CrownJewel-2

Platform: HackTheBox | Type: SOC/DFIR | Difficulty: Very Easy | Author: D3v0o0Nu11 | Date: 2026-02-10

Scenario

Forela's Domain environment is pure chaos. Just got another alert from the Domain controller of NTDS.dit database being exfiltrated. Just one day prior you responded to an alert on the same domain controller where an attacker dumped NTDS.dit via vssadmin utility. However, you managed to delete the dumped files kick the attacker out of the DC, and restore a clean snapshot. Now they again managed to access DC with a domain admin account with their persistent access in the environment. This time they are abusing ntdsutil to dump the database. Help Forela in these chaotic times!!

Key Questions

1. What indicators of compromise exist?
2. What attack chain / MITRE techniques were used?
3. What is the full timeline?

Investigation Timeline

Evidence Analysed

• Tools: per the investigation narrative.
• Artifacts: dump.

Detailed Investigation

1ST QUESTION --> ANS: REDACTED

2ND QUESTION --> ANS: REDACTED

3RD QUESTION --> ANS: REDACTED

4TH QUESTION --> ANS: REDACTED

5TH QUESTION --> ANS: REDACTED

6TH QUESTION --> ANS: REDACTED

7TH QUESTION --> ANS: REDACTED

Findings

1. Persistence mechanism — As documented in the investigation steps.
2. Initial access — As documented in the investigation steps.
3. Impact — As documented in the investigation steps.

MITRE ATT&CK Mapping

Answers / Flags

• 1ST QUESTION --> ANS: REDACTED
• 2ND QUESTION --> ANS: REDACTED
• 3RD QUESTION --> ANS: REDACTED
• 4TH QUESTION --> ANS: REDACTED
• 5TH QUESTION --> ANS: REDACTED
• 6TH QUESTION --> ANS: REDACTED
• 7TH QUESTION --> ANS: REDACTED

Lessons Learned

1. Use Hayabusa to parse forensic artifacts and flag malicious activity.
2. Use EvtxECmd to parse Windows Event Logs.
3. Use Timeline Explorer to analyze the parsed event logs.
4. Analyze NTDS dumping activity and enumeration of privileged user groups.