ThugLyfe Threat Hunt Notes

Pre Deployment:

Post Deployment:

net accounts

Suspicious Accounts:

• Administators
• SYSTEM_SERVICE

Get-ScheduledTask

Investigate Scheduled Tasks with no task path

The task was created not too long ago

When it triggers it calls an unknown svchost.exe

Get-ChildItem -Path c:\users\public -file -recurse

Investigate suspicious files

svchost.exe from suspicious task

SecurityUpdate is a hidden folder

To work on next:

• Display content in users folder
• fix icacls
• Further investigation on other stuff