Rogue - HackTheBox Challenge Writeup

Challenge Information

Description

SecCorp has experienced a security incident involving unauthorized access to a shared folder containing confidential files. Threat intelligence has identified an active dark web forum where disgruntled employees offer internal network access in exchange for cryptocurrency. One SecCorp employee is allegedly selling low-privileged domain-joined user credentials for 10,000 in cryptocurrency.

Objectives:

• Determine how the malicious entity gained access to the shared folder
• Identify what corporate secrets were stolen

Solution Overview

This forensics challenge requires analyzing evidence of unauthorized access to determine the attack vector and data exfiltration method. The investigation involves:

1. Examining system artifacts and access logs
2. Tracing the compromised user’s activities
3. Identifying what data was accessed and stolen
4. Correlating evidence with the insider threat scenario

Key Steps

Step 1: Initial Analysis and Evidence Collection

Begin by examining the provided forensic artifacts for signs of unauthorized access:

# List available evidence files
ls -la /path/to/evidence/

# Check for Windows event logs, file access records,
# and network traffic logs
file ./evidence_file

Step 2: Investigate User Activity

Analyze the compromised user account’s activities:

# Examine Windows Security event logs for logon events
# Look for Event ID 4624 (successful logon)
# and Event ID 4688 (process creation)

# Check for file access patterns and shared folder access
# Review Master File Table (MFT) records if available

Step 3: Trace Data Exfiltration

Identify what files were accessed and potentially stolen:

# Analyze file system artifacts for recent access times
# Check USB device history (USBSTOR registry)
# Review network connections and file transfer logs
# Look for compressed archives or bulk file operations

Step 4: Correlate Evidence with Insider Threat

Connect the technical findings with the dark web forum information:

# Timeline analysis of activities
# Cross-reference timestamps with known insider contact times
# Identify pattern of access to high-value corporate secrets

Tools Used

• Event Viewer - Windows event log analysis
• Registry Editor - USBSTOR and system activity examination
• Autopsy/The Sleuth Kit - File system forensics
• Timeline analysis tools - Activity correlation
• Log parsing utilities - Access pattern identification

Key Learnings

Insider Threat Indicators:

• Unusual access patterns to sensitive shared folders outside normal working hours
• Bulk file operations or compression activity
• Access to files unrelated to job responsibilities
• Correlation between system activity and external communications

Forensic Investigation Methodology:

• Preserve chain of custody for all evidence
• Build comprehensive timelines across multiple artifact sources
• Cross-correlate system logs, file metadata, and registry entries
• Document all findings with supporting evidence

Detection Gaps:

• Monitor for unusual shared folder access patterns
• Implement data loss prevention (DLP) on sensitive shares
• Log and alert on bulk file operations
• Track removable media connections and file transfers

Note: The solve notes indicate the automated solve attempt timed out without generating findings. Manual forensic analysis of the provided evidence artifacts would be required to complete this challenge and extract the flag: HTB{<redacted>}