ShadowRoast — Threat Hunting an Active Directory Attack with Splunk

Mon, 16 Mar 2026 00:00:00 +0000

Scenario

As a cybersecurity analyst at TechSecure Corp, you are alerted to unusual activity in the company’s Active Directory environment. Initial reports suggest unauthorized access and possible privilege escalation. Your task is to analyse the provided logs to uncover the extent of the attack and identify the malicious actions taken by the attacker.

Tools used: Splunk, Event Log Explorer.

Investigation

Q1. What is the malicious file used for initial access?

Hunting for process-creation events (Sysmon Event ID 1) on the most likely target (the Office workstation), filtering for cmd/powershell images:

Threat-Hunting on Blue Team Write-ups

ShadowRoast — Threat Hunting an Active Directory Attack with Splunk

Scenario

Investigation

Q1. What is the malicious file used for initial access?