Northwind order portal breach: the Windows side Start this lab

Why this matters

The Linux half of this breach taught the three phases. Windows changes the evidence, not the discipline: the shell is cmd.exe, persistence hides in scheduled tasks and Run keys rather than unit files, and lateral movement is an SMB logon by a service identity nobody thinks of as a user. Analysts who can only work Linux stall on exactly this box.

Concepts

Objectives graded

• Work a Windows server with cmd.exe: tasklist, netstat, dir /s /b, reg query, schtasks
• Prove initial access, SMB lateral movement, exfiltration and the persistence that survives a reboot
• Contain the server and the app-pool identity under approval, then file the post-incident record

MITRE ATT&CK coverage

An unrestricted upload on an IIS application server drops an .aspx web shell that spawns encoded PowerShell; the app-pool identity authenticates to the order file server over SMB, a scheduled task keeps the implant alive, and an archive is pushed to an external host.

What each rubric rule proves

• The workflow reached a terminal success state on the graded run.

  behavior · weight 20 · T1041 Exfiltration Over C2 Channel (Exfiltration)

• A consequential action passed through a human approval gate.

  safety · weight 15 · T1041 Exfiltration Over C2 Channel (Exfiltration)

• No non-idempotent operation was retried without an idempotency key.

  efficiency · weight 10 · T1059.001 Command and Scripting Interpreter: PowerShell (Execution)

• Every action node resolves its secret from the vault, never an inline field.

  configuration · weight 10 · T1021.002 SMB/Windows Admin Shares (Lateral Movement)

• The learner attached at least one linkable piece of evidence to the case.

  investigation · weight 10 · T1505.003 Server Software Component: Web Shell (Persistence)

• The case carries an analyst closure note explaining the outcome.

  explanation · weight 10 · T1190 Exploit Public-Facing Application (Initial Access)

• No innocent asset in the alert batch was contained, disabled or revoked.

  behavior · weight 15 · T1021.002 SMB/Windows Admin Shares (Lateral Movement)

• The playbook survived the integration faults it met and still finished.

  configuration · weight 15 · T1059.001 Command and Scripting Interpreter: PowerShell (Execution)

• Nothing was changed in the estate before evidence had been gathered.

  investigation · weight 10 · T1505.003 Server Software Component: Web Shell (Persistence)

• The analyst worked the compromised Windows server directly instead of grading the alert.

  investigation · weight 10 · T1505.003 Server Software Component: Web Shell (Persistence)

• Initial access was located on disk: the .aspx shell in the upload directory.

  investigation · weight 10 · T1505.003 Server Software Component: Web Shell (Persistence)

• The external peer was read off the host's own connection table and the IIS log.

  investigation · weight 10 · T1041 Exfiltration Over C2 Channel (Exfiltration)

• The live transfer was identified by PID before anything was contained.

  behavior · weight 10 · T1041 Exfiltration Over C2 Channel (Exfiltration)

• Lateral movement was proven: the app-pool identity reached the order file server over SMB.

  investigation · weight 10 · T1021.002 SMB/Windows Admin Shares (Lateral Movement)

• The compromised application server is isolated at end state.

  behavior · weight 15 · T1190 Exploit Public-Facing Application (Initial Access)

• The application pool identity the attacker inherited is disabled pending rotation.

  behavior · weight 10 · T1021.002 SMB/Windows Admin Shares (Lateral Movement)

• The persistence mechanism was found, so eradication can outlive the process kill.

  behavior · weight 10 · T1053.005 Scheduled Task/Job: Scheduled Task (Persistence)

• Root cause is recorded as the unpatched application version, not as analyst error.

  explanation · weight 10 · T1190 Exploit Public-Facing Application (Initial Access)

• A post-incident timeline was filed: upload, shell execution, SMB logon, exfiltration, containment.

  explanation · weight 15 · T1190 Exploit Public-Facing Application (Initial Access)

• The analyst scoped the host's network from the wire, so containment decisions know which segment is in play.

  investigation · weight 5

• The analyst scoped the machine itself, so memory-hungry triage steps are planned against real capacity rather than a guess.

  investigation · weight 3

• Disk capacity was taken from the volume itself, which is what makes an image or memory-dump decision defensible.

  investigation · weight 3

Common mistakes

• Reaching for Linux verbs — `ps aux` and `ss -tnp` do not exist on this host.
• Filing the relative page name instead of the full path from `dir /s /b`.
• Disabling a human account when the identity that moved was the application pool.
• Closing the case after killing the PID, leaving the scheduled task in place.

Same idea, three vendors

Vocabulary is generated from the teaching profiles, so it always matches what the consoles render.

The same concepts in shipping products

The consoles you practice in use teaching names. These are the words the real vendors print in their own documentation, so the vocabulary survives the day you sit in front of a production tenant.