From an HTA link to domain discovery

Link Sysmon process events by ProcessGuid to rebuild a chain: Outlook, mshta, a hidden PowerShell, and four discovery commands. Separate it from a management agent’s PowerShell.

Terminal mission
Advanced
3 objectives
0 of 3 solved

Briefing

Process IDs get reused, ProcessGuid does not. Each Sysmon event 1 carries the new process’s ProcessGuid and its parent’s ParentProcessGuid, so you can rebuild a tree with no guesswork.

An alert fired for net group "Domain Admins" on l.moreau’s laptop. Work back from it.

PowerShell · LT-LMOREAU

LT-LMOREAU · Sysmon triage

Type help for the command list and objectives for your tasks. Everything runs in this browser.

PS /Users/analyst>

Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.