TerminalFix: Steganographic PNG Payload to a Python Reverse Tunnel

An endpoint alert fired on CMI-WKS-07 this morning, and the note reads almost reassuring: LockScreenContentServer.exe, a signed Microsoft binary, ran on a claims analyst's machine, and a handful of PNG image files were written to disk around the same time. A signed Windows component and a few pictures are the kind of thing most shifts wave through. The analyst says they pasted a verification command into a terminal to get onto a site earlier, which the help desk already knows about, so how the activity started is not in question. What happened after it is. Get oriented across the endpoint, SIEM and firewall evidence before you start.

A binary being signed by Microsoft tells you who built it, not where it should run from or what it should load. Working from the process-creation and image-load telemetry on CMI-WKS-07, establish where LockScreenContentServer.exe actually executed from and the module it loaded out of that same location. Report the name of the folder under ProgramData it ran and loaded from.

A minute or two after LockScreenContentServer.exe started, two autostart entries appeared on the host: a registry Run value and a scheduled task, both pointing at the same binary and both created under one name. Signed software registers its own autostart all the time, so the entries are not damning on their own. Working from the registry and scheduled-task telemetry, report the name both entries were created under, exactly as written.

Later in the window, a windowless process on the host opened one outbound session and kept it established while the rest of the host's traffic was ordinary short-lived web requests. To decide whether the host needs containment, work out where that session goes: correlate the name resolution with the perimeter and endpoint network records and report the external destination it connects to.