My first hands-on Intel 471 threat hunting workshop experience investigating CVE-2023-46604 using Elastic SIEM, vulnerability intelligence, and post-exploitation detection.
This repository documents my first hands-on experience with Intel 471’s Intelligence-Driven Threat Hunting Workshop focused on CVE-2023-46604.
Through this practical workshop, I investigated how attackers leveraged a critical Apache ActiveMQ vulnerability, analyzed post-exploitation behaviors using Elastic SIEM, and applied intelligence-driven threat hunting methodologies to identify malicious persistence mechanisms.
Skills Demonstrated
Threat Hunting
Elastic SIEM Investigation
Vulnerability Intelligence
Windows Event Analysis
LOLBIN Detection (sc.exe)
Service Persistence Analysis
Event ID 7045 Detection
Blue Team Operations
Cyber Threat Intelligence (CTI)
Workshop Objectives
Understand CVE-2023-46604 exploitation
Build vulnerability-focused hunt hypotheses
Investigate exploitation telemetry
Detect post-exploitation persistence
Recover validation flags
Investigation Workflow
Step 1: Virtual Machine Deployment
Accessed Intel 471 lab VM
Reviewed hunt package
Understood vulnerability context
Step 2: Elastic SIEM Analysis
Queried suspicious process executions
Investigated sc.exe LOLBIN usage
Reviewed command-line arguments
Step 3: Service Name Pivoting
Suspicious command identified:
sc create "DailyCleanup" binPath= "C:\Users\Jamesmurphy\AppData\Local\Temp\powershell.exe" start= auto
Extracted service name: DailyCleanup
Pivoted searches using service name
Step 4: Event Correlation
Event ID 4688 = Process creation
Event ID = Successful service installation
Step 5: Flag Recovery
Final Flag 1 Answer:
A new service was installed on the system
Key Lessons Learned
Vulnerability severity alone is insufficient
Threat intelligence improves hunt precision
Process execution does not confirm successful attacker objectives
navya240/intel471-threat-hunting-cve-2023-46604
