Constellation

Scenario

This medium-difficulty Sherlock requires a deft application of Open Source Intelligence (OSINT) skills to unravel a convoluted web of deceit and betrayal.

As the story unfolds, you are tasked with investigating a suspected insider threat. The scenario begins with the SOC team’s recent discovery of potential malicious activities within Forela’s organization. A suspect employee’s workstation, now secured and thoroughly examined, yields the first clues. Your primary objective is to analyze several unusual URLs extracted from the employee’s computer memory by the Senior DFIR Analyst.

Executive Summary

A group calling itself AntiCorp recruited a Forela employee over Discord and paid them to leak internal data. The only artifacts are two URLs recovered from the employee’s memory: a Discord CDN link to a PDF of exfiltration instructions, and a Google search URL. Discord snowflake IDs and Google’s ei parameter turned both into exact UTC times, showing the DM channel opening, the PDF arriving, and the employee searching for how to archive a folder with tar about four minutes later. The PDF itself named the insider and the group, and its metadata exposed a forged creation date and an author handle that pivots to a person’s public profile.

Artifacts

• IOCs.txt: Artifacts/IOCs.txt → two URLs, a Discord CDN attachment link and a Google search link. Open in any text editor
• NDA_Instructions.pdf: Artifacts/NDA_Instructions.pdf → the file from URL 1. Read with pdftotext and exiftool

Timestamp note: Every time question wants YYYY-MM-DD HH:MM:SS in UTC. The PDF metadata is in UTC+01:00, so convert before submitting.

Initial Access

The Discord CDN path in URL 1 is /attachments/<channel_id>/<attachment_id>/<filename>. A DM is a channel, and channel IDs are snowflakes: the top bits are milliseconds since the Discord epoch (2015-01-01). Shift the channel ID right 22 bits, add the epoch offset and the result is when the conversation was created, which is the first DM.

python3 -I -c "import datetime as d;i=1152635915429232640;print(d.datetime.fromtimestamp(((i>>22)+1420070400000)/1000,d.timezone.utc))"

The last path segment of the same Discord URL is the filename, before the query string of expiry and signature parameters.

grep -o 'attachments/[^?]*' IOCs.txt

Decode the second ID in the path, the attachment ID, the same way. It marks when the upload happened, which is the moment the file was sent in the DM.

python3 -I -c "import datetime as d;i=1156461980652154931;print(d.datetime.fromtimestamp(((i>>22)+1420070400000)/1000,d.timezone.utc))"

Tip: Don’t use the ex= expiry parameter as the send time. It is when the link stops working, not when it was created.

The PDF opens with a greeting addressed to the recipient by name, thanking them for getting in touch.

pdftotext NDA_Instructions.pdf - | head -3

The same greeting names the sender, and the PDF’s Producer, Creator and Author metadata repeat it, so the group name is consistent across content and metadata.

exiftool NDA_Instructions.pdf | grep -E 'Producer|Creator|Author'

Gotcha: The format hint suggests a single word, but the group’s name includes the leetspeak suffix. Submitting just AntiCorp is wrong.

The Create Date field is in the year 2054, decades after the file was sent, which is the anomaly. ExifTool prints it with a +01:00 offset, so subtract an hour to get UTC.

exiftool NDA_Instructions.pdf | grep -i 'date'

The PDF’s Author field is [email protected], an operator handle left in the metadata. Searching that handle on LinkedIn surfaced one profile titled with the group name, and its name is the answer. This answer was reasoned rather than read straight from an artifact: nothing in the evidence names the person, so the link rests on the handle search returning a profile titled with the group name.

exiftool -Author NDA_Instructions.pdf

The profile found in Q10 lists the actor’s location. LinkedIn only shows the full profile to a logged-in browser, so open it in an authenticated session rather than fetching it from the command line. The profile, titled Security Expert at AntiCorp Gr04p, gives the city and region.

Tip: Unauthenticated requests to LinkedIn are blocked, so this one is a browser job.

Collection

URL 2 is a Google search URL. The q parameter holds the query actually submitted.

grep -oE '[?&]q=[^&]*' IOCs.txt

The oq (original query) parameter keeps what was typed before the suggestion was picked. It is cut off mid-word because the suggestion was clicked as soon as it appeared. It matches step 3 of the PDF, which tells the reader to archive the folders with tar.

grep -o 'oq=[^&]*' IOCs.txt

Gotcha: oq is URL-encoded with + for spaces. Decode it as is: the capital H stays, even though the format hint is all lowercase.

Google’s ei parameter begins with a base64url-encoded Unix timestamp (little-endian 32-bit). Decoding it gives 05:31:45 UTC. The millisecond epoch in the sxsrf parameter (1695792705892) lands on the same second, which confirms it. The search came about four and a half minutes after the PDF was sent.

python3 -I -c "import base64,struct,datetime as d;t=struct.unpack('<I',base64.urlsafe_b64decode('Qb4TZeL2M9XPxc8PwLa52Ag=')[:4])[0];print(d.datetime.fromtimestamp(t,d.timezone.utc))"

Attack Summary

Forensic Timeline

IOCs

MITRE ATT&CK

Defender Takeaways

Insiders recruited off-platform leave almost no corporate telemetry. The recruitment happened on Discord and the guidance was a PDF fetched from its CDN. Web proxy logs showing downloads from cdn.discordapp.com by employees with access to databases are the earliest signal available.

Memory-resident URLs carry more than they look like. Discord snowflakes and Google ei and sxsrf values encode exact times, so two URLs were enough to build a timeline. Capture and decode them during triage instead of treating the URL as an opaque string.

Document metadata is an OpSec leak worth checking on every attacker file. The PDF named its own author handle and used a forged 2054 creation date, both of which stand out immediately in ExifTool and give threat intel something to pivot on.

Watch for bulk archiving and cloud uploads from database hosts. The PDF’s plan was tar on the data folders, then aws s3 cp to an external bucket. Alert on tar of database and backup directories followed by AWS CLI use from servers that never run it.

Conclusion

The insider never got as far as exfiltration in the evidence, but the attacker’s own instructions and metadata identified the group, the handler handle and the recipient. The lesson is that a single Discord URL and a PDF yield a full timeline and attribution pivots, if you know how to decode them.