Logjammer

[Easy] - Sherlock Scenario: You have been presented the opportunity to work as a junior DFIR consultant for a big consultancy, however they have provided a technical assessment for you to complete. The consultancy Forela-Security would like to gauge your knowledge on Windows Event Log Analysis. Please analyse and report back on the questions they have asked. 附件 提取码:6f5j SHA256: f45b163c4e7ce233e177681225f4f1e54c95d9716e9a6b95f9ab6df5d362c506

已有数据

Windows 事件日志

• Dump

find . -name '*.evtx' | while read line; do chainsaw dump -j -o "./export/evtx/$(echo -e $line.json | awk -F '/' '{print $NF}')" $line ;done

• Hunt

chainsaw hunt --skip-errors -s ~/.ztm/Forensics/chainsaw/sigma -m ~/.ztm/Forensics/chainsaw/mappings/sigma-event-logs-all.yml -r ~/.ztm/Forensics/chainsaw/rules logjammer/Event-Logs/ -o export/evtx/hunt.log

Task List

• Task 1 - When did user cyberjunkie successfully log into his computer? (UTC)
• Task 2 - The user tampered with firewall settings on the system. Analyze the firewall event logs to find out the Name of the firewall rule added?
• Task 3 - Whats the direction of the firewall rule?
• Task 4 - The user changed audit policy of the computer. Whats the Subcategory of this changed policy?
• Task 5 - The user “cyberjunkie” created a scheduled task. Whats the name of this task?
• Task 6 - Whats the full path of the file which was scheduled for the task?
• Task 7 - What are the arguments of the command?
• Task 8 - The antivirus running on the system identified a threat and performed actions on it. Which tool was identified as malware by antivirus?
• Task 9 - Whats the full path of the malware which raised the alert?
• Task 10 - What action was taken by the antivirus?
• Task 11 - The user used Powershell to execute commands. What command was executed by the user?
• Task 12 - We suspect the user deleted some event logs. Which Event log file was cleared?

Task 1 - When did user cyberjunkie successfully log into his computer? (UTC)

27/03/2023 14:37:09

• 成功登录的事件 ID 为 4624，使用以下 jq 语法查询。

cat Security.evtx.json | jq '.[].Event | {EventID: .System.EventID, TargetName: .EventData.TargetUserName, Time: .System.TimeCreated_attributes.SystemTime} | select (.EventID == 4624) | select(.TargetName | test("cyberjunkie", "i"))'

Task 2 - The user tampered with firewall settings on the system. Analyze the

Metasploit C2 Bypass

• 查询所有防火墙添加规则中的规则名称

cat 'Windows Firewall-Firewall.evtx.json' | jq '.[].Event | select (.System.EventID == 2004) | {RuleName: .EventData.RuleName}' | grep Rule | sort -u

• 发现可疑规则名

Task 3 - Whats the direction of the firewall rule?

Outbound

• 查看事件信息，Direction == 2 为出方向 Outbound

cat 'Windows Firewall-Firewall.evtx.json' | jq '.[].Event | select (.EventData.RuleName == "Metasploit C2 Bypass")'

Task 4 - The user changed audit policy of the computer. Whats the Subcategory of this changed policy?

Other Object Access Events

• 修改审核策略 ID 为 4710，子类别类型从 windows 事件查看器中更方便看到，中文需要翻译一下

Task 5 - The user “cyberjunkie” created a scheduled task. Whats the name of this task?

HTB-AUTOMATION

• 创建计划任务的事件 ID 为 4698

cat Security.evtx.json | jq '.[].Event | select (.System.EventID == 4698)'

Task 6 - Whats the full path of the file which was scheduled for the task?

C:\Users\CyberJunkie\Desktop\Automation-HTB.ps1

• 事件详情里面可以看到

Task 7 - What are the arguments of the command?

-A [email protected]

• 在计划任务事件详细可以看到

Task 8 - The antivirus running on the system identified a threat and performed actions on it. Which tool was identified as malware by antivirus?

SharpHound

• Windows Defender 检测到恶意程序的事件 ID 为 1116

cat 'Windows Defender-Operational.evtx.json' | jq '.[] | select (.Event.System.EventID == 1116) | {Path: .Event.EventData.Path}' | sort -u

Task 9 - Whats the full path of the malware which raised the alert?

C:\Users\CyberJunkie\Downloads\SharpHound-v1.1.0.zip

• 完整路径在事件详情中的 Path 字段显示

cat 'Windows Defender-Operational.evtx.json' | jq '.[] | select (.Event.System.EventID == 1116) | {Path: .Event.EventData.Path}' | sort -u

Task 10 - What action was taken by the antivirus?

Quarantine

• windows denfender 对威胁的操作的事件 ID 为 1117

cat 'Windows Defender-Operational.evtx.json' | jq '.[] | select (.Event.System.EventID == 1117) | select(.Event.EventData.Path | test("SharpHound-v1.1.0.zip"))'

Task 11 - The user used Powershell to execute commands. What command was executed by the user?

Get-FileHash -Algorithm md5 .\Desktop\Automation-HTB.ps1

• 日志中有很多脚本的内容，过滤思路为去掉带有 $ 的行，因为脚本一般会使用其获取变量的值。

cat Powershell-Operational.evtx.json | jq '.[] | select(.Event.System.EventID == 4104) | {PS: .Event.EventData.ScriptBlockText}' | grep -v '\$' | sort -u

Task 12 - We suspect the user deleted some event logs. Which Event log file was cleared?

Microsoft-Windows-Windows Firewall With Advanced Security/Firewall

• 清理 Windows 事件日志的事件 ID 为 104

cat System.evtx.json | jq '.[] | select(.Event.System.EventID == 104) | {Log: .Event.UserData.LogFileCleared.Channel}' | sort -u