# Introduction to Threat Hunting & Hunting With Elastic Module

## Threat Hunting Definition

The median duration between an actual security breach and its detection, otherwise termed "dwell time", is usually several weeks, if not months. This implies a potential adversarial presence within a network for a span approaching three weeks, a duration that can be significantly impactful.

The principal objective of threat hunting is to substantially reduce dwell time by recognizing malicious entities at the earliest stage of the cyber kill chain. This proactive stance has the potential to prevent threat actors from entrenching themselves deeply within our infrastructure and to swiftly neutralize them.

## Threat Intelligence Report: Stuxbot

The present Threat Intelligence report underlines the immediate menace posed by the organized cybercrime collective known as "Stuxbot". The group initiated its phishing campaigns earlier this year and operates with a broad scope, seizing upon opportunities as they arise, without any specific targeting strategy – their motto seems to be anyone, anytime. The primary motivation behind their actions appears to be espionage, as there have been no indications of them exfiltrating sensitive blueprints, proprietary business information, or seeking financial gain through methods such as ransomware or blackmail.

* Platforms in the Crosshairs: `Microsoft Windows`
* Threatened Entities: `Windows Users`
* Potential Impact: `Complete takeover of the victim's computer / Domain escalation`
* Risk Level: `Critical`

The group primarily leverages opportunistic-phishing for initial access, exploiting data from social media, past breaches (e.g., databases of email addresses), and corporate websites. There is scant evidence suggesting spear-phishing against specific individuals.

In summary, the attack sequence for the initially compromised device can be laid out as follows:

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FbN7p6tMTq4Dqb7K3EdmV%2Flifecycle.webp?alt=media&#x26;token=0f4afdd1-dcb1-4fc9-9bd1-56db24c23beb" alt=""><figcaption></figcaption></figure>

**Initial Breach**

The phishing email is relatively rudimentary, with the malware posing as an invoice file. Here's an example of an actual phishing email that includes a link leading to a OneNote file:

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FZZsK1IZ90pZAadtgXD18%2Femail.webp?alt=media&#x26;token=0be717ce-940b-4499-bf65-c7deb799212e" alt=""><figcaption></figcaption></figure>

Our forensic investigation into these attacks revealed that the link directs to a OneNote file, which has consistently been hosted on a file hosting service (e.g., Mega.io or similar platforms).

This OneNote file masquerades as an invoice featuring a 'HIDDEN' button that triggers an embedded batch file. This batch file, in turn, fetches PowerShell scripts, representing stage 0 of the malicious payload.

**RAT Characteristics**

The RAT deployed in these attacks is modular, implying that it can be augmented with an infinite range of capabilities. While only a few features are accessible once the RAT is staged, we have noted the use of tools that capture screen dumps, execute [Mimikatz](https://attack.mitre.org/software/S0002/), provide an interactive `CMD shell` on compromised machines, and so forth.

**Indicators of Compromise (IOCs)**

The following provides a comprehensive inventory of all identified IOCs to this point.

**OneNote File**:

* https://transfer.sh/get/kNxU7/invoice.one
* https://mega.io/dl9o1Dz/invoice.one

**Staging Entity (PowerShell Script)**:

* https://pastebin.com/raw/AvHtdKb2
* https://pastebin.com/raw/gj58DKz

**Command and Control (C\&C) Nodes**:

* 91.90.213.14:443
* 103.248.70.64:443
* 141.98.6.59:443

**Cryptographic Hashes of Involved Files (SHA256)**:

* 226A723FFB4A91D9950A8B266167C5B354AB0DB1DC225578494917FE53867EF2
* C346077DAD0342592DB753FE2AB36D2F9F1C76E55CF8556FE5CDA92897E99C7E
* 018D37CBD3878258C29DB3BC3F2988B6AE688843801B9ABC28E6151141AB66D4

## Hunting For Stuxbot With The Elastic Stack

**The Available Data**

The cybersecurity strategy implemented is predicated on the utilization of the Elastic stack as a SIEM solution. Through the "Discover" functionality we can see logs from multiple sources. These sources include:

* `Windows audit logs` (categorized under the index pattern windows\*)
* `System Monitor (Sysmon) logs` (also falling under the index pattern windows\*, more about Sysmon [here](https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon))
* `PowerShell logs` (indexed under windows\* as well, more about PowerShell logs [here](https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html))
* `Zeek logs`, [a network security monitoring tool](https://www.elastic.co/guide/en/beats/filebeat/current/exported-fields-zeek.html) (classified under the index pattern zeek\*)

Our task centers around a threat intelligence report concerning a malicious software known as "Stuxbot". We're expected to use the provided Indicators of Compromise (IOCs) to investigate whether there are any signs of compromise in our organization.

The report indicates that initial compromises all took place via "invoice.one" files. Despite this, we must continue to conduct searches on other IOCs as the threat actors may have introduced different delivery techniques between the time the report was created and the present. Back to the "invoice.one" files, a comprehensive search can be initiated based on [Sysmon Event ID 15](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=90015) (FileCreateStreamHash), which represents a browser file download event. We're assuming that a potentially malicious OneNote file was downloaded from Gmail, our organization's email provider.

Our search query should be the following.

```
event.code:15 AND file.name:*invoice.one
```

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FskiHTGBT1cWQuAMhuR8x%2Fhunt1.webp?alt=media&#x26;token=836ac1a8-c329-4dc0-acf6-d0d4b7051572" alt=""><figcaption></figcaption></figure>

While this development could imply serious implications, it's not yet confirmed if this file is the same one mentioned in the report. Further, signs of execution have not been probed. If we extend the event log to display its complete content, it'll reveal that MSEdge was the application (as indicated by `process.name` or `process.executable`) used to download the file, which was stored in the Downloads folder of an employee named Bob.

The timestamp to note is: `March 26, 2023 @ 22:05:47`

We can corroborate this information by examining [Sysmon Event ID 11](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=90011) (File create) and the "invoice.one" file name. This method is especially effective when browsers aren't involved in the file download process. The query is similar to the previous one, but the asterisk is at the end as the file name includes only the filename with an additional Zone Identifier, likely indicating that the file originated from the internet.

```
event.code:11 AND file.name:invoice.one*
```

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FkUcAFtJ8B5soxxP6zr1q%2Fhunt2.webp?alt=media&#x26;token=3c68b54e-1cf4-4652-bb56-0d018a205156" alt=""><figcaption></figcaption></figure>

If we inspect network connections leveraging [Sysmon Event ID 3](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=90003) (Network connection) around the time this file was downloaded, we'll find that Sysmon has no entries. This is a common configuration to avoid capturing network connections created by browsers, which could lead to an overwhelming volume of logs, particularly those related to our email provider.

This is where Zeek logs prove invaluable. We should filter and examine the DNS queries that Zeek has captured from WS001 during the interval from `22:05:00` to `22:05:48`, when the file was downloaded.

Our `Zeek query` will search for a source IP matching 192.168.28.130, and since we're querying about DNS queries, we'll only pick logs that have something in the `dns.question.name` field. Note that this will return a lot of common noise, like google.com, etc., so it's necessary to filter that out. Here's the query and some filters.

```
source.ip:192.168.28.130 AND dns.question.name:*
```

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FpFxPdE1hHB3y81kPOoJq%2Fhunt3.webp?alt=media&#x26;token=1feeb71e-53b4-4ccb-97a0-1fad2425a6f2" alt=""><figcaption></figcaption></figure>

We can easily identify major sources of noise by looking at the most common values that Kibana has detected (click on a field as follows), and then apply a filter on the known noisy ones.

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2F1I7tcqZP6pr2VjBAMTkN%2Fhunt23.webp?alt=media&#x26;token=ba788db9-a184-4a91-b6a3-6090081fe3cf" alt=""><figcaption></figcaption></figure>

As part of our search process, since we're interested in DNS names, we'd like to display only the `dns.question.name` field in the result table. Please note the specified time `March 26th 2023 @ 22:05:00` to `March 26th 2023 @ 22:05:48`.

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2Fq7UTcyzoTiOl14v98FIT%2Fhunt24.webp?alt=media&#x26;token=6ad08976-7dff-4b85-be31-59f18e59a354" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2F4PYkJGnCxO6krjt89hn8%2Fhunt4.webp?alt=media&#x26;token=76b3751b-f454-485a-a7ae-77d795492fce" alt=""><figcaption></figcaption></figure>

Scrolling down the table of entries, we observe the following activities.

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FElUd3xWh0tYVkX22D5PM%2Fhunt5.webp?alt=media&#x26;token=a00aae96-bbba-4343-b6c4-62a13fffa756" alt=""><figcaption></figcaption></figure>

From this data, we infer that the user accessed Google Mail, followed by interaction with "file.io", a known hosting provider. Subsequently, Microsoft Defender SmartScreen initiated a file scan, typically triggered when a file is downloaded via Microsoft Edge. Expanding the log entry for file.io reveals the returned IP addresses (`dns.answers.data` or `dns.resolved_ip` or `zeek.dns.answers` fields) as follows.

`34.197.10.85`, `3.213.216.16`

Now, if we run a search for any connections to these IP addresses during the same timeframe as the DNS query, it leads to the following findings.

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FYgYM823rAsElFxzxVVbU%2Fhunt6.webp?alt=media&#x26;token=cc08f6a8-6e81-4535-9a08-066b11ea5cdd" alt=""><figcaption></figcaption></figure>

This information corroborates that a user, Bob, successfully downloaded the file "invoice.one" from the hosting provider "file.io".

Hypothetically, if "invoice.one" was accessed, it would be opened with the OneNote application. So, the following query will flag the event, if it transpired. **Note**: The time frame we specified previously should be removed, setting it to, say, 15 years again. The `dns.question.name` column should also be removed.

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FaRJr9pKV5REgy4GcaBGb%2Fhunt25.webp?alt=media&#x26;token=67df31b1-eb74-4b3e-afdf-7c419f41f4c0" alt=""><figcaption></figcaption></figure>

```shell-session
event.code:1 AND process.command_line:*invoice.one*
```

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2F8AUoeIib8TsHeD6DrfFh%2Fhunt7.webp?alt=media&#x26;token=4276a707-4a93-4f1c-abfd-8b590c0d071f" alt=""><figcaption></figcaption></figure>

Indeed, we find that the OneNote file was accessed shortly after its download, with a delay of roughly 6 seconds. Now, with OneNote.exe in operation and the file open, we can speculate that it either contains a malicious link or a malevolent file attachment. In either case, OneNote.exe will initiate either a browser or a malicious file. Therefore, we should scrutinize any new processes where OneNote.exe is the parent process. The corresponding query is the following. [Sysmon Event ID 1](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=90001) (Process creation) is utilized.

```shell-session
event.code:1 AND process.parent.name:"ONENOTE.EXE"
```

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2F6I689uldBwO09fQtMF2q%2Fhunt8.webp?alt=media&#x26;token=dadeae1d-1f32-4b9c-90d6-a992aeee45e3" alt=""><figcaption></figcaption></figure>

The results of this query present three hits. However, one of these (the bottom one) falls outside the relevant time frame and can be dismissed. Evaluating the other two results:

* The middle entry documents (when expanded) a new process, OneNoteM.exe, which is a component of OneNote and assists in launching files.
* The top entry reveals "cmd.exe" in operation, executing a file named "invoice.bat". Here is the view upon expanding the log.

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FNBGwVPb7CUz80NhAThj9%2Fhunt9.webp?alt=media&#x26;token=e21d9347-72d7-4351-8d1d-edf2681a3d82" alt=""><figcaption></figcaption></figure>

Now we can establish a connection between "OneNote.exe", the suspicious "invoice.one", and the execution of "cmd.exe" that initiates "invoice.bat" from a temporary location (highly likely due to its attachment inside the OneNote file). The question now is, has this batch script instigated anything else? Let's search if a parent process with a command line argument pointing to the batch file has spawned any child processes with the following query.

```shell-session
event.code:1 AND process.parent.command_line:*invoice.bat*
```

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FoBHDcnhg55JDpLIaE0XV%2Fhunt10.webp?alt=media&#x26;token=192fc878-460e-497d-877a-235da96a99ad" alt=""><figcaption></figcaption></figure>

This query returns a single result: the initiation of PowerShell, and the arguments passed to it appear conspicuously suspicious (note that we have added `process.name`, `process.args`, and `process.pid` as columns)! A command to download and execute content from Pastebin, an open text hosting provider! We can try to access and see if the content, which the script attempted to download, is still available (by default, it won't expire!).

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FPMRS5wY3wyvVNDw4RMBO%2Fhunt28.webp?alt=media&#x26;token=b3d36565-7c6f-4db9-8e6e-b2f79a471d4e" alt=""><figcaption></figcaption></figure>

Indeed, it is! This is referred to in the Threat Intelligence report, stating that a PowerShell Script from Pastebin was downloaded.

To figure out what PowerShell did, we can filter based on the process ID and name to get an overview of activities. Note that we have added the `event.code` field as a column.

```shell-session
process.pid:"9944" and process.name:"powershell.exe"
```

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2F5kqBoNFlGecNDcb0pHsd%2Fhunt12.webp?alt=media&#x26;token=b0cc1bab-7816-478b-ba57-ef818039af14" alt=""><figcaption></figcaption></figure>

Immediately, we can observe intriguing output indicating file creation, attempted network connections, and some DNS resolutions leverarging [Sysmon Event ID 22](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=90022) (DNSEvent). By adding some additional informative fields (`file.path`, `dns.question.name`, and `destination.ip` ) as columns to that view, we can expand it.

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2Fy7SQxLTDwcMmJJyu8DcZ%2Fhunt13.webp?alt=media&#x26;token=49ee8bc5-10f0-4478-8af4-4e2cc2839e90" alt=""><figcaption></figcaption></figure>

Now, this presents us with rich data on the activities. Ngrok was likely employed as C2 (to mask malicious traffic to a known domain). If we examine the connections above the DNS resolution for Ngrok, it points to the destination IP Address 443, implying that the traffic was encrypted.

Let's review Zeek data for information on the destination IP address `18.158.249.75` that we just discovered. Note that the `source.ip`, `destination.ip`, and `destination.port` fields were added as columns.

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FnKnOsPOLsOhkeN1zS9ZA%2Fhunt14.webp?alt=media&#x26;token=7de252ca-582f-4be6-a7b2-d18cfea7ce92" alt=""><figcaption></figcaption></figure>

Intriguingly, the activity seems to have extended into the subsequent day. The reason for the termination of the activity is unclear... Was there a change in C2 IP? Or did the attack simply halt? Upon inspecting DNS queries for "ngrok.io", we find that the returned IP (`dns.answers.data`) has indeed altered. Note that the `dns.answers.data` field was added as a column.

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FYHxou6R9ekqZXIi8H9yg%2Fhunt15.webp?alt=media&#x26;token=145a8ace-5bd2-4a02-999c-ff50744974f7" alt=""><figcaption></figcaption></figure>

The newly discovered IP also indicates that connections continued consistently over the following days.

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2F1XB4K7WCotmEI6aGruNs%2Fhunt16.webp?alt=media&#x26;token=771f4b39-cec8-422b-a86f-97d9442ee6ef" alt=""><figcaption></figcaption></figure>

Thus, it's apparent that there is sustained network activity, and we can deduce that the C2 has been accessed continually. Now, as for the earlier uploaded executable file "default.exe" – did that ever execute? By probing the Sysmon logs for a process with that name, we can ascertain this. Note that the `process.name`, `process.args`, `event.code`, `file.path`, `destination.ip`, and `dns.question.name` fields were added as columns.

```shell-session
process.name:"default.exe"
```

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FSiA8yK23xt2PDY3bwfKn%2Fhunt17.webp?alt=media&#x26;token=46c90db3-1e9e-4b51-892f-1af722597a01" alt=""><figcaption></figcaption></figure>

Indeed, it has been executed – we can instantly discern that the executable initiated DNS queries for Ngrok and established connections with the C2 IP addresses. It also uploaded two files "svchost.exe" and "SharpHound.exe". SharpHound is a recognized tool for diagramming Active Directory and identifying attack paths for escalation. As for svchost.exe, we're unsure – is it another malicious agent? The name implies it attempts to mimic the legitimate svchost file, which is part of the Windows Operating System.

If we scroll up there's further activity from this executable, including the uploading of "payload.exe", a VBS file, and repeated uploads of "svchost.exe".

At this juncture, we're left with one question: did SharpHound execute? Did the attacker acquire information about Active Directory? We can investigate this with the following query (since it was an on-disk executable file).

```shell-session
process.name:"SharpHound.exe"
```

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FIyF2XA9po5KIFe2UkuNB%2Fhunt18.webp?alt=media&#x26;token=9d575cb0-d929-48d8-8d67-30894356546a" alt=""><figcaption></figcaption></figure>

Indeed, the tool appears to have been executed twice, roughly 2 minutes apart from each other.

It's vital to note that Sysmon has flagged "default.exe" with a file hash (`process.hash.sha256` field) that aligns with one found in the Threat Intel report. This leads us to question whether this executable has been detected on other devices within the environment. Let's conduct a broad search. Note that the `host.hostname` field was added as a column.

```shell-session
process.hash.sha256:018d37cbd3878258c29db3bc3f2988b6ae688843801b9abc28e6151141ab66d4
```

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FoNdka7ERo4rj0WbJhhCK%2Fhunt29.webp?alt=media&#x26;token=9828a2ca-22cf-4a41-94d7-58780da546b9" alt=""><figcaption></figcaption></figure>

Files with this hash value have been found on WS001 and PKI, indicating that the attacker has also breached the PKI server at a minimum. It also appears that a backdoor file has been placed under the profile of user "svc-sql1", suggesting that this user's account is likely compromised.

Expanding the first instance of "default.exe" execution on PKI, we notice that the parent process was "PSEXESVC", a component of PSExec from SysInternals – a tool often used for executing commands remotely, frequently utilized for lateral movement in Active Directory breaches.

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FP8zGbwSJA3Np3qgKn65M%2Fhunt20.webp?alt=media&#x26;token=f78788c6-fe39-4c79-8b79-14609b7b7a2b" alt=""><figcaption></figcaption></figure>

Further down the same log, we notice "svc-sql1" in the `user.name` field, thereby confirming the compromise of this user.

How was the password of "svc-sql1" compromised? The only plausible explanation from the available data so far is potentially the earlier uploaded PowerShell script, seemingly designed for Password Bruteforcing. We know that this was uploaded on WS001, so we can check for any successful or failed password attempts from that machine, excluding those for Bob, the user of that machine (and the machine itself).

```shell-session
(event.code:4624 OR event.code:4625) AND winlog.event_data.LogonType:3 AND source.ip:192.168.28.130
```

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FnJinDFccaC9ZlcdBxU1x%2Fhunt21.webp?alt=media&#x26;token=eac39c92-ed0c-4d61-bdc3-64ce80315fad" alt=""><figcaption></figcaption></figure>

The results are quite intriguing – two failed attempts for the administrator account, roughly around the time when the initial suspicious activity was detected. Subsequently, there were numerous successful logon attempts for "svc-sql1". It appears they attempted to crack the administrator's password but failed. However, two days later on the 28th, we observe successful attempts with svc-sql1.

## Q & A

1\) Navigate to http://\[Target IP]:5601 and follow along as we hunt for Stuxbot. In the part where default.exe is under investigation, a VBS file is mentioned. Enter its full name as your answer, including the extension.

```
process.name: "default.exe" 
```

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FJnrjfVEPpOo0hjmWfD9M%2FScreenshot(1).png?alt=media&#x26;token=5d0cd079-0e34-4c02-80ca-ae2a0e8ef689" alt=""><figcaption></figcaption></figure>

Answer:  XceGuhkzaTrOy.vbs

**2)** Stuxbot uploaded and executed mimikatz. Provide the process arguments (what is after .\mimikatz.exe, ...) as your answer.

```
process.name: "mimikatz.exe" 
```

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2F11UetAhZy48ITgokHxwh%2FScreenshot(2).png?alt=media&#x26;token=2ad0109f-f378-4108-b0e2-5cd0d16c02a3" alt=""><figcaption></figcaption></figure>

Answer:  lsadump::dcsync /domain:eagle.local /all /csv, exit

3\) Some PowerShell code has been loaded into memory that scans/targets network shares. Leverage the available PowerShell logs to identify from which popular hacking tool this code derives. Answer format (one word): P\_\_\_\_V\_\_\_

I initially filter by checking whether `powershell.file.script_block_text` exists during the period from `March 26, 2023`, to `March 29, 2023`.

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2F3CuK0qJKC1Uur6lYjIEp%2FScreenshot(3).png?alt=media&#x26;token=018e189f-4ce4-4dce-aece-03804a2d4472" alt=""><figcaption></figcaption></figure>

Then I added `powershell.file.script_block_text` as a column and then scrolled down.

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FF2wAWCWVXyHo9siaNfr7%2FScreenshot(4).png?alt=media&#x26;token=bfd14b71-43a3-4926-a921-4c7683eebbd1" alt=""><figcaption></figcaption></figure>

By expanding this, you can retrieve the answer from the message field.

Answer:  PowerView

## Skills Assessment

### Hunting For Stuxbot (Round 2)

Recently uncovered details shed light on the operational strategy of Stuxbot's newest iteration.

1. The newest iterations of Stuxbot are exploiting the `C:\Users\Public` directory as a conduit for deploying supplementary utilities.
2. The newest iterations of Stuxbot are utilizing registry run keys as a mechanism to ensure their sustained presence within the infected system.
3. The newest iterations of Stuxbot are utilizing PowerShell Remoting for lateral movement within the network and to gain access to domain controllers.

### The Available Data

The cybersecurity strategy implemented is predicated on the utilization of the Elastic stack as a SIEM solution. Through the "Discover" functionality we can see logs from multiple sources. These sources include:

* `Windows audit logs` (categorized under the index pattern windows\*)
* `System Monitor (Sysmon) logs` (also falling under the index pattern windows\*, more about Sysmon [here](https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon))
* `PowerShell logs` (indexed under windows\* as well, more about PowerShell logs [here](https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html))
* `Zeek logs`, [a network security monitoring tool](https://www.elastic.co/guide/en/beats/filebeat/current/exported-fields-zeek.html) (classified under the index pattern zeek\*)

### The Tasks

Navigate to the bottom of this section and click on `Click here to spawn the target system!`

Now, navigate to `http://[Target IP]:5601`, click on the side navigation toggle, and click on "Discover". Then, click on the calendar icon, specify "last 15 years", and click on "Apply".

`Hunt 1`: Create a KQL query to hunt for ["Lateral Tool Transfer"](https://attack.mitre.org/techniques/T1570/) to `C:\Users\Public`. Enter the content of the `user.name` field in the document that is related to a transferred tool that starts with "r" as your answer.

`Hunt 2`: Create a KQL query to hunt for ["Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"](https://attack.mitre.org/techniques/T1547/001/). Enter the content of the `registry.value` field in the document that is related to the first registry-based persistence action as your answer.

`Hunt 3`: Create a KQL query to hunt for ["PowerShell Remoting for Lateral Movement"](https://www.ired.team/offensive-security/lateral-movement/t1028-winrm-for-lateral-movement). Enter the content of the `winlog.user.name` field in the document that is related to PowerShell remoting-based lateral movement towards DC1.

1\) Enter your answer for Hunt 1.

```
"C:\Users\Public*" and event.code: 11
```

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FcVJbPw4FFRDmG2fuvMV8%2FScreenshot(5).png?alt=media&#x26;token=1564b552-4bd3-41bf-b093-ab0824f99b46" alt=""><figcaption></figcaption></figure>

Answer:  svc-sql1

2\) Enter your answer for Hunt 2.

```
event.code:13 AND registry.path: *Run*
```

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2F66LKPhrxIjy7fEXzGoGC%2FScreenshot(6).png?alt=media&#x26;token=afe3fc77-ba58-45a5-986c-182ced5819b4" alt=""><figcaption></figcaption></figure>

Answer:  LgvHsviAUVTsIN

3\) Enter your answer for Hunt 3.

```
powershell.file.script_block_text: *Enter-PSSession* and event.code:4104
```

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FA9bAtrQBVAvtRdnJWBFn%2FScreenshot(7).png?alt=media&#x26;token=fbaa7017-f4bd-4bd9-833b-f4e82dcda59c" alt=""><figcaption></figcaption></figure>

Answer:  svc-sql1
