Challenge Overview
The Invoice Ghost challenge simulates a Business Email Compromise (BEC) scenario. The finance department processed a suspicious vendor payment after receiving email updates requesting changes to banking details. The objective is to analyze the provided logs, email artifacts, and configuration files to determine if mailbox compromise occurred, identify key fraud indicators, filter out decoy IoCs, and construct the final flag.
Investigation Approach
To solve this challenge, we analyze the provided artifacts sequentially to reconstruct the attacker’s timeline and identify the true Indicators of Compromise (IoCs):
Review simulation decoys to establish what information to ignore.
Inspect the Microsoft 365 audit log and mailbox rules to identify unauthorized persistence and external login IP addresses.
Analyze email headers and metadata files to uncover domain spoofing and verify the actual fraudulent payment amount.
Evidence and Artifacts Examined
DECOY_IOCS.TXT: Lists false indicators from past simulation telemetry.
O365_AUDIT.CSV: Contains Microsoft 365 audit entries, including rule creation events.
MAILBOX_RULES.JSON: Displays configured mailbox forwarding and filtering rules.
EMAIL_THREAD.EML: Headers and raw message contents of the fraudulent email.
INVOICE_METADATA.TXT: Contains detailed metadata regarding the processed invoice.
Tools Used
Linux Terminal (Kali Linux)
Command Line Utilities: cat, grep, head
Step-by-Step Analysis
Identifying Decoy Indicators
First, inspect decoy_iocs.txt to identify false positives:
cat decoy_iocs.txt
Output:
Decoy Domain: payments-vendor.co
Decoy IP: 103.77.201.55
Identifying Fraudulent Payment Amount
Next, inspect invoice_metadata.txt to retrieve payment details:
cat invoice_metadata.txt
Key Observations:
Invoice ID: INV-2026-03-8841.pdf
Currency: USD
Payment Amount: 48750
Analyzing Email Headers for Spoofed Domain
Examine the raw email thread using head to check header attributes:
head -n 30 email_thread.eml
Key Observations:
From header contains billing@payrnents-vendor.com.
Notice the typo-squatted domain: payrnents-vendor.com (using rn to look like m), distinct from the decoy domain payments-vendor.co.
Mailbox Rule and IP Analysis
Filter o365_audit.csv for rule creation operations (New-InboxRule) as guided by the hint:
grep -i “New-InboxRule” o365_audit.csv
Audit Log Entry:
2026-03-28T08:19:15Z,finance@northbridge.local,New-InboxRule,185.193.88.24,Success,Rule:ArchiveAndHide
Malicious External IP: 185.193.88.24
Rule Name: ArchiveAndHide
Cross-referencing mailbox_rules.json reveals the rule details:
name: ArchiveAndHide
enabled: true
action: forwardTo
targetAddress: backup.finance@protonmail.com
conditions: subjectContains:invoice, markAsRead:true, moveToFolder:RSS Subscriptions
Target Folder: RSS Subscriptions
Formatting requirement: Lowercase with a hyphen (rss-subscriptions).
Flag Construction
IP Address: 185.193.88.24
Spoofed Domain: payrnents-vendor.com
Amount: 48750
Folder Name: rss-subscriptions
Final Flag:
HackCTF{185.193.88.24_payrnents-vendor.com_48750_rss-subscriptions}
