Forum Discussion

Palaract's avatar
Palaract
Icon for Bronze I rankBronze I
2 months ago

APT29 Threat Hunting with Elasticsearch: Ep.11 – Demonstrate Your Skills

Hello! I could rather easily get the answers for the other questions, but Q6 has really taken me aback. The question is: A PowerShell script was executed to assist with further enumeration. What co...
defensive cyber
AbdelrhamnaAttia's avatar
AbdelrhamnaAttia
Icon for Bronze II rankBronze II
28 days ago

Hello 
I have completed this question, and I can confirm that the answer is located within the PowerShell. You will find it in plain text, including the IP address, and it is not embedded within the Base64-encoded data, the Powershell includes Base 64.