Blue Box: Midnight RDP - Incident Response Writeup Report

SHADOW120

Blue Box: Midnight RDP - Incident Response Writeup Report

Case ID: BB-EVTX-2024-0228
Classification: Confirmed Compromise - RDP Brute Force, Account Takeover & Persistence
Analyst: Security Operations
Evidence: security.evtx, system.evtx, user_list.txt
Host: DC01.bluecorp.local
Date of Analysis: 2026-08-05
Challenge Link: https://learn.hacklido.com/blue-box/midnight-rdp

1. Executive Summary

Windows Security and System event logs from DC01.bluecorp.local were analyzed after midnight-hours RDP activity was flagged. The logs show a sustained RDP brute-force campaign from three external IP addresses against the domain’s user accounts, culminating in a successful logon to the t.davis account. Within one second of the successful logon, the account was granted elevated system privileges, and an attacker-installed “Remote Access Tool” service was created and started for persistence.

Verdict: Confirmed account takeover via RDP brute force, followed by privilege escalation and persistence via a malicious service.

2. Tools Used

Both security.evtx and system.evtx in this evidence set are plaintext XML exports of the Windows Event Log schema, so they can be parsed directly with a script or standard XML/text tooling rather than requiring the binary EVTX format tools.

Tool	Purpose
Python (`re`, XML pattern matching)	Bulk extraction of Event IDs and structured `<Data Name="...">` fields
`grep` / `strings`	Quick manual inspection of raw log content
`user_list.txt`	Cross-reference of valid domain usernames targeted by the brute force

3. Methodology - Step by Step

Step 1: Get an overview of event volume by Event ID

grep -o "<EventID>[0-9]*</EventID>" security.evtx | sort | uniq -c

Output:

175  <EventID>4625</EventID>   Failed logon
 70  <EventID>4624</EventID>   Successful logon
 56  <EventID>4647</EventID>   User-initiated logoff
  1  <EventID>4672</EventID>   Special privileges assigned to new logon

The presence of 175 failed logons against only 70 successful ones, on a domain controller, is an immediate red flag for a brute-force or credential-stuffing campaign.

Q1 - Failed login attempts during the attack: HackCTF{175}

Step 2: Break down the failed logons by source IP

import re
from collections import Counter

with open("security.evtx") as f:
    content = f.read()

events = re.findall(r"<Event .*?</Event>", content, re.S)

def get_field(e, name):
    m = re.search(rf'<Data Name="{name}">(.*?)</Data>', e)
    return m.group(1) if m else None

ip_counts = Counter()
for e in events:
    if "<EventID>4625</EventID>" in e:
        ip_counts[get_field(e, "IpAddress")] += 1

print(ip_counts)

Output:

Counter({'45.155.205.33': 80, '185.142.53.122': 75, '103.142.112.89': 20})

Three distinct external IP addresses generated all 175 failed logon attempts, all with LogonType 10 (RemoteInteractive, i.e. RDP), against multiple domain usernames pulled from user_list.txt (j.smith, m.johnson, r.williams, t.davis, l.brown, a.garcia, p.martinez). This is a classic distributed RDP password-spray pattern, using several source IPs to reduce the chance of a single IP being blocked after repeated failures.

Q9 - Distinct attacker IPs involved in the reconnaissance phase: HackCTF{3}

Step 3: Identify the successful attacker logon among the 4624 events

for e in events:
    if "<EventID>4624</EventID>" in e:
        ip = get_field(e, "IpAddress")
        if ip in ("45.155.205.33", "185.142.53.122", "103.142.112.89"):
            t = re.search(r'TimeCreated SystemTime="(.*?)"', e).group(1)
            print(t, ip, get_field(e, "TargetUserName"),
                  get_field(e, "LogonType"), get_field(e, "WorkstationName"),
                  get_field(e, "AuthenticationPackageName"))

Output:

2024-02-28T02:13:45Z 185.142.53.122 t.davis 10 ATTACKER-PC Negotiate
2024-02-28T02:18:45Z 185.142.53.122 t.davis 10 WORKSTATION Negotiate
2024-02-28T02:28:45Z 185.142.53.122 t.davis 10 WORKSTATION Negotiate
2024-02-28T02:38:45Z 185.142.53.122 t.davis 10 WORKSTATION Negotiate

Of the three brute-forcing IPs, only 185.142.53.122 succeeded, against the t.davis account, at 2024-02-28T02:13:45Z. Three more successful RDP sessions follow in the same window as the attacker maintains access. The very first successful logon carries a distinctive workstation name, ATTACKER-PC, before later sessions revert to the generic WORKSTATION value also used by legitimate internal logons, this first, unique hostname is the clearest attacker-supplied artifact.

Q2 - Source IP of the successful attacker: HackCTF{185.142.53.122}
Q3 - Compromised user account: HackCTF{t.davis}
Q4 - Time of the successful login: HackCTF{2024-02-28 02:13:45}
Q5 - Logon type used for the attack: HackCTF{10}
Q8 - Workstation name used by the attacker: HackCTF{ATTACKER-PC}
Q10 - Authentication package used for the successful login: HackCTF{Negotiate}

Step 4: Confirm privilege escalation immediately following the compromise

for e in events:
    if "<EventID>4672</EventID>" in e:
        print(e)

Output (trimmed):

TimeCreated SystemTime="2024-02-28T02:13:46Z"
SubjectUserName: t.davis
PrivilegeList: SeTcbPrivilege, SeBackupPrivilege, SeRestorePrivilege,
               SeTakeOwnershipPrivilege, SeDebugPrivilege,
               SeSystemEnvironmentPrivilege, SeLoadDriverPrivilege,
               SeImpersonatePrivilege

Event ID 4672 fires exactly one second after the successful logon (02:13:46Z vs 02:13:45Z), confirming t.davis's session was immediately granted a set of highly sensitive privileges (including SeDebugPrivilege and SeImpersonatePrivilege, both commonly abused for further privilege escalation and credential theft). This is well outside the normal privilege set for a standard domain user account and is the clearest indicator of privilege escalation in the log.

Q6 - Event ID that indicates privilege escalation: HackCTF{4672}

Step 5: Check system.evtx for persistence mechanisms

grep -A2 "EventID>7045" system.evtx
grep -A2 "EventID>7036" system.evtx

Output:

<EventID>7045</EventID>
<TimeCreated SystemTime="2024-02-28T02:15:45Z"/>
...
<Data Name="Message">A service was installed: Remote Access Tool</Data>

<EventID>7036</EventID>
<TimeCreated SystemTime="2024-02-28T02:18:45Z"/>
...
<Data Name="Message">The Remote Access Tool service entered the running state</Data>

Two minutes after the initial compromise, a service named Remote Access Tool was installed (Event ID 7045, the standard Service Control Manager event for new service installation) and started running (Event ID 7036) three minutes later, coinciding with the attacker’s second successful RDP logon. This is the attacker’s persistence mechanism, allowing continued access independent of the RDP brute-force foothold.

Q7 - Service installed post-compromise: HackCTF{Remote Access Tool}

Step 6: Correlate initial reconnaissance traffic in system.evtx

grep -B8 "permitted a connection" system.evtx | grep -E "TimeCreated|Message"

Output shows repeated Windows Filtering Platform permit events for inbound RDP (port 3389) connections from 103.142.112.89 to 192.168.1.10:3389, roughly every two minutes between 01:35:00Z and 01:43:00Z, immediately preceding the brute-force attempts recorded in security.evtx. This confirms 103.142.112.89 began probing the RDP service before the coordinated brute force from all three IPs escalated.

4. Consolidated Findings

#	Question	Answer	Flag
1	Failed login attempts during the attack	175	`HackCTF{175}`
2	Source IP of the successful attacker	185.142.53.122	`HackCTF{185.142.53.122}`
3	Compromised user account	t.davis	`HackCTF{t.davis}`
4	Time of the successful login	2024-02-28 02:13:45	`HackCTF{2024-02-28 02:13:45}`
5	Logon type used for the attack	10 (RemoteInteractive/RDP)	`HackCTF{10}`
6	Event ID indicating privilege escalation	4672	`HackCTF{4672}`
7	Service installed post-compromise	Remote Access Tool	`HackCTF{Remote Access Tool}`
8	Workstation name used by the attacker	ATTACKER-PC	`HackCTF{ATTACKER-PC}`
9	Distinct attacker IPs in the reconnaissance phase	3	`HackCTF{3}`
10	Authentication package used for the successful login	Negotiate	`HackCTF{Negotiate}`

5. Indicators of Compromise (IOCs)

Brute-force source IPs: 45.155.205.33, 185.142.53.122, 103.142.112.89
Successful attacker IP: 185.142.53.122
Compromised account: t.davis
Attacker workstation name: ATTACKER-PC
Malicious service: Remote Access Tool
Logon type: 10 (RemoteInteractive / RDP)
Timeline:
- 01:35:00Z - 01:43:00Z - RDP reconnaissance/probing from 103.142.112.89
- 01:48:30Z onward - Distributed brute-force logon failures from all three IPs
- 02:13:45Z - Successful RDP logon to t.davis from 185.142.53.122
- 02:13:46Z - Privilege escalation (Event ID 4672)
- 02:15:45Z - Malicious service installed (Event ID 7045)
- 02:18:45Z - Malicious service started (Event ID 7036), second attacker RDP session
- 02:28:45Z, 02:38:45Z - Continued attacker RDP sessions

6. Recommendations

Disable or reset the t.davis account credentials immediately, and review any actions performed during the compromised sessions.
Block 45.155.205.33, 185.142.53.122, and 103.142.112.89 at the network perimeter.
Identify and remove the “Remote Access Tool” service from DC01 and any other hosts it may have been deployed to.
Enforce account lockout policies and RDP-specific protections (Network Level Authentication, rate limiting, or a VPN/jump-host requirement) to prevent direct RDP brute-forcing against the domain controller.
Enable and monitor for Event ID 4625 spikes, Event ID 4672 on non-administrative accounts, and Event ID 7045 service installations as ongoing detection rules.
Audit all privileges and group memberships in the domain to confirm no other accounts were escalated during this window.
Review system.evtx retention and coverage on other domain hosts to determine whether the attacker pivoted beyond DC01.

document.querySelectorAll("ins.adsbygoogle:not([data-adsbygoogle-status])").forEach(function(){try{(adsbygoogle=window.adsbygoogle||[]).push({});}catch(e){}});