LogJammer

Scenario

In this entry-level digital forensics and incident response (DFIR) challenge, Forela-Security, a renowned consultancy, has presented you with a technical assessment to evaluate your proficiency in Windows Event Log Analysis. As a potential junior DFIR consultant, your task is to scrutinize, interpret, and report on the specific event logs they have provided. This scenario puts your understanding of Windows Event IDs, your ability to identify and interpret noteworthy security events, and your skills in effectively reporting your findings, to the test. This practical assessment mirrors real-world tasks you might face in a DFIR role, offering a realistic insight into the job while showcasing your abilities to Forela-Security.

Executive Summary

The CyberJunkie account logged on interactively at a workstation and, within minutes, added an outbound Windows Firewall rule named for a Metasploit command-and-control bypass. The user then changed the audit policy and registered a scheduled task that runs a PowerShell script from the desktop. Defender flagged a downloaded SharpHound archive as a hack tool and quarantined it. Later the user hashed the scheduled script from PowerShell, and a few minutes after that cleared the firewall operational log, which held the record of the rule. Every step is visible across the Security, Firewall, Defender, PowerShell and System channels.

Artifacts

• Windows event logs: the .evtx files under evidence/Event-Logs (Security, Firewall, Defender, PowerShell, System, plus Sysmon) → parse everything into one CSV with EvtxECmd, then filter by event ID with Python

Timestamp note: Q1 wants DD/MM/YYYY HH:mm:ss in UTC. EvtxECmd’s TimeCreated is already UTC, so only the field order changes.

Tip: EvtxECmd can exit non-zero on an argument error while still writing the CSV. Check the output directory before assuming the parse failed.

EvtxECmd -d evidence/Event-Logs --csv work/evtx

Initial Access

Security 4624 is the successful logon event. Filter to DESKTOP-887GK2L\CyberJunkie with LogonType 2 (interactive) and take the earliest. That timestamp starts the timeline for everything below.

python3 -I -c "import csv,sys; [print(r['TimeCreated'],r['PayloadData1'],r['PayloadData2']) for r in csv.DictReader(open('work/evtx/all.csv')) if r['EventId']=='4624' and 'CyberJunkie' in str(r.values())]"

Defense Evasion

Firewall event 2004 means a rule was added. One such event lands about seven minutes after the logon, and the rule name says what it was for.

python3 -I -c "import csv; [print(r['TimeCreated'],r['PayloadData1'],r['PayloadData2']) for r in csv.DictReader(open('work/evtx/all.csv')) if r['EventId']=='2004']"

Same 2004 event as Q2. The Direction field in the payload gives it, and an outbound allow rule is the one a reverse shell needs.

Security 4719 records an audit policy change. The event stores the subcategory as a GUID (0cce9227-69ae-11d9-bed3-505054503030), and that GUID resolves to the answer.

python3 -I -c "import csv; [print(r['TimeCreated'],r['PayloadData1'],r['Payload']) for r in csv.DictReader(open('work/evtx/all.csv')) if r['EventId']=='4719']"

Gotcha: The event also carries %% value codes for the audit change. Recalling a subcategory from those codes by memory gives the wrong name (a first answer of Other Policy Change Events was rejected). Resolve the GUID instead.

Log clearing shows up as System 104 (and Security 1102 for the Security log). Listing every one of them separates the noise: several are Sysmon clears from 24 March, days before the logon in Q1. The one that matters is the 104 at 15:01:56 on 27 March, after the rest of the activity, and it names the Firewall channel. That fits wiping the evidence of the Q2 rule.

python3 -I -c "import csv; [print(r['TimeCreated'],r['EventId'],r['PayloadData1'],r['Payload']) for r in csv.DictReader(open('work/evtx/all.csv')) if r['EventId'] in ('104','1102')]"

Gotcha: Multiple 104 events exist and the Sysmon ones are older noise. Choosing the firewall clear is a judgement on timing and on which log held the Q2 rule, so confirm the channel name in the payload.

Persistence

Security 4698 logs scheduled task creation and embeds the full task XML. TaskName is at the top of it.

python3 -I -c "import csv; [print(r['TimeCreated'],r['Payload']) for r in csv.DictReader(open('work/evtx/all.csv')) if r['EventId']=='4698']"

Same 4698 event as Q5. The <Command> element in the task XML holds the script path, on the user’s desktop.

The <Arguments> element sits right below <Command> in the same task XML from Q5.

Discovery

Defender raises 1116 when it detects something and 1117 when it acts on it. The threat name is HackTool:MSIL/SharpHound!MSR, the BloodHound collector used for Active Directory enumeration.

python3 -I -c "import csv; [print(r['TimeCreated'],r['EventId'],r['Payload']) for r in csv.DictReader(open('work/evtx/all.csv')) if r['EventId'] in ('1116','1117')]"

The Path field of the Q8 1116 event points into the user’s Downloads folder. It is the release archive, not an extracted binary.

The 1117 event carries the action name for the same detection.

Execution

PowerShell script block logging writes 4104 with the command text. At 14:58:33 the user ran Get-FileHash against the same script the Q5 task runs, which looks like a check on the file before or after scheduling it.

python3 -I -c "import csv; [print(r['TimeCreated'],r['Payload']) for r in csv.DictReader(open('work/evtx/all.csv')) if r['EventId']=='4104']"

Attack Summary

Phase	Action
Initial Access	CyberJunkie logs on interactively
Defense Evasion	Outbound firewall rule Metasploit C2 Bypass added
Defense Evasion	Audit policy changed for the Other Object Access Events subcategory
Persistence	Scheduled task HTB-AUTOMATION created to run a desktop PowerShell script
Discovery	SharpHound archive in Downloads detected and quarantined by Defender
Execution	Get-FileHash run against the scheduled script
Defense Evasion	Firewall operational log cleared

IOCs

Type	Value
Account	DESKTOP-887GK2L\CyberJunkie
Firewall rule	Metasploit C2 Bypass (outbound)
Scheduled task	HTB-AUTOMATION
File	C:\Users\CyberJunkie\Desktop\Automation-HTB.ps1
Task arguments	-A [email protected]
File	C:\Users\CyberJunkie\Downloads\SharpHound-v1.1.0.zip
Detection	HackTool:MSIL/SharpHound!MSR

MITRE ATT&CK

Technique	ID	Description
Valid Accounts: Local Accounts	T1078.003	Interactive logon as CyberJunkie
Impair Defenses: Disable or Modify System Firewall	T1562.004	Outbound Metasploit C2 Bypass rule added
Impair Defenses: Disable or Modify Tools	T1562.001	Audit policy changed
Scheduled Task/Job: Scheduled Task	T1053.005	HTB-AUTOMATION runs Automation-HTB.ps1
Ingress Tool Transfer	T1105	SharpHound archive present in Downloads
Command and Scripting Interpreter: PowerShell	T1059.001	Get-FileHash run against the scheduled script
Indicator Removal: Clear Windows Event Logs	T1070.001	Firewall operational log cleared

Defender Takeaways

Firewall rule creation and audit policy changes are rare on a workstation, so alert on them. Firewall 2004 and Security 4719 both appeared cleanly here. A rule named for a C2 bypass should never survive a review, and an outbound allow rule from an interactive user deserves a ticket.

Scheduled task creation hands you the payload. Security 4698 carries the command and arguments in the task XML, so the alert can show the script path without a second lookup. Interactive users registering tasks that point at their own desktop are worth a look.

Script block logging made the PowerShell activity visible. Event 4104 recorded the exact command. Without it, only the process start would remain.

A local log is not evidence the user cannot touch. The firewall log that held the rule was cleared minutes after the other activity. Forward logs to a collector and alert on System 104 and Security 1102, and tell clears apart by channel and time, since old Sysmon clears sit in the same log.

Resolve audit subcategories from the GUID. The %% value codes are easy to misremember, and the GUID is the field that does not change.

A quarantined hack tool is a lead, not a closed case. A SharpHound detection means someone tried to enumerate Active Directory, so the account’s other activity needs review.

Conclusion

The user opened an outbound path, loosened auditing, scheduled a script and pulled down an AD enumeration tool, then cleared the firewall log to hide the rule. Defender and script block logging caught the tool and the command, but only the logs that were not cleared kept the story intact.