Lab 001 · Question set
Questions¶
Hunt on your own and check your answers as you go. Your score is only saved in this browser. Each question has a hint, the answer, and a link to the part of the walkthrough that covers it.
Answers aren't case sensitive unless the question says so. When a question asks for several values, separate them with commas, in any order.
Running a CTF?
You can export these questions to CTFd with scripts/export_ctfd.py. See the exporter docs.
Triage¶
2 questions · 100 points
Which workstation was compromised first?
Hint
Which host first started a shell straight from Explorer?
Evidence: Sysmon process creation, Sysmon network connection
Which domain user ran the first suspicious process tree?
Hint
Check the user on the earliest suspicious process, not later logons.
Evidence: Sysmon process creation
Initial access¶
2 questions · 150 points
What social engineering technique got the user to paste and run the first command?
Hint
Look at the Run dialog history in the registry.
Evidence: Sysmon registry value set, Sysmon process creation
Which command interpreter did Explorer start to download and unpack the first bundle?
Hint
Match the Run dialog history to processes started by explorer.exe.
Evidence: Sysmon process creation, Sysmon registry value set
Loader analysis¶
5 questions · 425 points
What file name did the loader run under on disk?
Hint
What did tar.exe write?
Evidence: Sysmon process creation, Sysmon file create
What original file name is embedded in that executable?
Hint
Sysmon records the original file name from the binary's version info.
Evidence: Sysmon process creation
What Python path configuration file was placed next to the loader?
Hint
tar keeps the archive's file times, so check Sysmon event 2 as well as event 11.
Evidence: Sysmon file creation time change
Which archive file supplied the loader's startup code?
Hint
Not every archive has an archive extension.
Evidence: Sysmon file creation time change
What executable did the loader start first?
Hint
Look at the loader's direct children.
Evidence: Sysmon process creation
Discovery¶
2 questions · 175 points
Which two built-in Windows programs were run over and over to collect user and network details?
Hint
Ignore anything launched through cmd.exe.
Evidence: Sysmon process creation
Which parent and child pair collected operating system details? Submit them in order, parent first.
Hint
One of the two only wraps the other.
Evidence: Sysmon process creation
Remote access¶
2 questions · 175 points
Which remote support tool was deployed under the same support-themed file name?
Hint
Two different binaries share one file name. Compare their original file names.
Evidence: Sysmon process creation, Sysmon network connection
What command line did the attacker type to open a shell?
Hint
Look for a command a person typed, not the automated discovery.
Evidence: Sysmon registry value set, Sysmon process creation
Persistence¶
3 questions · 300 points
Which legitimate program loaded a DLL from the user profile, started discovery commands and made an outbound connection?
Hint
Look at image loads from user-writable folders.
Evidence: Sysmon image load, Sysmon process creation, Sysmon network connection
What registry value was added for persistence? Submit the key path with the value name, starting with HKCU.
Hint
Sysmon names user hives by SID, not HKCU.
Evidence: Sysmon registry value set
Which two DLLs were staged in the user-writable plugin folder?
Hint
Look at every file written to the folder the DLL loaded from.
Evidence: Sysmon file create, Sysmon image load
Credential access¶
4 questions · 300 points
What password was tried against several domain accounts? (case sensitive)
Hint
Look for command lines that pass a password.
Evidence: Sysmon process creation
Which two regular user accounts rejected the sprayed password?
Hint
Check failed Kerberos pre-authentication.
Evidence: Windows Security Kerberos pre-authentication failures, Zeek Kerberos
Which admin-named account also rejected the sprayed password?
Hint
Same events as the last question.
Evidence: Windows Security Kerberos pre-authentication failures, Zeek Kerberos
Which account accepted the sprayed password?
Hint
Look for a successful logon right after the failures.
Evidence: Windows Security, Zeek Kerberos, Zeek SMB
Lateral movement¶
5 questions · 375 points
Which workstation did the attacker move to?
Hint
Where did that account log on next?
Evidence: Windows Security, Windows System, Sysmon process creation
Which remote service execution tool did the attacker use to move?
Hint
Search command lines on the first host for UNC paths.
Evidence: Sysmon process creation, Windows System
Which two admin shares were used, one to test credentials and one to stage the payload?
Hint
Zeek's SMB mapping log records share names.
Evidence: Sysmon process creation, Zeek SMB mapping
What service name was installed on the target?
Hint
System event 7045 records new services.
Evidence: Windows System
Which account did the payload run as on the second workstation?
Hint
Check the user on the payload's process start, not the logon account.
Evidence: Sysmon process creation
Infrastructure¶
5 questions · 425 points
Which two attacker domains appear in the intrusion?
Hint
Rank DNS queries from the affected hosts and look for rare names.
Evidence: Zeek DNS, Sysmon DNS query
Which IP address did each attacker domain resolve to?
Hint
Check Zeek DNS answers.
Evidence: Zeek DNS, Zeek connection, Sysmon network connection
Answer
update-cache-m9tdco18phmc.com → 203.0.113.87support-assist-7wfncs.online → 192.0.2.146
Which destination port did the implant use for command and control?
Hint
Separate the implant's traffic from the remote support tool's traffic.
Evidence: Zeek connection, Zeek SSL, Sysmon network connection
Which two destination ports carried the remote support tool's signaling and relay traffic?
Hint
Count only completed connections from the client. Ignore attempts that were never answered.
Evidence: Sysmon network connection, Zeek connection
Which other destination port did the remote support tool connect to successfully?
Hint
Look at all of its connections, not only the long ones.
Evidence: Sysmon network connection, Zeek connection
Scope¶
1 question · 75 points
Which two workstations called back to the implant's server?
Hint
Use endpoint logs to confirm the source host.
Evidence: Sysmon network connection