Following an EDR alert

Start with the alert

These notes follow a guided SOC lab walkthrough involving a high-severity Mimikatz alert. Mimikatz is associated with credential access and can also be used in authorised security testing.

The alert provided a starting point. The investigation needed to establish what executed, how it started, why it was detected and whether it had an effect before detection.

Follow the process tree

A process tree shows which process launched another. For example, explorer.exe → chrome.exe can reflect a user opening Chrome through the Windows desktop. That relationship explains part of the launch, but does not prove the activity is safe.

In the walkthrough, the parent executable wusvc.exe stood out. Its name resembled a Windows service, and the investigation showed communication with a remote server on port 8888.

The name and port alone did not establish malicious activity. Together with the alert and command behaviour, they warranted investigation into possible command-and-control communication.

Understand the encoded command

The PowerShell command used -enc, a shortened form of -EncodedCommand. CyberChef was used in the walkthrough to decode the Base64 content.

The decoded instructions downloaded a PowerShell script from GitHub and used Invoke-Expression to execute it, including Invoke-Mimikatz. This made the attempted credential-dumping behaviour clearer.

The useful step was interpreting the decoded instructions. The presence of encoding alone would not have explained what the command was trying to do.

Check supporting file analysis

The executable’s hashes were checked in VirusTotal. At the time shown in the walkthrough, 51 of 71 vendors flagged the sample, with results referencing Sandcat, CALDERA, trojans and backdoors. This is a historical observation from the lab, rather than a current lookup.

CALDERA is an adversary emulation platform used for security testing. Sandcat is an agent it uses to simulate attacker behaviour on endpoints, helping teams test their detection and response capabilities. In this lab, it was used as part of an attack simulation.

External detections support an assessment, but they need to be considered alongside the environment, authorisation and observed behaviour.

What is sandbox analysis?

A sandbox is an isolated, controlled environment used to run a suspicious file and observe its behaviour. Analysts can examine the processes it creates, its network connections, file changes and attempts to maintain access.

Platforms such as ANY.RUN may also let analysts search by a file’s hash to find previous analysis of the same sample.

Some malware can recognise a sandbox and avoid showing its malicious behaviour. Therefore, seeing no suspicious activity in a sandbox does not automatically mean the file is safe.

Bring the evidence together

The walkthrough brought together several findings:

Credential-access alert

An alert involving Mimikatz.

Parent process

A suspicious parent executable.

Network activity

Communication with a remote server.

PowerShell instructions

Decoded instructions attempting credential dumping.

File analysis

Results identifying a CALDERA-related agent.

Together, these findings helped explain the simulated attack. However, evidence of a credential-dumping attempt does not automatically confirm that credentials were successfully stolen.