Skip to main content

We use cookies to ensure you get the best user experience. For more information see our cookie policy.

Handbook for the Recently Compromised

Trace an intrusion through Windows event logs and uncover what happened on the workstation.

Task 1: Log Analysis Handbook for the Recently Compromised

STRANGE & UNUSUAL ACTIVITY // FORENSICS 
Handbook for the

Recently Compromised

EASY
A Windows workstation has been flagged for unusual activity. Examine its event logs, follow the sequence of suspicious actions, and piece together how the host was compromised.
LOG ANALYSIS WINDOWS FORENSICS EVTX
 
+ INCIDENT BRIEF
STATUS: ACTIVE
01 // MISSION

You have been given Windows event logs collected from a workstation under investigation. Review the recorded activity, identify the events associated with the intrusion, and build a timeline that explains what the attacker did on the host.

EVIDENCE PROVIDED
+ Windows Event Logs (.evtx)
02 // OBJECTIVES
01. Identify the earliest evidence of suspicious activity.
02. Connect related events and reconstruct the attack timeline.
03. Link the observed actions to relevant MITRE ATT&CK techniques.
04. Establish what the attacker achieved on the workstation.
ANALYST NOTE
Start with the timestamps, then compare the accounts, processes, and commands involved. An isolated event may look ordinary; the events around it can tell a different story.
 
SUSPICIOUS_ENDPOINT_ACTIVITY // CASE FILE OPEN
HANDBOOK_FOR_THE_RECENTLY_COMPROMISED // FORENSICS // LOG_ANALYSIS

Answer the questions below

  1. A trusted Windows utility downloaded a second-stage script onto the host. The command that called the utility obscured its name with a wildcard. What is the utility’s full executable name?

  2. What full URL did the utility retrieve the second-stage script from?

  3. Which MITRE ATT&CK sub-technique describes the abuse of the Windows scripting host that executed the initial attachment?

  4. Which MITRE ATT&CK sub-technique describes the persistence mechanism the intruder configured?

  5. What is the flag?

Room Icon

Handbook for the Recently Compromised

Trace an intrusion through Windows event logs and uncover what happened on the workstation.

easy

30 min

Team room

18

User profile photo.
User profile photo.

To access material, start machines and answer questions login.

Score updated
Score updated

Set up your virtual environment

To successfully complete this room, you'll need to set up your virtual environment. This involves starting both your AttackBox (if you're not using your VPN) and Lab Machines, ensuring you're equipped with the necessary tools and access to tackle the challenges ahead.
Attacker machine
Status:Off
Lab machine
Status:Off
STRANGE & UNUSUAL ACTIVITY // FORENSICS 
Handbook for the

Recently Compromised

EASY
A Windows workstation has been flagged for unusual activity. Examine its event logs, follow the sequence of suspicious actions, and piece together how the host was compromised.
LOG ANALYSIS WINDOWS FORENSICS
 
+ INCIDENT BRIEF
STATUS: ACTIVE
01 // MISSION

You have been given Windows event logs collected from a workstation under investigation. Review the recorded activity, identify the events associated with the intrusion, and build a timeline that explains what the attacker did on the host.

EVIDENCE PROVIDED
+ Windows Event Logs (.evtx)
02 // OBJECTIVES
01. Identify the earliest evidence of suspicious activity.
02. Connect related events and reconstruct the attack timeline.
03. Link the observed actions to relevant ATT&CK techniques.
04. Establish what the attacker achieved on the workstation.
ANALYST NOTE
Start with the timestamps, then compare the accounts, processes, and commands involved. An isolated event may look ordinary; the events around it can tell a different story.
 
SUSPICIOUS_ENDPOINT_ACTIVITY // CASE FILE OPEN
HANDBOOK_FOR_THE_RECENTLY_COMPROMISED // FORENSICS // LOG_ANALYSIS
Answer the questions below

A trusted Windows utility downloaded a second-stage script onto the host. The command that called the utility obscured its name with a wildcard. What is the utility’s full executable name?

What full URL did the utility retrieve the second-stage script from?

Which MITRE ATT&CK sub-technique describes the abuse of the Windows scripting host that executed the initial attachment?

Which MITRE ATT&CK sub-technique describes the persistence mechanism the intruder configured?

What is the flag?