Welcome to the GhostConnect lab walkthrough, a full end-to-end investigation into a targeted intrusion that began with a single phishing email and ended in domain reconnaissance, defense evasion, and data exfiltration. The incident was detected on a corporate workstation, FB-WKS64, belonging to the user chriskarma, after the host began exhibiting unusual outbound network activity and unexpected PowerShell behavior. This lab is built almost entirely around endpoint telemetry - Sysmon events forwarded into Splunk - supplemented by browser artifacts (Chrome's History SQLite database) and threat-intelligence enrichment.
Throughout this walkthrough, we reconstruct the attack chain in the order it actually unfolded: the user opening their email client, clicking a malicious link, the browser fetching a lure page, an auto-downloaded VBScript orchestrating multiple downstream processes, a multi-stage loader chain, Active Directory enumeration, a second-stage implant attributed via threat intel, a secondary command-and-control (C2) fetch, MSI-based persistence, and finally the staging and exfiltration of the victim's data. Each question anchors a specific link in that chain, and each answer is recovered from a durable forensic artifact rather than a guess.
The skills demonstrated here are the bread and butter of modern DFIR and threat hunting: writing precise Splunk queries against Sysmon EventIDs, reading parent-child process relationships, recovering download provenance from Mark-of-the-Web alternate data streams, correlating endpoint timestamps with browser-recorded visit times, enriching a hash against a threat-intelligence platform, and recognizing operator OPSEC mistakes that fingerprint the source of their tooling. By the end, you will be able to reconstruct a complete intrusion timeline and extract a rich set of indicators of compromise (IOCs) suitable for blocking and cross-environment hunting.
Primary host:
FB-WKS64(FB-WKS64.fedbridge.local) Primary victi…