Operation Blackout 2025: Smoke & Mirrors

Platform: HackTheBox | Type: SOC/DFIR | Difficulty: Very Easy | Author: D3v0o0Nu11 | Date: 2026-02-10

Scenario

Byte Doctor Reyes is investigating a stealthy post-breach attack where several expected security logs and Windows Defender alerts appear to be missing. He suspects the attacker employed defense evasion techniques to disable or manipulate security controls, significantly complicating detection efforts. Using the exported event logs, your objective is to uncover how the attacker compromised the system's defenses to remain undetected.

Key Questions

1. What indicators of compromise exist?
2. What attack chain / MITRE techniques were used?
3. What is the full timeline?

Investigation Timeline

Evidence Analysed

• Tools: powershell.
• Artifacts: memory, registry.

Detailed Investigation

1. In this case, we were tasked with investigating a scoped and niche activity. Preliminary observations indicated that several security logs and Windows Defender alerts were missing, suggesting that the threat actor may have employed defense evasion techniques to disable or manipulate security controls.
2. Our objective was to verify whether such activities were actually conducted and, if confirmed, to provide concrete evidence of the threat actor’s actions.
3. Since our objective is very straightforward, we can speed up the investigation using a tool to parse event logfiles to a CSV file containing severity tags highlighting notable events.
4. This time I used Hayabusa which is a tool developed by Yamato Security.

COMMAND:

hayabusa-3.3.0-win-x64.exe csv-timeline -d C:\HTB-SHERLOCKS\ -o results.csv -p super-verbose

1. Using the command above, my objective was to parse all event logs located in the HTB-SHERLOCKS directory, which contained the forensic evidence. I utilized the --csv-timeline flag to instruct Hayabusa to convert the parsed data into a CSV timeline format, and the -o flag to specify the output file name as results.csv.
2. Additionally, I enabled the --super-verbose flag to ensure Hayabusa provided detailed output regarding its scanning findings, which helped in identifying relevant artifacts more efficiently.

I CHOOSE THE 3RD OPTION SCAN RULE AND ENABLE SYSMON SCAN

1. Great! It seems Hayabusa indeed captures all activities related to our interest.

1ST QUESTION -> ANS: REDACTED

1. I reviewed the CSV output file using Timeline Explorer, a forensic analysis tool developed by Eric Zimmerman.

2. Searching for LSA resulting to an interesting event at 2025-04-10 13:28:47.

3. An attempt to disable LSA PPL Protection via reg.exe binary.

4. Reviewing the command line, its clear that the threat actor abusing LSA registry key -> HKLM\SYSTEM\CurrentControlSet\Control\LSA.

2ND QUESTION -> ANS: REDACTED

1. To identify activity related to Windows Defender, usually I used 2 search keywords in Timeline Explorer -> Mp and Set-MpPreference.

2. Between the timestamps 2025-04-10 13:31:32 and 2025-04-10 13:37:05, identified three HIGH-severity events related to Windows Defender tampering.

3. Based from it, its clear that the first command executed is:

 pwsh read-only • copy allowed Copy
Set-MpPreference -DisableIOAVProtection $true -DisableEmailScanning $true -DisableBlockAtFirstSeen $true

NOTES:

 MD read-only • copy allowed Copy
Set-MpPreference -> PowerShell cmdlet for configuring Windows Defender preferences.
-DisableIOAVProtection $true -> Disables real-time file scanning (Input/Output Anti-Virus).
-DisableEmailScanning $true -> Disables email attachment scanning.
-DisableBlockAtFirstSeen $true -> Disables cloud-based protection for unknown files.

3RD QUESTION -> ANS: REDACTED

1. Afterward, the threat actor appeared to attempt invoking Windows API (WinAPI) functions through PowerShell scripts, likely to perform low-level operations while evading traditional detection methods.

2. The script above should be our interest and likely it is used to implements an AMSI (Antimalware Scan interface) bypass technique.

3. We observed that the AMSI function name AmsiScanBuffer() was obfuscated and assigned to a variable named a. Following this, a memory patch was applied to the function’s address using inline assembly instructions, indicating an attempt to bypass AMSI scanning.

4TH QUESTION -> ANS: REDACTED

1. Shortly after, at timestamp 2025-04-10 13:38:35, an attempt to tamper with the Master Boot Record (MBR) was identified through the use of bcdedit.exe, suggesting efforts to modify boot configuration settings—potentially to enable persistence or boot into Safe Mode.
2. Reviewing the details, found the exection performed is to modifies the system boot settings.
3. It configures the system to boot into safe mode with networking.

"C:\WINDOWS\system32\bcdedit.exe" /set safeboot network

5TH QUESTION -> ANS: REDACTED

1. Continue reviewing the threat actor's activity, at timestamp 2025-04-10 13:38:43 found an attempt to disable powershell command history logging.

COMMAND:

Set-PSReadlineOption -HistorySaveStyle SaveNothing

1. Great! We've investigated a quick case and specific request!

Findings

1. Persistence mechanism — An autostart/persistence mechanism was established on the host (see timeline).
2. Initial access — As documented in the investigation steps.
3. Impact — As documented in the investigation steps.

MITRE ATT&CK Mapping

Answers / Flags

• 1ST QUESTION -> ANS: REDACTED
• 2ND QUESTION -> ANS: REDACTED
• 3RD QUESTION -> ANS: REDACTED
• 4TH QUESTION -> ANS: REDACTED
• 5TH QUESTION -> ANS: REDACTED

Lessons Learned

1. Utilized Hayabusa to parse Windows event logs into CSV format, with severity tags highlighting notable events.
2. Employed Timeline Explorer to efficiently examine and filter through the CSV timeline data.
3. Identified indicators of attempts to disable Windows Defender and LSA (Local Security Authority) protection.
4. Detected an AMSI (Antimalware Scan Interface) patch attempt, commonly used to bypass in-memory script scanning.
5. Observed activities aimed at restarting the system in Safe Mode and disabling PowerShell command history logging, indicating efforts to evade detection and maintain stealth.