Answer: 6812

Answer: 27/03/2023 14:37:09 (27 March 2023 14:37:09 UTC)

We have the following artefacts from the environment:

In this investigation, we familiarize ourselves with key Sysmon Event IDs and how they can be used to detect and analyse malicious activity on a Windows system. The scenario is inspired by Unit 42 (Palo Alto Networks) research into an UltraVNC campaign, where attackers deployed a backdoored version of UltraVNC to maintain persistence. This lab guides you through the initial access stage of that campaign, using a single Sysmon log file as evidence.