Jinkies

Platform: HackTheBox | Type: SOC/DFIR | Difficulty: Medium | Author: D3v0o0Nu11 | Date: 2026-02-10

Scenario

You’re a third-party IR consultant and your manager has just forwarded you a case from a small-sized startup named cloud-guru-management ltd. They’re currently building out a product with their team of developers, but the CEO has received word of mouth communications that their Intellectual Property has been stolen and is in use elsewhere. The user in question says she may have accidentally shared her Documents folder and they have stated they think the attack happened on the 6th of October. The user also states she was away from her computer on this day. There is not a great deal more information from the company besides this. An investigation was initiated into the root cause of this potential theft from Cloud-guru; however, the team has failed to discover the cause of the leak. They have gathered some preliminary evidence for you to go via a KAPE triage. It’s up to you to discover the story of how this all came to be. Warning: This sherlock requires an element of OSINT and players will need to interact with 3rd party services on internet.

Key Questions

1. What indicators of compromise exist?
2. What attack chain / MITRE techniques were used?
3. What is the full timeline?

Investigation Timeline

Evidence Analysed

• Tools: per the investigation narrative.
• Artifacts: per the investigation narrative.

Detailed Investigation

1. We have been engaged to investigate an incident that occurred on October 6th involving Cloud-Guru-Management Ltd, a small-sized startup. The CEO has reported that their intellectual property has been stolen and is being utilized elsewhere. As third-party Incident Response (IR) consultants, we have been provided with preliminary evidence to review through a KAPE triage.

1ST QUESTION --> ANS:

REDACTED

3RD QUESTION --> ANS:

REDACTED

5TH QUESTION --> ANS:

REDACTED

7TH QUESTION --> ANS:

REDACTED

9TH QUESTION --> ANS:

REDACTED

Findings

1. Persistence mechanism — An autostart/persistence mechanism was established on the host (see timeline).
2. Initial access — As documented in the investigation steps.
3. Impact — Data was stolen / systems impacted as described in the investigation steps.

MITRE ATT&CK Mapping

Answers / Flags

• 1ST QUESTION --> ANS:REDACTED
• 2ND QUESTION --> ANS:REDACTED
• 3RD QUESTION --> ANS:REDACTED
• 4TH QUESTION --> ANS:REDACTED
• 5TH QUESTION --> ANS:REDACTED
• 6TH QUESTION --> ANS:REDACTED
• 7TH QUESTION --> ANS:REDACTED
• 8TH QUESTION --> ANS:REDACTED
• 9TH QUESTION --> ANS:REDACTED
• 10TH QUESTION --> ANS:REDACTED

Lessons Learned

1. Correlate artifacts across evidence sources to build a timeline.
2. Map findings to MITRE ATT&CK techniques.
3. Document IoCs for detection engineering.