# ShadowRoast Lab
Q1) What's the malicious file name utilized by the attacker for initial access?
```splunk-spl
index="shadowroast" event.code=1 (winlog.event_data.Image="*cmd*" OR winlog.event_data.Image="*powershell*")
| table winlog.event_data.ParentImage, winlog.event_data.Image
```
We can also get the answer using powershell.
```powershell
Get-WinEvent -FilterHashtable @{Path='C:\Users\Administrator\Desktop\Start here\Artifacts\Office-PC\winevt\logs\Microsoft-Windows-Sysmon%4Operational.evtx'; Id=1}
| Where-Object {$_.Properties[4].Value -Like "*cmd*" -or $_.Properties[4].Value -like "*powershell*"}
| ForEach-Object {[PSCustomObject]@{ Image = $_.Properties[4].Value; ParentImage = $_.Properties[20].Value}}
```
We can solve this using TimelineExplorer.exe, but first, we need to convert the file to a CSV format.
```powershell
.\EvtxeCmd\EvtxECmd.exe -f 'C:\Users\Administrator\Desktop\Start here\Artifacts\Office-PC\winevt\logs\Micro
soft-Windows-Sysmon%4Operational.evtx'
--csv "C:\Users\Administrator\Desktop\Start here\Artifacts\Office-PC" --csvf event_log.csv
```
Open the file in Timeline Explorer and apply a filter for Event ID 1.
In the payload, I applied a filter for "cmd".
Answer: AdobeUpdater.exe
Q2) What's the registry run key name created by the attacker for maintaining persistence once gained foothold?
Based on the previous analysis, we have determined that the `ProcessId` for `AdobeUpdater.exe` is `4928`. Using this information, we can proceed to search for the associated registry keys.
```splunk-spl
index="shadowroast" event.code=13 winlog.event_data.ProcessId=4928
```
Let's solve this using Powershell.
```powershell
Get-WinEvent -FilterHashtable @{Path="C:\Users\Administrator\Desktop\Start here\Artifacts\Office-PC\winevt\logs\Microsoft-Windows-Sysmon%4Operational.evtx"; Id=13}
| Where-Object {$_.Properties[4].Value -like '4928'}
| ForEach-Object {[PSCustomObject]@{ EventId = $_.Properties[4].Value; Image = $_.Properties[5].Value; TargetObject = $_.Properties[6].Value}}
| Format-List
```
Let’s utilize Timeline Explorer to analyze the data, then apply a filter for Event ID 1.
I applied a filter for Event ID 4928 in the payload.
Answer: wyW5PZyF
Q3) What's the full path of the directory used by the attacker for storing his dropped tools?
```splunk-spl
index="shadowroast" event.code=11
| stats count by winlog.event_data.Image, winlog.event_data.TargetFilename
```
Let's solve this using Powershell.
```powershell
Get-WinEvent -FilterHashtable @{Path="C:\Users\Administrator\Desktop\Start here\Artifacts\Office-PC\winevt\logs\Microsoft-Windows-Sysmon%4Operational.evtx"; Id=11}
| Where-Object {$_.Properties[4].Value -like '*adobeUpdater.exe*'}
| ForEach-Object {[PSCustomObject]@{ EventId = $_.Properties[4].Value; Image = $_.Properties[5].Value; TargetFilename = $_.Properties[6].Value}}
| Format-List
```
Let’s utilize Timeline Explorer to analyze the data, then apply a filter for Event ID 11.
I applied a filter to the payload using **adobeUpdater.exe**.
Answer: C:\Users\Default\AppData\Local\Temp\\
Q4) What tool was used by the attacker for privilege escalation and credential harvesting?
```splunk-spl
index="shadowroast" event.code=1 winlog.event_data.CurrentDirectory="C:\\Users\\Default\\AppData\\Local\\Temp*"
| table winlog.event_data.ParentImage, winlog.event_data.Image, winlog.event_data.OriginalFileName
```
We could also use Event Viewer, PowerShell, or Timeline Explorer to address this, but let's continue solving it with Splunk.
Answer: Rubeus
Q5) Was the attacker's credential harvesting successful? If so, can you provide the compromised domain account username?
In the previous question, we identified another file, **mimikatz.exe**, which had been renamed to **DefragTool.exe**. This indicates potential malicious activity, as attackers commonly use Mimikatz for techniques like Pass-the-Hash, Pass-the-Ticket, and similar credential theft methods.
```powershell
index="shadowroast" event.code=1 winlog.event_data.CurrentDirectory="C:\\Users\\Default\\AppData\\Local\\Temp*"
| table _time, winlog.event_data.ParentImage, winlog.event_data.Image, winlog.event_data.OriginalFileName, winlog.event_data.CommandLine
| sort _time
```
The attacker initially performed an AS-REP Roasting attack to extract hashes, followed by the execution of Mimikatz.
```splunk-spl
index="shadowroast" event.code=1 winlog.event_data.CurrentDirectory="C:\\Users\\Default\\AppData\\Local\\Temp*"
| table _time, winlog.event_data.Image, winlog.event_data.OriginalFileName, winlog.event_data.CommandLine, winlog.event_data.ParentUser
| sort _time
```
Answer: tcooper
Q6) What's the tool used by the attacker for registering a rogue Domain Controller to manipulate Active Directory data?
```splunk-spl
index="shadowroast" event.code=3 winlog.event_data.DestinationPort=389 OR winlog.event_data.DestinationPort=464 "winlog.event_data.User"="CORPNET\\tcooper"
| stats count by winlog.event_data.Image
```
* **port 389 (LDAP)**
* **port 464 (Kerberos)**
Tools like Mimikatz are often used for such purposes, and in this case, the attacker renamed it to **DefragTool.exe**.
Answer: mimikatz
Q7) What's the first command used by the attacker for enabling RDP on remote machines for lateral movement?
```splunk-spl
index="shadowroast" event.code=1 "winlog.event_data.User"="CORPNET\\tcooper"
| stats count by winlog.event_data.Image, winlog.event_data.CommandLine, winlog.event_data.ParentCommandLine
```
This command is commonly used by administrators to enable Remote Desktop on Windows systems programmatically, such as in scripts or during initial system setup.
Answer: reg add "hklm\system\currentcontrolset\control\terminal server" /f /v fDenyTSConnections /t REG\_DWORD /d 0
Q8) What's the file name created by the attacker after compressing confidential files?
```splunk-spl
index="shadowroast" event.code=11 "winlog.event_data.User"="CORPNET\\tcooper" NOT winlog.event_data.Image="C:\\Windows\\Explorer.EXE"
| stats count by winlog.event_data.Image, winlog.event_data.TargetFilename
```
Answer: CrashDump.zip
---
# Agent Instructions: Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter:
```
GET https://faresbltagy.gitbook.io/footprintinglabs/cyberdefenders/shadowroast-lab.md?ask=
```
The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.