| ID | Tactic | Technique |
|---|---|---|
| T1110.001 | Initial Access | Brute Force: Password Guessing |
| T1078 | Initial Access | Valid Accounts |
| T1059.001 | Execution | Command and Scripting Interpreter: PowerShell |
| T1059.003 | Execution | Command and Scripting Interpreter: Windows Command Shell |
| T1218.011 | Defense Evasion | System Binary Proxy Execution: Rundll32 |
| T1027 | Defense Evasion | Obfuscated Files or Information |
| T1082 | Discovery | System Information Discovery |
| T1049 | Discovery | System Network Connections Discovery |
| T1069 | Discovery | Permission Groups Discovery |
Brute force from 89[.]187[.]177[.]73 (confirmed malicious via AbuseIPDB) succeeded at 07:07 AM with logon event 4624 on account LetsDefend. Attacker conducted hands-on-keyboard recon via cmd spawned from explorer[.]exe including whoami, net user, net share, and PowerShell queries for running services, Defender status, and firewall profile. Attacker ran two LOLBin PoC commands via rundll32 abusing vbscript and mshtml traversal to spawn calc[.]exe. Second variant used LoL45 junk path obfuscation to bypass AV signature matching. First variant caught by AV. No external IPs contacted, no additional payloads executed. Verdict: True Positive - Contained. Machine contained.
Sep 12, 2024 - 07:09 AM
Host Elenora at 172[.]16[.]17[.]126. Brute force from 89[.]187[.]177[.]73. Successful logon at 07:07 AM. Commands executed via cmd and PowerShell spawned from explorer[.]exe.
External threat actor from 89[.]187[.]177[.]73. Gained access via brute force against LetsDefend account. Activity consistent with manual recon and Defender evasion testing - no payload deployment observed.
Attacker enumerated users, network, shares, and security tooling post-access. Rundll32 LOLBin PoC suggests probing Defender detection thresholds. LoL45 obfuscation indicates awareness of known AV signatures for standard mshtml traversal.
| Type | Value | Description |
|---|---|---|
| IP | 89[.]187[.]177[.]73 | Attacker IP - brute force source, confirmed malicious AbuseIPDB |
| IP | 172[.]16[.]17[.]126 | Host Elenora - compromised endpoint |
| Account | LetsDefend | Brute forced account |
| Process | RUNDLL32[.]EXE | LOLBin used for Defender evasion PoC |
🔗 AbuseIPDB (89[.]187[.]177[.]73) → https://www.abuseipdb.com/check/89.187.177.73?page=5 🔗 LOLBAS - Mshtml → https://lolbas-project.github.io/lolbas/Libraries/Mshtml/