---

Questions

Q1. How many logs are ingested from the month of March, 2022?

A: Set the “Date Range” from 03/01/2022 - 03/31/2022, next set the index to win_eventlogs or * and search.

index=*

---

Q2. Imposter Alert: There seems to be an imposter account observed in the logs, what is the name of that user?

A: For this query I’ve used the top and tablecommands to return the most frequent values for the UserName field and to display a structured table with only the specified fields: UserName, HostName, CommandLine, and EventID.

index=* 
| search HostName="*" 
| top limit=100 UserName | table UserName HostName CommandLine EventID

---

Q3. Which user from the HR department was observed to be running scheduled tasks?

A: For this query I've filtered all users from HR that had the term "schtasks" in the CommandLine field.

index=* 
| search HostName="HR*" AND schtasks 
| table _time UserName HostName CommandLine EventID

---

Q4. Which user from the HR department executed a system process (LOLBIN) to download a payload from a file-sharing host.

A: I had to do a bit of research as to which LOLBIN (Live Off The Land Binaries) are commonly used for downloading data. (For the next few questions I will continue to use the same query)

index=* sourcetype=* OR sourcetype=*
| search CommandLine="*bitsadmin*" 
       OR CommandLine="*certutil*" 
       OR CommandLine="*powershell*" 
       OR CommandLine="*mshta*" 
       OR CommandLine="*rundll32*" 
       OR CommandLine="*curl*" 
       OR CommandLine="*wget*"
| search HostName="HR*"
| table _time UserName HostName CommandLine ParentProcessName EventID
| sort _time

---

Q5. To bypass the security controls, which system process (LOLBIN) was used to download a payload from the internet?

A: Let's breakdown the command being used in the screenshot:

1. certutil.exe:

   • Certutil is a built-in Windows utility used to manage certificates and perform various cryptographic tasks.
   • In this case, it is being used to download a file from the internet, which is an unusual use of the utility and often seen in malicious activities (e.g., downloading malware).

2. -urlcache:

   • This switch tells certutil to work with URL cache (the HTTP caching mechanism). Specifically, it is used here to fetch a file from a remote URL.

3. -f:

   • The -f option forces the overwrite of any existing file with the same name. If a file with the same name already exists on the disk, it will be replaced without prompting.

4. - (hyphen):

   • This is used in conjunction with the -urlcache option, specifying that certutil should download the file rather than just caching the URL.

5. https://controlc.com/e4d11035:

   • This is the URL from which certutil is downloading the file. The URL points to a file hosted on controlc.com, which is a pastebin-like service. The exact file being downloaded is determined by the content hosted at this URL.

6. benign.exe:

   • This is the output file name. The file downloaded from the URL will be saved locally as benign.exe. Despite the name suggesting that it is "benign," there is no guarantee that the file is harmless.

index=* sourcetype=* OR sourcetype=*
| search CommandLine="*bitsadmin*" 
       OR CommandLine="*certutil*" 
       OR CommandLine="*powershell*" 
       OR CommandLine="*mshta*" 
       OR CommandLine="*rundll32*" 
       OR CommandLine="*curl*" 
       OR CommandLine="*wget*"
| table _time UserName HostName CommandLine ParentProcessName EventID
| sort _time

---

Q6. What was the date that this binary was executed by the infected host? format (YYYY-MM-DD)

A: _time displays the time that event occured.

index=* sourcetype=* OR sourcetype=*
| search CommandLine="*bitsadmin*" 
       OR CommandLine="*certutil*" 
       OR CommandLine="*powershell*" 
       OR CommandLine="*mshta*" 
       OR CommandLine="*rundll32*" 
       OR CommandLine="*curl*" 
       OR CommandLine="*wget*"
| table _time UserName HostName CommandLine ParentProcessName EventID
| sort _time

---

Q7. Which third-party site was accessed to download the malicious payload?

A: This answer can be find under the CommandLine section.

---

Q8. What is the name of the file that was saved on the host machine from the C2 server during the post-exploitation phase?

A: The answer to this question can also be found under the CommandLine section as well.

---

Q9. The suspicious file downloaded from the C2 server contained malicious content with the pattern THM{..........}; what is that pattern?

A: Head to the URL found in the CommandLine section, but before doing so make sure you make sure to double check the URL on VirusTotal before proceeding or visit the URL in the THM AttackBox or Browserling. After navigating to the URL you will find the answer to the question.

---

Q10. What is the URL that the infected host connected to?

A: The URL can be found in the CommandLine section of the event.

---