Additional Info:
Date of Investigation: Nov, 05, 2024, 06:16 AM
Alert title: Unauthorized Access – Hack Tool Executed
Time to investigate: 16 minutes<\/p>\n\n\n\n
Retrospective note:
If I were to revisit this today, I would list the command used to download Mimikatz and its timestamp, as well as the time it was executed. Include the SIEM Query to detect the brute-force attack, and note the offending IP and the timestamp of the successful login. As well as the query made to check for outbound connections and scope. On the host, take note of the malicious file paths that were removed.<\/p>\n\n\n\n
Affected systems and users\n\nEndpoint Address IP: 172.16.17.168\nHostname: Oliver\nSuspected Malicious IP:37.19.205.153\n\nSteps taken in the investigation\nI checked the Endpoint Security Module. Terminal history shows that Mimikatz was downloaded and executed on the system. Endpoint security also gave us the file hash, and it\u2019s confirmed that 63 vendors mark the file as malicious and as Mimikatz. I confirmed that the initial entry was made through a brute-force attack. The Malicious IP also has a history of malicious activity and is flagged as malicious by three vendors on Virustotal. SIEM doesn\u2019t show any additional data exfiltration. This endpoint seems to be the only one affected by this attack.\n\nArtifacts\nhxxps[:\/\/]files-ld[.]s3[.]us-east-2[.]amazonaws[.]com\/static\/test[.]zip\nE930b05efe23891d19bc354a4209be3e\n37[.]19.205.153\n\nActions taken\nContained System. Removed malicious files\n\nReferences\nhttps://www.virustotal.com\/gui\/ip-address\/37.19.205.153\nhttps:\/\/www.abuseipdb.com\/check\/37.19.205.153\nhttps:\/\/www.virustotal.com\/gui\/file\/92804faaab2175dc501d73e814663058c78c0a042675a8937266357bcfb96c50\n<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"Additional Info:Date of Investigation: Nov, 05, 2024, 06:16 AMAlert title: Unauthorized Access – Hack Tool ExecutedTime to investigate: 16 minutes Retrospective note:If I were to revisit this today, I would list the command used to download Mimikatz and its timestamp, as well as the time it was executed. Include the SIEM Query to detect the brute-force attack, and note the offending IP and the timestamp of the successful login. As well as the query made to check for outbound connections and scope. On the host, take note of the malicious file paths that were removed.<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"footnotes":""},"class_list":["post-1186","page","type-page","status-publish","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t