Collector — FlagYrad

*Forensics — Medium*

o o o

Description:

The antivirus has detected multiple files being dropped on the machine. We need to identify the downloaded files and retrieve the flag.

System Information:

Hostname: castelblack.north.sevenkingdoms.local

User: CASTELBLACK\vagrant

The Tool: Chainsaw

Manually parsing Windows Event Logs (.evtx) is slow. To speed up the triage, I used Chainsaw, a powerful "first-response" tool. It allowed me to scan for known "bad" behaviors using Sigma rules—standardized signatures for threat detection.

I ran the following command to hunt for anomalies:

chainsaw hunt logs/ -s sigma - mapping chainsaw/mappings/sigma-event-logs-all.yml

Microsoft-Windows-Bits-Clint

Chainsaw quickly flagged suspicious PowerShell execution and BITS transfer jobs.

looking at the jobTitle😄 it the format [FlagY]

1. The PowerShell Engine

Before the files were dropped, I found Event ID 4104 (Script Block Logging). This log revealed that Process ID 6808 was running an automated script.

if((Get-ExecutionPolicy ) -ne 'AllSigned') { Set-ExecutionPolicy -Scope Process Bypass }; & 'C:\Users\vagrant\Desktop\AnAn.ps1'

The script checked the security policy, bypassed it, and executed a file called AnAn.ps1. Interestingly, the wrapper used for this execution appeared to be an Ansible automation payload, suggesting the attacker was using automated management tools to stay under the radar.

The “JobTitle” Twist The attacker used a clever technique: Living off the Land. Instead of naming the transfer something obvious, they used the jobTitle field to spell out the flag character by character, simple string searches for “Flag” or “FlagY” would fail. I had to reconstruct it manually.

Lessons Learned

1. Metadata is Evidence: The “Flag” wasn’t inside a file; it was in the name of the transfer job.
2. Watch the BITS logs: Attackers love “Living off the Land” (LotL) techniques because they use legitimate Windows services to bypass detection.
3. Automate Triage: Using tools like Chainsaw allows you to move from “Alert” to “Root Cause” in minutes rather than hours.

The End..