Hack The Box · Forensics Challenge

Event Horizon

Name	Event Horizon
Hint	Our CEO's computer was compromised in a phishing attack. The attackers took care to clear the PowerShell logs, so we don't know what they executed. Can you help us?
Base Points	Easy - Retired [0]
Rated Difficulty
	HTB-Bot
Creator	felamos

Analysis

Download and unzip the file, then review the supplied hint:

Our CEO's computer was compromised in a phishing attack. The attackers took care to clear the PowerShell logs, so we don't know what they executed. Can you help us?

The archive contains 325 files and folders. We need to inspect the EVTX files for PowerShell activity, which leads us to the PowerShell Operational.evtx log.

PowerShell Operational event log showing Invoke-Mimikatz activity — PowerShell Operational events reveal Invoke-Mimikatz activity.

Invoke-Mimikatz appears in the first relevant event. To reduce the noise, filter out event IDs 40962, 40961, 53504, and 4100.

-40962, -40961, -53504, -4100

Filtered PowerShell event log results — Filtered results isolate the useful PowerShell execution details.

Flag

HTB{8Lu3_734m_F0r3v3R}

Challenge was easier than expected.