CrownJewel-1

Platform: HackTheBox | Type: SOC/DFIR | Difficulty: Very Easy | Author: D3v0o0Nu11 | Date: 2026-02-10

Scenario

Forela's domain controller is under attack. The Domain Administrator account is believed to be compromised, and it is suspected that the threat actor dumped the NTDS.dit database on the DC. We just received an alert of vssadmin being used on the DC, since this is not part of the routine schedule we have good reason to believe that the attacker abused this LOLBIN utility to get the Domain environment's crown jewel. Perform some analysis on provided artifacts for a quick triage and if possible kick the attacker as early as possible.

Key Questions

1. What indicators of compromise exist?
2. What attack chain / MITRE techniques were used?
3. What is the full timeline?

Investigation Timeline

Evidence Analysed

• Tools: per the investigation narrative.
• Artifacts: per the investigation narrative.

Detailed Investigation

hayabusa-3.3.0-win-x64.exe csv-timeline -d C:\HTB-SHERLOCKS\Artifacts -o results-crownjewel-1.csv -p super-verbose

1ST QUESTION --> ANS:

REDACTED

3RD QUESTION --> ANS:

REDACTED

5TH QUESTION --> ANS:

REDACTED

7TH QUESTION --> ANS:REDACTED

Findings

1. Persistence mechanism — As documented in the investigation steps.
2. Initial access — As documented in the investigation steps.
3. Impact — As documented in the investigation steps.

MITRE ATT&CK Mapping

Answers / Flags

• 1ST QUESTION --> ANS: REDACTED
• 2ND QUESTION --> ANS:REDACTED
• 3RD QUESTION --> ANS:REDACTED
• 4TH QUESTION --> ANS:REDACTED
• 5TH QUESTION --> ANS:REDACTED
• 6TH QUESTION --> ANS:REDACTED
• 7TH QUESTION --> ANS:REDACTED

Lessons Learned

1. Correlate artifacts across evidence sources to build a timeline.
2. Map findings to MITRE ATT&CK techniques.
3. Document IoCs for detection engineering.