← Back to Writeups
HTBMediumSOC/DFIR
Bookmark

NeuroSync-D

D3v0o0Nu119/2/20262 min read
#soc/dfir#htb#medium

NeuroSync-D

Platform: HackTheBox | Type: SOC/DFIR | Difficulty: Medium | Author: D3v0o0Nu11 | Date: 2026-02-10

Scenario

\NeuroSync™ is a leading suite of products focusing on developing cutting edge medical BCI devices, designed by the Korosaki Coorporaton. Recently, an APT group targeted them and was able to infiltrate their infrastructure and is now moving laterally to compromise more systems. It appears that they have even managed to hijack a large number of online devices by exploiting an N-day vulnerability. Your task is to find out how they were able to compromise the infrastructure and understand how to secure it.

Key Questions

  1. What indicators of compromise exist?
  2. What attack chain / MITRE techniques were used?
  3. What is the full timeline?

Investigation Timeline

TimeEventEvidence / Source
—SAFDAS

Evidence Analysed

  • Tools: per the investigation narrative.
  • Artifacts: per the investigation narrative.

Detailed Investigation

  1. SAFDAS

1ST QUESTION -> ANS:

REDACTED

3RD QUESTION -> ANS:

REDACTED

5TH QUESTION -> ANS:

REDACTED

7TH QUESTION -> ANS:

REDACTED

9TH QUESTION -> ANS:

REDACTED

11TH QUESTION -> ANS:

REDACTED

13TH QUESTION -> ANS:

REDACTED

15TH QUESTION -> ANS:REDACTED

Findings

  1. Persistence mechanism — As documented in the investigation steps.
  2. Initial access — As documented in the investigation steps.
  3. Impact — As documented in the investigation steps.

MITRE ATT&CK Mapping

TacticTechniqueID
Lateral MovementRemote ServicesT1021

Answers / Flags

  • 1ST QUESTION -> ANS:REDACTED
  • 2ND QUESTION -> ANS:REDACTED
  • 3RD QUESTION -> ANS:REDACTED
  • 4TH QUESTION -> ANS:REDACTED
  • 5TH QUESTION -> ANS:REDACTED
  • 6TH QUESTION -> ANS:REDACTED
  • 7TH QUESTION -> ANS:REDACTED
  • 8TH QUESTION -> ANS:REDACTED
  • 9TH QUESTION -> ANS:REDACTED
  • 10TH QUESTION -> ANS:REDACTED
  • 11TH QUESTION -> ANS:REDACTED
  • 12TH QUESTION -> ANS:REDACTED
  • 13TH QUESTION -> ANS:REDACTED
  • 14TH QUESTION -> ANS:REDACTED
  • 15TH QUESTION -> ANS:REDACTED

Lessons Learned

  1. Correlate artifacts across evidence sources to build a timeline.
  2. Map findings to MITRE ATT&CK techniques.
  3. Document IoCs for detection engineering.