Scenario
In this lab, I assume the role of a Security Analyst responding to a suspected intrusion. TryHackMe states that the intrusion is carried out by the notorious APT group, Volt Typhoon.
Throughout this lab, we will analyze logs through each phase of the kill chain from initial access to C2 communications.
Who is Volt Typhoon?
According to MITRE, Volt Typhoon is a China state-sponsored threat actor that has been active since 2021. Volt Typhoon is known for targeting critical U.S infrastructure, and for their stealthy LotL techniques for evading detections.
Initial Access
The log source defined in this lab is “ADSelfServicePlus” logs which are ingested in Splunk.
Account Compromise
- Comb through the ADSelfService Plus logs to begin retracing the attacker’s steps. At what time (ISO 8601 format) was Dean’s password changed and their account taken over by the attacker?
With the information available to us, we can identify deans username through the username field listed under “interesting fields”, presenting deans username as “dean-admin”.
- Shortly after Dean’s account was compromised, the attacker created a new administrator account. What is the name of the new account that was created?
To find out the type of action an account creation would fall under, we can list the action_name events, which lists “Enrollment”.
Persistence
Querying on this produces 4 results, and cross-referencing with the timestamp of the
dean-admin account takeover, we can find that a new admin account was created as voltyp-admin. As dean’s inital account that was comprimised had Administrator rights, Volt Typhoon created their new admin account to further achieve persistence and elevate privileges.Execution
As noted before, Volt Typhoon is known for their Windows Managmenent Instrumentation Command-Line (WMIC) for a range of execution techniques, ranging from information gathering to dumping databases. Through these LotL techniques, it makes detection more challenging.
- In an information gathering attempt, what command does the attacker run to find information about local drives on server01 & server02?
At this point, we have confirmed that the two user accounts
dean-admin and voltyp-admin are compromised. Knowing this, we can query for a wildcard text search on server02 to gain more information on the WMIC command being run.At this point, we have confirmed that the two user accounts
dean-admin and voltyp-admin are compromised. Knowing this, we can query for a wildcard text search on server02 to gain more information on the WMIC command being run.OS Credential Dumping: NTDS
Data Exfiltration
Breaking this command down,
wmic process call create cmd.exe /c mkdir C:\Windows\Temp\tmp creates a new directory in the Temp folder.Followed by
ntdsutil.exe:ac i ntds: actives NTDS (Active Directory database) instance
ifm create full: attempts to create a full copy of the Active Directory database (NTDS.dit)- contains user account information, password hashes (NT), group security policies and memberships
- The attacker uses ntdsutil to create a copy of the AD database. After moving the file to a web server, the attacker compresses the database. What password does the attacker set on the archive?
Previously, the Active Directory copy was named
temp.dit, knowing this we can further track this file by querying on the AD database copy.
By following the
temp.dit file, we can identify 3 events.We can see that after the Active Directory database copy was taken, it copied over to the
wwwroot directory on webserver-01, prepping the database copy for data exfiltration through the following command:Followed by obfuscating the file name to blend in with legitimate network files, and password-protecting the zip contents to likely avoid the content from being scanned, and splits it into 100mb volumes to avoid file size detection.
Persistence
- To establish persistence on the compromised server, the attacker created a web shell using base64 encoded text. In which directory was the web shell placed?
Web Shell Creation
As the attacker has had presence in the
C:\Windows\Temp folder, this was the first place I checked, utilizing the query above. Sure enough, we can identify PowerShell pipeline execution with b64 encoded text.
To decode this text, I utilized CyberChef. Decoding the base64 shows a C# script to create a webshell on the file
ntuser.ini.To decode this text, I utilized CyberChef. Decoding the base64 shows a C# script to create a webshell on the file
ntuser.ini.Defense Evasion
- In an attempt to begin covering their tracks, the attackers remove evidence of the compromise. They first start by wiping RDP records. What PowerShell cmdlet does the attacker use to remove the “Most Recently Used” record?
Doing some research, the
Remove-ItemProperty is commonly used to remove “Most Recently Used” records in the registry, thus returning 3 events for removing registry keys.
- The APT continues to cover their tracks by renaming and changing the extension of the previously created archive. What is the file name (with extension) created by the attackers?
The previous archive, which was a
.7z file, stored the Active Directory database data, querying on this file, the APT renamed the file to cl64.gif from cisco-up.7z.Information Gathering
- Under what regedit path does the attacker check for evidence of a virtualized environment?
Knowing that a virtualized environment registry key would fall under the HKLM hive, I queried for HKLM registry keys and was able to discover a powershell command execution to gather information regarding the systems virtualization.
Credential Access
- Using reg query, Volt Typhoon hunts for opportunities to find useful credentials. What three pieces of software do they investigate?
Knowing that they used reg query, to further gather information about the software installed on the system, we can query on reg query to identify any command execution containing reg query.
Doing so, returns 8 events, where the APT identifies OpenSSH, RealVNC, PuTTY, and also the current Windows version.
- What is the full decoded command the attacker uses to download and run mimikatz?
Earlier to download the webshell, the APT used base64 encoding in the powershell execution, so knowing that information, I can run a base64 encoding on the word “Mimikatz” and use that as a wildcard search in Splunk.
Mimikatz —base64—> bWltaWthdHo=
As this can differ slightly depending on surroudning characters, I will use “bWltaW” in my wildcard query.
Suprisingly, this returned 1 event.
Decoding the b64 encoded command:
Discovery & Lateral Movement
- The attacker uses wevtutil, a log retrieval tool, to enumerate Windows logs. What event IDs does the attacker search for?
Querying on the key word “wevtutil”, returns 12 events, combing through the command execution line, the attacker is looking at event IDs 4624 4625 4769.
- Moving laterally to server-02, the attacker copies over the original web shell. What is the name of the new web shell that was created?
The original web shell was named
ntuser.ini, so querying on this file name, reveals an event where the certutil tool is used to decode the original base64 encoded file, and naming it iisstart.aspx, however when moving laterally to server-02, the file name is changed.
As the attacker moves laterally to server-02, the file name of the webshell changes to AuditReport.jspx.
Collection
- The attacker is able to locate some valuable financial information during the collection phase. What three files does Volt Typhoon make copies of using PowerShell?
At some point, I recall seeing a log related to finance data, however I cant remember which query this was under. So, I’ll try a wildcard search on
finance.
The events returned reveal sensitive financial data compromise to
2022.csv, 2023.csv, 2024.csv.C2 Communications
- The attacker uses netsh to create a proxy for C2 communications. What connect address and port does the attacker use when setting up the proxy?
Using netsh as a keyword, we can identify 4 events containing netsh usage.
One of the events contains the command:
So we can identify a C2 communication to IP address
10.2.30.1 over port 8443.- To conceal their activities, what are the four types of event logs the attacker clears on the compromised system?
By reviewing the wevtutil utility usage, I was able to identify removal for the following types of logs: Application Security Setup System.
Closing Thoughts
This was one of my favorite labs so far, it really engaged me and allowed me to create an attack timeline throughout my head and keep an idea on what the APT may be trying to do. Overall, this really helped me think like a threat hunter and develop key skills through Splunk.