🛡️ SOC Investigation Report: CVE-2024-49138 Exploitation

📌 Executive Summary

• Alert Title: SOC335 - CVE-2024-49138 Exploitation Detected
• Severity: High
• Target Host: Victor (172.16.17.207)
• Operating System: Windows 10
• Primary User: letsdefend
• Verdict: True Positive (Malicious Activity Confirmed)

---

🔍 Investigation Methodology

1. Process & Binary Analysis

• Suspicious File: svohost.exe
• Execution Path: C:\temp\service_installer\svohost.exe
• Anomalies:
  • Process Masquerading: Name mimics the legitimate Windows system file svchost.exe.
  • Path Location: System binaries run from C:\Windows\System32\, whereas this binary executed from a user temp path.

2. Threat Intelligence Verification

• File Hash: b432dcf4a0f0b601b1d79848467137a5e25cab5a0b7b1224be9d3b6540122db9
• VirusTotal Detection: 50/71 security vendors flagged the file as malicious.
• Threat Classification: Trojan/Win64.MalwareX, tagged with cve-2024-49138 privilege escalation exploit.

3. Log Management & Network Correlation

• Queried SIEM logs for host IP 172.16.17.207.
• Findings: Confirmed outbound network connection to external Command & Control (C2) IP 185.107.56.1.

---

🛑 Containment & Remediation Actions

1. Host Isolation: Navigated to EDR Endpoint Security and toggled Containment: Enabled for host Victor (172.16.17.207) to block network traversal.
2. Artifact Logging: Documented malicious file hash, C2 IP, and target host IP in Case Management.
3. Case Closure: Finalized playbook analysis as True Positive.

---

🎯 Indicators of Compromise (IOCs)