HTB Sherlocks: Notes from the Blue Team Grind • V1NCENT

Some labs got proper notes. Others got one line. A few barely got that 🫠

Here’s the stuff I kept from 12 Sherlocks in my 10-week blue team roadmap: useful artifacts, a few gotchas, and reminders for next time.

Week 6 🔎

GET /sh at 2025-02-06 22:25:29 — my starting point.
Need to recheck the timezone, both IPs, and what came back. A request alone doesn’t tell me whether anything ran.

Fake IT-support email → Gladys gets asked to allow remote access to her PC.
Parsing setup: $MFT → MFTECmd, EVTX → EvtxECmd, then CSV → Splunk.
Next checks: remote-access logs, PowerShell, Defender, and file timestamps. Also check 4616 for clock changes before sorting everything into a timeline. Event docs.
I didn’t save the session details, payload indicators, or final timeline. Future-me problem, apparently.

Files: SneakyKeys.exe + cap.pcapng. SHA-256: f6f6beaa023bf314616297196a2d1825a04e3911b7eb6d7e54852c10391f467b.
Copies itself to %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\gg.exe and logs keystrokes when Chrome is active.
Sends encrypted input through IRC PRIVMSG, TCP 6697, channel #key_storrage. Check the capture for TLS; the port isn’t enough.
IDA for persistence and keyboard APIs; expand 32-byte k was the ChaCha20 clue. Wireshark + Python helped recover Alice’s messages to John.
Encoding gotcha: 9d9a51bfb38f496499ad31c1249d5a70 from MachineGuid is 32 ASCII bytes, or 16 bytes if hex-decoded. ChaCha20 needs 32, so follow what the binary actually does. Nonce: on3_n0nc (8 ASCII bytes). ChaCha20 docs.

My mini-timeline for 2024-05-15. Forgot to save the timezone:

Time	Note
`05:36:31`	User logon session started
`05:39:55`	VSS entered the running state
`05:39:56`	Database dump created
`05:39:58`	Database detached

Administrator logon → ntdsutil.exe → VSS → ESENT creates/detaches the database. Dump staged; still need evidence that it actually left the host.

Likely victim: 192.168.157.144. Attacker IP in my notes: 192.168.157.145.
Lots of DNS queries with very long names → possible tunneling. I wrote down dnscat; need to recheck the payloads and traffic direction to confirm.

Case notes: compromised IAM accounts + a bad S3 policy → encrypted objects and a ransom note.
Search terms I kept: forela-fileshare, 54.242.59.197, dev-policy-specialist, GetObject, PutUserPolicy, CreateAccessKey, CopyObject.
I saved the Splunk search history but not the results. Need the actual events to check who did what, the parameters, and whether it worked. S3 CloudTrail docs.

7045 = service installed, in the System log. I had 7145 written down. Oops. Check the service path for PsExec traces. HTB guide.
Sysmon 17/18 = named pipe created/connected. Line these up with $MFT, $UsnJrnl:$J, Prefetch, and Amcache. Sysmon docs.

Worked back to the ransomware’s entry point and file-encryption code. VirusTotal helped here.
AES-256, with key material in the binary. Need the mode, IV/nonce, and file format for recovery too — didn’t save those.

Chat logs → remote-access logs → exposed AWS credentials → CloudTrail. Get the host timestamps into UTC first.
From the screenshots: 146.70.202.35, bucket arctic-archive-freezer, IAM user arctic-archive-user.
2024-11-13 UTC: PutBucketVersioning 15:31:15 → RestoreObject 15:43:49 (no error shown) → DeleteObject 16:04:09 (denied) → PutObject with GLACIER 16:10:03.
My 19 × 8 = 152 MB shortcut needs a recheck. There are 19 GetObject events for GiftList_Worldwide.csv; use the transfer bytes and check retries/range requests. Also, restore started ≠ restore finished. S3 restore docs.

AXFR responses in Wireshark: dns.qry.type == 252 && dns.flags.response == 1.
RegRipper compname gave me DESKTOP-ELS5JAK.
policy.lnk: check $MFT/USN, then PowerShell logs and Prefetch for execution. Memory helps fill in the process details.
mal.exe: noted as Cobalt Strike. 1768.py for the config; C:\Windows\System32\Tasks for scheduled tasks. Didn’t keep the exact payload type or task name.

Printer traffic this time. Follow the TCP streams and read the PJL requests/replies with HP’s reference open beside you.