SOC Incident Investigation — 2026

Cobalt Strike
PowerShell Malware Investigation

Full incident investigation of a Cobalt Strike beacon delivered through an encoded PowerShell script (endpoint.ps1). Initial access via RDP brute force attack on port 3389, followed by internal reconnaissance, port scanning, and exfiltration of a SQL database backup. Complete incident report covering the full NIST IR lifecycle.

MITRE ATT&CK NIST SP 800-61 CrowdStrike
View Analysis Download Report LetsDefend Profile Back to SOC & IR
Overview

Incident at a Glance

0[1] Attack Phases
0[2] C2 Channels
0[3] Detection Rules
0[4] Compromised Hosts
Analysis

Incident Investigation

Step-by-step investigation following NIST SP 800-61 IR methodology, from initial detection through containment and lessons learned.

Initial Access

Determined root cause via RDP brute force attack on port 3389 (open to internet). Analyzed Windows Security logs — Event ID 4625 (failed logins) followed by Event ID 21 (successful RDP session) from IP 3.16.42.241 using Administrator account. Brute-force attack on the RDP service was the entry vector.

Execution & Reconnaissance

Attacker executed new1.bat for system enumeration (applications, processes, network connections). Deployed Advanced Port Scanner for internal network reconnaissance and downloaded netcat (nc111nt.zip). Ran encoded PowerShell script endpoint.ps1 with Base64 + Gzip compressed Cobalt Strike beacon.

Exfiltration

Attacker used findstr to locate sensitive data, then exfiltrated user-db-backup.sql via netcat to IP 3.16.42.144 on port 4444. Confirmed through Sysmon Event ID 3 (network connection) and terminal history analysis on the compromised host.

Timeline

Attack Timeline

Reconstructed from Sysmon Operational logs and Windows Security events.

12:12
Successful RDP login from 3.16.42.241 via brute force
12:30
new1.bat created by Notepad.exe — system enumeration script
12:32
Advanced Port Scanner downloaded and executed via Chrome
12:39
nc111nt.zip (netcat) downloaded via Chrome
12:43
endpoint.ps1 executed — Base64-encoded Cobalt Strike beacon
—
user-db-backup.sql exfiltrated via netcat to 3.16.42.144:4444
Framework

MITRE ATT&CK Mapping

Attack techniques mapped to the MITRE ATT&CK framework for structured threat intelligence.

Initial Access

External Remote Services
Valid Accounts — Local Accounts

Execution

Command and Scripting Interpreter
Software Deployment Tools

Defense Evasion

Indicator Removal on Host

Exfiltration

Exfiltration Over Alternative Protocol

Report

Full Incident Report

Complete writeup covering detection, analysis, containment, eradication, and lessons learned.

Download Report (PDF) Back to SOC & IR

References

  1. Attack Simulation Plan — 6-phase Cobalt Strike attack chain (recon, delivery, exploitation, C2, lateral movement, exfiltration).
  2. C2 Channel Analysis — 4 C2 communication channels tested (HTTP, HTTPS, DNS, SMB) with detection bypass assessment.
  3. Detection Rules — 4 Sigma detection rules written for Cobalt Strike indicators with SOC playbook integration.
  4. Incident Report — Full incident response report documenting detection, containment, eradication, and recovery procedures.

Full deliverables available in the project repository.