> For the complete documentation index, see [llms.txt](https://faresbltagy.gitbook.io/footprintinglabs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://faresbltagy.gitbook.io/footprintinglabs/cyberdefenders/goldenspray-lab.md).
# GoldenSpray Lab
Q1) What's the attacker IP?
```splunk-spl
event.action: Logon AND event.outcome: failure
```
```splunk-spl
event.action: Logon AND event.outcome: failure AND winlog.event_data.IpAddress: "77.91.78.115"
```
Too many failed login attempts in a small time frame.
Answer: 77.91.78.115
Q2) What country is the attack originating from?
Answer: Finland
Q3) What's the compromised account username used for initial access?
```splunk-spl
event.action: Logon AND winlog.event_data.IpAddress: "77.91.78.115"
```
Answer: SECURETECH\mwilliams
Q4) What's the name of the malicious file utilized by the attacker for persistence on ST-WIN02?
Now we know that the attacker used the mwilliams user to gain initial access.
```splunk-spl
event.code: 11 AND "ST-WIN02" AND "mwilliams"
#OR
event.code: 1 AND "ST-WIN02" AND "mwilliams"
```
Answer: OfficeUpdater.exe
Q5) What's the full path used by the attacker for storing his tools?
Answer: C:\Users\Public\Backup\_Tools\\
Q6) What's the process ID of the tool responsible for dumping credentials on ST-WIN02?
```splunk-spl
event.code: 1 AND "ST-WIN02" AND "*mimikatz.exe"
```
Answer: 3708
Q7) What's the second account username the attacker compromised and used for lateral movement?
```splunk-spl
event.action: Logon AND winlog.event_data.IpAddress: "77.91.78.115"
```
Answer: SECURETECH\jsmith
Q8)
```splunk-spl
event.code: 1 AND "*schtasks.exe"
```
Answer: FilesCheck
Q9) What's the encryption type used in the environment Kerberos tickets?
Answer: RC4-HMAC
Q10) Can you provide the full path of the output file in preparation for data exfiltration?
```splunk-spl
event.code: 11 AND winlog.event_data.Image: *powershell AND "jsmith"
```
Answer: C:\Users\Public\Documents\Archive\_8673812.zip
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://faresbltagy.gitbook.io/footprintinglabs/cyberdefenders/goldenspray-lab.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
.png?alt=media&token=86638d6c-2b71-49e6-866d-e01e55cf6229)
.png?alt=media&token=274faba6-60af-448b-89f5-18c059e9baa3)
.png?alt=media&token=3ebc2986-e134-4d9f-acd3-cba7fc86ef5b)
.png?alt=media&token=23ca8bd9-ec30-4ff4-927f-498782d6147d)
.png?alt=media&token=fd42ab77-35ce-4cf1-ad59-43f1167a4317)
.png?alt=media&token=5c5fb7e8-c858-4e22-8843-3997b2d43287)
.png?alt=media&token=9bcf712d-c4fb-40a1-8f81-afeeb0c47777)
.png?alt=media&token=22d45d94-8407-4a04-bb04-989f36ad227a)
.png?alt=media&token=24434436-eeab-4823-abaf-135df1929b58)
.png?alt=media&token=e42ddc29-2ea9-421e-b826-6e0656884144)