Operational Noise in Windows Event Logs During Advanced Cyberattacks
The sophistication and adaptability of threat actors have been a central topic in cybersecurity discussions. However, recent findings reveal a more nuanced reality of their operations.
The sophistication and adaptability of threat actors have been a central topic in cybersecurity discussions. However, recent findings reveal a more nuanced reality of their operations.
Forensic investigations into threat actor activities, particularly those documented in Windows Event Logs, show that attacks often involve trial-and-error methods rather than flawlessly executed strategies. Endpoint detection and response (EDR) telemetry and Windows Event Logs indicate that attackers frequently experiment, encounter obstacles, and adjust their tactics in real-time.
A notable case in November demonstrated this chaotic operational style. While initial analysis suggested a smooth progression toward Warlock ransomware deployment, a closer examination of the Windows Event Logs revealed that the attackers faced significant challenges. These included failed attempts to install Cloudflare tunnels, mistyped commands, and efforts to launch an absent OpenSSH server.
Between November 6 and November 25, 2025, three separate intrusions displayed similar tactics, techniques, and procedures (TTPs), suggesting a single threat actor or group. Each intrusion exploited web application vulnerabilities, allowing remote code execution through Microsoft Internet Information Services (IIS) web servers. The goal was to deploy a Golang-based trojan, "agent.exe," for persistent access.
Incident 1: The attacker repeatedly attempted to execute a renamed executable (815.exe) after Microsoft Defender blocked their initial download attempt. Despite being quarantined later, the attacker returned with a rebranded GotoHTTP tool. Incident 2: On November 17, the attacker added Windows Defender exclusions via PowerShell, but the persistence mechanism failed to start as documented in Service Control Manager event logs. Incident 3: Occurring on November 25, it followed a similar pattern to Incident 2, including failed service startup attempts.
The evidence challenges the perception of constantly evolving threats. Instead, it highlights attackers making incremental adjustments and repeating ineffective techniques. Security teams can leverage this insight by focusing on specific friction points, such as failed service installations and repeated access attempts, to develop targeted countermeasures. The sophistication of an attacker may be characterized more by persistence than by expertise.
Item Description
C:\users\public\815.exe
The sophistication and adaptability of threat actors have been a central topic in cybersecurity discussions.
SHA256: 909460d974261be6cc86bbdfa27bd72ccaa66d5fa9cbae7e60d725df13d7e210
Incident Details Executable (Incident 1)
IP Address (Attempted Download) 110.172.104.95
Client/Network Connection IPs 188.253.126.205, 188.253.126.202, 103.36.25.171
agent.exe & dllhost.exe
SHA256: 66a28bd3502b41480f36bd227ff5c2b75e0d41900457e5b46b00602ca2ea88cf
Incident Details Executable (Incident 2, 3)
test.exe
SHA256: 272de450450606d3c71a2d97c0fcccf862dfa6c76bca3e68fe2930d9decb33d2
Incident Details Executable (Incident 2, 3)
Client/Network Connection IPs 188.253.126.202, 103.36.25.169 (Incident 2)
Additional IP (Incident 3) 188.253.121.101
Based on reporting by GBHackers.