Elevating Movement

3 min read1 day ago

Investigate the second, Windows part of the Honeynet Collapse!

Elevating Movement

Hey Emily, when you are done with DeceptiPot deployment, can you take a look at SRV-IT-QA? It became unstable after we replaced the motherboard, so maybe you can debug what’s going on there. ~ Matthew

While Emily worked on the issue from a local admin account, the threat actor continued the attack. With the entry point secured and Emily’s domain credentials stolen, they now wanted to explore opportunities for privilege escalation. Leveraging your knowledge of Windows forensics, can you uncover the elevating movement?

When did the attacker perform RDP login on the server?
Answer Format Example: 2025–01–15 19:30:45

Go to Event Viewer after starting the attack box Search 1149 event logs and look out for each event where u will find the emily ross login successfully

MeetCyber

Elevating Movement

Elevating Movement

Go to Event Viewer after starting the attack box Search 1149 event logs and look out for each event where u will find the emily ross login successfully

Create an account to read the full story.

Published in MeetCyber

Written by THM{0x416469747961204D6163686972616A75}

Responses (1)

More from THM{0x416469747961204D6163686972616A75} and MeetCyber

Man-in-the-Middle Detection

Learn what MITM attack is, and how to identify the footprints of this attack in the network traffic.

Vibe coding: the antidote

LLMs have shown themselves to be a terrible way to write programs. But the problem they address is real, and we aren’t solving it any other…

I Met One of India’s Best Hackers. Here’s What He Told Me.

Inside the Mind of a Hacker Who Knows Too Much.

Linux Threat Detection 2

Explore the first actions of attackers after breaching a Linux server and learn how to detect them.

Recommended from Medium

Man-in-the-Middle Detection

Learn what MITM attack is, and how to identify the footprints of this attack in the network traffic.

TryHackMe | Linux Threat Detection 2 | WriteUp

Explore the first actions of attackers after breaching a Linux server and learn how to detect them

30 Days of Red Team: Day 1 — Understanding the Kill Chain (Your Roadmap to Domain Admin)

Welcome to Day 1 of what’s going to be an intense 30-day journey. By the end of this series, you’re going to understand exactly how…

Mastering MITRE ATT&CK® Navigator: Turning Thread’s Layers into Actionable Defence Maps

Originally published at Arachne Digital.

Red Team Dorks: The Ultimate OSINT Recon Cheat-Sheet for Attack Surface Mapping

In offensive security, reconnaissance wins before the first exploit is fired. OSINT dorking — crafting surgical queries across engines like…

Log Analysis with SIEM Walkthrough Notes | TryHackMe

Learn how SIEM helps detect and analyze malicious activity.