Cyberhaze | You have got mail
You are a SOC analyst investigating a cybersecurity incident raised when an internal user interacted with a malicious email received on 19th of January.
Scenario
VM Linux machine credentials: Username: helk Password: Cyberhaze Kibana access: Url: https://127.0.0.1 Username: helk Password: Cyberhaze ** Be Aware that you might need to change the index to find the rest of the logs. **
Q1: What is the email logs index?
Answer : cyberhaze_email*
Q2 : What is the malicious file hash?
First, we need to look and see what is the name of the attachment that arrived in the email and that the employee interacted with. We will add these columns :
And then search for a strange attachment name.
Now we found an attachment with a .doc extension. This is the most common extension used by attackers to deceive victims into thinking it is just a regular document file.
Answer: 68126cb20ca18cd68cefe085cf26221ed4b17eaa8913760679bf23851c4f884e
Q3: What is the sender of the malicious email?
Answer: partner@external-vendor.com
Q3: What is the name of the infected host?
Now, we need to find the hostname where this occurred, so we will check the Windows logs to find the answer.
After filtering with the query shown in the image above, one hit appeared. If we expand it, we will be able to see the hostname.
Answer: ACC2.haze
Q5: What is the name of the downloaded malicious script?
To find the name of the downloaded script, we need to filter further and check event code 4688 to view the processes that were created and see if we can find the answer through them.
The image directly above is a treasure we have reached to understand what happened. The image tells us that after running the file we identified earlier, invoice.doc, an encoded PowerShell command was executed. This was followed by the download of the Mimikatz tool, which is famous for credential dumping, and then the use of the PsExec tool, which is famous for lateral movement.
Get Yousefelzeiny’s stories in your inbox
Join Medium for free to get updates from this writer.
Now, we need to decode the PowerShell command we found and see its original form, we can do this on (ceberchef).
As shown in the image, the attacker is trying to download a script named s2.ps1.
Answer: s2.ps1
Q6: What is the useragent used during the communication of downloading the malicious script as per the logs?
Now, we need to check the proxy logs within our same time range to search for a strange user agent name.
Answe: Mozilla/5.0 (Windows NT 10.0; Win64; x64) PowerShell/7.1.0
Q7: What is the name of the script used to collect the users’ credentials?
Answer: Invoke-Mimikatz.ps1
Q8: What is the name of the tool used for lateral movement?
Answer: psexec.exe
Q9: What is the username used for lateral movement?
Answer: administrator
Q10: What is the hostname the attacker pivoted to?
Now, we need to find out which device or host the user named administrator is located on. We will search the Windows logs using this username and add the host name column.
Answer: IT.haze
Q11: What is the service name installed on the infected machine for pivoting?
The PsExec tool, when deployed, always creates its own temporary service. To find its name, we will search for event code 4697, which is related to service creation.
We will expand the log and look for the service name.
Answer: hazeservice
