Forum Discussion

Hazzie's avatar
Hazzie
Icon for Bronze I rankBronze I
6 days ago

Trick or Treat on Specter Street: Ghost of the SOC

Hi,

I am being very blind here but i am struggling so a hint would be great. I am at Q3 trying to find the username the Glitch Geist executed the script under.

The alert i have found in kibana relates to a powershell issue, but everything i see around that alert suggests the user.name is Administrator which is not accepted as the answer. Also tried this which i have seen S-1-5-18 and what i believe it relates to Local System.

Any nudges in the right direction would be appreciated.

challenges

3 Replies

  • neeemu's avatar
    neeemu
    Icon for Bronze III rankBronze III
    6 days ago

    Hi Hazzie​ , as it's PowerShell script that was executed have you tried searching for *.ps1 to see what users executed that file type?

  • Dragonstar16's avatar
    Dragonstar16
    Icon for Bronze I rankBronze I
    6 days ago

    The question tells that there was no alert for those commands, so i would suggest you to check the logs for that question