CVE-2024-49138 PoC — Windows Common Log File System Driver Elevation of Privilege Vulnerability

Description

Hands-on SOC investigation of CVE-2024-49138 using LetsDefend, VirusTotal, Hybrid Analysis, TrueFort, and ChatGPT.

Readme

# LetsDefend Investigation: CVE-2024-49138

## 🔍 Overview

Hands-on SOC investigation and incident response simulation using [LetsDefend](https://letsdefend.io/), focused on a real-world exploitation of **CVE-2024-49138** — a privilege escalation vulnerability in Windows CLFS driver.

## 📅 Event Details

- **Event ID**: 313
- **Incident Type**: Privilege Escalation
- **Event Time**: Jan 22, 2025
- **Hostname**: Victor
- **IP Address**: 172.16.17.207
- **Malicious Binary**: `svohost.exe`
- **Parent Process**: `powershell.exe`
- **Suspicious Command**: `\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1`

## 🛠️ Tools Used

- [VirusTotal](https://virustotal.com)
- [Hybrid Analysis](https://www.hybrid-analysis.com)
- [TrueFort](https://www.truefort.com)
- [ChatGPT](https://chat.openai.com) — For decoding PowerShell commands and analyzing behavior
- LetsDefend Lab Environment

## 🧠 Indicators of Compromise

- **Hash**: `b432dcf4a0f0b601b1d79848467137a5e25cab5a0b7b1224be9d3b6540122db9`
- **Malicious URL**: `https://files-ld.s3.us-east-2.amazonaws.com/service-installer.zip`
- **Malicious IP**: `185.107.56.141`

## 🧩 Key Takeaways

- Identified fake system binary (`svohost.exe`) used for privilege escalation.
- Mapped activity to MITRE ATT&CK techniques.
- Used a layered toolset for full visibility (EDR, sandboxing, static/dynamic analysis, AI).
- Gained insight into PowerShell-based malware delivery methods.

## 🏁 Outcome

Successfully triaged, investigated, and documented the attack chain leveraging CVE-2024-49138. This lab helped reinforce my skills in incident response, behavioral analysis, and threat detection.

## 🔎 Investigation Screenshots

### Alert Triggered in LetsDefend
![Alert Screenshot](/Alert-Panel.png)

### VirusTotal Result for Malicious Hash
![VirusTotal](/VirusTotal.png)

### 🔬 Process Tree Analysis
![Process Analysis](/Process.png)

### 🧪 PowerShell & AbuseIPDB Usage
![AbuseIPDB](/AbuseIPDB.png)

### 📋 Incident Notes
![Notes](/Note.png)

### 🪟 Windows Artifacts
![Microsoft Artifact](/Microsoft.png)

### ✅ Final Wrap-up / Task Marked
![Final](/Mark.png)


---

> “Getting 1% better every day.”

File Snapshot

Remarks