GhostTrace

Scenario

This challenge simulates a sophisticated Active Directory attack involving phishing, privilege escalation, lateral movement, and domain compromise. As a blue team analyst, you must perform forensic analysis to answer questions about the attack. Use tools like Event Viewer, PowerShell, Autopsy, or other forensic utilities to analyze the provided logs and $MFT files. Identify key events such as process creation, network connections, credential dumping, and persistence mechanisms.

Executive Summary

A user on Client02 downloaded a macro-enabled Word document from an internal attacker host and opened it, which called back to a listener and pulled down a second-stage executable that opened a reverse shell. The attacker used PowerShell to fetch PowerView, enumerated the domain and requested a Kerberos service ticket for a service account, then logged on to Client03 with the cracked credentials. A Sysinternals-style remote service gave them execution there, and a renamed Mimikatz exposed another user’s cleartext password. That account ran a DCSync against the domain controller, after which the attacker authenticated as Administrator on DC01 and left a service, a scheduled task and a Run key behind.

Artifacts

• Windows event logs: Logs-* folders per host (Client02, Client03, DC01) → parsed with EvtxECmd to CSV, then filtered with Python. Sysmon, Security and PowerShell Operational channels are all present
• $MFT: collected alongside the logs. The event logs answered everything, so it was not needed

Timestamp note: Three questions need YYYY-MM-DD hh:mm:ss in UTC. EvtxECmd output is already UTC, so copy the time as shown.

Initial Access

Start with the Client02 Sysmon channel. File-create (event 11) and stream-create (event 15) records show Chrome writing a single document into the jody user’s Downloads folder. The .docm extension means macros, which is what a phishing attachment needs.

EvtxECmd -d Logs-Client02 --csv work/evtx

Tip: Event 15 (FileCreateStreamHash) fires for the Zone.Identifier stream Chrome adds, so it points at downloaded files directly.

The Zone.Identifier stream hash recorded for the document includes its HostUrl, the URL the file came from. It points to a plain HTTP server on an internal address, which is the attacker’s host.

grep -i 'HostUrl' work/evtx/Client02.csv | grep -i Profits.docm

Execution

Sysmon event 3 on Client02 shows WINWORD.EXE itself making an outbound connection at 03:29:06, which is the macro calling home. The destination is the same host that served the document (Q2), on a classic listener port.

grep 'WINWORD.EXE' work/evtx/Client02.csv | grep -i 'NetworkConnect'

PowerShell script block logging (event 4104) on Client02 records an Invoke-WebRequest that saves an executable into Downloads. That is the second stage, fetched after the first-stage callback in Q3.

grep 'Invoke-WebRequest' work/evtx/Client02.csv | grep -i Downloads

Command and Control

Pivot from the Q4 filename to Sysmon event 3. UpdatePolicy.exe connects back to the same attacker IP, but on a different port than the Word macro used in Q3.

grep 'UpdatePolicy.exe' work/evtx/Client02.csv | grep -i 'NetworkConnect'

Discovery

Back in the 4104 script blocks on Client02, a second Invoke-WebRequest pulls a PowerShell script rather than an executable. The later cmdlets (Get-DomainUser, Get-DomainSPNTicket) are PowerView functions, which confirms the tool.

grep '4104' work/evtx/Client02.csv | grep -i PowerView

Credential Access

The PowerView session in Q6 runs Get-DomainUser -Identity <name> | Get-DomainSPNTicket, which is a Kerberoast request for one named account. The domain controller backs it with a matching service-ticket event (4769) for the same account.

grep 'Get-DomainSPNTicket' work/evtx/Client02.csv

Lateral Movement

Hunt logon events (4624) and NTLM validations (4776) for sqlsvc. The first hit is a failed logon around 03:49. The successful network logon (type 3) on Client03 is what the question wants.

grep -E 'sqlsvc' work/evtx/Client03.csv | grep -E '4624|4625'

Gotcha: The earlier 03:49 attempts failed. The first use of the cracked credentials that counts is the first successful 4624.

On Client03, look at Sysmon registry events (13) under Services after the 04:03:47 logon. The first new service appears at 04:05:12, with an ImagePath of %systemroot%\ plus a random-looking executable name.

grep 'ImagePath' work/evtx/Client03.csv | grep -i 'systemroot'

Gotcha: PsExec normally leaves PSEXESVC.exe. This service and its binary have random names, the pattern of an Impacket-style psexec clone, so searching for PSEXESVC finds nothing.

Credential Access

Build a Sysmon process-creation (event 1) timeline for Client03 after the service in Q9 and look for an unfamiliar binary. netdiag.exe stands out, and its SHA256 in VirusTotal resolves to Mimikatz, so the name is a masquerade.

grep 'netdiag.exe' work/evtx/Client03.csv

bin/vt 92804FAA...

Tip: The hash is cut here. Take the full SHA256 from the Sysmon event 1 record when you look it up.

The log does not print the dumped password, so this one was reasoned rather than read from an artifact. Client03’s PowerShell history shows runas /user:Main\lucas, which only makes sense once the password is known, and lucas is the account that performs the DCSync in Q12. HTB accepted it.

grep -i 'runas' work/evtx/Client03.csv

A DCSync shows on the domain controller as event 4662 (directory service access) from a non-DC account. Filter DC01 for 4662 by MAIN\lucas.

grep '4662' work/evtx/DC01.csv | grep -i lucas

Privilege Escalation

The DCSync yields the Administrator hash. On DC01, take the first 4624 for Administrator after the Q12 time.

grep '4624' work/evtx/DC01.csv | grep -i Administrator

Persistence

Process-creation auditing (4688) on DC01 captures an sc create command line after the Administrator logon. The service name is the first argument.

grep '4688' work/evtx/DC01.csv | grep -i 'sc create'

Two sources agree: a 4698 (scheduled task created) event and a schtasks /create command line in the same process-creation log. Both carry the task name.

grep -E '4698|schtasks' work/evtx/DC01.csv | grep -i create

A reg add against HKCU Run in the DC01 process-creation log. The name HTB wants is the value name passed with /v.

grep '4688' work/evtx/DC01.csv | grep -i 'reg add'

Gotcha: The question says registry key, but the answer is the Run value name set with /v, not the Run key path.

Attack Summary

Phase	Action
Initial Access	jody downloads a macro document from an internal attacker web server via Chrome
Execution	Word connects back to the attacker on the first listener port
Execution	Second-stage executable downloaded with PowerShell
Command and Control	Second stage opens a reverse shell on a different port
Discovery	PowerView fetched and used to enumerate the domain
Credential Access	Kerberoast request for the sqlsvc service account
Lateral Movement	Cracked sqlsvc credentials used for a network logon to Client03
Lateral Movement	Sysinternals-style remote service with a random name created on Client03
Credential Access	Renamed Mimikatz run on Client03; lucas password recovered
Credential Access	lucas runs DCSync against the domain
Privilege Escalation	Attacker authenticates to DC01 as Administrator
Persistence	Service, scheduled task and Run value created on DC01

Forensic Timeline

Timestamp (UTC)	Event
03:29:06 (date not recorded)	WINWORD.EXE connects to the attacker on port 4444
2025-05-25 04:03:47	First successful sqlsvc logon on Client03, after failed attempts around 03:49
04:05:12 (date not recorded)	Random-name service created on Client03
2025-05-25 04:26:36	MAIN\lucas performs DCSync (4662)
2025-05-25 04:34:01	First Administrator logon on DC01

IOCs

Type	Value
IP	192.168.204[.]152
Ports	4444 (macro callback), 1337 (reverse shell)
File	Profits.docm (C:\Users\jody\Downloads\)
File	UpdatePolicy.exe
File	PowerView.ps1
File	netdiag.exe (renamed Mimikatz)
File	%systemroot%\VgYTbFEK.exe (remote service binary on Client03)
Account	sqlsvc (Kerberoasted), lucas (DCSync), Administrator
Service	WindowsUpdateSvc (DC01)
Scheduled task	WindowsUpdateCheck (DC01)
Registry	HKCU Run value xcvafctr (DC01)

MITRE ATT&CK

Technique	ID	Description
Phishing: Spearphishing Attachment	T1566.001	Macro document delivered to jody
User Execution: Malicious File	T1204.002	Document opened, macro called back
Ingress Tool Transfer	T1105	Second stage and PowerView pulled with Invoke-WebRequest
Command and Scripting Interpreter: PowerShell	T1059.001	PowerShell download and PowerView use
Account Discovery: Domain Account	T1087.002	PowerView domain enumeration
Steal or Forge Kerberos Tickets: Kerberoasting	T1558.003	SPN ticket requested for sqlsvc
Valid Accounts: Domain Accounts	T1078.002	sqlsvc, lucas and Administrator logons
System Services: Service Execution	T1569.002	Remote service on Client03
Masquerading: Match Legitimate Name or Location	T1036.005	Mimikatz renamed netdiag.exe
OS Credential Dumping: LSASS Memory	T1003.001	Cleartext credentials dumped on Client03
OS Credential Dumping: DCSync	T1003.006	lucas replicates directory secrets
Create or Modify System Process: Windows Service	T1543.003	WindowsUpdateSvc on DC01
Scheduled Task/Job: Scheduled Task	T1053.005	WindowsUpdateCheck on DC01
Boot or Logon Autostart: Registry Run Keys	T1547.001	Run value xcvafctr on DC01

Defender Takeaways

Block and alert on macro documents that arrive over plain HTTP. The document came straight from an internal host with a Zone.Identifier HostUrl, then Word opened an outbound connection of its own. Block macros from the internet zone, and alert on WINWORD.EXE making any network connection (Sysmon event 3).

Service accounts with SPNs need strong passwords and ticket-request monitoring. A single Get-DomainSPNTicket for sqlsvc led to cracked credentials. Use long random passwords or gMSAs, and alert on 4769 requests for RC4 tickets against service accounts.

Name-based detection of Sysinternals tools misses clones. The remote service on Client03 had a random name and binary, so a PSEXESVC rule would stay silent. Detect on service installs (7045 or Sysmon 13 under Services) whose ImagePath is a random executable in %systemroot% right after a network logon.

A renamed credential dumper is still caught by hash and behaviour. netdiag.exe was Mimikatz under another name. Enable LSASS access auditing and hash reputation checks, and keep WDigest off so cleartext passwords are not there to dump.

DCSync and DC persistence should page someone. 4662 with the replication GUIDs from a non-DC account, followed by a new service, task and Run value on the domain controller within minutes, is a complete compromise pattern. Alert on each, and restrict replication rights to domain controllers.

Conclusion

A single phished macro document led to full domain compromise in about an hour, with the attacker holding Administrator on DC01 and three persistence mechanisms planted. Every hop left a Sysmon or Security event, so the gap was missing alerting on the chain, not missing logs.