Intel 471 Threat Hunting Workshop – CVE-2023-46604 Investigation

Overview

This repository documents my first hands-on experience with Intel 471’s Intelligence-Driven Threat Hunting Workshop focused on CVE-2023-46604.

Through this practical workshop, I investigated how attackers leveraged a critical Apache ActiveMQ vulnerability, analyzed post-exploitation behaviors using Elastic SIEM, and applied intelligence-driven threat hunting methodologies to identify malicious persistence mechanisms.

---

Skills Demonstrated

• Threat Hunting
• Elastic SIEM Investigation
• Vulnerability Intelligence
• Windows Event Analysis
• LOLBIN Detection (sc.exe)
• Service Persistence Analysis
• Event ID 7045 Detection
• Blue Team Operations
• Cyber Threat Intelligence (CTI)

---

Workshop Objectives

• Understand CVE-2023-46604 exploitation
• Build vulnerability-focused hunt hypotheses
• Investigate exploitation telemetry
• Detect post-exploitation persistence
• Recover validation flags

---

Investigation Workflow

Step 1: Virtual Machine Deployment

• Accessed Intel 471 lab VM
• Reviewed hunt package
• Understood vulnerability context

Step 2: Elastic SIEM Analysis

• Queried suspicious process executions
• Investigated sc.exe LOLBIN usage
• Reviewed command-line arguments

Step 3: Service Name Pivoting

Suspicious command identified:

sc create "DailyCleanup" binPath= "C:\Users\Jamesmurphy\AppData\Local\Temp\powershell.exe" start= auto

• Extracted service name: DailyCleanup
• Pivoted searches using service name

Step 4: Event Correlation

• Event ID 4688 = Process creation
• Event ID = Successful service installation

Step 5: Flag Recovery

Final Flag 1 Answer:

A new service was installed on the system

---

Key Lessons Learned

• Vulnerability severity alone is insufficient
• Threat intelligence improves hunt precision
• Process execution does not confirm successful attacker objectives
• Pivoting is essential
• Behavioral detection is critical

---

MITRE ATT&CK Mapping

• T1543.003 – Windows Service
• T1218 – Signed Binary Proxy Execution
• T1059 – Command and Scripting Interpreter

---

Full Blog Write-Up

https://navyacyber.hashnode.dev/my-first-hands-on-threat-hunting-workshop-experience-with-intel-471-hunting-cve-2023-46604-from-curiosity-to-confidence

---

Connect With Me

https://www.linkedin.com/in/navya-machhi-/

---

Disclaimer

This repository is intended for educational and professional portfolio purposes only.

It focuses on methodology, learning outcomes, and practical threat hunting skills without disclosing proprietary workshop materials.