Forum Discussion
Solved
APT29 Threat Hunting with Elasticsearch: Ep.11 – Demonstrate Your Skills
Hello! I could rather easily get the answers for the other questions, but Q6 has really taken me aback. The question is: A PowerShell script was executed to assist with further enumeration. What co...
Hello
I have completed this question, and I can confirm that the answer is located within the PowerShell. You will find it in plain text, including the IP address, and it is not embedded within the Base64-encoded data, the Powershell includes Base 64.
As far as I remember on these labs I searched for the powershell codes within elasticsearch and then looked at what it was passing alongside powershell.exe
