LetsDefend Tour - Endpoint Security

Endpoint Security

EndPoint Security - LetsDefend

New York Server

172.16.20.80

Nicole

172.16.17.201

Andrew

172.16.17.97

Felix

172.16.20.151

LinuxHub

172.16.20.142

Elinux

172.16.20.48

Peggie

172.16.17.92

Walton-MemImage

172.16.17.145

DockerBox

172.16.20.36

VirtuLinux

172.16.17.186

Gloriana

172.16.17.172

PA-Firewall-01

172.16.17.139

Madalyn

172.16.17.154

Eddie

172.16.17.182

SSHDevServer01

172.16.17.121

Shirley

172.16.20.191

Diya

172.16.17.209

Hilary

172.16.17.197

Nathan

172.16.17.152

Livy

172.16.17.94

Fiona

172.16.17.73

Harley

172.16.17.84

Laureen

172.16.17.205

Scot

172.16.17.61

Shannen

172.16.17.62

Matthew

172.16.17.148

Jennifer

172.16.17.203

ScreenConnect Server 23.9.7

172.16.17.65

SOC-TestServer

172.16.20.92

Ignite-Server

172.16.20.144

Reports-FileServer

172.16.17.188

Seed-Server

172.16.20.117

Monica

172.16.17.163

Abbey

172.16.17.192

Sonic-Server

172.16.20.52

FileUploadApp

172.16.17.42

Julia

172.16.17.167

Nancy

172.16.20.192

Lark

172.16.17.196

Apache OFBiz 16.11.01

172.16.17.202

Arnold

172.16.17.164

Margot

172.16.17.180

Claire

172.16.17.181

Webserver2023

172.16.20.24

Arthur

172.16.17.72

Stephen

172.16.17.153

WebServer-Test

172.16.20.44

Jason

172.16.17.68

Floyd

172.16.17.191

Lucia

172.16.17.67

Jesse

172.16.17.104

Catherine

172.16.17.27

Polly

172.16.17.102

Kelsey

172.16.17.147

HR-WebServer

172.16.17.29

Splunk Enterprise

172.16.20.13

Gary

172.16.17.103

Atlanta-Server

172.16.20.121

Confluence Data Center v8.0.3

172.16.17.234

Oliver

172.16.17.168

Los Angeles-Server

172.16.20.160

Denver-Server

172.16.20.140

SOC Analyst Lab

172.16.17.105

Phoenix-Server_Analysis

172.16.20.145

Cisco Catalyst 8000V

172.16.17.101

Isabella

172.16.17.136

Elliot

172.16.17.241

Hadley

172.16.17.142

MS-SharePointServer

172.16.17.233

Chandler

172.16.20.33

Sarah

172.16.17.200

Rachel

172.16.17.127

Averell

172.16.17.124

Abigail

172.16.17.125

Joseph-Server

172.16.20.55

Angela

172.16.17.143

Audrey

172.16.17.59

Carlos

172.16.17.123

JavaWebBox

172.16.17.204

Leonardo

172.16.17.159

Veronica

172.16.17.141

Ryan

172.16.17.194

Charles

172.16.17.195

Manchester

172.16.20.40

Danny

172.16.17.211

Alcaraz

172.16.17.190

Chris

172.16.17.179

Gloria

172.16.17.158

Anthony

172.16.17.157

Robert

172.16.17.189

Jakub

172.16.17.155

Rebecca

172.16.17.156

Noelle

172.16.17.151

Helga

172.16.17.115

Domain Controller Server - 1

172.16.20.9

Henry

172.16.17.149

Mane

172.16.17.210

Ethan

172.16.17.134

Sophia

172.16.17.112

Megan

172.16.17.222

Lucy

172.16.17.111

Lilith

172.16.17.93

Jokic

172.16.17.91

Samuel

172.16.17.173

Richard

172.16.17.89

Scarlett

172.16.17.48

Amanda

172.16.17.169

Donald

172.16.17.52

Nate

172.16.17.40

Billy

172.16.17.193

Lily

172.16.17.32

Lucas

172.16.17.199

George

172.16.17.26

VMServer

172.16.17.146

Can

172.16.17.20

Alexander

172.16.17.246

Serena

172.16.17.85

Mata

172.16.17.53

London-Server

172.16.20.10

Cruyff

172.16.17.144

David

172.16.17.31

Faun

172.16.17.100

Nolan

172.16.17.24

Wilshere

172.16.17.10

Rooney-Server

172.16.20.45

Jordan

172.16.17.11

Rosa

172.16.17.43

Kane

172.16.17.44

Gerrard

172.16.17.64

Ohio-Server

172.31.31.155

Adriana

172.16.17.96

Olivia

172.16.17.66

Public Web Server

172.16.20.19

Malware Analysis Lab

1.1.1.1

Exchange Server 2

172.16.20.8

Sysmon

1.1.1.1

Jack-dev-server

172.16.17.81

JonasPRD

172.16.17.39

EmmaPRD

172.16.20.87

SpringServer

172.31.34.218

WebServer1006

172.16.17.13

WebServer1005

172.16.17.15

WebServer1004

172.16.17.16

EliotPRD

172.16.17.46

WebServer1002

172.16.17.17

WebServer1001

172.16.17.18

Roberto

172.16.17.38

EricProd

172.16.17.22

JohnReed

172.16.17.58

Minecraft Server

192.168.10.69

TempHost

192.168.10.62

PicusSimulationServer

192.168.10.60

NodeServer

192.168.10.56

PublicServer

172.16.20.14

TomcatServer

192.168.10.55

PublicApache

192.168.10.45

LD-Web

192.168.10.35

PreProd

192.168.10.25

LabServer

192.168.10.15

Brian

172.31.34.46

Matt

172.31.34.35

JackRamsey

172.16.17.23

Adelia

172.16.17.90

WebServer

172.16.20.11

Wordpress

172.16.20.7

ValeriaPRD

172.16.17.50

Helena-2

172.16.17.99

LarsPRD

172.16.17.57

Helena

172.16.17.36

SQLServer

172.16.20.6

NicolasPRD

172.16.17.37

PentestMachine

172.16.20.5

WilsonPRD

172.16.17.34

DanielPRD

172.16.17.33

RichardPRD

172.16.17.45

Jack

172.16.17.21

BellaPRD

172.16.17.19

Maxim

172.16.17.83

Alex - HP

172.16.17.55

Desktop-Anderson

172.16.17.54

Aldo

172.16.17.51

EmilyComp

172.16.17.49

AdamPRD

10.15.15.18

JessiePhone

10.15.15.14

Sofia

172.16.17.56

gitServer

172.16.20.4

KatharinePRD

172.16.15.78

ChanProd

172.16.17.150

BillPRD

172.16.17.47

Katie

172.16.17.35

JohnComputer

172.16.17.82

MarksPhone

10.15.15.12

Exchange Server

172.16.20.3

MarkPRD

172.16.17.88

SusieHost

172.16.17.5

MikeComputer

172.16.17.14

Hostname:
Felix
Domain:
LetsDefend
IP Address:
172.16.20.151
Bit Level:
64
OS:
Windows 10
Primary User:
Felix
Client/Server:
Client
Last Login:
May, 13, 2024, 12:04 PM

Endpoint Information
Host Information
Hostname:
Felix
Domain:
LetsDefend
IP Address:
172.16.20.151
Bit Level:
64
OS:
Windows 10
Primary User:
Felix
Client/Server:
Client
Last Login:
May, 13, 2024, 12:04 PM
Action
Containment:
Processes
86
Network Action
23
Terminal History
8
Browser History
12
Results:
10
​
EVENT TIME
PROCESS ID
PROCESS NAME
PARENT PROCESS
COMMAND LINE

May 13 2024 12:57:42

108
services.exe
wininit.exe
C:\Windows\system32\services.exe

May 13 2024 12:57:42

108
services.exe
wininit.exe
C:\Windows\system32\services.exe

May 13 2024 12:57:50

5288
svchost.exe
services.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv

May 13 2024 12:57:51

2740
wuauclt.exe
svchost.exe
"C:\Windows\system32\wuauclt.exe" /RunHandlerComServer

May 13 2024 12:57:52

7588
AM_Engine_Patch_1.1.24010.10.exe
wuauclt.exe
"C:\Windows\SoftwareDistribution\Download\Install\AM_Engine_Patch_1.1.24010.10.exe"

May 13 2024 12:58:01

592
smss.exe
ntoskrnl.exe
\SystemRoot\System32\smss.exe

May 13 2024 12:58:01

956
winlogon.exe
smss.exe
winlogon.exe

May 13 2024 12:58:01

1376
svchost.exe
services.exe
C:\Windows\System32\svchost.exe -k termsvcs -s TermService

May 13 2024 12:58:02

4960
smss.exe
smss.exe
\SystemRoot\System32\smss.exe 0000010c 00000084

May 13 2024 12:58:02

4960
smss.exe
smss.exe
\SystemRoot\System32\smss.exe 0000010c 00000084
1
2
3
4
5
…
9

May 13 2024 13:00:31

108
services.exe
wininit.exe
C:\Windows\system32\services.exe

May 13 2024 13:00:32

108
services.exe
wininit.exe
C:\Windows\system32\services.exe

May 13 2024 13:00:32

6696
explorer.exe
userinit.exe
C:\Windows\Explorer.EXE

May 13 2024 13:00:34

1076
svchost.exe
services.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p

May 13 2024 13:00:35

1076
svchost.exe
services.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p

May 13 2024 13:00:35

6696
explorer.exe
userinit.exe
C:\Windows\Explorer.EXE

May 13 2024 13:00:38

Event Time :

 
May 13 2024 13:00:38

Process ID :

 
6697

Target Process Command Line :

 
"C:\Users\Felix\Downloads\Coffee.exe"

Image Path :

 
"C:\Users\Felix\Downloads\Coffee.exe"

Process User :

 
EC2AMAZ-ILGVOIN\Felix

Parent Name :

 
explorer.exe

Parent Path :

 
C:\Windows\Explorer.EXE

Image Hash :

 
CD903AD2211CF7D166646D75E57FB866000F4A3B870B5EC759929BE2FD81D334

Command Line :

 
C:\Windows\Explorer.EXE

6697
Coffee.exe
explorer.exe
C:\Windows\Explorer.EXE

May 13 2024 13:01:00

6700
cmd.exe
Coffee.exe
C:\Windows\System32\cmd.exe

May 13 2024 13:01:05

6701
systeminfo.exe
cmd.exe
C:\Windows\System32\systeminfo.exe

May 13 2024 13:01:07

6702
hostname.exe
cmd.exe
C:\Windows\System32\hostname.exe

files-ld.s3.us-east-2.amazonaws.com/59cbd215-76ea-434d-93ca-4d6aec3bac98-free-coffee.zip