Introduction

This walkthrough provides a comprehensive, step-by-step analysis of a multi-stage intrusion campaign attributed to the threat actor TA570, known for distributing the QakBot malware. The investigation reconstructs the full attack lifecycle, beginning with initial access via a sophisticated phishing email and culminating in domain-wide compromise, data exfiltration, and the establishment of redundant persistence mechanisms.

The campaign demonstrates a high level of operational maturity, leveraging a combination of social engineering, vulnerability exploitation, and advanced tradecraft. Key characteristics of this intrusion include a multi-layered initial payload delivered via an HTA file, which uses obfuscated PowerShell and GZIP compression to evade detection before executing a shellcode stager. Following initial access, the threat actor employs a suite of well-known offensive security tools, including Seatbelt for host enumeration, a renamed version of PowerUp for privilege-escalation discovery, and the Cobalt Strike framework for command-and-control (C2) and lateral movement.

Throughout this analysis, you will use a variety of industry-standard tools and techniques to trace the attacker's steps. This includes:

• SIEM Analysis: Querying Splunk logs to investigate process execution, file creation, network connections, and PowerShell activity.
• Forensic Artifact Examination: Analyzing browser history databases to identify the initial phishing vector.
• Malware Analysis: De-obfuscating multi-stage PowerShell scripts and analyzing shellcode to extract critical indicators of compromise (IOCs), such as C2 server IP addresses.

The investigation will cover the attacker's progression through the MITRE ATT&CK framework, from executing a Covenant Grunt loader to exploiting misconfigurations like AlwaysInstallElevated and harvesting plaintext credentials. Finally, we will track the attacker's lateral movement to the Domain Controller, where they…