HTB Sherlock Constellation Writeup: Insider Threat Timeline and OSINT
A Hack The Box Sherlock Constellation walkthrough covering memory-extracted URLs, Discord attachment timestamps, Google search artifacts, document metadata, and OSINT attribution.
Constellation is a Hack The Box Sherlock that mixes DFIR, URL timestamp analysis, document metadata, and OSINT. I rewrote this post to follow the original task path more closely: decode the recovered communication artifacts, establish the file-transfer timeline, inspect search activity, and then pivot into attribution.
Task 1: DM Conversation Start Time
The recovered Discord artifact contained enough timestamp information to establish when the direct conversation first began. I used Unfurl to decode the timestamp from the URL-like evidence.
Answer: 2023-09-16 16:03:37
Task 2: File Sent to the Suspected Insider
The attachment evidence showed the file name sent through the conversation. This document became the main artifact for later metadata review.
Answer: NDA_Instructions.pdf
Task 3: File Sent Timestamp
Decoding the attachment timestamp placed the file transfer on the timeline. This happened shortly before the suspect's relevant search activity.
Answer: 2023-09-27 05:27:02
Task 4: Google Search Query
A recovered Google search URL revealed what the user was trying to learn after receiving the document. The query pointed toward archiving a folder with tar.
Answer: how to zip a folder using tar in linux
Task 5: Original Typed Words
The search artifact also preserved the partial text that was typed before the final query was submitted.
Answer: How to archive a folder using tar i
Task 6: Search Timestamp
The decoded search timestamp showed that the query happened only minutes after the suspicious PDF was sent, which strengthened the timeline connection.
Answer: 2023-09-27 05:31:45
Task 7: Threat Group Name
After the local artifacts established the timeline, the investigation moved into OSINT. The external entity was tied to a named group.
Answer: AntiCorp Gr04p
Task 8: Suspected Insider
The evidence pointed to the employee who interacted with the external actor and received the file.
Answer: Karen Riley
Task 9: Anomalous PDF Creation Date
Running ExifTool against the PDF exposed metadata that did not fit a normal timeline. The creation date was clearly anomalous and worth calling out.
Answer: 2054-01-17 22:45:22
exiftool NDA_Instructions.pdf
Task 10: Real Name of the External Actor
Searching the attacker contact details led to public OSINT that identified the person behind the contact.
Answer: Abdullah Al Sajjad
Task 11: City
The same OSINT trail also exposed the city associated with the person.
Answer: Bahawalpur
Key Takeaways
- Recovered URLs can carry timestamps that are strong enough to build an incident timeline.
- Search artifacts can preserve both intent and timing.
- Document metadata is useful when it is compared against the rest of the timeline, not viewed in isolation.
- OSINT pivots should be tied back to local evidence so attribution does not float away from the case facts.