Analyzing Sysmon From Backdoored UltraVNC Malware - HTB Sherlocks - Unit42
Source: YouTube · IppSec · published Oct 21, 2024 · 39:32
This video covers the Hack The Box "Unit 42" Sherlock challenge, focusing on analyzing Cismon logs related to a real-world UltraVNC backdoor campaign 0:02-0:07.
Key Takeaways:
• The challenge is a defensive "Sherlock" scenario on Hack The Box centered around Cismon log analysis 0:04-0:10.
• The scenario is inspired by Palo Alto's Unit 42 threat intelligence team and their published research 0:19-0:26.
• The real-world attackers used a backdoored version of UltraVNC to maintain persistent access to compromised systems 0:27-0:32.
The creator recommends researching the original Unit 42 UltraVNC report before diving into the challenge logs to better understand the threat actor's techniques 0:35-0:43.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
what's going on YouTube this is IPC we doing unit 42 from hack the box which is another Sherlock which is a defensive challenge in this one we're going to be digging into some cismon logs so let's head over to the Sherlock info page to see what this is about it starts off telling us yes we're going to deal with cismon logs and then it's based upon unit 42 which is poo alto's threat intelligence and instant response team and they had published some research on an ultra VNC campaign where the attackers utilized a backdoor version of Ultra VNC to maintain access to the system so before we dig into the actual Sherlock questions I always like just looking at how the shock was inspired so let's Google unit 42 and then Ultra VNC and you don't have to do this um before doing the challenge but I al…