Investigating Permalink Software: Cyber Haze OSINT — MITRE (3) Writeup

Decoding the Kill Chain: Cyber Haze — OSINT & MITRE (3) Challenge Walkthrough

Incident Response is never just about staring at logs; it’s about connecting the dots.

Recently, I jumped into a Medium-difficulty challenge on Cyber Haze created by Ahmed Esmail. The scenario puts you right in the shoes of a SOC analyst dealing with an active compromise at a fictional company called Permalink Software.

The setup? A massive spike in network traffic, an alert from the Network Intrusion Detection System (NIDS), and a known malicious IP communicating with an internal endpoint.

Our job? Reconstruct the attack kill chain using the MITRE ATT&CK framework. Here is how I mapped out the entire adversary lifecycle, from initial scanning to the final impact.

The Scenario & Investigation Breakdown

The challenge consists of 11 questions that track the attacker’s footprints. Let’s break down the investigation phase by phase.

Phase 1: Reconnaissance & Initial Access

The attack didn’t start out of nowhere. Looking at the initial triage data, the SOC team noticed heavy scanning activity.

Q1 & Q2: The Loud Scanner

• The Clue: A massive spike in traffic with a highly revealing User-Agent string: Mozilla/5.0 (compatible; Nmap Scripting Engine;).
• The Logic: Nmap’s Scripting Engine (NSE) is a classic giveaway for active scanning. In the MITRE ATT&CK matrix, active scanning falls under Reconnaissance. Specifically, scanning for vulnerabilities is a sub-technique.
• The Answers:
• Sub-technique ID: T1595.002 (Active Scanning: Vulnerability Scanning)
• Main Technique: Active Scanning (T1595)

Q3 & Q4: Breaking In

• The Clue: The adversary found a way in via an SQL Injection (SQLi) vulnerability on an external-facing software application, automated using the famous SQLmap tool.
• The Logic: Exploiting a public-facing application is the textbook definition of gaining Initial Access.
• The Answers:
• MITRE Technique ID: T1190 (Exploit Public-Facing Application)
• SQLmap Software ID: S0218 (MITRE explicitly catalogs SQLmap as software ID S0218)

Phase 2: Execution & Persistence

Once the attacker exploited the SQLi, things escalated quickly. They achieved Remote Code Execution (RCE) and spawned a reverse shell.

Q5: Spawning the Shell

• The Clue: A cmd.exe process was initiated to establish a remote reverse shell.
• The Logic: Running commands via an interactive shell falls under Execution. When it’s done via a command interpreter like cmd.exe, it maps directly to Command and Scripting Interpreter.
• The Answer: Sub-technique ID: T1059.003 (Command and Scripting Interpreter: Windows Command Shell)

Q6: Escalating Privileges

• The Clue: The attacker abused SeImpersonatePrivilege to impersonate an administrator security token.
• The Logic: This is a classic Windows privilege escalation technique (often seen in tools like JuicyPotato or PrintSpoofer). To detect token impersonation, defenders look for specific Windows API logs.
• The Answer: API Call to monitor: DuplicateTokenEx (or ImpersonateLoggedOnUser / CreateProcessWithTokenW)

Q7: Staying Inside (Persistence)

• The Clue: The responder found that an existing Windows service had its image path modified to point to the malicious reverse shell payload.
• The Logic: If the system reboots, the service restarts, giving the attacker their shell back. Modifying existing services is a sub-technique of System Service.
• The Answer: Sub-technique ID: T1543.003 (System Service: Service Architecture)

Phase 3: Defense Evasion & Credential Access

An analyst’s worst nightmare: the attacker starts blinding your security controls.

Q8: Blinding the EDR

• The Clue: SIEM logs showed that the system’s Endpoint Detection and Response (EDR) tool was completely turned off and disabled.
• The Logic: This is straight-up Defense Evasion. Disabling security software maps to Impair Defenses.
• The Answer: Sub-technique ID: T1562.001 (Impair Defenses: Disable or Modify Tools)

Q9: The Mystery Binary

• The Clue: A piece of software named ccf32 was transferred to the host right after the compromise.
• The Logic: Looking at common threat actor TTPs, tools named or disguised similarly to ccf32 (often associated with credential dumping tools like ProcDump variants or specific infostealers) are designed to target LSASS or password vaults. Therefore, the Tactic ID it serves is Credential Access (TA0006).
• The Answer: Tactic ID: TA0006 (Credential Access)

Phase 4: Exfiltration & Final Impact

The final stages of the attack chain: stealing the data and making a statement.

Q10: Stealing data via GitHub

• The Clue: The attacker staged sensitive files and intellectual property, then exfiltrated them by pushing them to a public GitHub repository.
• The Logic: The challenge asks for a Mitigation ID to prevent unauthorized external services. To block data from leaving to unapproved SaaS or cloud hosting platforms, organizations use Network Boundary Exfiltration prevention or API/Blocklists.
• The Answer: Mitigation ID: M1021 (Restrict Web-Based Services / Network Segmentation)

Q11: The Defacement (Impact)

• The Clue: To complete their objectives, the attacker defaced the public corporate website with propaganda messages.
• The Logic: Website defacement directly harms the integrity of the company’s public face. In MITRE, this sits firmly under the Impact tactic.
• The Answer: Full Sub-technique ID: T1491.002 (Defacement: External Defacement)

Overall, a fantastic, well-structured lab by Ahmed Esmail that perfectly mirrors how real-world multi-stage web compromises go down.

Did you solve this challenge differently? Let’s discuss it in the comments!