Players will use SmartScreen debug logs to understand user activities and corporate sabotage. This Sherlock is released alongside a HackTheBox blog post (https://hackthebox.com/blog/smartscreen-logs-evidence-execution) to highlight how this log, which was discovered by HackTheBox content engineers during their research, can serve as a crucial artefact in incident investigations.
An attacker connected over RDP to the workstation where a user named Dutch keeps sensitive files and ran a roughly thirteen minute sabotage and extortion session. They installed an archiver, then dropped a portable file-search utility and used it to locate board and budget documents. A cloud sync client followed for exfiltration, and a file shredder was installed to destroy the data afterwards. The last step was clearing the event logs. Because the Security log was wiped, the logon and process-creation trail is gone, and the whole story is rebuilt from the SmartScreen debug channel and the Terminal Services logs that survived.
evidence/Logs/*.evtx → parse everything with EvtxECmd, then filter the CSV with PythonMicrosoft-Windows-SmartScreen/Debug channel → records applicationLookup and isFileSupported events with the full path of each file the user ran or openedMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational and LocalSessionManager/Operational → RDP session evidenceTimestamp note: Every answer uses
YYYY-MM-DD HH:MM:SS. Use theTimeCreatedvalue from the EvtxECmd CSV as it is and do not shift it.
Parse the whole log directory once and work from the CSV from then on.
EvtxECmd -d evidence/Logs --csv work/evtx --csvf all.csvThe obvious source is Security 4624 with logon type 10, but the Security log was cleared during the intrusion (see Q10), so no logon events from the session survive. Pivot to the Terminal Services channels. RemoteConnectionManager event 1149 (“User authentication succeeded”) names the user and the source address, and it is the first RDP event for the connection. LocalSessionManager logs its own session events a second later.
python3 -I -c "import csv;[print(r['TimeCreated'],r['Channel'],r['EventId'],r['PayloadData1']) for r in csv.DictReader(open('work/evtx/all.csv')) if r['EventId'] in ('1149','21','22','25') and r['TimeCreated'].startswith('2025-01-24')]"Gotcha:
1149and theLocalSessionManagerevents sit one second apart. The1149authentication event is the login; the session events are the desktop being attached.
Filter the CSV to the SmartScreen debug channel and sort by time. Every file the user launches produces an applicationLookup event carrying its path, so the session reads like a program execution history. The first installer fetched into Downloads after the RDP login is an archiver setup file, and the installed program’s own executable shows up in the lookups right after it.
python3 -I -c "import csv;[print(r['TimeCreated'],r['PayloadData1']) for r in csv.DictReader(open('work/evtx/all.csv')) if 'SmartScreen' in r['Channel']]"From the same SmartScreen listing, look for an executable that has no installer in front of it. A portable file-search tool runs straight from Downloads, and its applicationLookup event carries the full path. The path starts with the drive letter, as the format asks.
python3 -I -c "import csv;[print(r['TimeCreated'],r['PayloadData1']) for r in csv.DictReader(open('work/evtx/all.csv')) if 'SmartScreen' in r['Channel'] and 'Downloads' in r['PayloadData1']]"Same event as Q3. The TimeCreated of the applicationLookup row for that path is the first time the tool ran. It lands a few minutes after the login, in the same window as the archiver install, so the attacker was moving quickly.
Keep reading the SmartScreen channel after the search tool starts. Opening a document produces an isFileSupported event with its full path, which is how a viewer or shell checks that a file type can be handled. The first one after the search tool is a PDF in a board of directors folder under Documents. Note that the folder name contains a space and a leading year, so copy the path exactly.
python3 -I -c "import csv;[print(r['TimeCreated'],r['PayloadData1']) for r in csv.DictReader(open('work/evtx/all.csv')) if 'SmartScreen' in r['Channel'] and 'isFileSupported' in str(r.values())]"The next isFileSupported event after Q5 sits in the same folder, about twenty seconds later. The name flags it as budget material marked confidential.
A minute after the second document, a setup file for a cloud storage sync client appears in the SmartScreen listing. Cloud storage clients are a common exfiltration route because the traffic is ordinary HTTPS to a well-known provider.
python3 -I -c "import csv;[print(r['TimeCreated'],r['PayloadData1']) for r in csv.DictReader(open('work/evtx/all.csv')) if 'SmartScreen' in r['Channel'] and 'Setup' in r['PayloadData1']]"The installer lookup from Q7 is not the answer. Look for the installed client’s own executable under its install path, which logs a separate applicationLookup a couple of minutes after the setup file.
python3 -I -c "import csv;[print(r['TimeCreated'],r['PayloadData1']) for r in csv.DictReader(open('work/evtx/all.csv')) if 'SmartScreen' in r['Channel'] and 'MEGAsync.exe' in r['PayloadData1']]"Gotcha: Setup and application are separate events. Reporting the installer time answers a different question.
After the sync client, the SmartScreen channel shows another download and install, this time of a secure-deletion tool. The setup file is followed shortly by the application executable, so the attacker installed it and ran it straight away.
python3 -I -c "import csv;[print(r['TimeCreated'],r['PayloadData1']) for r in csv.DictReader(open('work/evtx/all.csv')) if 'SmartScreen' in r['Channel'] and 'hredder' in r['PayloadData1']]"Security event 1102 (“The audit log was cleared”) records the wipe; 104 is the equivalent for other logs, which covers the second cleared log the task mentions. Filter the CSV for both on the incident date. The Security 1102 is the last step of the session and explains why Q1 had to be answered from Terminal Services instead of 4624.
python3 -I -c "import csv;[print(r['TimeCreated'],r['Channel'],r['EventId']) for r in csv.DictReader(open('work/evtx/all.csv')) if r['EventId'] in ('1102','104') and r['TimeCreated'].startswith('2025-01-24')]"| Phase | Action |
|---|---|
| Initial Access | RDP login to Dutch’s workstation, seen in Terminal Services 1149 |
| Execution | Archiver downloaded and installed |
| Execution | Portable file-search utility run from Downloads |
| Discovery | Search used to find board and budget documents |
| Collection | Two confidential PDFs opened from the board of directors folder |
| Exfiltration | Cloud sync client installed and launched |
| Impact | File shredder installed and run to destroy data |
| Defense Evasion | Event logs cleared, Security 1102 last |
| Timestamp | Event |
|---|---|
| 2025-01-24 10:15:14 | RDP authentication succeeds (RemoteConnectionManager 1149) |
| 2025-01-24 10:17:14 | Archiver installer looked up in Downloads |
| 2025-01-24 10:17:33 | Portable file-search tool first executed |
| 2025-01-24 10:19:00 | First confidential PDF opened |
| 2025-01-24 10:19:19 | Second confidential PDF opened |
| 2025-01-24 10:20:05 | Cloud sync client installer looked up |
| 2025-01-24 10:22:19 | Cloud sync client executed |
| 2025-01-24 10:26:40 | File shredder installer looked up |
| 2025-01-24 10:27:09 | File shredder executed |
| 2025-01-24 10:28:41 | Security log cleared (1102) |
| Type | Value |
|---|---|
| Tool path | C:\Users\Dutch\Downloads\Everything.exe |
| Installer | C:\Users\Dutch\Downloads\winrar-x64-701.exe |
| Installer | MEGAsyncSetup64.exe |
| Installer | file_shredder_setup.exe |
| Accessed file | C:\Users\Dutch\Documents\2025- Board of directors Documents\Ministry Of Defense Audit.pdf |
| Accessed file | C:\Users\Dutch\Documents\2025- Board of directors Documents\2025-BUDGET-ALLOCATION-CONFIDENTIAL.pdf |
| Account | Dutch (RDP) |
| Technique | ID | Description |
|---|---|---|
| Remote Services: Remote Desktop Protocol | T1021.001 | Attacker logged in to the workstation over RDP as Dutch |
| Ingress Tool Transfer | T1105 | Archiver, search tool, sync client and shredder fetched onto the host |
| File and Directory Discovery | T1083 | Portable search utility used to find sensitive documents |
| Exfiltration to Cloud Storage | T1567.002 | Cloud sync client installed to move the documents out |
| Data Destruction | T1485 | Secure-deletion utility used to make the data unrecoverable |
| Indicator Removal: Clear Windows Event Logs | T1070.001 | Security log cleared (the task says two logs were cleared) |
SmartScreen debug logging records what Security auditing missed. Once the Security log was cleared, there was no 4624 or 4688 left, but the SmartScreen channel still held a path-level history of everything run and opened. Collect Microsoft-Windows-SmartScreen/Debug alongside the standard channels, and enable it where it is off by default.
Ship logs off the host before the attacker can clear them. Both the Security and a second log were wiped in the final minutes. Forward Security and Terminal Services events to a collector in near real time, and alert on 1102 and 104 as high-severity.
RDP into a user’s workstation followed by installers is a short chain worth detecting. The session went from login to archiver, search tool, cloud sync client and shredder in minutes. Alerting on an RDP logon followed by software installs from Downloads would have fired well before the shredder ran.
Restrict outbound access to consumer cloud storage. The sync client existed only to move documents out. Egress filtering or application allow-listing on a machine holding board documents would have blocked it.
The attacker reached sensitive board documents over RDP, exfiltrated them with a cloud sync client, shredded the originals and wiped the logs, all within about thirteen minutes. The wipe removed the standard evidence, but the SmartScreen debug log kept the path-level history that the defenders needed.