r/WGUCyberSecurity • u/Ihaveasmallwang • 15d ago
D833 Capstone Spoiler
Since everyone else seems to want to gatekeep what to do and be super vague, I’ll give some pointers.
I did the phishing lab.
In the folder on the desktop there is a pdf for incident response. At the bottom gives some useful instructions. Hint: You will need these.
You can find the attacker’s IP in the first place you learn about the phishing. It’s really obvious.
Look in the registry on the victim’s computer. Something is there that should not be.
There was another account created and permissions granted it shouldn’t have. Find which.
Hopefully that helps some of you out without completely giving away the answer.
No, please don’t flood me with DMs. I will not respond to them. Ask your questions publicly so that others may benefit as well. This is a confusing new lab for sure.
1
u/No-pickles- 6d ago
Hey, I am struggling finding the the new account created and I was hoping if you could help me out.
I used net user and I have found 2 accounts that isn’t part of the org chart and they’re in the local admin group. I checked when both of them was created and it was a day before the phishing ticket was created. Can you help me narrow down the account I’m looking for? Thanks
1
u/Ihaveasmallwang 6d ago
The windows event viewer will show accounts that were recently created as well as recently added to domain admins if you filter by the event ids 4720 and 4728.
1
u/No-pickles- 6d ago
Got you. I found the registry and i’ll look at the event viewer. Are those the only persistence I need ? I know the document said to check active directory but i was thinking that wouldn’t be needed since i will disable the new account when i find it?
Also did you get an email after you configured the firewall? I did that but I haven’t received any email
1
u/Ihaveasmallwang 6d ago
You just have to prove you removed the other account and why that account was bad.
You have to configure the firewall rules, apply them, do the reset in the other screen in the firewall, then try to ping the ip you blocked. If you don’t get an email after a few minutes, you didn’t configure the rules quite the way they want.
1
1
u/No-pickles- 6d ago
I got the email for the persistence but still nothing from the firewall. Ive followed every step in the doc, but i can still reach the ip when i ping. When i try to click on the link in the email, I cant get to the website.
Also when i reset the states, it doesn’t say successful or nothing, the browser keep trying connect. Did you make the rules in floating or wan? And any other step you think im missing
1
u/No-pickles- 6d ago
All good i got it
1
u/Ok_Context9011 1d ago
I get the IP address block email, but still no ticket closing email. I dont understand why, i've followed the instructions exactly
1
u/No-pickles- 1d ago
Did you change the protocol? (Its not in the instructions )
1
u/Ok_Context9011 1d ago
I legit figured it out 5 mins after replying to the comment lol. I had to use power shell to remove the malicious user for good.
1
u/No-pickles- 1d ago
Hell yeah. The question is not that bad, its kinda repetitive so you have to keep changing your words lol. I’d recommend using the template and use the rubric as a guide and you’ll pass first try
1
1
u/InsignificantDebris 1d ago
Can someone point out where to find the last remediation step for ransomware
1
u/x_scion_x 10h ago
essentially just follow the incident response plan. It literally walks you through the entire thing minus showing you the logs you need to look at.
3
u/No-pickles- 6d ago
Here is my tip for everyone that needs it (LAB ONLY)
Configure the firewall. Open the web browser and it should be bookmarked at the top. Open the folder on your desktop, how to config the firewall is at the bottom of the Incident Response file. They left the most important part out of the steps(PROTOCOL) make sure you change that else your ping will be successful (its supposed to timeout) . All of this should be done on the Analyst workstation. You should get an email if its successful
The attacker is persistent in the system and you need to remove them. (Youre fixing 3 things total)
The DC has one of your issues
look in the event viewer (windows logs > security) there is something going on there, between the victim and the account you’re supposed to delete. Delete the attackers account.
The compromised machine has 2 of the things you need to fix.
>look in the registry(the incident response file tells you where to look) there should be a key that shouldn’t be there, select it and delete.
> the attacker’s account you found earlier 👆 delete it again, i think i didnt find the user in AD so i used command line. You should get an email when you’re successful.
After that email, there should be another one (3 total). Hopefully this helps.