## 5 Results  
### Experimental Scenario: Malicious Documents  
Malicious documents fall under social engineering [33], which can be defined as malicious activities that are facilitated through human interaction. The tactic uses psychological manipulation [34], which is the process of tricking a user to perform a certain task that will lead to the giving away of sensitive information or the opening of a backdoor that may compromise a system. The adversary first examines the target and gathers necessary information about an individual or company; then, the adversary searches for weak entry points and security protocols for a successful attack. An example is a phishing email, where a user obtains a malicious document from an email with a script that runs once macros are enabled. In the lab experiment, the researchers launched an attack using the Covenant C2 framework to generate a payload that can be embedded in a Microsoft Excel document. Figure 6 is an illustration of the payload generation consisting of visual basic code. The researchers delivered the infected Microsoft Excel document to the targeted machine and simulated the victim's interaction with the malicious document to gain unauthorised access to the victim's machine. Once the attack was launched, from the analyst's perspective, alerts were triggered in the Squert web interface, notifying the analyst of a possible attack. The alerts shown in Figure 7 indicate a compromised system (hence the insignia colour), and from it, the analyst observed that there was a PowerShell file request made over an HTTP connection which was associated with a Covenant C2 framework attack. However, in real life, these connections may be encrypted with a secure transport (TLS), making the connections difficult to detect. The analyst further examined the alerts to pull a CapME transcript to obtain details of the network traffic flow (Figure 8) and observed a PowerShell script block. The transcript is a textual format of a full packet capture and can also be downloaded as a full network packet capture specifically for that event. Figure 5: Malicious document execution process. Figure 6: Covenant C2 malicious payload generation. Figure 7: Squert web interface alerts. The analyst switched from the SQuert web interface to the Velociraptor web interface, a digital forensics/EDR tool, to perform investigations on the endpoint device. The network investigations revealed suspicious behaviour; however, there was no knowledge of how it started, who did it, and so on. A query on events creation was performed using the velociraptor process creation artefact, and several interesting rows were returned, as shown in Figure 9.  
In Figure 9, label 1, the analyst observed evidence of a PowerShell process creation with an encoded command consisting of _-nop_ (no profile) and _-Window Hidden_ (window  
Figure 8: CapME transcript showing the PowerShell stager. Figure 9: Velociraptor process creation events. hidden) attributes. It is evident that the excel.exe process with _PID_ (process identification number) _2844_ initiated the powershell.exe process with _PID 3272_, whilst the powershell.exe invoked the conhost.exe with _PID 2880_, which is used to assist third-party software in initiating and managing the command line. It is not normal for software like Microsoft Excel to launch system programs such as PowerShell, and this is suspicious behaviour. The analyst queried for a parent-child process attack using the artefact _Windows.Attack. ParentProcess_. The Velociraptor artefact validates whether an adversary or malware is maliciously executing a legitimate process or not. The results showed that powershell.exe was the actual process name, and the actual parent's name was excel.exe.