|
| 1 | +--- |
| 2 | +title: "Offensive Security Threat Hunter Exam Report" |
| 3 | +author: ["[email protected]", "OSID: XXXXX"] |
| 4 | +date: "2024-10-19" |
| 5 | +subject: "Markdown" |
| 6 | +keywords: [Markdown, Example] |
| 7 | +subtitle: "OSTH Exam Report" |
| 8 | +lang: "en" |
| 9 | +titlepage: true |
| 10 | +titlepage-color: "483D8B" |
| 11 | +titlepage-text-color: "FFFAFA" |
| 12 | +titlepage-rule-color: "FFFAFA" |
| 13 | +titlepage-rule-height: 2 |
| 14 | +book: true |
| 15 | +classoption: oneside |
| 16 | +code-block-font-size: \scriptsize |
| 17 | +--- |
| 18 | +# Offensive Security Threat Hunter Exam Report |
| 19 | + |
| 20 | +## Introduction |
| 21 | + |
| 22 | +The OffSec Threat Hunter exam report contains all efforts that were conducted in order to pass the OffSec certification examination. |
| 23 | +This report should contain all items that were used to pass the exam and it will be graded from a standpoint of correctness and fullness to all aspects of the exam. |
| 24 | +The purpose of this report is to ensure that the student has a full understanding of threat hunting methodologies as well as the technical knowledge to pass the qualifications for the OffSec Threat Hunter. |
| 25 | + |
| 26 | +## Objective |
| 27 | + |
| 28 | +The objective of this assessment is to perform a threat hunting sprint in the Megacorp One environment. |
| 29 | +The student is tasked with following a methodical approach to identify all compromised systems and detect if sensitive data was exfiltrated or encrypted. |
| 30 | +An example page has already been created for you at the latter portions of this document that should demonstrate the amount of information and detail that is expected in the exam report. |
| 31 | +Use the sample report as a guideline to get you through the reporting. |
| 32 | + |
| 33 | +## Requirements |
| 34 | + |
| 35 | +The student will be required to fill out this threat hunting report fully and to include the following sections: |
| 36 | + |
| 37 | +- Executive Summary |
| 38 | +- Methodology |
| 39 | +- Hunt Narrative |
| 40 | + - A detailed walkthrough of the entire threat hunting sprint. |
| 41 | + - The walkthrough should contain an explanation of all steps, assumptions, and decisions supported by screenshots and Splunk queries if applicable. |
| 42 | + - The walkthrough should be thorough enough that the complete threat hunting sprint can be replicated step-by-step by a technically competent reader. |
| 43 | +- Findings |
| 44 | + - A timeline of all key activities related to the attacker’s actions |
| 45 | +- Conclusion |
| 46 | +- IoC Lists in the Appendix |
| 47 | + |
| 48 | +# Executive Summary |
| 49 | + |
| 50 | +## Overview |
| 51 | + |
| 52 | +The threat hunting sprint began with the assignment of reviewing the threat intelligence report of an APT group known as “We Are Garfield” (WAG) and proactively hunting for indicators of a compromise within the Megacorp One systems. |
| 53 | +The primary objectives were to identify all compromised systems and assess the impact of the attacker’s actions, such as determining whether data has been exfiltrated or encrypted. |
| 54 | + |
| 55 | +During the threat hunt, we identified three compromised systems within the Megacorp One environment: |
| 56 | + |
| 57 | +- PC1 |
| 58 | +- PC2 |
| 59 | +- PC3 |
| 60 | + |
| 61 | +The threat actor accessed and exfiltrated the secret recipe for our chocolate muffins, which could have catastrophic consequences if leaked or sold to competitors. |
| 62 | + |
| 63 | +## High-Level Attack Path |
| 64 | + |
| 65 | +The threat hunt revealed the following high-level path the threat actor took to compromise the Megacorp One environment: |
| 66 | + |
| 67 | +1. PC1 was used as the initial entry vector by the threat actor by trying numerous passwords against several user accounts. The threat actor finally succeeded and got access to this machine with administrative privileges. |
| 68 | +2. PC2 was configured to use the same password for the local administrator account and the threat actor used it to get access to it. On the machine, the attacker obtained credentials from logged on users by using Mimikatz. |
| 69 | +3. PC3 was accessed using one of the obtained sets of credentials from PC2. The threat actor accessed and exfiltrated the secret chocolate muffin recipe from this machine. |
| 70 | + |
| 71 | +## Recommendations |
| 72 | + |
| 73 | +The threat hunt revealed the following high-level path the threat actor took to compromise the Megacorp One environment: |
| 74 | + |
| 75 | +1. **Escalate Incident to Incident Response Team:** |
| 76 | + - Escalate the incident to the incident response team to conduct a thorough investigation of the identified compromises. The focus should be on assessing the full scope of the incident and understanding its impact on the organization's systems and data. |
| 77 | + - Collaborate closely with the incident response team to share findings, provide context, and support their efforts in containing and remediating the security incidents. |
| 78 | +2. **Continued Support and Analysis:** |
| 79 | + - Remain actively involved in supporting other defensive teams, particularly during the incident detection and identification phase of the incident management process. |
| 80 | + - Conduct further analysis of the malware samples to extract additional IoCs and behavioral patterns, providing valuable insights for ongoing threat detection and mitigation efforts. |
| 81 | +3. **Continuous Improvement and Training:** |
| 82 | + - Implement policies to ensure that users do not reuse passwords across different accounts. |
| 83 | + - Develop and deploy detection rules to identify and prevent successful password attacks. |
| 84 | + - Add access control mechanisms to prevent unprivileged user accounts from accessing sensitive files. |
| 85 | + - Implement security awareness training for all users, emphasizing strong password usage and best practices. |
| 86 | + |
| 87 | +# Methodology |
| 88 | + |
| 89 | +For the scheduled threat hunting sprint, we utilized the following tools, scripts, commands, and resources: |
| 90 | + |
| 91 | +- Splunk |
| 92 | +- WAG Threat Intelligence Report |
| 93 | +- PowerShell on DEV (Deobfuscation) |
| 94 | + |
| 95 | +We performed an intelligence-based threat hunting sprint based on the information provided in the WAG threat intelligence report. This approach led us to detect the usage of Mimikatz on PC2, which revealed several additional indicators for further investigation. By analyzing these indicators, we were able to identify lateral movement to PC3 by correlating login and Sysmon events in Splunk with the known tools and techniques categorized under the "Lateral Movement" column. Through this analysis, we also discovered that after compromising PC3, the attacker exfiltrated a sensitive document. |
| 96 | + |
| 97 | +After exhausting our list of IoCs and other information from the intelligence-based phase, we transitioned to hypothesis-based threat hunting. This shift provided us with the flexibility to investigate how PC2 was accessed and how the perimeter was breached, considering that this is not a publicly accessible machine. |
| 98 | + |
| 99 | +Our hunting hypothesis was: |
| 100 | + |
| 101 | +We suspect that PC3 and PC2 are not the only systems compromised by the WAG threat actor. While we couldn’t identify any further indicators that revealed additional compromised systems using the credentials obtained from PC2, or following the compromise of PC3, it is likely that PC2 was not the initial system compromised by WAG, given that it is not externally accessible. Therefore, we suspect that at least one other machine is compromised. We will validate this by investigating the events preceding the use of Mimikatz to obtain credentials and by identifying the vector the threat actor used to access PC2 and breach the perimeter. |
| 102 | + |
| 103 | +# Hunt Narrative |
| 104 | + |
| 105 | +The threat intelligence report covering TTPs of the threat actor We Are Garfield provided a list of IoCs including SHA-256 hashes. We used the following query in Splunk to hunt for these hashes: |
| 106 | + |
| 107 | +```default |
| 108 | +index="*" ("EEAAFA68236BD1629E36E81C5A8EC2CE8804C9798B5C84FEE55F6128CCBA8FB0" OR |
| 109 | +"4ED877F6F154EB6EBB02EE44E4D836C28193D9254A4A3D6AF6236D8F5BAB88D2" OR |
| 110 | +"11EBBAA2EDA3CCD4B7F1BB2C09AC7DCA0CD1F4B71B7E0CFCEDE36861E23DA034" OR |
| 111 | +"8507FFC7EA1953F66D8441180C281D456889F93CF3F6CBB01F368886F9D8C097" |
| 112 | +``` |
| 113 | + |
| 114 | +This search query resulted in only a single event with the timestamp 01/11/2024 1:11:11 AM: |
| 115 | + |
| 116 | + |
| 117 | + |
| 118 | +The matching SHA-256 hash is referred to as “Mimikatz” in the threat intelligence report. We then reviewed the event in more detail. |
| 119 | + |
| 120 | + |
| 121 | + |
| 122 | +The event provides us several important information that can be leveraged in our hunt: |
| 123 | + |
| 124 | +- Username: Administrator |
| 125 | +- Filename: Zwetsch.exe |
| 126 | +- Directory: `C:\hackingtools\` |
| 127 | + |
| 128 | +Based on the matching SHA-256 hash of the threat intelligence report and the characteristic commandline argument “sekurlsa::logonpasswords”, we can be certain that this is Mimikatz. |
| 129 | + |
| 130 | +[...] |
| 131 | + |
| 132 | +# Findings |
| 133 | + |
| 134 | + Timestamp | Observation | Affected Assets |
| 135 | +----------------------|-------------|----------------- |
| 136 | +01/09/2024 3:25:00 PM | Beginning of Password Spraying with Password Password1! | Host: PC1 |
| 137 | +01/09/2024 3:58:00 PM | End of Password Spraying. | Host: PC1 |
| 138 | +01/09/2024 3:58:15 PM | Successful login for local Administrator user | Host: PC1 User: Administrator (local) |
| 139 | +01/09/2024 3:59:00 PM | Download of meterpreter.exe from `<IP>` via Browser | Host: PC1 User: Administrator |
| 140 | +01/09/2024 3:59:49 PM | Process Creation of meterpreter.exe | Host: PC1 User: Administrator (local) |
| 141 | +01/09/2024 4:05:11 PM | Process Creation of PsExec | Host: PC1 User: Administrator (local) Target Machine: PC2 Target User: Administrator (local) Password: Password1!" |
| 142 | +[...] | [...] | [...] |
| 143 | +01/11/2024 1:11:11 AM | Process Creation of Zwetsch.exe | Host: PC2 User: Administrator (local) |
| 144 | +[...] | [...]| [...] |
| 145 | + |
| 146 | +# Conclusion |
| 147 | + |
| 148 | +Our threat hunting sprint successfully uncovered three compromised systems within the Megacorp One enterprise, along with the exfiltration of our secret chocolate muffin recipe. |
| 149 | + |
| 150 | +Based on our findings and actionable insights, the incident response team can now initiate the necessary steps for incident detection and identification, containment, and restoration of the compromised systems. In addition, any policy- or regulation-driven actions can be initiated to ensure compliance and further secure the organization. |
| 151 | + |
| 152 | +For comprehensive guidance on potential remediation steps and enhancing detection capabilities, please refer to the compiled list of IoCs provided in the Appendix of this report. These IoCs serve as a valuable reference and baseline for improving our organization's overall security resilience against similar threats in the future. |
| 153 | + |
| 154 | +# Appendix |
| 155 | + |
| 156 | +## **IOCs** |
| 157 | + |
| 158 | +Attached is a compiled list of the resulting IOCs found during the threat hunting sprint. |
| 159 | + |
| 160 | +**File Hashes** |
| 161 | + |
| 162 | +File Name | SHA256 |
| 163 | +----------------|------------------------------------------------------------------ |
| 164 | +Zwetsch.exe | 4ED877F6F154EB6EBB02EE44E4D836C28193D9254A4A3D6AF6236D8F5BAB88D2 |
| 165 | +meterpreter.exe | DF99BBABE7BD0E7A1D96CF370B78FDCF250AF380065A3D51F57EDE6A571E2C15 |
| 166 | +[...] | [...] |
| 167 | + |
| 168 | +**Network Communications** |
| 169 | + |
| 170 | +Type | Value |
| 171 | +---------------|---------------------------------------- |
| 172 | +C&C | 192.168.1.1:9999 (meterpreter.exe) |
| 173 | +Exfiltration | 192.168.1.1:80 (WebDAV Share “looty”) |
| 174 | +File Download | 192.168.1.1:80 (meterpreter.exe) |
| 175 | +File Download | 192.168.1.1:80 (Zwetsch.exe) |
| 176 | +[...] | [...] |
| 177 | + |
0 commit comments