Dissect the endpoint activity
The Windows export caught the hands-on-keyboard activity. Go deeper than the base course: measure the process activity, decode the hidden PowerShell, and identify how the attacker set up persistence.
How it works: the terminal below is a real Linux machine running in your browser. Click it and
type. Tasks tick themselves off as you complete them; questions are answered in the box under each task.
Press Reset any time for a fresh machine. Your password on this machine (for
sudo) is student.
Hints
`grep -c ',4688,'` counts process-creation events.
Decode: `grep -oE 'enc [A-Za-z0-9+/=]+' ... | awk '{print $2}' | base64 -d | tr -d '\0'`.
Solution explanation
You read the two 4688 process events, decoded the -enc blob back to an IEX(New-Object Net...) downloader, and found the 4720 account creation the attacker used to persist. Decoding obfuscated commands and reading process lineage is the difference between "PowerShell ran" and "here is exactly what it did."
Show solution
cd /home/student
grep -c ',4688,' /srv/soc-data/windows/security.log
awk -F, '$2==4688' /srv/soc-data/windows/security.log
grep -oE 'enc [A-Za-z0-9+/=]+' /srv/soc-data/windows/security.log | awk '{print $2}' | base64 -d | tr -d '\0' > /home/student/decoded-ps.txt
cat /home/student/decoded-ps.txt