## https://sploitus.com/exploit?id=1433F0E8-B2C7-5A42-B94C-6A3E5FE852AF
# 🛡️ SOC Investigation Report: CVE-2024-49138 Exploitation
## 📌 Executive Summary
- **Alert Title:** SOC335 - CVE-2024-49138 Exploitation Detected
- **Severity:** High
- **Target Host:** Victor (`172.16.17.207`)
- **Operating System:** Windows 10
- **Primary User:** letsdefend
- **Verdict:** True Positive (Malicious Activity Confirmed)
---
## 🔍 Investigation Methodology
### 1. Process & Binary Analysis
- **Suspicious File:** `svohost.exe`
- **Execution Path:** `C:\temp\service_installer\svohost.exe`
- **Anomalies:**
- **Process Masquerading:** Name mimics the legitimate Windows system file `svchost.exe`.
- **Path Location:** System binaries run from `C:\Windows\System32\`, whereas this binary executed from a user `temp` path.
### 2. Threat Intelligence Verification
- **File Hash:** `b432dcf4a0f0b601b1d79848467137a5e25cab5a0b7b1224be9d3b6540122db9`
- **VirusTotal Detection:** **50/71** security vendors flagged the file as malicious.
- **Threat Classification:** `Trojan/Win64.MalwareX`, tagged with `cve-2024-49138` privilege escalation exploit.
### 3. Log Management & Network Correlation
- Queried SIEM logs for host IP `172.16.17.207`.
- **Findings:** Confirmed outbound network connection to external Command & Control (C2) IP `185.107.56.1`.
---
## 🛑 Containment & Remediation Actions
1. **Host Isolation:** Navigated to EDR Endpoint Security and toggled **Containment: Enabled** for host `Victor` (`172.16.17.207`) to block network traversal.
2. **Artifact Logging:** Documented malicious file hash, C2 IP, and target host IP in Case Management.
3. **Case Closure:** Finalized playbook analysis as **True Positive**.
---
## 🎯 Indicators of Compromise (IOCs)
| Artifact Type | Value | Description |
| :--- | :--- | :--- |
| **File Hash (SHA-256)** | `b432dcf4a0f0b601b1d79848467137a5e25cab5a0b7b1224be9d3b6540122db9` | Malicious Exploit Executable |
| **C2 IP Address** | `185.107.56.1` | Command & Control IP |
| **Victim IP** | `172.16.17.207` | Compromised Windows 10 Host |
| **File Path** | `C:\temp\service_installer\svohost.exe` | Executable Location |