Liberty

Scenario

Liberty is an endpoint forensics investigation Sherlock challenge in which players are provided with a triage image of a compromised endpoint to investigate a potential security breach stemming from an RDP brute-force attack. Players will analyze and correlate various Windows forensic artifacts to reconstruct the complete attack chain, including persistence mechanisms such as the creation of a new user account and the installation of PowerShell Web Access.

Executive Summary

An external host password-sprayed a Windows server and landed on a valid account after a short burst of failures. Using a share open to all users, the actor dropped an internet shortcut whose icon pointed back at their own machine, a forced-authentication lure that leaks an NTLM challenge response from anyone who browses the folder. A second user’s account was then used for an RDP session, from which the actor found a project folder, compressed it and uploaded the archive to a C2 file manager through Edge. For persistence they created a new local user, installed PowerShell Web Access from the PowerShell console and signed in through it, and exposed the project folder with a new share.

Artifacts

• Windows event logs: Windows/System32/winevt/logs → parse with EvtxECmd, then read the CSV with grep or Python
• $MFT: root of the triage image → MFTECmd for the table, strings for resident file contents
• $Recycle.Bin: per-SID $I records → strings
• Registry hives: SAM, SYSTEM and their LOG1/LOG2 files → strings -e l
• Edge history: SQLite History under the k.texus profile → SQLECmd
• PowerShell history: ConsoleHost_history.txt per user

Timestamp note: Timestamp answers are UTC in YYYY-MM-DD hh:mm:ss. Q9 wants the 4624 logon, not the earlier RDP authentication event.

Tip: Run EvtxECmd once over the whole log folder and work from the CSVs. Several questions (Q1, Q3, Q9, Q14, Q17) are single grep calls afterwards.

Credential Access

Parse the Security log and filter to 4625 and 4624. A run of failed logons from one internal address sits directly before a successful 4624 from the same address, so the answer is the count of 4625 events in that burst.

EvtxECmd -d evidence/Windows/System32/winevt/logs --csv work/evtx

grep -E ',(4624|4625),' work/evtx/*Security*.csv

The 4624 (logon type 3) that closes the burst at 14:35:56 names the account the sprayer landed on.

grep ',4624,' work/evtx/*Security*.csv | grep 192.168.189.129

The SMBServer log and the Security share-access events (1006) map a \\*\<share> name to a folder under the k.texus desktop. That share name is the one the sprayed credentials reached.

grep -h ',1006,' work/evtx/*SMBServer*.csv

Parse the $MFT and list what was written into the folder behind the share from Q3. One entry is a .url internet shortcut, the classic hash-capture lure: Explorer resolves its icon path as soon as the folder is viewed. The resident record contents confirm it.

MFTECmd -f 'evidence/$MFT' --csv work/mft

Small files are resident in the $MFT, so their contents survive in the raw strings. The shortcut’s URL= line points at the fake proposal page.

strings 'evidence/$MFT' | grep -i -B2 -A4 'proposal.html'

The same resident data holds the IconFile= line. It points at a UNC path on the attacker address with %USERNAME% in the file name, so every victim who opens the folder tries an SMB authentication to that host.

strings 'evidence/$MFT' | grep -i 'IconFile'

No packet capture or listener log is in the triage, so this one is reasoned from the mechanism, not read from an artifact. A UNC icon path makes the victim authenticate over SMB to the attacker host, and a Windows client doing that sends an NTLMv2 challenge response. The RDP logon by the second user from the same address (Q9) follows shortly after.

Lateral Movement

The second account in the intrusion is k.texus, the owner of the shared folder and the account that later creates the backdoor user (Q14). regipy would not open the dirty SAM hive, so read the FullName value straight from the hive as UTF-16 strings.

strings -e l evidence/Windows/System32/config/SAM | grep -i texus

Gotcha: regipy fails on the dirty SAM and SYSTEM hives. UTF-16 strings on the hive is quicker than replaying transaction logs.

Filter Security for 4624 logon type 10 from the attacker address for the second user. The TerminalServices log has a 1149 authentication two seconds earlier, but the question wants the logon event.

grep ',4624,' work/evtx/*Security*.csv | grep k.texus | grep 192.168.189.129

Gotcha: The 1149 event is stamped two seconds before the type 10 4624. Use the logon event, not the authentication event.

Collection

The $MFT and a $Recycle.Bin $I record both reference the same top-level folder holding the project files, and it sits at the root of the system drive.

MFTECmd -f 'evidence/$MFT' --csv work/mft

The archive was deleted, but its recycle bin $I record ($ILDSQT3.zip) keeps the original path. That path sits inside the Q10 folder and ends in the archive name.

strings evidence/'$Recycle.Bin'/*/'$ILDSQT3.zip'

List the files under the Q10 folder in the MFTECmd output and add up the sizes of the real files, leaving out the Zone.Identifier alternate data streams as the question asks. Seven files remain.

MFTECmd -f 'evidence/$MFT' --csv work/mft

Exfiltration

Run SQLECmd over the Edge History database of the second user. A visit to an upload.php page on a single external site at 14:46:44 lands right after the archive was created, which makes it the upload.

SQLECmd -d evidence/Users/k.texus/AppData/Local/Microsoft/Edge/'User Data'/Default --csv work/sql

Persistence

4720 in Security records a local account creation by the second user at 14:48:17. The new account name is the suspicious user.

grep ',4720,' work/evtx/*Security*.csv

ConsoleHost_history.txt for the second user holds the installer command for PowerShell Web Access, the web-based gateway.

cat evidence/Users/k.texus/AppData/Roaming/Microsoft/Windows/PowerShell/PSReadLine/ConsoleHost_history.txt

PowerShell Web Access sits on top of PowerShell remoting, and the same history shows Enable-PSRemoting and Test-WSMan. The protocol is reasoned from that history and the design of the feature, not read from a single artifact.

grep -iE 'PSRemoting|WSMan' ConsoleHost_history.txt

The Microsoft-Windows-PowerShellWebAccess operational channel logs event 769 when a user session is established. It lists the account from Q14, which confirms the backdoor works.

grep -h ',769,' work/evtx/*PowerShellWebAccess*.csv

The same 769 event carries the session identifier, built from the host name, the user and a timestamp.

grep -h ',769,' work/evtx/*PowerShellWebAccess*.csv

Tip: The timestamp inside the session ID reads seven hours behind the UTC event time, so do not use it for the Q17 or Q19 answers.

Event 770 in the same channel records the user sign-off for that session ID.

grep -h ',770,' work/evtx/*PowerShellWebAccess*.csv

Share definitions live in the registry, so go to the hives. The LanmanServer shares key is in SYSTEM, which is dirty, and its LOG1 holds the uncommitted write. Strings on it show a ShareName= value with Path= pointing at the Q10 folder.

strings -e l evidence/Windows/System32/config/SYSTEM.LOG1 | grep -iE 'ShareName|Path='

Tip: regipy cannot replay transaction logs, so the newest share definition only shows up in the LOG1 strings.

Attack Summary

Phase	Action
Credential Access	Password spray from 192.168.189.129 ends in a successful logon as v.hunter
Credential Access	Hash-capture shortcut dropped in the Proposal share, icon pointing at the attacker
Lateral Movement	RDP logon as k.texus from the attacker host
Collection	Project folder compressed into arkproj.zip
Exfiltration	Archive uploaded to a C2 site through Edge
Persistence	Local user t.minami created
Persistence	PowerShell Web Access installed; session opened and signed off as t.minami
Persistence	Share ProjectArk created over C:\ProjectArk

Forensic Timeline

Timestamp (UTC)	Event
2025-06-11 14:35:56	Spray succeeds, v.hunter logon from 192.168.189.129
2025-06-11 14:44:46	RDP authentication event for k.texus (TerminalServices 1149)
2025-06-11 14:44:48	4624 logon type 10 for k.texus
2025-06-11 14:46:44	Archive upload to the C2 site in Edge history
2025-06-11 14:48:17	t.minami created by k.texus
2025-06-11 14:54:55	PowerShell Web Access session opens
2025-06-11 14:55:40	PowerShell Web Access session signed off

IOCs

Type	Value
IP	192.168.189[.]129
Domain	yourc2filemanager[.]cn
URL	hxxp[://]argonaut[.]ark/proposal.html
UNC	\\192.168.189[.]129\%USERNAME%.icon
File	Proposal.url, arkproj.zip
Accounts	v.hunter, k.texus, t.minami
Shares	Proposal, ProjectArk

MITRE ATT&CK

Technique	ID	Description
Brute Force: Password Spraying	T1110.003	Failed logons from one host, then a valid pair
Forced Authentication	T1187	.url icon pointing at an attacker UNC path
Remote Services: Remote Desktop Protocol	T1021.001	Logon type 10 as k.texus
Archive Collected Data	T1560	Project folder zipped
Exfiltration Over Web Service	T1567	Upload through Edge to a C2 site
Create Account: Local Account	T1136.001	t.minami created
Command and Scripting Interpreter: PowerShell	T1059.001	Feature installed from the PowerShell console
Remote Services: Windows Remote Management	T1021.006	PowerShell remoting enabled for the web gateway

Defender Takeaways

A burst of 4625 followed by a 4624 from the same source is a cheap, reliable spray detection. Five failures and the success came from one address. A correlation rule on that pattern, even at a low threshold, flags the initial foothold.

An everyone-writable share is a lure delivery path. The actor dropped a .url file whose icon path forced SMB authentication back to their host. Restrict write access to shares, and block outbound SMB at the perimeter so a forced authentication has nowhere to go.

Account creation and Windows feature installs from a user session need alerts. 4720 and an Install-WindowsFeature command line in ConsoleHost_history.txt are rare and high signal. PowerShell Web Access also has its own operational channel (769/770), which should be collected.

Keep SAM and SYSTEM transaction logs with the hives. The dirty hives hid the newest share definition from parsers, and it only appeared in LOG1. Collecting the LOG1/LOG2 files alongside the hives preserves it.

Conclusion

The actor went from a password spray to a persistent web-based gateway and a copy of the project data in about twenty minutes. Each step left a clear log trail, so the gap was monitoring, not evidence.