LetsDefend Investigation: CVE-2024-49138

🔍 Overview

Hands-on SOC investigation and incident response simulation using LetsDefend, focused on a real-world exploitation of CVE-2024-49138 — a privilege escalation vulnerability in Windows CLFS driver.

📅 Event Details

• Event ID: 313
• Incident Type: Privilege Escalation
• Event Time: Jan 22, 2025
• Hostname: Victor
• IP Address: 172.16.17.207
• Malicious Binary: svohost.exe
• Parent Process: powershell.exe
• Suspicious Command: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

🛠️ Tools Used

• VirusTotal
• Hybrid Analysis
• TrueFort
• ChatGPT — For decoding PowerShell commands and analyzing behavior
• LetsDefend Lab Environment

🧠 Indicators of Compromise

• Hash: b432dcf4a0f0b601b1d79848467137a5e25cab5a0b7b1224be9d3b6540122db9
• Malicious URL: https://files-ld.s3.us-east-2.amazonaws.com/service-installer.zip
• Malicious IP: 185.107.56.141

🧩 Key Takeaways

• Identified fake system binary (svohost.exe) used for privilege escalation.
• Mapped activity to MITRE ATT&CK techniques.
• Used a layered toolset for full visibility (EDR, sandboxing, static/dynamic analysis, AI).
• Gained insight into PowerShell-based malware delivery methods.

🏁 Outcome

Successfully triaged, investigated, and documented the attack chain leveraging CVE-2024-49138. This lab helped reinforce my skills in incident response, behavioral analysis, and threat detection.

🔎 Investigation Screenshots

Alert Triggered in LetsDefend

VirusTotal Result for Malicious Hash

🔬 Process Tree Analysis

🧪 PowerShell & AbuseIPDB Usage

📋 Incident Notes

🪟 Windows Artifacts

✅ Final Wrap-up / Task Marked

---

“Getting 1% better every day.”