Day 2: One man's false positive is another man's potpourri.

• Start the lab and visit the provided url. Click on three line in top left corner then click on Discover.
• Now update the time frame from 29-nov-24 00:00 to 01-dec-24 09:30
• Add following filters >>
  1. host.hostname
  2. user.name
  3. process.command_line
  4. event.category
  5. event.outcome
  6. source.ip
  
• You can see , there are a lot of hits on 1 dec around 08:00. May be these hits occurs when someone tries to bruteforce the authentication. And we can see there is an username service_admin which is causing all failed login attempts.

To find all the failed login hits , set the filters event.category = authentication and event.outcome = failure

We can see the source ip address of the attacker (GLITCH) who was performing the brutefore attack. And after being successfull may be he stopped or chenged device or possibly used the cracked account.

After doing a lot of failed login attempts, Glitch found success on :

• After successfull attempt, glitch ran a encoded command in powershell which is : SQBuAHMAdABhAGwAbAAtAFcAaQBuAGQAbwB3AHMAVQBwAGQAYQB0AGUAIAAtAEEAYwBjAGUAcAB0AEEAbABsACAALQBBAHUAdABvAFIAZQBiAG8AbwB0AA==

  
• Open cyberchef and use the recips From Base64 and Decode text with encoding type of UTF-16LE(1200) (POWERSHELL default encoding type)
• In output you can see the decoded command