A cybersecurity simulation covering the Weaponization, Delivery, and Installation kill chain phases—crafting evasive payloads, tracing forensics, and designing layered Endpoint Detection & Response (EDR) controls.
Attack Vectors & Forensics
- Payloads: VBA macro reverse shell (.doc), SEToolkit HTA executing via mshta.exe, and Base64 obfuscated PowerShell.
- Forensics: Used Sysinternals TCPView to trace WINWORD.EXE network connections.
- Used Process Explorer to trace malicious parent-child chains (WINWORD.EXE → cmd.exe).
EDR Architecture (4 Layers)
- GPO: Disabled Office macros and blocked legacy .doc formats.
- AppLocker: Deny rules applied to mshta.exe, wscript.exe, cscript.exe.
- Event Logging: PowerShell Script Block Logging (ID 4104) to reveal decoded Base64 commands.
- Auditing: Process Creation Auditing (ID 4688) alerting on Office spawning shells.