ShadowRoast Lab
Q1) What's the malicious file name utilized by the attacker for initial access?
index="shadowroast" event.code=1 (winlog.event_data.Image="*cmd*" OR winlog.event_data.Image="*powershell*")
| table winlog.event_data.ParentImage, winlog.event_data.Image
We can also get the answer using powershell.
Get-WinEvent -FilterHashtable @{Path='C:\Users\Administrator\Desktop\Start here\Artifacts\Office-PC\winevt\logs\Microsoft-Windows-Sysmon%4Operational.evtx'; Id=1}
| Where-Object {$_.Properties[4].Value -Like "*cmd*" -or $_.Properties[4].Value -like "*powershell*"}
| ForEach-Object {[PSCustomObject]@{ Image = $_.Properties[4].Value; ParentImage = $_.Properties[20].Value}}
We can solve this using TimelineExplorer.exe, but first, we need to convert the file to a CSV format.
.\EvtxeCmd\EvtxECmd.exe -f 'C:\Users\Administrator\Desktop\Start here\Artifacts\Office-PC\winevt\logs\Micro
soft-Windows-Sysmon%4Operational.evtx'
--csv "C:\Users\Administrator\Desktop\Start here\Artifacts\Office-PC" --csvf event_log.csv
Open the file in Timeline Explorer and apply a filter for Event ID 1.
In the payload, I applied a filter for "cmd".
Answer: AdobeUpdater.exe
Q2) What's the registry run key name created by the attacker for maintaining persistence once gained foothold?
Based on the previous analysis, we have determined that the ProcessId for AdobeUpdater.exe is 4928. Using this information, we can proceed to search for the associated registry keys.
index="shadowroast" event.code=13 winlog.event_data.ProcessId=4928
Let's solve this using Powershell.
Get-WinEvent -FilterHashtable @{Path="C:\Users\Administrator\Desktop\Start here\Artifacts\Office-PC\winevt\logs\Microsoft-Windows-Sysmon%4Operational.evtx"; Id=13}
| Where-Object {$_.Properties[4].Value -like '4928'}
| ForEach-Object {[PSCustomObject]@{ EventId = $_.Properties[4].Value; Image = $_.Properties[5].Value; TargetObject = $_.Properties[6].Value}}
| Format-List
Let’s utilize Timeline Explorer to analyze the data, then apply a filter for Event ID 1.
I applied a filter for Event ID 4928 in the payload.
Answer: wyW5PZyF
Q3) What's the full path of the directory used by the attacker for storing his dropped tools?
index="shadowroast" event.code=11
| stats count by winlog.event_data.Image, winlog.event_data.TargetFilename
Let's solve this using Powershell.
Get-WinEvent -FilterHashtable @{Path="C:\Users\Administrator\Desktop\Start here\Artifacts\Office-PC\winevt\logs\Microsoft-Windows-Sysmon%4Operational.evtx"; Id=11}
| Where-Object {$_.Properties[4].Value -like '*adobeUpdater.exe*'}
| ForEach-Object {[PSCustomObject]@{ EventId = $_.Properties[4].Value; Image = $_.Properties[5].Value; TargetFilename = $_.Properties[6].Value}}
| Format-List
Let’s utilize Timeline Explorer to analyze the data, then apply a filter for Event ID 11.
I applied a filter to the payload using adobeUpdater.exe.
Answer: C:\Users\Default\AppData\Local\Temp\
Q4) What tool was used by the attacker for privilege escalation and credential harvesting?
index="shadowroast" event.code=1 winlog.event_data.CurrentDirectory="C:\\Users\\Default\\AppData\\Local\\Temp*"
| table winlog.event_data.ParentImage, winlog.event_data.Image, winlog.event_data.OriginalFileName
We could also use Event Viewer, PowerShell, or Timeline Explorer to address this, but let's continue solving it with Splunk.
Answer: Rubeus
Q5) Was the attacker's credential harvesting successful? If so, can you provide the compromised domain account username?
In the previous question, we identified another file, mimikatz.exe, which had been renamed to DefragTool.exe. This indicates potential malicious activity, as attackers commonly use Mimikatz for techniques like Pass-the-Hash, Pass-the-Ticket, and similar credential theft methods.
index="shadowroast" event.code=1 winlog.event_data.CurrentDirectory="C:\\Users\\Default\\AppData\\Local\\Temp*"
| table _time, winlog.event_data.ParentImage, winlog.event_data.Image, winlog.event_data.OriginalFileName, winlog.event_data.CommandLine
| sort _time
The attacker initially performed an AS-REP Roasting attack to extract hashes, followed by the execution of Mimikatz.
index="shadowroast" event.code=1 winlog.event_data.CurrentDirectory="C:\\Users\\Default\\AppData\\Local\\Temp*"
| table _time, winlog.event_data.Image, winlog.event_data.OriginalFileName, winlog.event_data.CommandLine, winlog.event_data.ParentUser
| sort _time
Answer: tcooper
Q6) What's the tool used by the attacker for registering a rogue Domain Controller to manipulate Active Directory data?
index="shadowroast" event.code=3 winlog.event_data.DestinationPort=389 OR winlog.event_data.DestinationPort=464 "winlog.event_data.User"="CORPNET\\tcooper"
| stats count by winlog.event_data.Image
port 389 (LDAP)
port 464 (Kerberos)
Tools like Mimikatz are often used for such purposes, and in this case, the attacker renamed it to DefragTool.exe.
Answer: mimikatz
Q7) What's the first command used by the attacker for enabling RDP on remote machines for lateral movement?
index="shadowroast" event.code=1 "winlog.event_data.User"="CORPNET\\tcooper"
| stats count by winlog.event_data.Image, winlog.event_data.CommandLine, winlog.event_data.ParentCommandLine
This command is commonly used by administrators to enable Remote Desktop on Windows systems programmatically, such as in scripts or during initial system setup.
Answer: reg add "hklm\system\currentcontrolset\control\terminal server" /f /v fDenyTSConnections /t REG_DWORD /d 0
Q8) What's the file name created by the attacker after compressing confidential files?
index="shadowroast" event.code=11 "winlog.event_data.User"="CORPNET\\tcooper" NOT winlog.event_data.Image="C:\\Windows\\Explorer.EXE"
| stats count by winlog.event_data.Image, winlog.event_data.TargetFilename
Answer: CrashDump.zip
Last updated