Tolkien Ring - Windows Event Logs walkthrough

"Investigate the Windows event log mystery in the terminal or offline. Get hints for this challenge by typing hint in the upper panel of the Windows Event Logs terminal."

Difficulty Rating: 2/5

Advancing to the next stage of the challenge after wireshark practice challenge, we talk to Dusty Giftwrap and we access a terminal called “Windows Event Logs”, We are provided with powershell.evtx.log file that contains all the logs captured between 13-12-2022 23:12:29.956579 till 24-12-2022 18:44:53.874228, within which claims to be an attack happened and we will analyse. For ease of analysis, have personally converted the log file into xml 

1. What is the date of when the attack took place ? 24/12/2022

PowerShell strict mode has been turned off as a first activity and more activities are seen on the 24th, which can be identified as your perform a visual grep through the logs or even a head command on the powershell.evtx.log file, given windows logs are in reverse chronological order.

2. What is the original filename where the attacker took the secret?  Recipe

 

Based on the visual grep on the file, the word recipe keeps getting repeated. Grepping for the word Recipe were able to identify as per below screenshot and based on the story context, that recipe.txt is the file where the attack took the secrets from.

Note: Recipe & Recipe.txt are 2 different files.

3. Submit the last full PowerShell line where the attacker used a variable to manipulate the file?

 

$foo = Get-Content .\Recipe| % {$_ -replace ‘honey’, ‘fish oil’} $foo | Add-Content -Path ‘recipe_updated.txt’

Where the attacker is replacing the word honey with fish oil within the recipe_updated file.

4. Show the last command that was run to send the variable’s value to a new file?  

$foo | Add-Content -Path ‘Recipe’

 

Last command that involves the variable can be found by filtering for the variable foo with grep. And windows logs are in reverse chronological order, hence it’s the first command in the output

5. What is the name of the file which the attacker used the previous command on multiple times? Recipe.txt

Based on the above screenshot, we can see that the Add-Content command is being used multiple times on the file Recipe.txt

 

6. Were any files deleted?  Yes

If we grep for the keyword del, we can see two entries in the logs for deletion attempts. 

7. Was the original file deleted ? No

Since we can only see logs for deletion for Recipe.txt and recipe_updated.txt, not for Recipe which is the original file.

 

8. EventID of the log entry where the file was deleted ? 4104

When we search for “del” keyword within the PowerShell logs, we can see the EventID is 4104

9. Was the secret ingredient compromised ?  Yes

Since the attacker was able to read the file and also modify honey with fish oil

 

10. What is the secret ingredient?  Honey

Based on the reference to the command seen in Question 3, we can see the secret ingredient attempted to replace was Honey

 

Extra Mile

To see the full command history behind this whole activity, we can filter for the field “ScriptBlockText” which should give us a nice summary like a command history. “cat PowerShell | grep ScriptBlockText > commands.xml”. Near the end of the output you should the activity for the 24th which lists the recipe related commands.

Troubleshoots

• Software packages - https://softwarerecs.stackexchange.com/questions/17590/how-to-view-evtx-files-on-linux-windows-event-log
• https://github.com/williballenthin/python-evtx
• pip3 install python-evtx
• For Mac Users (python3 /opt/homebrew/bin/evtx_dump.py powershell.evtx > powershell.xml)