Advent of Cyber 2025 Walkthroughs: Complete Guide

Table of Contents

Quick answer: Advent of Cyber 2025 is TryHackMe’s free, beginner-friendly cybersecurity event that ran throughout December 2025. Each day released one hands-on room teaching a practical skill: Linux, phishing, Splunk, IDOR, XSS, YARA, containers, forensics, prompt injection, AWS and more. This page links to a step-by-step Cracking Station walkthrough for every day, plus the Prep Track.

This hub is your complete index for TryHackMe Advent of Cyber 2025. Every walkthrough explains the concept behind the room, the tools and commands used, and the reasoning behind each answer, so you learn the skill rather than just copying a flag. All walkthroughs are written by Mehmood Ali, a certified CEH and EC-Council Certified Instructor (CEI), with video walkthroughs on the Mr. Professor YouTube channel.

Advent of Cyber 2025 Walkthroughs: All Days

Select any day below to open its full walkthrough. New to the event? Start with the Prep Track.

Day	Topic	Room name	Walkthrough
Prep	Beginner warm-up	Advent of Cyber Prep Track	Prep Track walkthrough
1	Linux CLI	Shells Bells	Day 1 Linux CLI walkthrough
2	Phishing	Merry Clickmas	Day 2 Phishing walkthrough
3	Splunk Basics	Did you SIEM?	Day 3 Splunk walkthrough
4	AI in Security	old sAInt nick	Day 4 AI in Security walkthrough
5	IDOR	Santa’s Little IDOR	Day 5 IDOR walkthrough
6	Malware Analysis	Egg-xecutable	Day 6 Malware Analysis walkthrough
7	Network Discovery	Scan-ta Clause	Day 7 Network Discovery walkthrough
8	Prompt Injection	Sched-yule conflict	Day 8 Prompt Injection walkthrough
9	Passwords	A Cracking Christmas	Day 9 Passwords walkthrough
10	SOC Alert Triaging	Tinsel Triage	Day 10 SOC Alert Triage walkthrough
11	XSS	Merry XSSMas	Day 11 XSS walkthrough
12	Phishing	Phishmas Greetings	Day 12 Phishing walkthrough
13	YARA Rules	YARA mean one!	Day 13 YARA Rules walkthrough
14	Containers	DoorDasher’s Demise	Day 14 Containers walkthrough
15	Web Attack Forensics	Drone Alone	Day 15 Web Attack Forensics walkthrough
16	Registry Forensics	Registry Furensics	Day 16 Registry Forensics walkthrough
17	CyberChef	Hoperation Save McSkidy	Day 17 CyberChef walkthrough
18	Obfuscation	The Egg Shell File	Day 18 Obfuscation walkthrough
19	ICS/Modbus	Claus for Concern	Day 19 ICS/Modbus walkthrough
20	Race Conditions	Toy to The World	Day 20 Race Conditions walkthrough
21	Malware Analysis	Malhare.exe	Day 21 Malware Analysis walkthrough
22	C2 Detection	Command & Carol	Day 22 C2 Detection walkthrough
23	AWS Security	S3cret Santa	Day 23 AWS Security walkthrough
24	Exploitation with cURL	Hoperation Eggsploit	Day 24 cURL Exploitation walkthrough

What Is Advent of Cyber 2025?

Advent of Cyber 2025 (AoC 2025) is a free annual cybersecurity event run by TryHackMe. Throughout December, a new hands-on room was released each day, teaching one real-world security skill inside a festive, story-driven format. The rooms are guided with hints, explanations and videos, which makes the event one of the most popular starting points for people entering cybersecurity.

The rooms remain available on TryHackMe after the event, so you can still complete every day at your own pace using the walkthroughs above.l levels.

What You Will Learn

AoC 2025 covers a broad mix of offensive and defensive skills:

Foundations: Linux command line, networking and network discovery
Web security: IDOR, cross-site scripting (XSS), race conditions and exploitation with cURL
Defensive operations: log analysis with Splunk, SOC alert triage, phishing analysis and C2 detection
Malware and forensics: malware analysis, YARA rules, registry forensics, web attack forensics and deobfuscation
Modern attack surfaces: AI prompt injection, containers, AWS cloud security and ICS/Modbus
Tools: CyberChef, Splunk, YARA, cURL and more

How Advent of Cyber 2025 Works

A new room is released each day in December, each focused on one topic.
You can work in the browser-based AttackBox or connect with your own VPN. See our OpenVPN setup guides.
Rooms include hints and explanations, and you do not need to finish them on the day they are released.
During the event, each completed room counted as a raffle entry for TryHackMe’s prizes.

The Prep Track

Before the main event, TryHackMe released a beginner Prep Track covering basic Linux commands, password security, user-agent investigation, malware behavior, breach checks and cyber hygiene. If you are new to cybersecurity, complete it first with our Advent of Cyber Prep Track walkthrough.

The Storyline: Saving Wareville

Every Advent of Cyber has a festive story. In 2025, the town of Wareville is in trouble again: North Pole production lines are disrupted, SOC-mas traditions are threatened, and McSkidy and the TBFC team investigate a series of digital incidents. Each daily room reveals another chapter.

Rewards and Prizes

During the event, TryHackMe ran a prize raffle in which every completed room counted as one entry, so completing more rooms increased your chances. Prizes typically included tech gadgets, swag and premium subscriptions, and participants who completed the event could earn a certificate. Eligibility followed TryHackMe’s terms and conditions.

Who Should Take Advent of Cyber 2025?

The rooms start simple and increase in difficulty, so the event suits absolute beginners, students, IT professionals, aspiring ethical hackers, SOC analysts and anyone switching careers into cybersecurity. It is also useful practice for certifications such as CEH and CompTIA Security+.

How to Use These Walkthroughs

Try each room yourself first, then use the walkthrough to check your reasoning or get unstuck.
Every walkthrough includes step-by-step explanations, commands, screenshots and, where available, a video guide.
Follow TryHackMe’s rules: use writeups for learning, and don’t share flags publicly.
Take notes as you go. The skills repeat across later rooms and certifications.

Final Thoughts

Advent of Cyber 2025 is one of the best free ways to gain hands-on cybersecurity experience in a guided, beginner-friendly format. Whether you are preparing for a certification, starting a career or sharpening your skills, work through the rooms above one day at a time. When you finish, continue with our TryHackMe CTF Writeups & Hacking Roadmap.

Related Resources

Frequently Asked Questions

1. What is TryHackMe Advent of Cyber 2025?

Advent of Cyber 2025 is a free, month-long cybersecurity event hosted by TryHackMe in December. It features daily hands-on challenges designed to teach real-world cybersecurity skills through an engaging, story-driven format.

2. Is Advent of Cyber 2025 free to participate?

Yes, the event is completely free to join. You only need a TryHackMe account to access the challenges and start learning.

3. Do I need prior cybersecurity knowledge to join AoC 2025?

No, beginners are welcome. The Prep Track and early challenges are designed to help new users build foundational knowledge before progressing to more advanced topics.

4. What is the Prep Track in Advent of Cyber 2025?

The Prep Track is a beginner-friendly warm-up path released before December. It covers basic concepts like Linux commands, password security, and cyber hygiene to prepare users for the main event.

5. How does the Advent of Cyber challenge system work?

Each day in December, a new challenge (room) is released. You can complete tasks at your own pace, and each completed room earns you a raffle entry for prizes.

6. What kind of topics are covered in AoC 2025?

The event includes a wide range of topics such as web exploitation, malware analysis, networking, digital forensics, OSINT, cryptography, cloud security, and incident response.

7. Can I complete challenges after December ends?

Yes, most rooms remain available even after the event ends, so you can continue learning and completing challenges at your convenience.

8. Are there rewards or certificates for completing AoC 2025?

Yes, participants can win prizes through a raffle system. Completing rooms increases your chances. Certificates are often awarded to users who complete the event.

9. Is it okay to use write-ups for solving challenges?

Write-ups should be used only for learning purposes after attempting the challenges yourself. Avoid using them to skip the learning process or share flags publicly.

10. What is the best way to succeed in Advent of Cyber 2025?

Stay consistent, complete challenges daily if possible, take notes, and practice what you learn. Engaging with the community and reviewing write-ups after solving challenges can greatly improve your understanding.