Operation Blackout 2025: Smoke & Mirrors

Scenario

In Smoke & Mirrors, players analyze the provided event logs and forensic artifacts to uncover how the attacker disabled or altered security features. They must identify the tools, commands, or scripts used to reduce visibility and reconstruct the methods the attacker used to operate undetected.

Executive Summary

An attacker with command execution on a Windows host spent a few minutes stripping its defenses before doing anything else. They switched off LSA protection through the registry, then used PowerShell to weaken Defender’s scanning preferences. A PowerShell script compiled with Add-Type patched the AMSI scan routine in memory, with the target function name built from split strings to dodge string matching. The host was then told to reboot into Safe Mode, where most security tooling does not load, and PowerShell’s history logging was turned off to leave less behind. All of it is visible in PowerShell script block logging and Sysmon process creation.

Artifacts

• Windows event logs: the provided .evtx set under evidence/ → parse with EvtxECmd, then query the CSV. The ones that matter are PowerShell Operational (4103/4104) and Sysmon Operational (Event ID 1)

Timestamp note: The work files record times as HH:MM:SS only, with no date or timezone noted. The Forensic Timeline below is relative to a single day.

Defense Evasion

LSA protection is controlled by the RunAsPPL value under the LSA key in HKLM. Parse the whole log set to CSV and search for RunAsPPL. Both the PowerShell script block log (4104) and the Sysmon process creation event (Event ID 1) show a reg add setting RunAsPPL to 0, which turns the protection off. The key path in that command is the answer, so copy it as written, using the HKLM abbreviation.

EvtxECmd -d evidence --csv work/evtx

python3 -I -c "import csv,re,sys; [print(r) for r in csv.DictReader(open(sys.argv[1], encoding='utf-8-sig')) if re.search('RunAsPPL', str(r))]" work/evtx/<parsed>.csv

Tip: EvtxECmd may print an --icons error here. It still wrote the CSV, so check the output folder before assuming it failed.

Search the 4104 script block events for Set-MpPreference and take the earliest one, shortly after the LSA change. It sets three Defender preferences to $true at once: IOAV protection, email scanning and block-at-first-seen. The format hint matches that three-parameter shape. Later Set-MpPreference calls exist, so sort by time before picking.

python3 -I -c "import csv,re,sys; [print(r) for r in csv.DictReader(open(sys.argv[1], encoding='utf-8-sig')) if re.search('Set-MpPreference', str(r))]" work/evtx/<parsed>.csv

Look at the 4104 events around the Defender changes for a script using Add-Type with a P/Invoke definition. It resolves a function in the AMSI DLL with GetProcAddress and overwrites it in memory. The function name is never written whole: it is assembled from split string pieces, so the patch target only appears once you read the concatenation.

python3 -I -c "import csv,re,sys; [print(r) for r in csv.DictReader(open(sys.argv[1], encoding='utf-8-sig')) if re.search('GetProcAddress|DllImport', str(r))]" work/evtx/<parsed>.csv

Gotcha: A plain search for the function name finds nothing because of the string splitting. Search for the API calls (GetProcAddress, DllImport) instead.

The Safe Mode switch is a boot configuration change, so it shows up as a process creation, not a script block. Sysmon Event ID 1 records bcdedit.exe with a safeboot setting shortly after the AMSI patch. The network variant keeps networking available in Safe Mode, which an attacker wants for remote access.

python3 -I -c "import csv,re,sys; [print(r) for r in csv.DictReader(open(sys.argv[1], encoding='utf-8-sig')) if re.search('bcdedit|safeboot', str(r), re.I)]" work/evtx/<parsed>.csv

Seconds after the Safe Mode change, PowerShell’s own logs (4103 and 4104) record a Set-PSReadlineOption call. Setting the history save style to nothing stops PSReadLine writing the session to its history file, which removes a common source of command evidence on disk. The script block log still caught it.

python3 -I -c "import csv,re,sys; [print(r) for r in csv.DictReader(open(sys.argv[1], encoding='utf-8-sig')) if re.search('PSReadline', str(r), re.I)]" work/evtx/<parsed>.csv

Attack Summary

Phase	Action
Defense Evasion	reg add sets RunAsPPL to 0, disabling LSA protection
Defense Evasion	Set-MpPreference weakens Defender scanning options
Defense Evasion	PowerShell Add-Type script patches the AMSI scan function in memory
Defense Evasion	bcdedit configures the next boot into Safe Mode with networking
Defense Evasion	Set-PSReadlineOption stops command history being saved

Forensic Timeline

Times are HH:MM:SS as recorded in the case notes. The date and timezone were not captured.

Time	Event
06:28:47	reg add sets RunAsPPL to 0 (PowerShell 4104 and Sysmon 1)
06:31:32	First Set-MpPreference script block
06:37:47	AMSI patch script block logged
06:38:35	bcdedit.exe Safe Mode setting (Sysmon 1)
06:38:43	History logging disabled (PowerShell 4103/4104)

IOCs

Type	Value
Registry value	HKLM\SYSTEM\CurrentControlSet\Control\LSA RunAsPPL = 0
Command	Set-MpPreference -DisableIOAVProtection $true -DisableEmailScanning $true -DisableBlockAtFirstSeen $true
Command	bcdedit.exe /set safeboot network
Command	Set-PSReadlineOption -HistorySaveStyle SaveNothing
Patched function	AmsiScanBuffer

MITRE ATT&CK

Technique	ID	Description
Modify Registry	T1112	RunAsPPL set to 0 to turn off LSA protection
Impair Defenses: Disable or Modify Tools	T1562.001	Set-MpPreference changes and the in-memory AMSI patch
Impair Defenses: Safe Mode Boot	T1562.009	bcdedit set to boot into Safe Mode with networking
Indicator Removal: Clear Command History	T1070.003	PSReadLine history saving turned off
Command and Scripting Interpreter: PowerShell	T1059.001	Defender, AMSI and history changes all made from PowerShell

Defender Takeaways

Alert on RunAsPPL being set to 0. Turning off LSA protection is a precursor to credential theft from LSASS and has almost no legitimate reason to happen. A Sysmon registry rule or a process rule on reg add against the LSA key catches it. Here it appeared in both Sysmon and script block logs.

Treat Set-MpPreference with disable switches as high signal. Defender tamper protection and an alert on any -Disable* argument would have flagged the first change within minutes of the LSA edit.

String-splitting defeats keyword rules, not behavior rules. The AMSI target name was never written whole, so a rule for the function name alone missed it. Detect on the combination of Add-Type, GetProcAddress and the AMSI DLL in a script block instead.

Watch bcdedit with safeboot. A Safe Mode switch outside a maintenance window means security tooling will be absent on the next boot. Alert on bcdedit.exe with safeboot in the command line from Sysmon Event ID 1.

Forward PowerShell logs off the host. The attacker turned off history saving, but script block logging (4104) still recorded the command. Enabling it, and shipping it centrally, is what made this reconstruction possible.

Conclusion

The attacker removed LSA protection, Defender scanning, AMSI and local PowerShell history in about ten minutes, and queued a Safe Mode reboot to finish the job. None of it was hidden from script block logging and Sysmon, so the lesson is that evasion tooling is loud on the telemetry the attacker forgot to touch.