FIELD NOTES: RECONSTRUCTING AN ATTACKER'S WORKFLOW

Summary from the TLDR InfoSec newsletter

PowerShell scripts recovered from an intrusion revealed a %TEMP% file-watching loop that fed commands to Invoke-Expression, overlapping tradecraft from Microsoft's TerminalFix ClickFix analysis. A fake Windows Security prompt looped until the victim entered valid credentials for a targeted account, logging every attempt in cleartext. At the same time, follow-on scripts enumerated AD computers, tested remote WMI access, and mapped readable SMB shares. Defenders should enable Script Block Logging (Event ID 4104) and hunt for string combinations like PromptForCredential, GetNetworkCredential().Password, and DirectorySearcher alongside PowerShell fanning out over TCP/445 or WMI.