---
description: 'Scenario: Identify and Investigate an Infected Host'
---

# Benign

One of the client’s IDS indicated a potentially suspicious process execution indicating one of the hosts from the HR department was compromised. Some tools related to network information gathering / scheduled tasks were executed which confirmed the suspicion. Due to limited resources, we could only pull the process execution logs with Event ID: 4688 and ingested them into Splunk with the index **win\_eventlogs** for further investigation.

About the Network Information

The network is divided into three logical segments. It will help in the investigation.

\*\*IT Department\
\*\*

* James
* Moin
* Katrina

\*\*HR department\
\*\*

* Haroon
* Chris
* Diana

**Marketing department**

* Bell
* Amelia
* Deepak

Answer the questions below

How many logs are ingested from the month of March?

<figure><img src="https://125533565-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8j0nua8Yk6eTswSIxruB%2Fuploads%2FLn5YE6v68FRT0KP9sTuJ%2FPasted%20image%2020221215133527.png?alt=media&#x26;token=46891703-f914-4118-ae3e-f9eb448020ff" alt=""><figcaption></figcaption></figure>

_13959_

Imposter Alert: There seems to be an imposter account observed in the logs, what is the name of that user?

index=win\_eventlogs| rare limit=20 UserName

<figure><img src="https://125533565-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8j0nua8Yk6eTswSIxruB%2Fuploads%2F6rUi2mz876h2wcQxsIUQ%2FPasted%20image%2020221215133941.png?alt=media&#x26;token=c41c5e8a-97f1-4e7b-af0f-38e192053c08" alt=""><figcaption></figcaption></figure>

_Amel1a_

Which user from the HR department was observed to be running scheduled tasks?

https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4688

index=win\_eventlogs EventID=4688

or

index=win\_eventlogs "schtasks"

<figure><img src="https://125533565-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8j0nua8Yk6eTswSIxruB%2Fuploads%2FIZo116BiqZ4PTKjVZZCq%2FPasted%20image%2020221215140145.png?alt=media&#x26;token=74330702-0a2f-43c6-bd12-a588681c4232" alt=""><figcaption></figcaption></figure>

<figure><img src="https://125533565-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8j0nua8Yk6eTswSIxruB%2Fuploads%2FnEhKXYRnAPbULZircpG7%2FPasted%20image%2020221215143204.png?alt=media&#x26;token=68f439ef-242f-4293-b48d-2ef001083968" alt=""><figcaption></figcaption></figure>

_Chris.fort_

Which user from the HR department executed a system process (LOLBIN) to download a payload from a file-sharing host. Explore lolbas-project.github.io/ to find binaries used to download payloads

index=win\_eventlogs| rare limit=20 ProcessName

<figure><img src="https://125533565-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8j0nua8Yk6eTswSIxruB%2Fuploads%2FSY2ruDDkI2V1192Y0eEZ%2FPasted%20image%2020221215143345.png?alt=media&#x26;token=97be82cf-0eda-4e8e-8d7b-c6831bc612a5" alt=""><figcaption></figcaption></figure>

https://lolbas-project.github.io/#certu

to download

<figure><img src="https://125533565-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8j0nua8Yk6eTswSIxruB%2Fuploads%2FeCW8FJsOTYMCHiPr0raY%2FPasted%20image%2020221215143445.png?alt=media&#x26;token=4a60eb99-7d38-4d37-b6cd-86f9372c50cf" alt=""><figcaption></figcaption></figure>

index=win\_eventlogs certutil.exe

<figure><img src="https://125533565-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8j0nua8Yk6eTswSIxruB%2Fuploads%2F8NX2m8nUpfdPu8Jd5kLh%2FPasted%20image%2020221215143555.png?alt=media&#x26;token=82c7f0dd-62ff-4e31-9244-9b3429b43aca" alt=""><figcaption></figcaption></figure>

_haroon_

To bypass the security controls, which system process (lolbin) was used to download a payload from the internet?

_certutil.exe_

What was the date that this binary was executed by the infected host? format (YYYY-MM-DD)

<figure><img src="https://125533565-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8j0nua8Yk6eTswSIxruB%2Fuploads%2FxgzELE9IqG71kq2TKTZl%2FPasted%20image%2020221215143654.png?alt=media&#x26;token=65ac7b5d-27d0-4504-927b-bd41af103a2c" alt=""><figcaption></figcaption></figure>

_2022-03-04_

Which third-party site was accessed to download the malicious payload?

_controlc.com_

What is the name of the file that was saved on the host machine from the C2 server during the post-exploitation phase?

_benign.exe_

The suspicious file downloaded from the C2 server contained malicious content with the pattern THM{..........}; what is that pattern?

https://controlc.com/548ab556

```
*THM{KJ&*H^B0}*
```

What is the URL that the infected host connected to?

_https://controlc.com/548ab556_

\[\[Investigating with Splunk]]
