Compromised

Platform: HackTheBox | Type: SOC/DFIR | Difficulty: Easy | Author: D3v0o0Nu11 | Date: 2026-02-10

Scenario

Our SOC team detected suspicious activity in Network Traffic, the machine has been compromised and company information that should not have been there has now been stolen – it’s up to you to figure out what has happened and what data has been taken.

Key Questions

1. What indicators of compromise exist?
2. What attack chain / MITRE techniques were used?
3. What is the full timeline?

Investigation Timeline

Evidence Analysed

• Tools: per the investigation narrative.
• Artifacts: per the investigation narrative.

Detailed Investigation

1. ASDA

1ST QUESTION -> ANS:

REDACTED

3RD QUESTION -> ANS:

REDACTED

5TH QUESTION -> ANS:

REDACTED

7TH QUESTION -> ANS:

REDACTED

Findings

1. Persistence mechanism — As documented in the investigation steps.
2. Initial access — As documented in the investigation steps.
3. Impact — As documented in the investigation steps.

MITRE ATT&CK Mapping

Answers / Flags

• 1ST QUESTION -> ANS:REDACTED
• 2ND QUESTION -> ANS:REDACTED
• 3RD QUESTION -> ANS:REDACTED
• 4TH QUESTION -> ANS:REDACTED
• 5TH QUESTION -> ANS:REDACTED
• 6TH QUESTION -> ANS:REDACTED
• 7TH QUESTION -> ANS:REDACTED
• 8TH QUESTION -> ANS:REDACTED

Lessons Learned

1. Correlate artifacts across evidence sources to build a timeline.
2. Map findings to MITRE ATT&CK techniques.
3. Document IoCs for detection engineering.