-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
29 changed files
with
254 additions
and
15 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,71 @@ | ||
| --- | ||
| title: "hackthebox sherlocks Unit42" | ||
| summary: "Unit42 htb sherlocks writeup" | ||
| # weight: 1 | ||
| # aliases: ["/first"] | ||
| tags: ["Post","hackthebox","sherlocks","DFIR"] | ||
| author: "Katana" | ||
| # author: ["Me", "You"] # multiple authors | ||
| showToc: true | ||
| TocOpen: false | ||
| draft: false | ||
| hidemeta: false | ||
| comments: false | ||
| description: "Unit42 htb sherlocks writeup" | ||
| canonicalURL: "https://h3xkatana.github.io/Blog/post/unit42/" | ||
| disableHLJS: true # to disable highlightjs | ||
| disableShare: false | ||
| disableHLJS: false | ||
| hideSummary: false | ||
| searchHidden: true | ||
| ShowReadingTime: true | ||
| ShowBreadCrumbs: true | ||
| #ShowPostNavLinks: true | ||
| ShowWordCount: true | ||
| ShowRssButtonInSectionTermList: true | ||
| UseHugoToc: true | ||
| cover: | ||
| image: "<image path/url>" # image path/url | ||
| alt: "<alt text>" # alt text | ||
| caption: "<text>" # display caption under cover | ||
| relative: false # when using page bundles set this to true | ||
| hidden: true # only hide on current single page | ||
| editPost: | ||
| URL: "https://github.com/<path_to_repo>/content" | ||
| Text: "Suggest Changes" # edit text | ||
| appendFilePath: true # to append file path to Edit link | ||
| --- | ||
|
|
||
| INTRO: | ||
| In this Sherlock, you will familiarize yourself with Sysmon logs and various useful EventIDs for identifying and analyzing malicious activities on a Windows system. Palo Alto's Unit42 recently conducted research on an UltraVNC campaign, wherein attackers utilized a backdoored version of UltraVNC to maintain access to systems. This lab is inspired by that campaign and guides participants through the initial access stage of the campaign. | ||
|
|
||
|
|
||
|  | ||
|
|
||
| We have a file containing Windows event logs that capture suspicious activity. | ||
| These logs are accompanied by well-defined rules for detection. | ||
|
|
||
| Upon filtering, we discovered that there are 56 occurrences of Event ID 11, | ||
| which is highly suspicious because this ID typically signifies file creation events. | ||
|
|
||
| Event ID 1 provides detailed records of processes, including their names, | ||
| hashes, and parent paths. This information can be instrumental in identifying malware. | ||
|
|
||
| Event ID 22 presents domain records, | ||
| indicating that the file was downloaded from Dropbox, which raises suspicion. | ||
|
|
||
| Event ID 2 indicates a process altering file creation times, a behavior that is often indicative of malicious activity. | ||
|
|
||
| For Task 5, the instruction is to search for Event ID 11 alongside the presence of "once.cmd", | ||
| suggesting a specific detection scenario. | ||
|
|
||
| Task 6 involves utilizing Event ID 22 to uncover domain names associated with potentially malicious activities. | ||
|
|
||
| Task 7 entails leveraging Event ID 3, which typically indicates network connections, | ||
| to identify suspicious connections, particularly those involving TCP connections to suspicious IP addresses. | ||
|
|
||
| Finally, Task 8 involves using Event ID 5 to compile a list of terminated processes, | ||
| which could provide insights into potentially malicious activities that have been halted. | ||
|
|
||
| In summary, by analyzing specific event IDs and their associated details, | ||
| we can effectively detect and investigate suspicious activities within the Windows event logs. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.