applications, endpoints and identities discussed are intentionally configured for cyber security learning, practice and assessment.
Do not use these techniques, tools or methods against systems, networks, applications, cloud tenants or services that you do not own or do not have explicit written permission to test. Unauthorised access, scanning, exploitation, credential use or disruption is illegal and unethical.
The tools and methods listed in this repository are examples of approaches used during specific rooms. They are not the only possible solutions, and alternative tools, queries and workflows may be equally valid.
This repository is intended solely for authorised cyber security education, controlled laboratory exercises, Capture the Flag challenges and legitimate defensive research.
Requests for assistance that appear to involve unauthorised access, real-world exploitation, credential theft, malware deployment, data theft, service disruption, evasion of security controls or harm against individuals, organisations, systems, networks or cloud tenants will not be supported.
This includes, but is not limited to:
- Requests to attack systems or cloud environments without clear authorisation
- Attempts to obtain or misuse passwords, tokens, cookies, API keys, secrets or temporary access passes
- Requests involving ransomware, destructive malware, persistence, botnets, phishing or data exfiltration
- Instructions intended to conceal malicious activity or evade lawful monitoring
- Threats, harassment, extortion, doxxing or targeted abuse
- Attempts to adapt educational material for use against real-world targets
Abusive or suspicious requests may be documented, preserved, blocked and reported to the relevant platform, service provider, repository host, organisation or lawful authority where appropriate.
By accessing or interacting with this repository, you agree to use its content only within environments that you own or are explicitly authorised to test.
Educational context does not excuse unlawful or harmful activity.
No authorisation means no testing.
TryHackMe periodically updates, replaces or retires rooms and learning paths. Links, room sequences and path content may therefore change after a writeup is published.
Each writeup should be treated as a record of the room as it appeared on the date documented. Where a material change is identified, the relevant page may be updated or marked as archived.
If you notice a broken link, outdated instruction, formatting problem, technical error or any other noticeable issue within a writeup, please report it through the GitHub repository's Discussions tab. When providing feedback, include the name of the affected writeup, a brief description of the problem and, where possible, the relevant section or line.
Constructive corrections are welcome and help keep the repository accurate, useful and maintainable.
Thanks for checking out my TryHackMe writeups. These notes form part of my ongoing cybersecurity learning journey, where I document rooms, techniques, tools, mistakes and lessons learned while working through different challenges.
You can view my TryHackMe profile here:
I am also active within cybersecurity learning communities, including Discord, where I discuss labs, tools, methodologies and general security topics with other learners and practitioners.
Feel free to follow my progress, compare approaches or get in touch if you are working through similar rooms.
Walkthrough requests are always welcome, although publication will depend on my availability and whether sharing the content complies with the platform's rules.
Created by V4L1K4HN as part of my cybersecurity learning journey through TryHackMe.
Unless otherwise stated, the original written content in this repository is licensed under the Creative Commons Attribution 4.0 International License.
Copyright © 2026 V4L1K4HN.
You may share and adapt the licensed material for any purpose, including commercially, provided that:
- appropriate credit is given to V4L1K4HN;
- a link to the license is provided; and
- any changes made to the original material are clearly indicated.
This license applies only to original material created by the repository author. TryHackMe content, branding, room materials, third-party software, trademarks, externally sourced material, and any other third-party intellectual property remain subject to their respective owners' terms and licenses.
See the LICENSE file for the complete legal terms.
Powered on ☕ made with ❤️ by V4L1K4HN
⭐ If this project is useful, consider starring it on GitHub.