September 13, 2026
Lap: OSINT — MITRE (3)
Platform: cyberhaze
By Zeyad Ali
4 min read
Lap: OSINT — MITRE (3)
Lap Overview : This lab simulates an incident response scenario where the SOC team detects suspicious traffic between an internal endpoint and a known malicious IP. The goal is to investigate the compromise, identify the attacker's TTPs, and reconstruct the attack chain using the MITRE ATT&CK framework.
(Q1,Q2):Reconnaissance
In Q1 A significant spike in network traffic was detected from an external IP using the Nmap Scripting Engine (NSE). The activity indicates that Nmap was being used to scan the target for potential vulnerabilities. At this stage, the identified IoCs were an external IP address and the use of Nmap for vulnerability scanning.These findings indicate that the activity is part of the Scanning stage. Based on the MITRE ATT&CK framework, this falls under the Reconnaissance tactic, specifically Active Scanning, since the attacker is actively interacting with the target using a tool such as Nmap to identify potential vulnerabilities.
We can find the technique ID in Reconnaissance > Active Scanning > Vulnerability Scanning > T1595.002
Q3:Exploiting a Public-Facing Application
At this stage, the attacker exploited an external-facing software application by identifying an SQL Injection vulnerability. By exploiting this vulnerability, the attacker was able to gain Initial Access to the organization's environment.
To map this activity to MITRE ATT&CK, we look under the Initial Access tactic and identify the Exploit Public-Facing Application technique, which matches the attacker's method of exploiting a vulnerability in an externally accessible application.
find the technique ID in Initial Access>Exploit Public-Facing Application >T1190
Q4:I searched for SQLmap in MITRE ATT&CK to identify its associated Software ID
The SQLmap tool was identified during the investigation. SQLmap automates the process of detecting and exploiting SQL Injection vulnerabilities, making it easier for an attacker to identify vulnerable applications and exploit them.
At this stage, I was able to identify the tools used by the attacker, which is an important indicator of the attack. I can then search for each tool by name in thMITRE ATT&CK framework to identify its corresponding technique ID. Go to Home and Search Sqlmap.
The Pyramid of Pain shows different types of indicators that can be used to identify an attacker.
From bottom to top, it includes Hashes, IP Addresses, Domains, Network/Host Artifacts, Tools, and TTPs.
The higher the indicator is on the pyramid, the harder it is for the attacker to change or hide it." width="936" height="529" loading="lazy" data-zoom-src="/img/medium/4000/1*MUY9DUEO77_aEfW8ewK-_A.png" class="prose-image" data-caption="IOC: Indicator of Compromise"/>
Q5: Code Execution
At this stage, the attacker achieved Remote Code Execution by exploiting the SQL Injection vulnerability. This allowed the attacker to create a reverse shell by initiating a
cmd.exeprocess on the Windows server.
Since the attacker executed commands through the Windows Command Shell, we can map this activity to the Execution tactic, specifically the Command and Scripting Interpreter technique.. By checking sub-techniques, we find T1059.003 — Windows Command Shell.
find the technique ID in Execution>Command and Scripting Interpreter >T1059.003
Q6:Impersonating an administrator user's security token and abusing the SeImpersonatePrivilege
At this stage, the attacker performed Privilege Escalation by abusing the
SeImpersonatePrivilege. In simple terms, the attacker attempted to impersonate an administrator's security token, allowing the attacker to operate with higher privileges than the original account.Since this is a Privilege Escalation technique, we can navigate to Privilege Escalation → Access Token Manipulation in the MITRE ATT&CK framework.
Under the sub-techniques, we find Token Impersonation/Theft (T1134.001). In the Detection section, MITRE recommends monitoring API calls such as
DuplicateToken,DuplicateTokenEx,ImpersonateLoggedOnUser, andSetThreadToken.
In this case, the relevant API call is ImpersonateLoggedOnUser, which can be monitored to detect token impersonation activity.
Q7:Persistence
During the live incident response triage, it was discovered that an existing Windows service had its image path modified to point to the attacker's malicious reverse shell payload. This indicates that the attacker was attempting to maintain Persistence on the compromised system.
To map this activity to MITRE ATT&CK, we navigate to Persistence → Create or Modify System Process, where we find the sub-technique Windows Service (T1543.003). This technique covers the creation or modification of Windows services to achieve persistence.
Q8:Defense Impairment
At this stage, the SIEM reported that the system's EDR tool was turned off and disabled. This indicates that the attacker was attempting to disable security controls to avoid detection and operate without the EDR blocking or alerting on suspicious activity.
In MITRE ATT&CK, this falls under the Defense Impairment tactic, specifically Disable or Modify Tools, which covers disabling or modifying security tools to weaken the system's defenses.
Q9:Collection
The CCF32 software was transferred to the host shortly after the initial compromise. Since I was not familiar with the tool, I searched for it in the MITRE ATT&CK framework and found that CCF32 is associated with data collection activity.
Based on this, the relevant MITRE ATT&CK tactic is Collection (TA0009), as the tool is used to collect data from the compromised system.
Q10:Exfiltration to Public GitHub Repository
The attacker staged sensitive data and then exfiltrated it by uploading the data to a public GitHub repository.
Since this activity involves stealing data from the compromised environment, it can be mapped to the Exfiltration tactic. The attacker used a web-based external service to transfer the stolen data.
To identify the appropriate mitigation, we can check the Mitigations section in MITRE ATT&CK. Restrict Web-Based Content (M1021) can help prevent the use of unauthorized external web services for data exfiltration.
Q11:Impact
The attacker modified the organization's public-facing website to display propaganda messages during the attack. This is an example of Defacement, where an attacker alters a website's content to damage the organization's image or reputation.
In MITRE ATT&CK, this falls under the Impact tactic → Defacement → External Defacement.
MITRE ATT&CK ID:
T1491.002 — External Defacement