Author: Nathan Yam, Jonathan Kartawidjaja

Opening the log shows us a bunch of SIEM logging.

2025-04-03T08:55:02Z host=WIN-FIN-05 user=SYSTEM event=ServiceStart service=LanmanWorkstation
2025-04-03T08:56:41Z host=WIN-FIN-05 user=SYSTEM event=ServiceStart service=Dnscache
2025-04-03T08:57:11Z host=WIN-FIN-05 user=SYSTEM event=ServiceStart service=WindowsUpdate
2025-04-03T08:57:19Z host=WIN-FIN-05 user=SYSTEM event=NetworkConnect dest_ip=13.107.246.45 dest_port=443 protocol=TCP
2025-04-03T08:58:02Z host=WIN-FIN-05 user=SYSTEM event=ScheduledTaskStart task="\Microsoft\Windows\UpdateOrchestrator\Reboot"
2025-04-03T08:58:44Z host=WIN-FIN-05 user=SYSTEM event=ServiceStart service=WinDefend
2025-04-03T08:59:12Z host=WIN-FIN-05 user=SYSTEM event=DefenderScan type=QuickScan result=NoThreatsFound
2025-04-03T09:00:48Z host=WIN-FIN-05 user=SYSTEM event=ProcessCreate image=svchost.exe

2025-04-03T09:01:02Z host=WIN-FIN-05 user=bob event=Logon logon_type=Interactive src_ip=10.10.23.54
2025-04-03T09:01:08Z host=WIN-FIN-05 user=bob event=ProcessCreate image=explorer.exe
2025-04-03T09:02:11Z host=WIN-FIN-05 user=bob event=ProcessCreate image=OneDrive.exe
2025-04-03T09:02:29Z host=WIN-FIN-05 user=bob event=FileSync file="C:\Users\bob\Documents\Q1_report.docx"
2025-04-03T09:03:17Z host=WIN-FIN-05 user=bob event=ProcessCreate image=chrome.exe cmdline="chrome.exe <https://intranet.local>"
2025-04-03T09:04:01Z host=WIN-FIN-05 user=bob event=NetworkConnect dest_ip=10.10.1.12 dest_port=443 protocol=TCP
2025-04-03T09:05:33Z host=WIN-FIN-05 user=bob event=FileRead file="C:\Users\bob\Documents\Q2_budget.xlsx"
2025-04-03T09:06:55Z host=WIN-FIN-05 user=bob event=FileRead file="C:\Users\bob\Documents\Q2_budget.xlsx"
2025-04-03T09:08:14Z host=WIN-FIN-05 user=bob event=ProcessCreate image=EXCEL.EXE
2025-04-03T09:09:50Z host=WIN-FIN-05 user=bob event=FileWrite file="C:\Users\bob\AppData\Local\Temp\~DF234.tmp"

2025-04-03T09:13:58Z host=WIN-FIN-05 user=bob event=ProcessCreate image=cmd.exe cmdline="cmd.exe /c whoami"
2025-04-03T09:14:02Z host=WIN-FIN-05 user=bob event=ProcessCreate image=powershell.exe cmdline="powershell.exe -nop -w hidden"
2025-04-03T09:14:03Z host=WIN-FIN-05 user=bob event=RegistryRead key="HKCU\Software\Microsoft\Windows\CurrentVersion\Run"
2025-04-03T09:14:04Z host=WIN-FIN-05 user=bob event=RegistryRead key="HKCU\Environment"

2025-04-03T09:14:05Z host=WIN-FIN-05 user=bob event=FileCreate file="C:\Users\bob\AppData\Roaming\V0NTQC2.ps"
2025-04-03T09:14:06Z host=WIN-FIN-05 user=bob event=FileCreate file="C:\Users\bob\AppData\Roaming\3tmaWC2.ps"
2025-04-03T09:14:07Z host=WIN-FIN-05 user=bob event=FileCreate file="C:\Users\bob\AppData\Roaming\x0ZXJC2.ps"
2025-04-03T09:14:08Z host=WIN-FIN-05 user=bob event=FileCreate file="C:\Users\bob\AppData\Roaming\fdGhvC2.ps"
2025-04-03T09:14:09Z host=WIN-FIN-05 user=bob event=FileCreate file="C:\Users\bob\AppData\Roaming\c2VfbC2.ps"
2025-04-03T09:14:10Z host=WIN-FIN-05 user=bob event=FileCreate file="C:\Users\bob\AppData\Roaming\G9nc1C2.ps"
2025-04-03T09:14:11Z host=WIN-FIN-05 user=bob event=FileCreate file="C:\Users\bob\AppData\Roaming\9mcm9C2.ps"
2025-04-03T09:14:12Z host=WIN-FIN-05 user=bob event=FileCreate file="C:\Users\bob\AppData\Roaming\tX3RoC2.ps"
2025-04-03T09:14:13Z host=WIN-FIN-05 user=bob event=FileCreate file="C:\Users\bob\AppData\Roaming\ZV9zaC2.ps"
2025-04-03T09:14:14Z host=WIN-FIN-05 user=bob event=FileCreate file="C:\Users\bob\AppData\Roaming\WVtIXC2.ps"
2025-04-03T09:14:15Z host=WIN-FIN-05 user=bob event=FileCreate file="C:\Users\bob\AppData\Roaming\0=V0NC2.ps"
2025-04-03T09:14:16Z host=WIN-FIN-05 user=bob event=FileCreate file="C:\Users\bob\AppData\Roaming\TQ3tmC2.ps"
2025-04-03T09:14:17Z host=WIN-FIN-05 user=bob event=FileCreate file="C:\Users\bob\AppData\Roaming\aWx0ZC2.ps"
2025-04-03T09:14:18Z host=WIN-FIN-05 user=bob event=FileCreate file="C:\Users\bob\AppData\Roaming\XJfdGC2.ps"
2025-04-03T09:14:19Z host=WIN-FIN-05 user=bob event=FileCreate file="C:\Users\bob\AppData\Roaming\hvc2VC2.ps"
2025-04-03T09:14:20Z host=WIN-FIN-05 user=bob event=FileCreate file="C:\Users\bob\AppData\Roaming\fbG9nC2.ps"
2025-04-03T09:14:21Z host=WIN-FIN-05 user=bob event=FileCreate file="C:\Users\bob\AppData\Roaming\c19mcC2.ps"
2025-04-03T09:14:22Z host=WIN-FIN-05 user=bob event=FileCreate file="C:\Users\bob\AppData\Roaming\m9tX3C2.ps"
2025-04-03T09:14:23Z host=WIN-FIN-05 user=bob event=FileCreate file="C:\Users\bob\AppData\Roaming\RoZV9C2.ps"
2025-04-03T09:14:24Z host=WIN-FIN-05 user=bob event=FileCreate file="C:\Users\bob\AppData\Roaming\zaWVtC2.ps"
2025-04-03T09:14:25Z host=WIN-FIN-05 user=bob event=FileCreate file="C:\Users\bob\AppData\Roaming\IX0=C2.ps"

2025-04-03T09:14:27Z host=WIN-FIN-05 user=bob event=FileRead file="C:\Users\bob\AppData\Roaming\Microsoft\Teams\storage.json"
2025-04-03T09:14:28Z host=WIN-FIN-05 user=bob event=ProcessCreate image=msedge.exe
2025-04-03T09:14:29Z host=WIN-FIN-05 user=bob event=NetworkConnect dest_ip=185.203.116.44 dest_port=443 protocol=TCP
2025-04-03T09:14:31Z host=WIN-FIN-05 user=bob event=DNSQuery query=api.office365.com response=NOERROR
2025-04-03T09:14:38Z host=WIN-FIN-05 user=bob event=DNSQuery query=login.microsoftonline.com response=NOERROR

2025-04-03T09:15:02Z host=WIN-FIN-05 user=SYSTEM event=ScheduledTaskStart task="\Microsoft\Windows\Defrag\ScheduledDefrag"
2025-04-03T09:15:45Z host=WIN-FIN-05 user=SYSTEM event=ProcessCreate image=defrag.exe
2025-04-03T09:17:03Z host=WIN-FIN-05 user=bob event=ProcessCreate image=OUTLOOK.EXE
2025-04-03T09:19:41Z host=WIN-FIN-05 user=bob event=ProcessCreate image=OUTLOOK.EXE
2025-04-03T09:21:14Z host=WIN-FIN-05 user=bob event=EmailReceive from="[email protected]"
2025-04-03T09:24:36Z host=WIN-FIN-05 user=bob event=FileWrite file="C:\Users\bob\Documents\meeting_notes.txt"
2025-04-03T09:27:18Z host=WIN-FIN-05 user=bob event=FileWrite file="C:\Users\bob\Documents\meeting_notes.txt"
2025-04-03T09:31:02Z host=WIN-FIN-05 user=bob event=ProcessCreate image=Teams.exe
2025-04-03T09:34:47Z host=WIN-FIN-05 user=bob event=AudioDeviceChange device=Headset
2025-04-03T09:41:55Z host=WIN-FIN-05 user=SYSTEM event=DefenderScan type=FullScan result=NoThreatsFound
2025-04-03T09:52:19Z host=WIN-FIN-05 user=bob event=LockScreen
2025-04-03T09:58:22Z host=WIN-FIN-05 user=bob event=Logoff

2025-04-03T10:03:41Z host=WIN-FIN-05 user=SYSTEM event=FileDelete file="C:\Users\bob\AppData\Roaming\*.ps"
2025-04-03T10:03:59Z host=WIN-FIN-05 user=SYSTEM event=ProcessCreate image=cleanmgr.exe
2025-04-03T10:04:10Z host=WIN-FIN-05 user=SYSTEM event=ServiceStop service=WindowsUpdate
2025-04-03T10:05:44Z host=WIN-FIN-05 user=SYSTEM event=SystemSleep

Solution

Who is Fagan? The previous president before yam :)

He loves C2s, (Command & Control) so I decided to make this challenge to give an example of how C2s are logged in a SIEM.

i put just this section in a file called c2

2025-04-03T09:14:05Z host=WIN-FIN-05 user=bob event=FileCreate file="C:\Users\bob\AppData\Roaming\V0NTQC2.ps"
2025-04-03T09:14:06Z host=WIN-FIN-05 user=bob event=FileCreate file="C:\Users\bob\AppData\Roaming\3tmaWC2.ps"
2025-04-03T09:14:07Z host=WIN-FIN-05 user=bob event=FileCreate file="C:\Users\bob\AppData\Roaming\x0ZXJC2.ps"
2025-04-03T09:14:08Z host=WIN-FIN-05 user=bob event=FileCreate file="C:\Users\bob\AppData\Roaming\fdGhvC2.ps"
2025-04-03T09:14:09Z host=WIN-FIN-05 user=bob event=FileCreate file="C:\Users\bob\AppData\Roaming\c2VfbC2.ps"
2025-04-03T09:14:10Z host=WIN-FIN-05 user=bob event=FileCreate file="C:\Users\bob\AppData\Roaming\G9nc1C2.ps"
2025-04-03T09:14:11Z host=WIN-FIN-05 user=bob event=FileCreate file="C:\Users\bob\AppData\Roaming\9mcm9C2.ps"
2025-04-03T09:14:12Z host=WIN-FIN-05 user=bob event=FileCreate file="C:\Users\bob\AppData\Roaming\tX3RoC2.ps"
2025-04-03T09:14:13Z host=WIN-FIN-05 user=bob event=FileCreate file="C:\Users\bob\AppData\Roaming\ZV9zaC2.ps"
2025-04-03T09:14:14Z host=WIN-FIN-05 user=bob event=FileCreate file="C:\Users\bob\AppData\Roaming\WVtIXC2.ps"
2025-04-03T09:14:15Z host=WIN-FIN-05 user=bob event=FileCreate file="C:\Users\bob\AppData\Roaming\0=V0NC2.ps"
2025-04-03T09:14:16Z host=WIN-FIN-05 user=bob event=FileCreate file="C:\Users\bob\AppData\Roaming\TQ3tmC2.ps"
2025-04-03T09:14:17Z host=WIN-FIN-05 user=bob event=FileCreate file="C:\Users\bob\AppData\Roaming\aWx0ZC2.ps"
2025-04-03T09:14:18Z host=WIN-FIN-05 user=bob event=FileCreate file="C:\Users\bob\AppData\Roaming\XJfdGC2.ps"
2025-04-03T09:14:19Z host=WIN-FIN-05 user=bob event=FileCreate file="C:\Users\bob\AppData\Roaming\hvc2VC2.ps"
2025-04-03T09:14:20Z host=WIN-FIN-05 user=bob event=FileCreate file="C:\Users\bob\AppData\Roaming\fbG9nC2.ps"
2025-04-03T09:14:21Z host=WIN-FIN-05 user=bob event=FileCreate file="C:\Users\bob\AppData\Roaming\c19mcC2.ps"
2025-04-03T09:14:22Z host=WIN-FIN-05 user=bob event=FileCreate file="C:\Users\bob\AppData\Roaming\m9tX3C2.ps"
2025-04-03T09:14:23Z host=WIN-FIN-05 user=bob event=FileCreate file="C:\Users\bob\AppData\Roaming\RoZV9C2.ps"
2025-04-03T09:14:24Z host=WIN-FIN-05 user=bob event=FileCreate file="C:\Users\bob\AppData\Roaming\zaWVtC2.ps"
2025-04-03T09:14:25Z host=WIN-FIN-05 user=bob event=FileCreate file="C:\Users\bob\AppData\Roaming\IX0=C2.ps"

Notice this section, where multiple PowerShell scripts are created in user bob’s AppData folder. We should investigate this, as the quantity and odd naming of the files are suspicious.

In fact, these PowerShell scripts are named with “C2.ps” at the end of each name!

The technique I want to highlight here is the ability to inject names of files as shellcode in Windows!

The names look like base64, so lets try to decode each segment and put it together.

First I want to extract just the encoded data from each file name