Section 1: Maybe It's just a tadpole?

1. What is the MITRE ATT&CK ID for defacement?

Ans: T1491

1. Who is the Web Administrator? (Paste the full name.)

Ans: Anita Bath

Employees
| where role == 'Web Administrator'
| project name

1. What is the hostname of the Web Administrator machine?

Ans: ✅ MYZB-LAPTOP

Employees
| where role == 'Web Administrator'
| project hostname

1. When did the defacement happen exactly? (Paste the full timestamp.

Ans: ✅ 2024-07-10T11:45:50Z

ProcessEvents
| where hostname == "MYZB-LAPTOP"
| where process_commandline has "Shadow Truth"
| project timestamp

1. When was the first image uploaded? (Paste the full timestamp.

Ans: ✅ 2024-07-10T10:53:37Z

ProcessEvents
| where hostname == "MYZB-LAPTOP"
| where process_commandline contains "frog_mall_meme"
| sort by timestamp desc 

1. What is the Sha256 hash of the first meme that was uploaded to the webserver?

Ans: ✅ 9880c2d74afb2e57c7de7b9d6d0976112887502bb80344d35df34e774628dba0

FileCreationEvents
| where hostname == "MYZB-LAPTOP"
| where filename startswith "frog_mall_meme"
| sort by filename asc 
| project sha256,  filename

1. What domain were the images downloaded from?

Ans: ✅ ronniesdankmemes.com

Let's find out Anita Ip

Employees
| where role == 'Web Administrator'
| project ip_addr

Ans: 10.10.0.8

OutboundNetworkEvents
| where src_ip == "10.10.0.8"
| where url contains "frog_mall_meme"
| extend domain = parse_url(url).Host
| distinct tostring(domain)

1. Which command did the attacker use to look for files containing passwords?

Ans: ✅ Get-ChildItem -Path C:\Users\anbath\Documents* -Include password -Recurse

ProcessEvents
| where hostname =="MYZB-LAPTOP"
| where process_commandline has "password"
| project process_commandline

1. What is the name of the file containing passwords?

Ans: ✅ mypasswordsnstuff.txt

Let's modify the previous query, include contains

ProcessEvents
| where hostname =="MYZB-LAPTOP"
| where process_commandline contains "password"

1. What is the name of that domain?

Ans: ✅ newdevelopmentupdates.org

1. What is the last IP address that the domain you found in Q11 resolve to?

Ans: ✅ 239.72.6.37

PassiveDns
| where domain == 'newdevelopmentupdates.org'

1. Do the IPs found in Q11 resolve to other domains? If they do, answer with the domain. If not, type no

Ans: ✅ greenprojectnews.net

PassiveDns
| where domain == "newdevelopmentupdates.org"
| distinct ip 
| lookup PassiveDns on ip 
| distinct domain

1. What version of Firefox is the threat actor using?

Ans: ✅ 3.6.11

Let's find out the username of anita

anbath

let TA_ips =
PassiveDns
| where domain == 'newdevelopmentupdates.org'
| distinct ip;
AuthenticationEvents
| where src_ip in (TA_ips)
| where username == 'anbath'

1. What is Anita’s email address?

Ans: ✅ [email protected]

Employees | where name == 'Anita Bath' | distinct email_addr

1. What is the subject of the email she received?

Ans: ✅ Web Server Credentials Update

let TA_domains = 
PassiveDns
| where domain == 'newdevelopmentupdates.org'
| distinct ip
| lookup PassiveDns on ip
| distinct domain;
Email
| where recipient == "[email protected]"
| where link has_any(TA_domains)

1. What is the link attached to that email?

Ans: ✅ https://greenprojectnews.net/share/modules/files/share/enter

let TA_domains = 
PassiveDns
| where domain == 'newdevelopmentupdates.org'
| distinct ip
| lookup PassiveDns on ip
| distinct domain;
Email
| where recipient == "[email protected]"
| where link has_any(TA_domains)
| project link

1. When did Anita click on the link? (Paste the full timestamp.

Ans: ✅ 2024-06-26T15:24:20Z

OutboundNetworkEvents
| where src_ip == "10.10.0.8"
| where url == "https://greenprojectnews.net/share/modules/files/share/enter"
| project timestamp

1. What is the full url showing her doing just that?

Ans: ✅ https://greenprojectnews.net/share/modules/files/share/enter?username=anbath&password=**********

OutboundNetworkEvents
| where src_ip == "10.10.0.8"
| where url startswith 'https://greenprojectnews.net/share/modules/files/share/enter'
| where url has "username"
| project url

1. Who sent Anita the mail?

Ans: ✅ [email protected] (refer q16 )