Project Overview
This simulated SOC investigation documents suspicious outbound network traffic, host-based triage, account and process correlation, plaintext PII exfiltration, containment actions, and post-remediation validation.
Objective
The objective was to determine the source of suspicious outbound traffic, identify the associated process, validate unauthorized account activity, determine whether sensitive data was exposed, and confirm successful containment.
Investigation Timeline
Indicators of Compromise
Analysis
Packet analysis identified suspicious outbound TCP traffic from internal host
10.10.1.5 to external IP 75.30.5.55 over port 1337/TCP.
Endpoint triage correlated the connection to a suspicious process named
WinT0Ols.exe running from C:\Users\admin\downloads\dist.
Additional host review identified a rogue local account named Adm1nistrator.
Event Viewer validation using Windows Event ID 4720 confirmed account
creation activity. TCP stream analysis showed plaintext transmission of customer
identity data, including names, addresses, and social security numbers.
Analyst Notes
The combination of unauthorized outbound communication, suspicious process execution, rogue account creation, and plaintext data transfer indicates a compromised endpoint requiring containment and further forensic review.
MITRE ATT&CK Mapping
- T1041 - Exfiltration Over C2 Channel
- T1136 - Create Account
- T1071 - Application Layer Protocol
- T1059 - Command and Scripting Interpreter
Final Verdict
Confirmed Host Compromise and Data Exfiltration
The investigation confirmed malicious outbound communication, suspicious process execution, unauthorized account creation, and plaintext exfiltration of personally identifiable information.
Recommendations
- Implement tighter monitoring for suspicious outbound connections and unusual destination ports.
- Alert on unauthorized local account creation events such as Event ID 4720.
- Review endpoint process execution paths for suspicious binaries running from user-controlled directories.
- Apply egress filtering and endpoint controls to reduce the risk of plaintext data exfiltration.
- Restrict execution from user download folders and monitor abnormal process names.
Lessons Learned
- Packet analysis helps detect hidden compromise and data movement.
- Network and endpoint evidence create stronger investigations when correlated.
- Account creation events are critical indicators during compromise review.
- Data exfiltration can occur over plaintext channels when egress controls are weak.
Investigation Evidence
Selected screenshots from the investigation workflow. These visuals support the written analysis and help show the investigation process.
Recommended evidence: suspicious outbound TCP traffic to 75.30.5.55 over port 1337.
Recommended evidence: Windows Event ID 4720 showing unauthorized account creation.
Recommended evidence: host process review showing WinT0Ols.exe execution path.