This Company Got Hacked... but HOW?
Source: YouTube · John Hammond · published Dec 14, 2023 · 19:01
This video demonstrates a complete incident response investigation using the "Poisoning the Well" lab, tracing how a domain controller was compromised from initial access via a malicious document to full domain takeover using Kerberoasting and credential dumping 0:00.
Key Takeaways:
• The attack began when user Jane Ross opened a weaponized Word document from SharePoint, which executed a macro that spawned a fake word.exe process connecting to an external IP 1:21.
• Process creation logs revealed that the legitimate Microsoft Word application spawned the malicious word.exe, confirming a macro-based payload delivery technique 5:18.
• SharePoint audit logs showed the file was staged by user Todd Lee before Jane accessed it, indicating Todd's account was likely compromised first to plant the malware 10:55.
• The attacker escalated privileges via Kerberoasting, requesting a service ticket for the admin account Joan King, which had a weak password ("summer2023") that was easily cracked 13:52.
• Once admin access was secured, the threat actor performed a DC Sync attack using DCE-RPC requests to dump all user NTLM hashes from the domain 17:16.
This walkthrough emphasizes the importance of cross-referencing Sysmon, security, and network logs to reconstruct the entire kill chain 18:03.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Incident Response. Commonly maps to: Security Operations, Security Assessment and Testing. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
Let's do an incident response investigation. Let's walk back the hack to uncover how this hypothetical company had their domain controller compromised and their whole environment taken over. This is a free and online training lab that you can follow along with. Link in the video description called Poisoning the Well. This incident response lab allows for the investigation of logs from a cyber attack on a domain controller. We will analyze different logs to detect the initial access and intrusion all the way to the thread actors compromised for domain admin. So first things first, we should download the logs. I do have these staged and set up inside of a Windows virtual machine. We can go open these and we can see all the different hosts and all the machines, all the endpoints that we might…