ShadowRoast — Threat Hunting an Active Directory Attack with Splunk
Scenario As a cybersecurity analyst at TechSecure Corp, you are alerted to unusual activity in the company’s Active Directory environment. Initial reports suggest unauthorized access and possible privilege escalation. Your task is to analyse the provided logs to uncover the extent of the attack and identify the malicious actions taken by the attacker. Tools used: Splunk, Event Log Explorer. Investigation Q1. What is the malicious file used for initial access? Hunting for process-creation events (Sysmon Event ID 1) on the most likely target (the Office workstation), filtering for cmd/powershell images: ...