By examining the logs located in the “C:\Logs\DLLHijack” directory, determine the process responsible for executing a DLL hijacking attack. Enter the process name as your answer. Answer format: _.exe
2.By examining the logs located in the “C:\Logs\PowershellExec” directory, determine the process that executed unmanaged PowerShell code. Enter the process name as your answer. Answer format: _.exe
I was also stuck for a while on this one. I over complicated it for 2 hours.
While trying to figure this out, I stumbled on the same exploit we went through earlier in the module on this website. It breaks down the exploit of calc.exe loading wininet.dll. The article mentions using the Find function in Event Viewer to find the wininet.dll.
In our case, after loading the logs into event viewer, we can Find for wininet.dll. There should only be a few logs that come up, and one specifically looks fishier than the rest. This should lead you to the correct .exe file.
Hello brother.You did a good job and I also came up with another way to solve this.I created an xml query to search for events where event data is not signed. In my opinion, one could feel more confident hunting dll hijacks this way , eliminating the need for hints
Does anyone know if the lab is working correctly? I have re-read the DLL hijacking lab and can’t find much with event ID 7, find, or searching via a customized XML query.
^ this is really good, you can create a txt file for the yml files, copy/paste the raw data into the text files, save/rename them as .yml. Afterward, run the chainsaw command to look for DLL hijacking against the event log.
However, I am not getting the correct result. Any tips/help are greatly appreciated.
Finally found a decent solution for this (“C:\Logs\DLLHijack) using the get-winevent method.
i ran this in the folder, so the path is just wildcarded (could specify the one file in there if you want)
We are looking for event ID 7 as this is looking for image loaded
We select some relevant fields
Then we use the where-object command to search through the message for any containing Signed: false
then we can either use the for each command or the select -expandproperty message to then print the message.
This should show us any dlls loaded that were not signed which indicate possible hijacking
Hi, I’m noob and stuck here too, spend whole night re-read the entire module cannot seem to get the answers for skills assesement, first i see event ID 7 and comes up with MMC.exe but this isn’t right can’t be so obvious, Any help clarification would be awesome thanks
