Consolidated Forensic Incident Report

Deep Incident Reconstruction of the SHIELDBASE.COM Active Directory Takeover Campaign

Incident Timeframe: January 2023
Target Domain: SHIELDBASE.COM
Scope: Client E:\ (Mounted) & DC01 (172.16.4.4)
Triage Standard: MITRE ATT&CK Correlation
Initial Pivoting Account
rsydow-a (Domain Admin)
Staged Local Escalation
wacsvc (Service Account)
Ultimate Domain Vector
Default Domain Policy GPO
DFIR Triage Ingress
F-Response & Mnemosyne
EXECUTIVE CORRELATION ANALYSIS & TIMELINE INTEGRATION
This consolidated forensic assessment pieces together the structural timeline of a multi-phase active directory campaign targeting the `SHIELDBASE.COM` domain. The attack was initiated via the compromise of Domain Administrator `rsydow-a` credentials on an external pivot host **`172.16.6.18`**.

Rather than immediately engaging in high-volume activities, the attacker conducted a tactical dual-track intrusion. Track 1 occurred on domain workstation assets (such as the mounted Windows 11 system **`E:\`**), where the actor established RDP sessions as a service account `wacsvc` to merge and merge multi-browser histories via NirSoft's **`bhv.exe`** and stage outbound execution toolkits (**`PsExec`** and **`Process Hacker`**). Track 2 targeted the core Domain Controller (**`DC01`**), where the attacker leveraged their hijacked Domain Admin session to establish interactive command shells and subsequently load the Group Policy Management Editor (**`mmc.exe gpme.msc`**). In this session, the actor executed modifications to the **Default Domain Policy GPO** (`{31B2F340-016D-11D2-945F-00C04FB984F9}`), aiming to gain permanent domain-wide execution authority across all domain-joined computers.

Rapid detection by the security operations center enabled containment and memory triage on January 24, 2023, leveraging F-Response and the `Mnemosyne` driver to acquire physical memory dumps on both hosts, disrupting the attacker's outbound lateral deployment plan.

Visual Lateral Movement Diagram

Pivot Host Origin
172.16.6.18
Compromised: rsydow-a
SMB/WinRM Type 3 →
Domain Workstation (E:\)
Windows 11 Client
Escalated to: wacsvc (staged tools)
Interactive Admin Pivot →
Domain Controller (DC01)
172.16.4.4
GPO Tampered: Default Domain Policy

Unified Forensic Timeline of the Attack Campaign

Correlated across DC01 Volatility structures, Client event logs, and browser download logs.

1
Continuous DFIR Telemetry Operational on DC01
2023-01-02 23:04:03 UTC | Host: DC01
The endpoint agent Velociraptor.exe (PID 5032) was started on DC01, initiating active socket communication back to the DFIR server at 172.16.4.7:8000.
2
Initial Interactive Shell on Domain Controller
2023-01-04 15:14:00 UTC | Host: DC01
The attacker established an initial administrative shell session cmd.exe (PID 5844) on DC01 using hijacked Domain Admin credentials rsydow-a, concurrently opening Server Manager and the DNS Management Console.
3
Active Directory Directory Services Enumeration
2023-01-09 19:01:13 UTC | Host: DC01
The actor launched Active Directory Users and Computers (dsa.msc, PID 1352) on DC01 to extract domain-wide user group structures.
4
Hijacked Domain Admin Session on DC01 Active
2023-01-12 05:02:04 UTC | Host: DC01
The actor loaded an interactive powershell.exe console (PID 6752) on DC01, loading the registry hive for rsydow-a (`C:\Users\rsydow-a\ntuser.dat`) into memory.
5
Initial Pivoting Network Ingress on Workstation
2023-01-16 17:01:03 UTC | Host: Workstation E:\
The attacker launched a sequence of 85 Network Logon (Logon Type 3) sessions on the domain workstation using hijacked credentials of Domain Admin rsydow-a, originating from pivot station 172.16.6.18.
6
Privilege Escalation & Interactive RDP Session
2023-01-17 14:43:03 UTC | Host: Workstation E:\
The attacker remotely logged onto the workstation via RDP (Logon Type 10) in the service account context **`wacsvc`** (Windows Admin Center Service), originating from pivot station 172.16.6.18.
7
Action on Objectives: History Harvesting Executed
2023-01-17 17:59:00 UTC | Host: Workstation E:\
Under the interactive RDP session of wacsvc, the actor downloaded NIRSoft's history gathering utility bhv.exe via Edge, merging histories across all local users between Jan 10-17, dumping output, and deleting bhv.exe to leave config file bhv.cfg.
8
Domain Controller cmd.exe Shell Loaded
2023-01-18 01:30:05 UTC | Host: DC01
Attacker loaded another interactive cmd.exe console (PID 2172) on the Domain Controller to prepare administrative commands.
9
Domain-Wide Persistence: Default GPO Tampered
2023-01-23 02:15:45 UTC | Host: DC01
The threat actor achieved total domain takeover by spawning the Group Policy Management Editor (mmc.exe, PID 6284) on DC01 to modify the **Default Domain Policy GPO** (GUID: {31B2F340-016D-11D2-945F-00C04FB984F9}).
10
Second Workstation Staging Session & Tool Deployment
2023-01-23 20:53:05 UTC | Host: Workstation E:\
A second remote RDP session (Logon Type 10) was launched as wacsvc from host 172.16.4.9. In this session, the attacker downloaded and staged execution utilities **`px.exe` (PsExec)** and **`ph.exe` (Process Hacker)** via Chrome from secure.csharefile.com.
11
Incident Detection & Rapid DFIR Ingress
2023-01-24 18:04:57 UTC | Host: Workstation & DC01
DFIR Analyst cbarton-a established remote ingress from workstation 172.16.5.25 using Kerberos network logons, deploying the F-Response Subject Service (PID 6724 on DC01) and loading the kernel driver Mnemosyne.sys to acquire physical memory dumps on both hosts, isolating active threats.
CONSOLIDATED REMEDIATION PLAYBOOK & ENVIRONMENT CONTAINMENT
  • Active Directory GPO Restructure & Audit: Since the attacker modified the Default Domain Policy GPO (`{31B2F340-016D-11D2-945F-00C04FB984F9}`), assume all domain-joined assets are potentially backdoored. Immediately parse policy Preference XML files or logon scripts in the Active Directory SYSVOL share (`C:\Windows\SYSVOL\domain\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}`). Revert GPO modifications to a known clean backup, or run dcgpofix if no backup exists.
  • Global Credential & Ticket Revocation: Perform an immediate domain-wide force reset for the Domain Admin account rsydow-a, rotate the service account password for wacsvc, and force reset the Kerberos Krbtgt password twice to invalidate all active domain tickets (TGTs).
  • Rigorous Endpoint Isolation: Network-isolate pivot stations 172.16.6.18 and 172.16.4.9. Terminate all WinRM/RDP services originating from these IPs.
  • Active Telemetry Telemetry Sweep: Leverage the active Velociraptor agent to run a domain-wide search for the NirSoft configuration files (`bhv.cfg`), staged PsExec binaries (`px.exe`), and Process Hacker (`ph.exe`). Verify that neither binary was executed (Prefetch analysis shows no local execution, indicating the threat was disrupted prior to lateral outbound pivot).

Phase 1: Browser Forensic Findings & Staging Tool downloads

Analysis of the browser databases (Chrome/Edge) on the mounted workstation image (`E:\`) successfully parsed historical records, exposing the download of dual-use and history-harvesting binaries by the compromised service account **`wacsvc`**.

bhv.cfg (NirSoft BrowsingHistoryView)

File Path: E:\Users\wacsvc\Downloads\bhv.cfg
Download Time: 2023-01-17 17:59:00 UTC (via Edge)
Binary Status: Deleted by attacker (anti-forensics)
Extracted Configuration Parameters:
  • VisitTimeFrom=10-01-2023 18:00:27
  • VisitTimeTo=17-01-2023 18:00:27
  • HistorySource=1 (Extracts history from all local user profiles)
  • LoadChrome=1, LoadEdge=1, LoadFirefox=1

px.exe (Sysinternals PsExec)

File Path: E:\Users\wacsvc\Downloads\px.exe
Download Time: 2023-01-23 20:54:02 UTC (via Chrome)
Source URL: secure.csharefile.com/download/px.exe
MD5 Hash: 18126be163eb7df2194bb902c359ba8e
Imported Capabilities / APIs:
  • MPR.dll (Network share mounting)
  • NETAPI32.dll (Network server enumeration)
  • ADVAPI32.dll (Service creation and token impersonation)

ph.exe (Process Hacker)

File Path: E:\Users\wacsvc\Downloads\ph.exe
Download Time: 2023-01-23 20:54:26 UTC (via Chrome)
Source URL: secure.csharefile.com/download/ph.exe
MD5 Hash: b365af317ae730a67c936f21432b9c71
Imported Capabilities / APIs:
  • WINSTA.dll (Terminal Services shadowing and messaging)
  • ntdll.dll (Direct system calls for process termination)
  • ADVAPI32.dll (Access token token adjustments & security service control)
PREFETCH EXECUTION CHECK
Crucially, analysis of the Windows Prefetch files (`C:\Windows\Prefetch`) on the workstation confirmed that while NIRSoft's history harvester was executed on **January 17, 2023 at 18:00:27 UTC**, neither **`px.exe` (PsExec)** nor **`ph.exe` (Process Hacker)** was ever executed locally on this workstation. The attacker staged these utilities on January 23 for an outbound lateral deployment sweep, but the DFIR team triaged the workstation on January 24, successfully disrupting the pivot before the tools could be triggered.

Phase 2: Host Lateral Pivoting & Logon Session Analysis (E:\)

Correlation of the security event logs parsed from the workstation mounted image (`E:\`) successfully mapped the attacker's ingress authentication profile.

User Account Logon Mechanism Source IP Address Session Count First Logon Time Last Logon Time Forensic Significance
rsydow-a 3 - Network (WinRM/SMB) 172.16.6.18 85 Sessions 2023-01-16 17:01:03 2023-01-17 19:01:34 Reconnaissance Pivot: Attacker used hijacked high-privilege credentials of Domain Admin `rsydow-a` to map the workstation's administrative surface.
wacsvc 10 - RDP (Remote) 172.16.6.18 12 Sessions 2023-01-17 14:43:03 2023-01-19 14:28:14 Privilege Escalation Session: The actor logged on remotely via RDP in the context of the service account `wacsvc` to execute browser history harvesting.
wacsvc 10 - RDP (Remote) 172.16.4.9 2 Sessions 2023-01-23 20:53:05 2023-01-23 20:53:05 Second Ingress Wave: Attacker logged onto the workstation from a different pivot station to stage the lateral movement execution toolkit.
cbarton-a 3 - Network (SMB/WinRM) 172.16.5.25 26 Sessions 2023-01-24 18:04:57 2023-01-24 18:04:59 Incident Response Ingress: Analyst connected to lock down the system, deploying F-Response subject service and capturung memory.

Service Installation Anomalies

The System Event Log parsed on the workstation captured several critical service installations during the compromise timeframe:

* F-Response Subject Service: Installed on 2023-01-24 at 18:04:59 UTC with binary path "C:/windows/subject_srv.exe" -s "172.16.5.25:5682" -l 3262 -v "F-Response Subject Service" -k "155522845" under LocalSystem. This marks the DFIR team's deployment of remote capture tools.
* mnemosyne: Installed on 2023-01-24 at 18:04:59 UTC using driver binary C:/windows/Mnemosyne.sys to acquire physical volatile kernel memory.

Phase 3: Active Directory Domain Controller Compromise (`dc01-memory.img`)

Deep forensic volatile memory analysis of the core Active Directory Domain Controller **`DC01`** reconstructed using Volatility 3 plugins on physical memory capture `dc01-memory.img`.

Active Process Tree & Command-Line Arguments on DC01
PID PPID Process Name Create Time (UTC) Command Line / Arguments Forensic Context
5640 5624 explorer.exe 2023-01-04 14:41:31 C:\Windows\Explorer.EXE Loaded interactive session running under compromised Domain Admin **`rsydow-a`** (verified by active loaded hive C:\Users\rsydow-a\ntuser.dat).
6752 5640 powershell.exe 2023-01-12 05:02:04 "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Interactive shell utilized for domain profile scanning. Loaded clean native assemblies.
2172 5640 cmd.exe 2023-01-18 01:30:05 "C:\Windows\system32\cmd.exe" Interactive terminal console opened under hijacked Domain Admin context.
6284 6984 mmc.exe 2023-01-23 02:15:45 "C:\WINDOWS\SYSTEM32\MMC.EXE" "C:\WINDOWS\SYSTEM32\GPME.MSC" /S /GPOBJECT:"LDAP://DC01.SHIELDBASE.COM/CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=POLICIES,CN=SYSTEM,DC=SHIELDBASE,DC=COM" GPO POLICY TAMPERING Attacker achievements of Domain Dominance by editing the **Default Domain Policy GPO** to push persistence configurations domain-wide.
6724 652 subject_srv.exe 2023-01-24 18:44:22 "C:\windows\subject_srv.exe" -s "172.16.5.25:5682" -l 3262 -v "F-Response Subject Service" -k "155522845" DFIR TELEMETRY Remote triage service deployed by Incident Response team to capture memory and isolate DC01.
Network Sockets on Domain Controller
Protocol Local Address Foreign Address State PID (Process)
TCPv4 172.16.4.4:389 172.16.4.6:57138 ESTABLISHED 660 (lsass.exe)
TCPv4 172.16.4.4:445 172.16.7.17:65163 ESTABLISHED 4 (System)
TCPv4 172.16.4.4:50714 172.16.4.5:445 ESTABLISHED 4 (System)
TCPv4 172.16.4.4:53379 172.16.4.7:8000 ESTABLISHED 5032 (Velociraptor.exe)
TCPv4 172.16.4.4:445 172.16.6.12:64657 ESTABLISHED 4 (System)

DC01 Memory Security Checks

Process Injection (malfind):
Memory segment signatures scanning was clean. PAGE_EXECUTE_READWRITE permissions were confined strictly to benign JIT compilation blocks within Microsoft.ActiveDirectory.WebServices.exe (PID 2980). No malicious payloads or process injection were detected.
Registry Telemetry:
Hivelist checks show only one interactive user profile hive loaded in kernel memory: \??\C:\Users\rsydow-a\ntuser.dat (Offset `0x800d31dc3000`). This confirms that compromised Admin rsydow-a was the account used to execute the domain GPO Editor.