ShadowBait

Scenario

This Sherlock provides players with an opportunity to analyze Kape Image and find evidence of intrusion via phishing, remote access via persistence mechanisms, and abusing Windows DPAPI to escalate privileges and acquire elevated access.

Executive Summary

A macro-enabled document pulled from a cloud file-sharing link landed in a user’s Downloads folder and was opened. Its macro dropped a PowerShell stager, which fetched a backdoor into the user’s roaming profile and beaconed out to the attacker. From the user’s shell the attacker found an exported PowerShell credential file belonging to a second account, imported it to recover that account’s secret, and pulled a runas-style tool from an internal staging server to get a shell as that second user. A privilege script then led to an elevated shell, obtained by spoofing the parent of a new process to a SYSTEM-owned one and calling back on a second port. Persistence was layered with a scheduled task and a Run key for a backdoor disguised as a PDF, plus a startup shortcut written by a VBScript.

Artifacts

• Windows event logs: KAPE triage collection logs directory → parse with EvtxECmd, then flatten the JSON payloads of Sysmon (Microsoft-Windows-Sysmon/Operational) into a TSV for grep
• PowerShell logs: Microsoft-Windows-PowerShell/Operational Event ID 4104 script blocks, plus the ConsoleHost_history.txt PSReadLine files
• Chrome profile: the History SQLite database for download URLs
• Startup shortcut: the LNK in the second user’s Startup folder → LECmd

Timestamp note: EvtxECmd leaves the event data as raw JSON in the payload columns. Flatten it first (a short Python script worked) or the Sysmon fields are painful to filter.

Initial Access

Parse the event logs, then search the flattened Sysmon output for Office-style file names. Sysmon Event ID 15 (FileCreateStreamHash) records the Zone.Identifier stream written when Chrome saved a document into steven\Downloads. That mark-of-the-web entry is the browser download of the macro document.

EvtxECmd -d logs --csv work/evtx

grep -i 'Zone.Identifier' work/sysmon.tsv | grep -i 'Downloads'

The Zone.Identifier stream from Q1 carries a HostUrl, but that is the redirect endpoint, not the link the browser requested. The Chrome History database holds the real chain: the downloads_url_chains table lists the URL the download was started from. Query it with SQLite, or load it in SQLECmd.

sqlite3 History "select tab_url, url from downloads_url_chains"

Gotcha: The format hint says URL and the HostUrl in Zone.Identifier looks like one, but it points to a download?id= endpoint. The answer is the uc?id= link in the Chrome download chain.

Execution

Look for Sysmon Event ID 11 (FileCreate) where the creating process is powershell.exe. The script downloader.ps1 is created by PowerShell shortly after the document is opened, and the event timestamp is the answer.

grep -i 'downloader.ps1' work/sysmon.tsv

Follow the stager from Q3. Sysmon Event ID 11 and the PowerShell 4104 script blocks show it writing an executable into the user’s roaming profile, which is the backdoor.

grep -i 'FileCreate' work/sysmon.tsv | grep -i 'AppData\\Roaming'

Command and Control

Pivot on the image from Q4. Sysmon Event ID 3 (NetworkConnect) from that executable shows the outbound connection and its destination port.

grep -i 'opendll.exe' work/sysmon.tsv | grep -i 'NetworkConnect'

Credential Access

Steven’s three ConsoleHost_history.txt files predate the intrusion and show a legitimate admin habit: a credential for the other account was saved with Export-Clixml. Export-Clixml protects the secret with DPAPI, which is why it can be recovered later by the account that wrote it. The path it was written to is the answer.

cat ConsoleHost_history*.txt | grep -i 'Export-Clixml'

Search PowerShell 4104 script blocks from the parsed EvtxECmd CSV in the window after the beacon starts. At 05:48:31 the attacker imports the file from Q6 into a $cred variable, which decrypts the stored secret in the context that can read it.

grep -i 'Import-CliXml' work/evtx/*PowerShell*.csv

Tip: The format mask shows the shape of the answer ($**** = ******-****** -**** **********.***), so the relative path connection.xml is expected, not the full path from Q6.

Lateral Movement

Sysmon Event ID 1 (ProcessCreate) records the full CommandLine. The attacker used certutil.exe with -urlcache -f against an internal address to fetch a runas-style tool.

grep -i 'certutil' work/sysmon.tsv | grep -i 'urlcache'

From Q8 we know the tool is RunasCs.exe, which takes the account name and password as arguments. The Sysmon Event ID 1 record for its execution holds them in the command line, so the password is recovered without touching the DPAPI blob.

grep -i 'RunasCs.exe' work/sysmon.tsv | grep -i 'ProcessCreate'

Discovery

Review the certutil downloads made as the second account after the shell lands. This answer was reasoned rather than read straight from an artifact: no obvious enumeration script (a PowerUp or WinPEAS style name) turned up in the triage, and psgetsys.ps1 was the best fit among the scripts fetched that way. The platform accepted it.

grep -i 'certutil' work/sysmon.tsv | grep -i '\.ps1'

Privilege Escalation

The 4104 script blocks show the psgetsys technique calling ImpersonateFromParentPid with a -ppid argument. That is parent PID spoofing: the new process is created as a child of a SYSTEM-owned process, and it inherits that token. The PID passed belongs to winlogon.exe.

grep -i 'ImpersonateFromParentPid' work/evtx/*PowerShell*.csv

The elevated shell was started with an encoded reverse-shell command. Decode the base64 from the script block or process command line and read the port out of the socket connection, then confirm it with the matching Sysmon Event ID 3.

import base64
print(base64.b64decode(open("work/revshell.b64").read()).decode("utf-16le"))

Persistence

Two persistence mechanisms point at the same file: a scheduled task created with schtasks named CheckSystem, and a Run key value named WMISVC. Both execute a backdoor that poses as a PDF through a double extension, placed in System32.

grep -iE 'schtasks|CurrentVersion\\Run' work/sysmon.tsv

Sysmon Event ID 11 shows cscript.exe creating an LNK inside the second user’s Startup folder, which runs at each logon. The name comes from that file-create event. LECmd was run on the LNK, but its target was not confirmed in the triage, so the link to the Q13 backdoor rests on the file’s location and creator.

grep -i 'Startup' work/sysmon.tsv | grep -i '\.lnk'

From Q14, the process creating the LNK is cscript.exe. Its Sysmon Event ID 1 command line gives the script it was running, which is the VBScript that wrote the shortcut.

grep -i 'cscript' work/sysmon.tsv | grep -i 'ProcessCreate'

Attack Summary

Phase	Action
Initial Access	Macro document downloaded through Chrome from a cloud file link
Execution	Macro runs PowerShell, which writes a stager script
Command and Control	Stager drops a backdoor in the roaming profile; it beacons out
Credential Access	Attacker imports a DPAPI-protected credential file belonging to a second user
Lateral Movement	certutil fetches a runas-style tool from an internal staging server; shell as the second user
Discovery	A script is downloaded under the second account
Privilege Escalation	Parent PID spoofing from a SYSTEM-owned process gives an elevated reverse shell on a second port
Persistence	Scheduled task and Run key for a PDF-named backdoor
Persistence	VBScript run by cscript writes a Startup shortcut

IOCs

Type	Value
File (phishing)	Policy.docm
URL	hxxps[://]drive[.]usercontent[.]google[.]com/uc?id=1Y6XAccvtdWvXUGx8WU0qG-7EP781c0uD&export=download
File (stager)	downloader.ps1
File (backdoor)	C:\Users\steven\AppData\Roaming\opendll.exe
Port (C2)	8899
Port (elevated shell)	9006
File (credential store)	C:\Users\samy\Documents\connection.xml
IP (staging)	192[.]168[.]204[.]152
File (tool)	RunasCs.exe
Credential	Winter2025! (samy)
File (script)	psgetsys.ps1
File (persistence)	C:\Windows\system32\document.pdf.exe
Scheduled task	CheckSystem
Run key value	WMISVC
File (shortcut)	NetworkDiagnostics.lnk
File (script)	C:\programdata\wscript.vbs

MITRE ATT&CK

Technique	ID	Description
Phishing: Spearphishing Link	T1566.002	Document delivered through a download link
User Execution: Malicious File	T1204.002	Macro-enabled document opened by the user
Command and Scripting Interpreter: PowerShell	T1059.001	Stager script and credential import
Ingress Tool Transfer	T1105	Backdoor, RunasCs and script downloads, including certutil
Credentials from Password Stores	T1555	DPAPI-protected Export-Clixml file imported
Valid Accounts: Local Accounts	T1078.003	Shell as the second user with a known password
Access Token Manipulation: Parent PID Spoofing	T1134.004	Elevated shell spawned under a SYSTEM process
Scheduled Task/Job: Scheduled Task	T1053.005	CheckSystem task for the backdoor
Boot or Logon Autostart: Registry Run Keys	T1547.001	WMISVC Run key value
Boot or Logon Autostart: Shortcut Modification	T1547.009	Startup LNK written by a VBScript
Masquerading: Double File Extension	T1036.007	Backdoor named like a PDF

Defender Takeaways

Macro documents from the internet should never run. The document arrived with a mark-of-the-web stream and still executed PowerShell. Block macros in files from the internet through policy, and alert on Office applications spawning powershell.exe.

Export-Clixml credentials are only as safe as the account that reads them. DPAPI protection means nothing once an attacker runs code as the same user. Stop saving credentials to files for convenience, and treat a process importing such a file outside normal admin activity as a credential-theft signal.

certutil -urlcache and plaintext passwords in command lines are cheap detections. Sysmon Event ID 1 captured both the staging download and the password passed to the runas tool. Alert on certutil fetching over HTTP, and on credentials appearing in process arguments.

Parent PID spoofing is visible in PowerShell logs. Script block logging recorded the ImpersonateFromParentPid call and the spoofed PID. Keep 4104 logging on and hunt for process-creation events whose parent does not match the creating process.

Persistence was layered, so remove all of it. A task, a Run key and a Startup shortcut all pointed at one backdoor. Sweep every autostart location for a known-bad file, not just the first hit, and flag executables with document-style double extensions in System32.

Conclusion

The attacker went from one opened document to an elevated shell and three persistence mechanisms using a credential file the victim had saved themselves and built-in Windows tooling. Script block logging and Sysmon process creation recorded every step; the detection value was in the chain, not any single event.