https://tryhackme.com/room/eviction
“Sunny is a SOC analyst at E-corp, which manufactures rare earth metals for government and non-government clients. She receives a classified intelligence report that informs her that an APT group (APT28) might be trying to attack organizations similar to E-corp. To act on this intelligence, she must use the MITRE ATT&CK Navigator to identify the TTPs used by the APT group, to ensure it has not already intruded into the network, and to stop it if it has.”
THM directs us to link https://static-labs.tryhackme.cloud/sites/eviction/ for this particular APT group. For this room, I have submitted it to THM write ups to assist other users so this blog post will not include snippets of the flags.
For the first question, “What is a technique used by the APT to both perform recon and gain initial access?” think “Reconnaissance”. How might one obtain access if one were to send a phishing email?
For the second question, “Sunny identified that the APT might have moved forward from the recon phase. Which accounts might the APT compromise while developing resources?”, if an adversary has a successful phishing attempt through an email, what type of accounts would that be able to obtain?
For the third question, “E-corp has found that the APT might have gained initial access using social engineering to make the user execute code for the threat actor. Sunny wants to identify if the APT was also successful in execution. What two techniques of user execution should Sunny look out for? (Answer format: and )”, The keyword you are looking at is execution. We skip over the initial access category, as stated in the question, the threat actor has already obtained it. For this, think “User Execution”.
Now that they have had the user execute a file/link, we need to know how those files/links were executed. Staying under the execution column, for the question “If the above technique was successful, which scripting interpreters should Sunny search for to identify successful execution? (Answer format: and )” the keyword is scripting interpreter.
Now we move to the Persistence column. For the question, “While looking at the scripting interpreters identified in Q4, Sunny found some obfuscated scripts that changed the registry. Assuming these changes are for maintaining persistence, which registry keys should Sunny observe to track these changes?” Think of the previous answers and Windows OS and startup.
Continuing our Windows assessment, for question “Sunny identified that the APT executes system binaries to evade defenses. Which system binary’s execution should Sunny scrutinize for proxy execution?” the key words you are looking for are Proxy. This will be under the Defense Evasion column.
For the question, “Sunny identified tcpdump on one of the compromised hosts. Assuming this was placed there by the threat actor, which technique might the APT be using here for discovery?”, the main standout is tcpdump. Think Wireshark/Snort and networks traffic. This will be under Credential Access.
For the question, “It looks like the APT achieved lateral movement by exploiting remote services. Which remote services should Sunny observe to identify APT activity traces?”, our column is giving us: lateral movement and also another keyword, “remote services”. Have Windows in your mind(again).
We are getting close to the end! Now we are under the “Collection” column. For the question, “It looked like the primary goal of the APT was to steal intellectual property from E-corp’s information repositories. Which information repository can be the likely target of the APT?” the word we are looking for is repositories. There are three that could be it, hmmm.
We are now under the C2 or Command and Control column. For “Although the APT had collected the data, it could not connect to the C2 for data exfiltration. To thwart any attempts to do that, what types of proxy might the APT use? (Answer format: and )” and the keyword is Proxy.
And that’s it! I hope this walkthrough helps guide you in navigating this MITRE navigator for this APT.