Finance Workstation Intrusion: Credential Theft to Persistence
| Report ID | INC2021-1228-WLLC | Classification | Simulated / Training Environment |
| Analyst | F. Nanos | Platform / Tool | TryHackMe ยท Splunk (Sysmon) |
| Severity | Critical | Status | Closed (Investigation Complete) |
| Affected Asset | 1x finance workstation (single user context) | ||
1. Executive Summary
A finance department workstation was compromised by malware that stole saved browser credentials, established communication with an external command-and-control server, disabled the endpoint's antivirus protection through targeted signature suppression, and installed a reboot-surviving persistence mechanism disguised as legitimate vendor telemetry. The full sequence was reconstructed from Sysmon endpoint telemetry in Splunk. Because the credential-harvesting tool executed repeatedly while an active C2 channel was present, all credentials stored in the browser on this host must be treated as compromised.
2. Scope & Methodology
The investigation was conducted entirely against Sysmon endpoint telemetry indexed in Splunk. Process-creation, file-creation, file-deletion, and network-connection event types were pivoted against one another to reconstruct a chain in which several stages (antivirus tampering, persistence) were designed to look like routine system activity. The queries that surfaced each stage are shown in Section 4.
3. Attack Chain
3.1 Credential Theft
A renamed copy of a well-known browser-cookie extraction utility was executed from a user temporary directory. It ran repeatedly across a short window, a pattern consistent with scripted or automated harvesting of saved browser cookies and credentials rather than manual use.
3.2 Command and Control
A second component, staged in the same temporary directory, initiated outbound HTTP connections to an external address, establishing the attacker's control channel.
3.3 Defense Evasion via Targeted Signature Suppression
Rather than disabling antivirus wholesale, the attacker used the built-in WMI utility to suppress four specific Windows Defender threat signatures (setting each to "Allow"). Disabling individual signatures is stealthier than a full shutdown and is far less likely to raise a "protection off" alert.
WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference
call Add ThreatIDDefaultAction_Ids=[ID]
ThreatIDDefaultAction_Actions=6 Force=True
# Actions=6 = Allow ; four distinct ThreatIDs suppressed3.4 Persistence via Vendor-Masquerading Scheduled Task
A scheduled task was registered under a name mimicking legitimate GPU-vendor crash-reporting telemetry, pointing to a payload in a user cache directory and triggering every single minute. Legitimate telemetry does not run once per minute; the frequency alone is a reliable detection signal.
Name: NvTmRep_CrashReport3_{...} (fake vendor telemetry)
Command: [user-cache path]\subst.exe
Trigger: every 1 minute3.5 Secondary Payloads & Anti-Forensics
Additional payloads were staged as a fake calculator application and inside a media-themed folder. On the way out, the attacker terminated processes and deleted at least one executable; those deletions were themselves captured in the file-delete telemetry, preserving the filenames despite removal.
4. Detection Queries
Each query below was used during the investigation to surface a specific stage of the chain.
# 1 - Processes run under the compromised account (surfaces all malicious binaries)
index=main EventCode=1 User="*[user]*"
| table _time, Image, CommandLine, ParentImage
# 2 - Scheduled-task creation (exposes the vendor-masquerading persistence)
index=main EventCode=1 Image="*schtasks*"
| table _time, CommandLine
# 3 - File deletions (anti-forensics; recovers deleted filenames)
index=main EventCode=23
| table _time, TargetFilename, Image
# 4 - Outbound network connections (ties the C2 process to its destination)
index=main EventCode=3
| table _time, Image, DestinationIp, DestinationPort5. MITRE ATT&CK Mapping
| Technique ID | Technique | Tactic |
|---|---|---|
| T1555 | Credentials from Password Stores | Credential Access |
| T1562.001 | Impair Defenses: Disable or Modify Tools | Defense Evasion |
| T1053.005 | Scheduled Task | Persistence |
| T1036 | Masquerading | Defense Evasion |
| T1070.004 | Indicator Removal: File Deletion | Defense Evasion |
| T1071.001 | Application Layer Protocol: Web | Command and Control |
| T1047 | Windows Management Instrumentation | Execution |
6. Recommendations
- Enable Windows Defender Tamper Protection to prevent WMI-based signature suppression.
- Deploy application control to block execution of unsigned tools from user Temp and AppData directories.
- Alert on WMI calls to the Defender preference class (ThreatID suppression).
- Alert on scheduled tasks that trigger at very short intervals and on task names impersonating known vendors when the binary path is in a user directory.
- Alert on repeated execution of known credential-access utilities, including by hash even when renamed.
- Reset all browser-stored credentials for the affected user and any accounts where those credentials were reused.
7. Investigator's Notes
The most instructive stage was the targeted Defender tampering. Suppressing four specific threat IDs rather than disabling protection outright is a deliberately quiet technique: the product still reports as running. This reinforced a standing detection lesson, that configuration changes to security tooling deserve their own high-priority alerting, since an attacker who can silently allow-list their own payloads has neutralized the endpoint's defenses without ever tripping an "antivirus disabled" signal.