Overview
In this Hack the Box investigation, I analyzed over 500,000 events across multiple log sources to identify malicious activity within a simulated enterprise environment. Using Splunk, Sysmon, Windows Security Logs, and Linux Syslog data, I traced an attack from initial malware execution through credential theft and eventual Active Directory compromise.
Investigation
I began by reviewing Sysmon process creation events, looking for unusual parent-child process relationships. One immediately stood out: notepad.exe spawning powershell.exe.
This behavior is highly unusual and warranted further investigation. Examining the command line revealed PowerShell downloading an executable from an internal IP address, 10.0.0.229.
Pivoting on the IP address led me to a Linux system named waldo-virtual-machine. Additional log analysis showed multiple systems communicating with this host and downloading tools and payloads. This suggested the Linux machine was being used as a staging server to distribute malicious files throughout the environment.
As the investigation continued, I shifted focus toward credential theft activity. Reviewing Sysmon Process Access events revealed notepad.exe accessing lsass.exe with extensive permissions. Since LSASS stores user credentials in memory, this behavior strongly indicated credential dumping activity.
To determine how far the compromise had progressed, I examined Active Directory-related events. Security Event ID 4662 revealed a user account requesting permissions associated with DS-Replication-Get-Changes-All, a permission commonly abused during DCSync attacks.
This finding confirmed that the attacker had progressed beyond a single host compromise and was actively attempting to replicate sensitive Active Directory data.
Findings
The attack chain consisted of:
- Malicious PowerShell execution
- Payload delivery from an internal Linux host
- Credential dumping against LSASS
- Privilege escalation
- DCSync activity against Active Directory
By correlating data across multiple log sources, I was able to reconstruct the attacker’s actions and identify evidence of a complete domain compromise.tep 2: Check System File Integrity
Lessons Learned
This room reinforced the importance of behavioral analysis during threat hunting. Simple indicators such as unusual parent-child processes can quickly lead investigators toward larger compromises.
It also demonstrated how valuable Sysmon telemetry can be when investigating credential theft and post-exploitation activity. Process creation events, process access events, and security logs collectively provided enough visibility to trace the attack from initial execution through Active Directory compromise.
Finally, this investigation highlighted the importance of converting hunting techniques into detections. The same behaviors used to identify the attacker can be transformed into alerts that help defenders identify future attacks more quickly.
Conclusion
This room provided a realistic example of how SOC analysts investigate attacks within large datasets. Rather than relying on a single indicator of compromise, the investigation required correlating activity across multiple systems, validating findings through log analysis, and identifying attacker behaviors that could be leveraged for future detection opportunities.
