Skip to main content

How to Play Sherlocks

A deep dive into the Sherlocks.

Written by Diablo

Sherlocks serve as defensive investigatory scenarios designed to provide hands-on practice in replicating real-life cases. Players engage in a captivating narrative of a fictional scenario, tackling various obstacles to sharpen their defensive abilities. Sherlocks are intricately woven into a dynamic simulated corporate setting, elevating the overall learning journey.

Accessing Sherlocks

You can access the Sherlocks platform from the HackTheBox Labs menu by clicking the Sherlocks tab. From this section, you can navigate between the Sherlocks Overview, Active Sherlocks, and Retired Sherlocks.

There, you'll discover a list of All Sherlocks, Active Sherlocks, Retired Sherlocks, and Scheduled releases. Similar to Machines, new Sherlocks are introduced every few weeks, staying active for a period before retiring.

A Sherlock can fit into one of these categories:

  • DFIR

  • SOC

  • Malware Analysis

  • Threat Hunting

  • Threat Intelligence

  • Cloud

And with the difficulty of Easy, Medium, Hard, and Insane.

On the Sherlock page, you will encounter three panels:

  • Play Sherlock: This is the main page that allows you to actively engage with the challenge and submit your answers.

  • Sherlock Info: In this panel, you will find a concise description of the challenge and the intriguing story that accompanies it. Gain insights into the background and context surrounding the Sherlock.

  • Reviews: This space is dedicated to user reviews and comments on the Sherlock

How to Play Sherlocks

To play a Sherlock, you need to :

  1. Download the Investigation Package: Download the specific investigation package for your chosen scenario. This is a downloadable zip file containing the data you need to logically piece together the evidence. The password to extract this file is always "hacktheblue".

  2. Review the Contents: Thoroughly review the downloaded data in a secure, isolated environment.

  3. Answer the Tasks: You will be presented with a series of mandatory questions related to the scenario. Submit your answers directly on the HackTheBox platform to solve the investigation.

Please be aware that Sherlocks may include real malware that requires careful handling.

  1. Mandatory Readme File: Each downloadable artifact will include a readme file that you must read thoroughly before proceeding with the exercise. This file contains vital instructions and precautions to ensure your safety throughout the experience.

  2. Explicit Warning: We want to emphasize that the files you download may contain malicious code. We strongly encourage you to employ a Virtual Machine (VM) when interacting with these artifacts. Using a VM provides an additional layer of protection for your system, preventing any potential harm.

Once all answers are correctly submitted, you complete the Sherlock.

Early File Downloads for New Content

HackTheBox supports early file downloads for new content exactly 72 hours ahead of the official release time. For example, if a new Sherlock is scheduled to release on Friday at 5:00 PM, players can download the files as early as Tuesday at 5:00 PM. The password to extract these files is then revealed exactly at the release time as a random string.

Why Use Early Downloads

Using early file downloads is highly beneficial for players competing for "bloods" and participating in future "Blue Seasons". By downloading large files in advance, players can begin solving the moment the content drops without waiting for a long download to complete.

Playing Modes

There are multiple playing modes for Sherlocks :

  • Linear: Answering an investigatory question successfully unlocks the next.

  • Free-flow: All investigatory questions are available to answer in any order you like.

Related Articles
Did this answer your question?