SOC Alert: Conti Ransomware Investigation

SOC Alert Reporting: Conti Ransomware Investigation Using Splunk

Simulating Real-World SOC Triage, Threat Hunting, and Incident Reporting Through a Conti Ransomware Investigation

What This Investigation Covers

Ransomware deployment analysis
Web shell investigation
Process injection detection
Credential dumping activity
Persistence mechanisms
Splunk SIEM investigation
Sysmon telemetry analysis
Incident timeline reconstruction
SOC alert triage and escalation

Introduction

This article is part of a new series focused on solving cybersecurity scenarios using a workflow that closely resembles real-world SOC operations.

Instead of answering each challenge question directly, I approach every task as if it were a genuine SOC alert appearing in a SIEM platform during an active investigation. The goal is not only to identify the answer, but also to demonstrate the analytical thinking, triage methodology, investigation workflow, and reporting standards expected from a Security Analyst.

In real SOC environments, alerts usually include contextual information such as timestamps, affected assets, severity classification, telemetry sources, and detection logic. Since challenge rooms do not always provide this level of operational context, I enrich each alert with additional information gathered throughout the investigation using Splunk, Sysmon telemetry, Windows Security Logs, and threat intelligence validation.

For each alert, I will:

Build a structured SOC alert report
Investigate surrounding activity and attacker behavior
Correlate telemetry from multiple log sources
Document findings using analyst-style reporting
Map attacker actions to MITRE ATT&CK techniques
Include escalation decisions and remediation recommendations
Construct a complete incident timeline

This approach allows me to practice not only technical investigation skills, but also the communication, escalation, documentation, and contextual analysis capabilities expected in real Security Operations Center and Incident Response environments.

The investigation below focuses on a Conti ransomware intrusion affecting a Microsoft Exchange server. Scenario, data and initial questions are based on TryHackMe’s Conti Room.

Tools and Telemetry Used

Splunk SIEM
Sysmon Operational Logs
Windows Security Event Logs
VirusTotal
MITRE ATT&CK Framework
IIS / Exchange Telemetry
Threat Intelligence Research

Scenario

I started this investigation using a Splunk instance containing the ingested logs related to the incident.

Several employees reported that they could not log into Outlook. Shortly afterward, the Exchange administrator also reported being unable to access the Exchange Admin Center (EAC). During initial triage, ransomware readme files were discovered on the Exchange server.

Alert 1 — Suspected Ransomware Binary Dropped on Exchange Server

Severity: Critical

SOC Report

Summary

Endpoint telemetry detected the creation and execution of a suspicious executable on the Exchange server, followed by widespread deployment of ransomware note files across multiple directories.

Timestamps

Suspicious executable creation: 2021-09-08 19:59:08.045 UTC
Suspicious executable execution: 2021-09-08 20:05:32.431 UTC
First ransom note creation detected: 2021-09-08 20:05:45.887 UTC

Detection Source

Microsoft-Windows-Sysmon/Operational

Affected Asset

WIN-AOQKG2AS2Q7.bellybear.local

User

NOT_TRANSLATED

Description

A suspicious executable impersonating the legitimate Windows cmd.exe binary was identified in an abnormal location within the Administrator user’s Documents directory.

Shortly after execution, the binary initiated mass creation of readme.txt files across multiple system folders, behavior highly consistent with ransomware deployment activity.

Technical Analysis

Confirmed creation of a suspicious executable named cmd.exe located at:
```
C:\Users/Administrator/Documents/cmd.exe
```
The executable was created by unsecapp.exe, a legitimate Windows component commonly abused in Living-off-the-Land Binary (LOLBin) techniques involving WMI operations.
Confirmed execution of the malicious cmd.exe process at 2021-09-08 20:05:32.431 UTC.
Observed rapid creation of 18 readme.txt ransom notes distributed across multiple directories immediately after execution.
Retrieved the file hash from Sysmon telemetry and validated it using VirusTotal, confirming the file as malicious ransomware.
Activity observed is consistent with ransomware staging and deployment behavior following privilege escalation and persistence establishment.

MITRE ATT&CK Mapping

T1047 — Windows Management Instrumentation
T1036 — Masquerading
T1486 — Data Encrypted for Impact

Findings

True Positive — Malicious ransomware activity confirmed

Actions Taken

Investigated process lineage associated with the suspicious executable
Identified related file creation activity
Collected file hash for threat intelligence validation
Correlated execution timeline with ransomware note deployment
Escalated the incident for containment and response

Escalation

Escalated to L2 SOC / Incident Response Team

Recommendations

Immediately isolate the affected Exchange server from the network
Acquire forensic images and volatile memory from the host
Block identified hashes and indicators across EDR and SIEM platforms
Reset privileged credentials potentially exposed during compromise
Review Exchange server exposure and patch management
Conduct an enterprise-wide IoC sweep for related activity

Analyst Investigation

Query used #1

index=* EventCode=11 Readme
| table UtcTime, Image, TargetFilename
| sort UtcTime

This query provided visibility into Sysmon File Create events (EventCode=11) related to files containing the term Readme.

The query displayed:

UtcTime → event chronology
Image → process responsible for file creation
TargetFilename → full path of created files

The results immediately revealed suspicious activity involving a file impersonating cmd.exe, but located within the Administrator Documents folder rather than the legitimate Windows system directory.

Additionally, the executable was responsible for creating multiple readme.txt files across several system locations, behavior strongly associated with ransomware note deployment.

Full details of the first readme.txt creation event:

Query used #2

index=* EventCode=1 Image="C:\\Users\\Administrator\\Documents\\cmd.exe" 
| table Image, Hashes

This query searched for Sysmon Process Creation events (EventCode=1) related to the suspicious executable, returning the image path and the file hashes.

Full details of the execution event:

VirusTotal validation results:

Query used #3

index=* EventCode=11 cmd.exe
| table UtcTime, Image, TargetFilename
| sort UtcTime

To identify the origin of the malicious executable, I searched for Sysmon file creation events involving cmd.exe.

The query returned the process responsible for writing the file to disk.

The results showed unsecapp.exe creating the suspicious executable shortly before ransomware deployment activity began.

This behavior strongly suggests abuse of a trusted Windows binary to stage malware execution while attempting to evade detection through LOLBin techniques.

Full details of the file creation event:

***

Alert 2 — Unauthorized Local User Creation Detected

Severity: Critical

Original Question

What was the command the attacker used to add a new user to the compromised system?

SOC Report

Summary

Endpoint telemetry detected command execution associated with unauthorized local account creation and privilege escalation activity.

Timestamp

2021-09-08 20:04:10.692 UTC

Detection Source

Microsoft-Windows-Sysmon/Operational

Affected Asset

WIN-AOQKG2AS2Q7.bellybear.local

User

NOT_TRANSLATED

Description

A net user command was executed to create a suspicious local account shortly before ransomware execution.

Subsequent commands added the account to privileged groups, indicating the attacker was establishing persistence and administrative access.

Technical Analysis

Identified execution of the following command:
```
net user /add securityninja hardToHack123$
```

Additional commands added the newly created user to privileged groups:

net localgroup administrators securityninja /add
net localgroup "Remote Desktop Users" securityninja /add

Confirmed successful account creation through Windows Security Event ID 4720
Confirmed successful group membership modification through Security Event IDs associated with privileged group additions
The account naming convention and timing strongly suggest attacker-created persistence

MITRE ATT&CK Mapping

T1136.001 — Create Account: Local Account
T1098.007 — Additional Local or Domain Groups

Findings

True Positive — Unauthorized persistence and privilege escalation activity confirmed

Actions Taken

Correlated Sysmon and Windows Security events
Verified successful account creation
Verified privileged group assignment
Documented persistence mechanisms established by the attacker
Escalated to Incident Response

Escalation

Escalated to L2 SOC / Incident Response Team

Recommendations

Disable and remove unauthorized accounts immediately
Audit all privileged group memberships
Reset credentials for affected administrative accounts
Review remote access policies and RDP exposure
Investigate the host for additional persistence mechanisms

Analyst Investigation

Query used #1

index=* EventCode=1 CommandLine=* NOT splunk*
| table UtcTime, CommandLine
| sort UtcTime

This query returned process creation events containing command-line activity.

The results were displayed chronologically to identify suspicious administrative commands executed during the intrusion timeline.

Among the returned entries, commands containing the keywords user and add immediately stood out.

The command revealed that a new local account named securityninja had been created through the Windows net user utility.

Because attackers frequently create local administrator accounts to maintain persistence after initial access, this activity represented a critical escalation point in the attack chain.

To verify whether the command successfully created the account, I pivoted to Windows Security Logs and searched for Event ID 4720 (User Account Created).

Query used #2

index=* EventCode=4720
| table UtcTime, Account_Name, Account_expires, Keywords, ComputerName

The event confirmed successful creation of the securityninja account.

Full event details:

To validate successful privilege escalation activity, I then investigated security group modification events 4728.

Query used #3

index=* EventCode=4728
| table Time, Account_Name, Group_Domain, Keywords, ComputerName, TaskCategory

Because the timestamp field was not automatically parsed correctly in some logs, I extracted and normalized the relevant fields within Splunk to improve timeline visibility and event correlation.

The results confirmed the user was successfully added to privileged groups on the affected Exchange server.

Complete event details:

Alert 3 — Suspicious Process Migration Observed

Severity: Critical

Original Question

The attacker migrated the process for better persistence. What is the migrated process image (executable), and what is the original process image (executable) when the attacker got on the system?

SOC Report

Summary

Sysmon telemetry identified process injection activity consistent with attacker process migration techniques used for stealth and defense evasion.

Timestamp

2021-09-08 19:54:12.665 UTC

Detection Source

Microsoft-Windows-Sysmon/Operational

Affected Asset

WIN-AOQKG2AS2Q7.bellybear.local

Description

The attacker migrated execution from PowerShell into unsecapp.exe, a legitimate Windows process associated with WMI operations.

This technique is commonly used to blend malicious activity into trusted system processes and evade security monitoring.

Technical Analysis

Identified Sysmon CreateRemoteThread event (EventCode=8) showing process injection activity

Source process:

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Target process:
```
C:\Windows\System32\wbem\unsecapp.exe
```
Subsequent investigation revealed unsecapp.exe later participated in malware staging and credential theft activity.

MITRE ATT&CK Mapping

T1055 — Process Injection

Findings

True Positive — Malicious process injection activity confirmed

Actions Taken

Correlated injection activity with later malicious process execution
Identified LOLBin abuse involving WMI-related processes
Expanded the investigation into subsequent child process activity
Escalated the incident to Incident Response

Escalation

Escalated to L2 SOC / Incident Response Team

Recommendations

Investigate PowerShell logging and script block activity
Enable advanced PowerShell logging if not already configured
Monitor CreateRemoteThread events across critical infrastructure
Implement behavioral EDR detections for process injection patterns

Analyst Investigation

Query used

index=* EventCode=8
| table UtcTime, SourceImage, TargetImage
| sort UtcTime

To identify process migration activity, I searched for Sysmon CreateRemoteThread events.

These events are commonly associated with process injection and code migration techniques.

The results revealed PowerShell injecting into unsecapp.exe, a trusted Windows process commonly associated with WMI functionality.

This strongly indicated an attempt to evade detection through LOLBin abuse and trusted process execution.

Complete event details:

Alert 4 — Credential Dumping Activity Detected

Severity: Critical

Original Question

The attacker also retrieved the system hashes. What is the process image used for getting the system hashes?

SOC Report

Summary

Telemetry identified attacker interaction with lsass.exe, behavior commonly associated with credential dumping and credential access activity.

Timestamp

2021-09-08 19:55:30.770 UTC

Detection Source

Microsoft-Windows-Sysmon/Operational

Affected Asset

WIN-AOQKG2AS2Q7.bellybear.local

Description

Process injection activity targeting lsass.exe was identified shortly after compromise escalation activity involving unsecapp.exe.

Because lsass.exe stores authentication material in memory, it is a common target for credential dumping operations.

Technical Analysis

Confirmed process injection from:

C:\Windows\System32\wbem\unsecapp.exe

to:

C:\Windows\System32\lsass.exe

Activity occurred at 2021-09-08 19:55:30.770 UTC
Behavior strongly aligns with credential theft operations used to obtain password hashes and authentication material
The attack chain progression suggests the threat actor was attempting to harvest credentials before ransomware deployment

MITRE ATT&CK Mapping

T1055 — Process Injection
T1003.001 — OS Credential Dumping: LSASS Memory

Findings

True Positive — Credential dumping activity confirmed

Actions Taken

Investigated LSASS-related telemetry
Correlated process injection activity with prior compromise stages
Documented credential access behavior
Escalated the incident for containment and credential reset procedures

Escalation

Escalated to L2 SOC / Incident Response Team

Recommendations

Reset all potentially exposed credentials
Investigate potential lateral movement activity
Enable LSASS protection where operationally feasible
Monitor for abnormal access to sensitive system processes
Review privileged authentication activity following the compromise

Analyst Investigation

Query used

index=* "C:\\Windows\\System32\\lsass.exe"

I searched for events involving lsass.exe, a common target for credential dumping activity on Windows systems.

The search returned two relevant events.

One of them revealed process injection activity from unsecapp.exe into lsass.exe.

Because attackers frequently target LSASS memory to extract NTLM hashes, Kerberos tickets, and plaintext credentials, this event represented a strong indicator of credential access activity.

Complete event details:

This same activity was also visible during the earlier investigation into Sysmon EventCode=8 process injection events.

Alert 5 — Web Shell Deployed to Exchange Infrastructure

Severity: Critical

Original Questions

What is the web shell the exploit deployed to the system?
What is the command line that executed this web shell?

SOC Report

Summary

A suspicious ASPX file consistent with web shell deployment activity was identified within the Microsoft Exchange web application directory.

Timestamp

2021-09-08 19:52:09.748 UTC

Detection Source

Microsoft-Windows-Sysmon/Operational

Affected Asset

WIN-AOQKG2AS2Q7.bellybear.local

Description

A suspicious .aspx file located inside the Exchange HttpProxy directory was modified using attrib.exe, a legitimate Windows utility frequently abused by attackers.

The file path and extension strongly suggest deployment of a web shell used for remote command execution and persistence.

Technical Analysis

Identified suspicious command execution involving:

attrib.exe -r \\win-aoqkg2as2q7.bellybear.local\C$\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\i3gfPctK1c2x.aspx

Web shell identified:
```
i3gfPctK1c2x.aspx
```
Observed HTTP POST requests involving the web shell between: 2021-09-08 19:51:36 UTC and 2021-09-08 19:51:50 UTC
Detected successful HTTP 200 responses and redirect 302 responses associated with the file
Investigated related w3wp.exe activity and identified behavior associated with Metasploit exploitation targeting IIS worker processes
Earliest related activity observed:2021-09-08 19:30:23.198 UTC

MITRE ATT&CK Mapping

T1505.003 — Web Shell
T1190 — Exploit Public-Facing Application

Findings

True Positive — Exchange web shell deployment confirmed

Actions Taken

Investigated web-accessible file modifications
Correlated HTTP activity with IIS worker process telemetry
Identified potential Metasploit-related exploitation activity
Escalated the incident for containment and forensic review

Escalation

Escalated to L2 SOC / Incident Response Team

Recommendations

Immediately isolate the Exchange server
Remove malicious web shell artifacts
Patch vulnerable Exchange infrastructure
Review IIS logs for additional attacker activity
Rotate all administrative and service account credentials
Conduct a full compromise assessment for persistence mechanisms

Analyst Investigation

Query used

index=* EventCode=1 CommandLine=* NOT splunk*
| table UtcTime, CommandLine, Image
| sort UtcTime

I searched for suspicious command-line activity occurring during the intrusion timeframe.

One result immediately stood out: usage of the LOLBin attrib.exe to remove the read-only attribute from an ASPX file located within the Exchange HttpProxy directory.

The file path strongly suggested deployment or modification of a web shell.

Complete event details:

Investigating the web shell activity

Related activity involving i3gfPctK1c2x.aspx:

HTTP 200 responses:

HTTP 302 responses:

Unhandled exception event also involving w3wp.exe:

Search results related to w3wp.exe activity:

Reviewing the process activity revealed multiple events commonly associated with exploitation frameworks such as Metasploit interacting with Exchange infrastructure.

Because w3wp.exe is responsible for handling IIS web application requests, it is frequently targeted during exploitation of public-facing Microsoft Exchange vulnerabilities and web shell deployment.

Details of the first observed Metasploit-related event:

Original Question

What three CVEs did this exploit leverage? Provide the answer in ascending order.

Analyst Investigation

This question required additional threat intelligence research.

Researching known Conti intrusion chains and associated exploitation activity revealed the following CVEs:

CVE-2018-13374
CVE-2018-13379
CVE-2020-0796

Incident Timeline

2021–09–08 19:30:23.198 UTC — First observed Metasploit-related connection involving w3wp.exe2021-09-08 19:51:36 - 19:51:50 UTC — Web shell communication activity involving i3gfPctK1c2x.aspx2021-09-08 19:52:09.748 UTC — Web shell modification activity detected
2021-09-08 19:54:12.665 UTC — PowerShell injected into unsecapp.exe2021-09-08 19:55:30.770 UTC — unsecapp.exe injected into lsass.exe2021-09-08 19:59:08.045 UTC — Malicious cmd.exe written to Administrator Documents folder
2021-09-08 20:04:10.692 UTC — Unauthorized securityninja account created
2021-09-08 20:04:10 UTC — securityninja added to privileged groups
2021-09-08 20:05:32.431 UTC — Malicious cmd.exe executed
2021-09-08 20:05:45.887 UTC — First ransomware note readme.txt created

Key Detection Opportunities

During this investigation, several opportunities for earlier detection became apparent:

Detection of suspicious ASPX file creation within Exchange web directories
Monitoring Sysmon Event ID 8 (CreateRemoteThread) for process injection behavior
Alerting on executable files launched from user profile directories
Detecting LOLBin abuse involving unsecapp.exe and attrib.exe
Monitoring unauthorized privileged group modifications
Detecting suspicious local account creation
Identifying mass file creation behavior associated with ransomware deployment

Skills Demonstrated

This investigation demonstrates practical application of:

SIEM investigation using Splunk
Sysmon log analysis
Windows Security Event Log analysis
Threat hunting methodology
IOC identification and validation
MITRE ATT&CK mapping
Process injection analysis
Web shell investigation
Ransomware behavioral analysis
Incident timeline reconstruction
SOC alert triage and escalation
Incident documentation and reporting

Conclusion

This investigation demonstrated how multiple stages of a ransomware intrusion can be reconstructed through effective SIEM analysis and telemetry correlation.

By approaching each challenge question as a real SOC alert rather than simply extracting answers, the investigation became significantly closer to workflows used in operational Security Operations Centers.

Correlating process injection activity, credential dumping, persistence establishment, web shell deployment, and ransomware execution allowed the full attack chain to be documented from initial compromise through impact.

Investigating a Phishing Attack with Volatility and Olevba | TryHackMe Boogeyman 2

CyberDefenders CCDL1: Practical SOC Analyst Training Beyond the Fundamentals