chapter1.md

The Phantom Sterling Chronicles: How Toxic Role Combinations Turned Anonymous Access into Global Admin

A cybersecurity thriller based on real-world attack techniques

---

Chapter 1: The Digital Treasure Hunt - Initial Reconnaissance

Day 1 - 3:47 AM EST

Phantom's Mindset: "Every privilege escalation starts with reconnaissance. Blue Mountain thinks their cloud migration makes them more secure, but my extensive background in financial institution security assessments gives me deep insight into their likely architecture patterns. I know where institutions like them typically keep their backup systems—that's where they'll have hidden the cross-subsidiary transaction data that I originally flagged as regulatory violations. They fired me to silence these findings, but now I'll prove I was right."

MITRE ATT&CK Techniques Employed:

• T1590.001 (Reconnaissance > Gather Victim Network Information: Domain Properties)
• T1592.004 (Reconnaissance > Gather Victim Host Information: Client Configurations)
• T1596.001 (Reconnaissance > Search Open Technical Databases: DNS/Passive DNS)
• T1594 (Reconnaissance > Search Victim-Owned Websites)

D3FEND Countermeasures Phantom Studies:

• D3-DA (Domain Analysis) - Phantom understands that Blue Mountain likely monitors certificate transparency logs for suspicious queries, so she distributes her reconnaissance across multiple timeframes and source IPs
• D3-DNSTA (DNS Traffic Analysis) - She uses legitimate DNS over HTTPS providers and varies query patterns to avoid automated detection
• D3-WEBRA (Web Content Analysis) - Phantom crafts realistic user-agent strings and follows normal browsing patterns when accessing public resources

Sophisticated Evasion Methodology - Ghost Protocol:

Phantom's operational security approach reflects her years of professional experience. She knows that Blue Mountain's security team monitors for reconnaissance patterns—after all, she'd once helped design those monitoring systems. Working at night provides her additional cover, as Blue Mountain's security operations center is minimally staffed during off-hours. Her custom toolkit, built around the Blackcat framework, implements sophisticated anti-detection measures.

Using an enterprise-grade VPN with exit nodes in Tokyo, Phantom routes all her traffic through Japanese IP addresses. This geographic routing ensures her reconnaissance appears to originate from legitimate business sources in the APAC region. The BlackCat framework's Invoke-StealthOperation function enhances this approach with multiple stealth options. Using the BusinessHours timing option with Japan as the country parameter, she aligns her traffic patterns with typical Japanese business hours (which conveniently overlap with her late-night East Coast time). This combination of VPN-based IP source manipulation and time-appropriate request patterns effectively masks her nighttime activity while benefiting from the SOC's reduced staffing.

First, she loads her advanced toolset, implementing the timing techniques she'd pioneered in her professional work:

# This code implements the first phase of reconnaissance
Import-Module BlackCat

# Set target domain - the financial institution being investigated
$TargetDomain = "bluemountainbank.com"

# Initialize findings collection
$TargetFindings = @{}

# Use BlackCat's built-in stealth operation with business hours timing
$params = @{
    DelayType = "BusinessHours"
    MinDelay = 5
    MaxDelay = 15
    Country = "JP"
}
"$TargetDomain" | Invoke-StealthOperation @params | ForEach-Object {
    $currentDomain = $_

    # Use BlackCat's Find-DnsRecords function for DNS enumeration with proper throttling
    $DnsResults = Find-DnsRecords -Domains $currentDomain `
        -EnumerateSubdomains `
        -SubdomainCategory "all"
}

# Look for Microsoft verification records (MS=ms######)
$MicrosoftVerificationRecords = $DnsResults | Where-Object {
    $_.RecordType -eq "TXT" -and $_.Data -match "MS=ms\d+"
}

if ($MicrosoftVerificationRecords) {
    # Extract the verification identifier from TXT record
    $VerificationId = ($MicrosoftVerificationRecords[0].Data -replace '.*MS=ms(\d+).*', '$1')
    Write-Host "    [+] Microsoft verification identifier: $VerificationId" -ForegroundColor Cyan

    # Store for potential tenant discovery later
    $TargetFindings.MicrosoftVerificationId = $VerificationId
}

Advanced Caching for Stealth Operations

As each query executes, Phantom watches the results populate with a mixture of satisfaction and disappointment. She appreciates how the BlackCat framework's sophisticated caching system automatically stores all query results locally, dramatically reducing the number of actual API calls required. This built-in intelligence means that when she needs to re-run queries to verify findings, BlackCat seamlessly retrieves the data from its cache rather than generating new requests that might trigger Blue Mountain's security monitoring.

"This caching system is invaluable for staying under the radar," she notes while watching the DNS results populate. The CacheExpirationMinutes parameter gives her precise control over how long data remains valid before requiring a refresh, while CompressCache optimizes storage for the large datasets she's collecting. More than just a stealth feature, the caching system accelerates her work considerably—allowing her to rapidly analyze her findings without waiting for repeated API calls.

Microsoft Verification Records - The First Breakthrough

When the Microsoft verification records appear in the results, Phantom's eyes narrow with interest. "Perfect," she whispers. These special TXT records (containing strings like "MS=ms12345") are crucial findings that confirm the organization is using Microsoft Azure services. Microsoft requires organizations to create these verification records to prove domain ownership when setting up Azure services—essentially providing Phantom with confirmation that Blue Mountain Bank uses Microsoft's cloud infrastructure.

She makes a note to use this verification data to help with tenant discovery later, possibly through techniques like extracting tenant information from login endpoints or examining federation metadata. Combined with the SPF records that reveal their email infrastructure, these findings provide her with a comprehensive understanding of Blue Mountain's digital footprint and authentication systems—crucial intelligence for her mission.

Validating Security Weaknesses

As each query executes, Phantom watches the results populate with a mixture of satisfaction and disappointment. Every positive result validates her predictions about Blue Mountain's architectural weaknesses. The DNS records reveal numerous subdomains she'd flagged in her previous assessment as potential security risks—development environments, test systems, and administrative interfaces that should never be exposed to the public internet.

"Financial institutions always build their systems the same way," she mutters, noting several subdomains with naming patterns that suggested internal tools. "They invest millions in protecting their customer-facing systems but neglect their development infrastructure."

The reconnaissance phase was confirming a critical security principle: an organization's attack surface often extends far beyond its primary domains. She discovers forgotten subdomains hosting outdated applications, misconfigured SPF records exposing email infrastructure details, and DNS entries revealing internal naming conventions—all providing valuable intelligence for later stages. Most concerning were the development and testing environments that appeared to have direct connections to production systems, exactly the architectural flaw she'd warned about in her original assessment.

With the Microsoft verification identifier in hand, Phantom now moves to discover the actual tenant ID (GUID) that would be necessary for targeted API access:

# For complete code, see: /Documentation/code/chapter1/phase1-comprehensive-recon.ps1

# Using the verification data to discover the actual tenant ID
$domain = $TargetDomain  # Using the target domain for tenant discovery
$openIdEndpoint = "https://login.microsoftonline.com/$domain/.well-known/openid-configuration"

try {
    $openIdConfig = Invoke-RestMethod -Uri $openIdEndpoint -Method Get
    
    # Extract tenant ID from authorization endpoint
    if ($openIdConfig.authorization_endpoint -match '/([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})/') {
        $actualTenantId = $Matches[1]
        Write-Host "    [+] Discovered actual tenant ID: $actualTenantId" -ForegroundColor Green
    }
}
catch {
    # Alternative approach - check for login page hints
    Write-Host "    [-] Trying alternative approach..." -ForegroundColor Yellow
}

"There it is," Phantom says, noting down the actual tenant ID (GUID). "Now I have what I need for targeted API access later." Unlike the verification identifier, this UUID is the actual tenant identifier used in Azure AD authentication flows and API endpoints. She adds this crucial piece of information to her target profile, knowing it will be essential for her subsequent actions.

Phase One: Systematic Infrastructure Mapping

Using the domains discovered through her initial DNS reconnaissance, Phantom systematically builds a comprehensive map of Blue Mountain's digital infrastructure.

Her approach mirrors legitimate security research, using tools and techniques that would be indistinguishable from authorized penetration testing. The irony isn't lost on her—she's essentially conducting the same assessment Blue Mountain fired her for completing.

Building on her initial reconnaissance, she deploys more targeted techniques to map the infrastructure in detail:

# For complete code, see: /Documentation/code/chapter1/phase2-infrastructure-mapping.ps1

# First, use Find-SubDomain for dedicated subdomain discovery and enumeration
$SubdomainParams = @{
    DomainName = $TargetDomain
    Category = "all"    # Try all subdomain categories (dev, admin, api, etc.)
    DeepSearch = $true   # Thorough search
    Detailed = $true     # Get detailed information about each subdomain
}
$SubdomainResults = Find-SubDomain @SubdomainParams

# Now use Find-DnsRecords with subdomain enumeration for additional findings
$DnsParams = @{
    Domains = $TargetDomain
    RecordTypes = @("A", "CNAME")   # Focus on address records
    EnumerateSubdomains = $true     # Enable subdomain enumeration
    SubdomainCategory = "all"       # Focus on cloud-related subdomains
    DNSInfoLevel = "Detailed"       # Get comprehensive DNS information
}
$DnsEnumerationResults = Find-DnsRecords @DnsParams

# Combine results and track storage accounts
$AllDomains = @($SubdomainResults.Url.Replace("https://", "")) +
              @($DnsEnumerationResults | Where-Object { $_.RecordType -eq "A" } |
                Select-Object -ExpandProperty Domain)

As the initial reconnaissance completes, Phantom's screen fills with validation of her darkest suspicions. The systematic discovery approach has yielded a gold mine of information, with each finding confirming what she already knew—Blue Mountain Bank had ignored her security recommendations and left themselves vulnerable.

"They've still got everything exposed," she whispers, reviewing the master inventory that now contains dozens of subdomains, Azure resources, and potential entry points. The subdomain discovery reveals several critical findings:

storage.bluemountainbank.com
dev-portal.bluemountainbank.com
backup.bluemountainbank.com
legacy-docs.bluemountainbank.com
consolidation.bluemountainbank.com
reporting.bluemountainbank.com

"Perfect," Phantom notes with grim satisfaction. "Those last two are exactly where they'd store the cross-subsidiary data that violated federal banking regulations."

Each discovered domain triggers memories of her original findings. The backup systems she'd warned were too permissive. The development portals she'd flagged as containing production data. The legacy documentation that contained sensitive configuration details. But most importantly, the consolidation and reporting systems she'd specifically called out for regulatory violations in her original report—the very findings that had cost her career.

"Now that I've mapped out their domains with Find-DnsRecords and Find-SubDomain," she says, analyzing the results, "it's time to see what services are running on each of these endpoints."

Phase Two: Systematic Penetration Following the Kill Chain

Phantom's approach now shifts from passive reconnaissance to active targeting. Unlike typical attackers who might employ a "smash and grab" approach, she implements a methodical kill chain that progressively builds on each discovery:

# For complete code, see: /Documentation/code/chapter1/phase3-azure-service-fingerprinting.ps1

# Define Azure service endpoints to check
$EndpointsToCheck = @{
    ".scm.azurewebsites.net" = @{
        Path = "api/vfs"
        Description = "Azure App Service Kudu API"
    }
    ".azurewebsites.net" = @{
        Path = ".well-known/openid-configuration"
        Description = "OpenID Configuration"
    }
}

# Test endpoints using BlackCat's service fingerprinting capabilities
# Using random timing with increased jitter to further obfuscate the pattern of requests
$stealthParams = @{
    DelayType = "Random"
    MinDelay = 1
    MaxDelay = 3
    Jitter = 0.4
    InputObject = $MasterInventory.Domains
}
$stealthResults = Invoke-StealthOperation @stealthParams
foreach ($domain in $stealthResults) {
    Test-AzureEndpoint -BaseUrl "https://$domain" -EndpointPath "api/data" -Description "API endpoint" -UseJitter
}

For the final phase of her Day 1 reconnaissance, Phantom implements targeted vulnerability scanning against the discovered resources:

# For complete code, see: /Documentation/code/chapter1/phase4-vulnerability-scanning.ps1

# Use Find-DnsRecords for records that might indicate vulnerabilities
$FinalDnsCheck = Find-DnsRecords -Domains $TargetDomain `
    -RecordTypes @("TXT", "CNAME") `  # These often contain sensitive information
    -DNSInfoLevel "Detailed"

# Use Find-SubDomain with a special wordlist for sensitive resources
$SensitiveParams = @{
    DomainName = $TargetDomain
    Category = "sensitive"  # Category focusing on potentially sensitive endpoints
    DeepSearch = $true
    Detailed = $true
}
$SensitiveSubdomains = Find-SubDomain @SensitiveParams

# Check Azure Storage Accounts for misconfigurations
$storageStealthParams = @{
    DelayType = "Random"
    MinDelay = 1
    MaxDelay = 3
    InputObject = $MasterInventory.StorageAccounts
}
$storageStealthResults = Invoke-StealthOperation @storageStealthParams
foreach ($account in $storageStealthResults) {
    $vulnerableContainers = Find-PublicStorageContainer -StorageAccount $account
    
    if ($vulnerableContainers -and $vulnerableContainers.Count -gt 0) {
        Write-Host "  [!] Found public containers in $account" -ForegroundColor Red
        $PublicStorageFindings += $vulnerableContainers
    }
}

By 8:00 AM, with the morning light beginning to break through the Seattle rain clouds, Phantom has compiled a comprehensive map of Blue Mountain's digital presence. The initial reconnaissance phase has been successful beyond her expectations—confirming that despite their supposed security improvements, the same fundamental flaws she'd identified during her original engagement were still present.

She reviews her findings, pleased with how the combination of BlackCat's functions provided comprehensive coverage:

"Find-DnsRecords gave me the detailed DNS information I needed, while Find-SubDomain found subdomains I would have missed otherwise," she notes in her log. "Using both together created a complete picture of their infrastructure."

She carefully encrypts her findings and closes her laptop. "That's enough for today," she whispers. "Tomorrow, we dig deeper."