Sans book 2 Flashcards
(125 cards)
1
Q
Keyword
A
Description
2
Q
Malware execution (WER Report)
A
Windows Error Logs (WER) are stored as files named Report.wer and are written in plain text or XML format. Of notes, they can include the SHA1 hash of a file, although note that there is a file size limitation, so the Report.wer won’t catch very large files.
They can be present in multiple different “WER” folders including:
> C:\ProgramData\Microsoft\Windows\WER
> %User Profile%\AppData\Local\Microsoft\Windows\WER (also check Default, Public, and ALL Users profiles)
3
Q
ShimCache: Application Compatability Cache
A
Designed to detect and remediate program compatibility challenges when a program launches. Different compatability modes are called “shims”.
4
Q
ShimCache: Location Windows 7+
A
Memory: SYSTEM\CurrentControlSet\Control\SessionManager\AppCompatCache\AppCompatCache
5
Q
ShimCache: Location Windows XP
A
Memory: SYSTEM\CurrentControlSet\Control\SessionManager\AppCompatibility\AppCompatCache
6
Q
AppCompatCacheParser.exe
A
Used to parse an offline SYSTEM hive or to collect data on a live system (Windows 7 and above).
7
Q
Amcache
A
Amcache tracks installed applications, programs executed, drivers loaded among others. It provides full path info, file size, publisher metadata, loaded drivers, SHA1 hash, and timestamps. Iportant keys are InventoryApplication, InventoryApplicationFile and InventoryDriverBinaries.
8
Q
Amcache: Evidence of Execution
A
Does not confirm execution, as AmCache also tracks .exe and .dll that were copied as part of application execution and .exe present in one of the directories scanned by the Microsoft Compatibility Appraiser scheduled task.
9
Q
InventoryApplicationFile
A
Amcache registry hive containing list of applications
10
Q
InventoryApplication
A
Amcache registry hive containing a list of “installed” applications, so contains a subset of InventoryApplicationFile
11
Q
InventoryDriverBinaries
A
Amcache: Contain information relating to loaded drivers
12
Q
AmcacheParser.exe
A
Tool to parse Amcache data.
13
Q
Amcache_ProgramEntries
A
Contains data from the InventoryApplication key. Contains metadata on installed applications.
14
Q
Amcache_UnassociatedFileEntries
A
File in InventoryApplicationFile key detailing information on executables present on the system that have not been installed as part of an installation package.
15
Q
Amcache_DriverBinaries
A
Output from AmcacheParser containing information from the InventoryDriverBinaries key
16
Q
appcompatprocessor.py
A
Toolset deisgned to perform hunting of ShimCache and Amcache artifacts placingthe result in a SQLite database.
17
Q
Event Logs: Location (Vista and before)
A
%systemroot%\System32\config
18
Q
Event Logs: Location (post-Vista)
A
%systemroot%\System32\winevt\logs
19
Q
Event Logs: Custom Location (Registry)
A
> HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application
HKLM\SYSTEM\CurrentControlSet\Services\EventLog\System
HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Security
20
Q
Event Logs: Max Capacity/Log Rolling
A
When the max size of a log is reached, you can:
> Overwrite events as needed (Default)
> Archive the log when full; do not overwrite events (“Archive-Security-<Date>")
> Do not overwrite events (error messages generated to indicate full event log), requires manual clearing.</Date>
21
Q
Event Logs: Three primary types
A
> Security: Records events based on auditing criteria included in local or group policies.
System: Records events logged by the OS or its components.
Application: Records events logged by applications.
22
Q
Security Logs Overview
A
> Only the Local Security Authorit Subsystem Service (LSASS) can interact with the Security log
Only admins can review, export, or clear the log
There is currently no known method to manipulate the log effectively.
23
Q
Security Logs Objects
A
> Account Logon
Account Mgmt
Directory Service
Logon Events
Object Access
Policy Change
Privilege Use
Process Tracking
System Events
24
Q
Prefetch: Definition
A
OS loads data/code into memory (prefetch directory) before needed.
25
Prefetch: directory
Contains 128 .pf files on Windows 7 and before. 1024 files on Windows 8 and above.
26
Prefetch: .pf file
Prefetch file. Captures 8 execution times = 9 run times when added to file system creation time.
27
Prefetch: cache manager
Prefetch: Records files and directories for .pf prefetch files.
28
Prefetch: file name / hash
Combination of .exe file name, a dash, and a hexadecimal representation of a hash of the file's path.
29
Prefetch: registry key 1
SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management EnablePrefetcher
30
Prefetch: registry key 2
SYSTEM\CurrentControlSet\Services\SysMain Start
31
SuperFetch
Prefetch: stored in files name Ag*.db (AgAppLaunch.db)
32
Prefetch: First Execution
Creation date of .pf file (~-10 seconds)
33
Prefetch: Last Executed
Last modification date of .pf file (~-10 seconds) + also in the .pf file as last time entry
34
PECmd.exe
Tool to parse and audit Prefetch files
35
Per-User Service
Beginning with Windows 10, Windows is now starting and stopping unique instances of services for each user logon. These services are named by adding a Locally Unique Identifier (LUID) to end of the service name. This makes the Security log much more voluminious. As such, it is important to rely on the System log more for malicious services.
36
Log Clearing
> Local administrators, domain administrators, and the local SYSTEM account all have the privileges to clear event logs (admin privs required).
> This will generate a ID 1102 event in the Security logs. ID 104 will be generated when any other log is cleared. Clearing from both the Command Line and GUI are captured.
> Only writable by LSASS (see Local Security Authority Subsystem). Log clearing is all or nothing.
37
Event Log Clearing (See log clearing)
38
Local Security Authority Subsystem Service (LSASS)
39
EvtxECmd
> Tool used to analyse Windows Event Logs.
> True value is ability to filter, normalise, and merge logs at scale from lots of different systems.
> It can be run on a live system or a collection of logs and used Xpath map files to synchronise output from lots of event types. Xpath allows us to identify specific parts of XML output. The Map file contains the values of the event type to extract using Xpath filter notation.
> It can also analyse Volume Shadow Copies (VSS) when run on live systems.
40
Map files (see EvtxECmd)
The standardised fileds that are available for use in maps include:
> UserName:
> RemoteHost
> ExecutableInfo: Used for things like process command line, scheduled task, info from service install.
> PayloadData1-6:
41
TerminalServices-RDPClient/Operational log
> Used to track RDP use on the source system, which is rare in Windows OS.
> You can also view the NTUSER\Softare\Microsoft\Terminal Server Client\Servers registry key for info from a source system. RegRipper plugin "rdphint" parses this data.
42
Microsoft-Windows-TerminalServices-RDPClient/Operational log
(see TerminalServices-RDPClient)
> TerminalServices-RDPClient/Operational log
> NTUSER\Software\Microsoft\Terminal Server Client\Servers registry key
> Jump List: mstsc.exe = RDP client
> Default.rdp in User Profile.
> RDP Bitmap Cache (bmc-tools.py to parse)
> Application logs for VNC tools or RMM tools like AnyDesk (C:\ProgramFiles\*)
43
RDP: Source System Logs
44
mstsc.exe (see RDP: Source System logs)
RDP Client in Jump List
45
Default.rdp (See RDP: Source System Logs)
User profile file indicating RDP use
46
RDP: Disable
> Active Directory setting "Deny log on through Remote Desktop Services" can be easily set on high valued accoutns.
> At the host level, RDP service can be disabled and the Windows firewall can be set to deny inbound RDP connections in parts of the network where RDP isnt required.
47
Admin Shares
> Default shared resources designed to allow administrative programs access to the entire file system. The most commonly abused are the drive volume shares (like C$), the Admin$ share giving access to the Windows folder, and the IPC$ share commonly used by named pipes.
> Note that Domain Admin prvileges are now required for access to admin shares.
48
Lateral movement: Admin shares
See Admin shares
49
Admin Shares: Source System Artifacts
> Command line auditing and the use of commands like "net use".
> Registry: NTUSER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2 (shows list of systems connected to by user)
50
MountPoints2
Registry key for admin shares (see Admin Shares)
51
Admin Shares: Destination System Artifacts
> 4624 Type 3 logons and 5140 share access events. Rebuild SMB sessions using network monitoring.
52
PsExec: Source System Artifacts
> Look for PSEXEC.EXE on the source system in Prefetch, ShimCache, BAM/DAM, and Amcache.
> Registry key (first run time): NTUSER\Software\SysInternals\PsExec\EulaAccepted
> Explicit creds used: EID 4648 "runas" event created.
> Command line auditing
> PSEXEC.EXE (or renamed binary) in running processes or memory).
53
PsExec: Destination System Artifacts
> Steps: user authenticates to destination system, named pipes are set up, the ADMIN$ share is mountsed, and PSEXESVC.exe is copies and run.
> Event logs: 4624 Type 3 (and Type 2 if alternate creds used = user profile created), 4672, 5140 (admin$ share used), 7045 (service installation).
> Registry: (new service) SYSTEM\CurrentControlSet\Services\PSEXESVC, (Shimcache) psexesvc.exe, (Amcache.hve (psexesvc.exe.
> File system: (prefetch) C:\Windows\Prefetch\psexesvc.exe, psexesvc.exe places in ADMIN$ by default, as well as other .exe pushed by the service, (user profile) profile created, unless -e flag used.
> Named pipes: used by IPC$ to establish system to system communication.
54
Windows commands (see Remote Services)
Numerous Windows commands have remote execution functionlity.
> Create and start a remote service: sc \\host create [service], sc \\host start [service]
> Remote scheduled task: at \\host 13:00 ".exe", schtask /CREATE /TN [task]
> Remote registries: The Remote Registry service (reg.exe) can be run
> WinRM: If enabled Windows Remote Management can be used to run a windows remote shell (winrs) session on a remote host.
55
Living off the land binaries (windows commands)
> Use of legitimate Windows binaries to carry out malicious activity
> LOLBASE (Living off the land binaries and scripts): Project collecting LOL techniques.
> Common examples: Bitsadminexe and certutil.exe (file download), rundll32.exe (execute code in DLLs)
> To determine use of these tools, we need full command line to capture DLLs run by rundll32 for example.
56
Windows Remote Management
>If enabled on a system, WinRM can be used like PsExec to run remote commands. It can also be turned on by attackers to move laterally. Uses winrs, which starts the winrshost.exe.
> Microsoft-Windows-WinRM/Operational log tracks Win?RM connections, which is the primary protocol for PowerShell remoting. This is avaialble on both source and destination systems and records the destination hostname, IP, current logged-on user (Event ID 6) and the source session creation (EID 91) and the authenticating user account (EID 168).
57
Windows Remote Shell (winrs)
See Windows Remote Management
58
Remote Services (see Windows Commands)
> Evidence of sc.exe on source system can be seen via application execution artifacts (ShimCache, BAM/DAM, AmCache, Prefetch).
> Evidence on Destination system exists in event logs: 4624 Type 3, 4697 service installation and related SYSTEM service logs like 7034.
> Registry: CurrentControlSet\Services\ for new service, ShimCache and AmCache hive for malicious exe's.
> File system: malicious service executable or service DLL in file creation or Prefetch file of malicious executable.
59
Scheduled Tasks: Source and Remote System Artifacts
See page 126 for evidence in Event Logs, Registry, and File System.
60
Windows Management Instrumentation: Lateral Movement
> WMI is a flexible remote and local management infrastructure that leverages PowerShell to execute commands. The most common is "process call create", which gives adversaries similar function to PsExec while leaving fewer artifacts. WMI commands are typically not encrypted unless used over WinRM (using PowerShell for example).
> On the source system wmic.exe is the only useful artifact (see ShimCache, AmCache, and PreFetch), but command line auditing is required to understand what was run.
> On the destination system, you are primarily looking for auth events tied to wmiprvse.exe, which is the core process used for remote wmic actions. But your key resource is the Microsoft-Windows-WMI-Activity/Operational log, which can help identify WMI event consumers. Also evidence of mofcomp.exe or .mof files are strong as they are used ti implement event consumers.
61
PowerShell: Lateral Movement and Remote Execution
> Remote powershell uses the WinRM protocol to scale tasks. However, note that remote PowerShell needs to be enabled.
> The most common comands are Invoke-Command and Enter-PSSession. The later provides an encrypted interactive shell to the remote system similar to SSH.
> On the source system, look for powershell.exe in common application execution artifacts. You can also look at Microsoft-Windows-PowerShell/Operational and Microsoft-WinRM/Operational logs. You can also look at ConsoleHost_history.txt on anything later than PowerShell version 5, as it records the last 4096 commands typed. Lastly look for Windows Remote Management (WS-Management) service enabled in environments that dont use it.
> On the destination system, look for wsmprovhost.exe following a Type 3 network logon. Then is enabled, Microsoft-Windows-PwerShell/Operational logs capture PowerShell script contents.
62
Application Deployment Software: Controls
> Limit and monitor accounts that have access to patch management or deployment tools
> Create unique accounts for this purpose
> Control patch management cycle times closely to facilitate malicious activity
> Creation and monitoring of test systems to collect and log package deployment.
> Note that their may be multiple deployment softwares across network segments, so it is important to make these changes for each one.
63
Vulnerabilities: Lateral Movement
Vulnerabilities in Windows can be used for lateral movement. But these vulnerabilities are rare. Much more common are vulnerabilities in custom applications, which are difficult to patch. SANs groups remote access tools like Peterpreter and Cobalt Strike Beacon into these cateogires, as they circumvent the standard authentication process.
64
Vulnerabilities: Malware based lateral movement
> Detecting malware-based lateral movement can be a challenge.
> Pay attention to system crashes recorded in event logs
> Use threat intelligence to track signatures
> Use signatures built into EDR solutions.
> Analyse running processes and system memory.
65
Malware lateral movement (See vulnerabilities)
66
Malware exectuion (evidence)
> Because Process Execution tracking is left disabled in most environments, we rely on System and Application logs heavily.
> In particular, you are looking for Critical, Error, and Warning events. The best ones are the security tooling alerts that get logged or evidence of system crashes or reboots.
> EID 1000 and 1002 report application errors and hands in Windows Error Reporting logs (WER).
67
Microsoft Protection Log (see Microsoft Defender Logs)
> MPLog files are primarily used for diagnostic and troubleshooting purposes. They are in text form and can be opened and viewed using a txt editor. There can be multiple log files, named according to their creation time, but it is rare to see data going back further than a month.
> They should be used as a supplment to the primary Windows Defender log. For example, you can sometimes pull SHA1 hashes using this data. They can also be used to uncover renamed files, as the "Origional filename" is sometimes written.
> The "tainted" flag is used to track files that have been injected.
> You can also use the MPLog to track running processes at a point in time, as this is one of the only places this information is audited.
> Again, the data can be overwhelming, so it is to be used as a supplment when IOCs are preferably already known. "detection", "tainted" or SDN Query" are common bad terms.
68
Microsoft Defender Logs
> Microsoft-Windows-Windows Defender\4Operational.evtx is the primary logs for Defender alerts. It can often provide 6 months of alerting. Use Event IDs 1116-1119 to capture malware detection events, actions taken on those events, and any failures while taking actions.
> Microsoft Protection Log (MPLog) found at C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory can also fill in alerting gaps as a supplement to the primary logs.
> Don't forget to check the quarentine folder, which may still contain the malicious files (maldump to extract). This can be found at C:\ProgramData\Microsoft\Windows Defender\Quarentine
69
Process Tracking Events
> EID 4688 (start) and 4689 (stop) in Security logs.
70
PowerShell Tracking
> With Server 2012R2, Microsoft released a new group policy setting to enable recording of full command lines in process reporting: Computer Configuration > Policies > Administrative Templates > System > Audit Process Creation.
> This audit requires process creation auditing to be enabled. While this can be voluminous, it can be helpful on critical systems.
> Note that EID 4688 now includes the Process name, in addition to the Process ID, which was legacy.
71
Command Line Tracking (see PowerShell tracking / PsExec)
72
Windows Management Instrumentation (WMI): Overview
> WMI is Microsoft's implementation of the WBEM standard and is used to help the administration of large enterprise environments.
> WMIC.exe is the traditional portal for executing WMI commands, but this has largely been deprecated in favor of PowerShell, which has native WMI support. As such, much of your findings will be found in command line auditing or powershell logging.
> It is largely memory only, uses trusted signed binaries, and on the network side, it uses all standard DCOM/PSRemoting traffic, that is sometimes encrypted.
73
Windows Management Instrumentation (WMI): Reconnaissance
74
Windows Management Instrumentation (WMI): PrivEsc
> The most common tool for WMI PrivEsc is "PowerUp.ps1". This leverages WMI to query 20 common misconfigurations that can be used to elevate privs.
> These queries hunt for all service paths that have a space, highly privileged processes, unquoted service paths set to auto-start with the service binary not present under a Windows folder.
75
Windows Management Instrumentation (WMI): Lateral Movement
> wmic process call create: this command can be used to execute code on a remote system. It is essentially a stealthy version of PsExec.
> NetEnum/NetAdd commands can also be used to duplicate tokens of logged in users.
76
Windows Management Instrumentation (WMI): Logging/Auditing
> Command line auditing in Security or Sysmon logging makes discovering WMI usage trivial. However, without it investigating WMI use is very difficult.
> You would see wmic.exe running on a system.
> You may be able to rely on command line auditing from an EDR tool.
> You may see evidence in WMI auditing: WMI-Activity/Operational. However, this won't include the command line.
77
Windows Management Instrumentation: Persistence
> To set up WMI persistence you need three discreet steps:
> 1. An event filter must be created describing a trigger to detect
> 2. An event consumer is added with a script and/or executable to run (typically CommandLine or Active Script consumers, PowerShell commands, or scripts/exe). Scrcons is the ActiveScript consumer and wbemcons.dll is the command line event consumer.
> 3. The event and consumer are tied together via a binding and the persistence tool is loaded into the WMI repository.
> To review this activity, you would rely on the WMI-Activity/Operational log: EID 5861 for new consumers (exe's, PowerShell, or VBScript), EID 5857 to track loaded DLLs, EID 5858 for WMI query errors. You can of course also rely on command line auditing.
> You can also run searches for PowerShell, eval, .vbs, .ps1, and ActiveXObject.
78
Active Script event consumer for WMI persistence
scrcons
79
Scrcons
Active Script event consumer for WMI persistence
80
Command Lined Event Consumer for WMI
wbemcons.dll
81
wbemcons.dll
Command line event consumer for WMI persistence
82
Script block logs (see PowerShell logs)
> Audits are recorded as event log entries in Microsoft-Windows-PowerShell/Operational
> This happens regardless of whether PowerShell was executed from a command shell, the integrated scripting environment, or via custom hosting of PowerShell components.
> Script block logs record the code blocks executed, including dynamically generated script contents, but typically no output. Windows will label events as EID 4104 Warning events. in Powershell/Operational logging.
83
Module Logs (see PowerShell: Module logs)
84
Powershell Version 5 (and 6 and 7)
PowerShell "Core" versions 6 and 7 are rewrites of PowerShell using the .NET Core, allowing the tool to be used across all operating systems. However, these versions are intended to coexists with PowerShell version 5 and not be rplacements. They are installed in seperate locations, have seperate group policy parameters, and have seperate logs. Note that you need to turn on script block logging for all versions independently, but the logs will all come to Microsoft-Windows-PowerShellCore/Operational
85
PowerShell Logs
> Script block logs can caputre the full command or contents of a script, who executed it, and when it occurred. These are recorded in Microsoft-Windows-PowerShell/Operational. EID 4104 records the Script block contents, but only the first time it was executed.
> Although script block logging is not enabled by default, suspicious scripts will still get logged in Microsof-Windows-PowerShell/Operational.
> You can also review EID 400 and 800 in the Windows Powershell.evtx log.
> Lastly, you should review WinRM logs in Microsoft-Windows-WinRM/Operational for EID 6, 91, 168. WinRM is the primary protocol for PowerShell remoting.
> A strong Powershell audit policy should include Module Loggong, PowerShell Script Block Logging, and PowerShell Transcription.
86
PowerShell logs: Script block logs
See Script block logs
87
PowerShell: Module logs (see PowerShell logs)
> Module logging focuses on PowerShell pipeline execution. Almost every command uses several modules or cmdlets and EID 4103 events can include variables, commands, interim output, and even some deobfuscation.
88
PowerShell version 2 downgrade attack
This is done to circumvent logging. V2 has much less logging enabled. Look for EID 400 in Windows PowerShell.evtx. Also look for powershell-Version 2 command in command-line auditing. It is recommended to remove V2 from your environment.
89
PowerShell: Stealth Syntax
90
PowerShell: Commonly abused keywords
91
cradle
Fileless, memory-less malicious scripts downloaded from the internet.
92
AMSI
See Antimalware scanning interface
93
Anti-Malware Scanning Interface
Can audit code at the point of execution in order to defeat obfuscated powershell codes.
94
Revoke-Obfuscation
uses feature extraction and character frequency analysis to identify strange looking scripts in PowerShell logs. You can run this against PowerShell/Operation logs.
95
CyberChef
Two features are most important: this tool is capable of running a local instance of the web app. You can also use the "Magic" decoder, which attempts to intuit the correct recipe for decoding input.
96
Transcription logs (PowerShell)
Display the contents of the Powershell terminal including inputs and outputs. This is unlike script block logging, which would only capture the script run.
97
PSReadline
Default module designed to log the last 40,96 commands types I PowerShell console. Output stored in ConsoleHost_history.txt. Only commands that ar types are logged. No timestamps available. Only recorded during interactive sessions explicity using the PowerShell console.
98
ConsoleHost_history.txt
Output of PSReadline PowerShell logging.
99
Logon Codes
> 2: Logon via console (keyboard, server KVM, or virtual client)
> 3: Network logon (SMB and some RDP connections such as those using Network Level Authentication)
> 4: Batch Logon - Often used by Scheduled Tasks
> 5: Windows Service Logon
> 7: Credentials used to lock or unlock screen: RDP session reconnect
> 8: Network logon sending credentials in cleartext
> 9: Different credentials used than logged on user - RusAs/netonly
> 10: Remote interactive logon (Remote Desktop Protocol)
> 11: Cached credentials used to log on
> 12: Cached Remote Interactive (similar to Type 10)
> 13: Cached unlock (similar to Type 7)
100
Logon ID
> Each account session is assigned a unique Logon ID at the time of logon. These can be used to determine Session time, process tracking, object access events, and more granular views of user activit, like screen locking an unlocking.
101
Session Time
> Logon Ids can be used to correlate session time, but not that some session types, like SMB, will not work this way.
102
Linked Logon IDs
> Ties the session to the Logon ID of any other authentication events. For exampl, they can link non-admin session to high privilege sessions when both are related.
103
Brute force attacks
> Typically indicated by failure codes C0000064 for unknown users and C000006A for bad passwords
104
Built-In Accounts
> System: This used to be the primary non-user related account prior to Windows 2003. The accounts below were added to provide additional layers of security.
> Local Service: Used for services that do not require network access. Cannot authenticate with network resources.
> Network Service: Similar to local service but with slightly higher privileges, which allow it to impersonate standard computer accounts and authenticate over the network. Assigned for processes or services that require network access.
> $: The computer account provides the means for the computer to be authenticated when communicating with Active Directory and accessing network and domain resources. The account is named according to the system name.
> DWM / UMFD: Related to the Windows Manager (DWM) and driver activity (UMFD), but little used.
> Anonymous Logon:
105
Account creation
Local admins can create local accounts and domain admins can create domain-wide accounts. EID 4720 logs date, time, computer, account used to create.
106
RDP Use in EID
EID 4624 (Logon Types 3,7,10) are the best indicators of RDP usage. You should also cross reference the RDPCoreTS and TerminalServices-RdpClient logs. EID 131 in RDPCoreTS and EID 1024/1102 in the TerminalServices-RdpClient log record outbound RDP connections and include destination hostname and IP.
107
RDP logs (Security + Custom)
> Source: TerminalServices-RDPClient: EID 1024,1102
> Source: Security logs: EID 4648 (if NLA enabled and alternate creds used)
> Destination: Security 4624 Type 3,7,10 & 4778/4779
> Destination: Remote Desktop Services-RDPCoreTS: EID 98,131
> Destination: TerminalServices-RemoteConnectionManager: EID 1149
> TerminalServices-LocalSession Manager: EID 21,22,25,41
108
Logon Events (as oposed to account logon events)
Login/Logoff activity happening on the actual system being logged into. Stored locally. Note that for local accounts where the auth is happening via the local SAM database, you will see account logon and logon events. This can indicate rouge accounts, as it is rare in an enterprise environment.
109
Account Logon Events (as opposed to logon events)
Third-party authentication of credentials provided during that logon session. For example, users that need to authenticate via a Domain Controller. Note that before a user can authenticate, their credentials need to be validated by the domain controller using either NTLM or Kerberos. These events are stored on the domain controller. The one exception is local account auth, where an account logon is generated for a local only account (see Logon Events).
110
Logon error codes
111
Kerberos
> Kerberos works by a user supplying credentials to the authentication server (often the domain controller). If correct, a Tiget Granting Ticket (TGT) is issued to the user for a period of time. This is like a passport. To access resources on another system, such as a server, a "Service Ticket" is requested.
> If the auth fails, an EID 4771 will be written to the authentication servers logs. This will include date/time, hostname, client IP address, username, Error Code (see Logon error codes).
112
Ticket Granting Ticket
Part of the Kerberos authentication process. A user granted a TGT when authenticated correctly to an auth server like a domain controller.
113
Service Ticket
Part of the Kerberos authentication process. A user granted a Service Ticket when authenticated correctly to a networked resource.
114
NTLM Auth
Although less common than Kerberos, NTLM logons do still occur. For example, local account will record logons as NTLM. Pass-the-hash attacks also rely on NTLM (which will record EID 4776).
115
Pass-the-hash attack
> Rely on NTLM logons
> Often appear as EID 4624 Type 3 network logon events.
> Allows Tas to perform SMB-based actions like mapping shares, executing code with PsExec (this relies on SMB).
> Although most modern environment are set up to block this, attackers can modify the LocalAccount TokenFilterPolicy with a one-liner to re-enable the capability.
116
Account enumeration
> TAs commonly deploy tools belonging to attack frameworks like Empire and PowerSploit to enumerate sensitive accounts and groups in an enterprise. Windows have introduced a new series of EID to track this activity.
> This is enabled at the GPO level using the "Audit Security Group Management" and "Audit User Account Management" audits.
> Although these events can be noisy, you should look out for PowerShell, WMI, or netuse via cmd.exe, as these are not common in an enterprise environment. Services like mmc.exe, services.exe, taskhostw.exe, explorer.exe and VSSSVC.exe are common.
117
Enumeration (see account enumeration)
118
Event log explorer
See Tools tab
119
Admin$
Network share containing network administration tools such as software patches (this is a legacy way to patch systems).
120
IPC$
Inter-Process Communication connection: This share must be authenticated to facilitate communication between two devices on a network. Includes account name, SID, domain, and Logon ID, as well as source IP and port. IPC$ shares cannot be used to move files, it is simply an auth mechanism.
121
Explicit Credentials
>Logged as EID 4624 Logon Type 9 and EID 4648 "Explicit Credentials" events: Use crdentials not logged in memory (new creds) to impersonate another user to access a resource or service on a network.
> These events (runas) are typically recorded on the origionating system instead of the target. This allows us to determine where a user was heading.
> You can determine whether a 4648 event was logged on the origional system or a target system by looking at the "Target Server" information: If localhost, it is inbound, if includes IP address, it is outbound.
> Can also capture outbound RDP sessions on the source system if network level authentication is enabled. This will include: current logged-on user name, alternate user name, destination host name/IP, process name.
122
make_token
Part of Cobalt Strike and used to create a new logon session using a stolen auth token.
123
pth
Part of Cobalt Strike and used to create a new logon session using pass the hash.
124
Scheduled Task
> Logged in Microsoft-Windows-Task Scheduler/Operational log. Not tracked by default and can be enabled via group policy, the wevutil command-line tool, or the GUI Task Scheduler application.
> Scheduled task logging in the Security log requires Object access auditing to be enabled.
> Tasks can be scheduled remotely, but the logs do not differentiate. To find remote tasks you must look for Type 3 (network) logon occuring near task creation.
> Logged in Security logs and Microsoft-Windows-Task Scheduler/Operational log. Security logs will provide more detail info like trigger info, account name, and full path.
> When a task is created, a config (or .job) file is deposited into %SystemRoot%\System32|Tasks or %SystemRoot%\SysWOW64 for 32-bit code (which is rare). You can use these to identfy the account and system name used to schedule the task. Not on XP/Win2003, the .job file is written in binary.
125
PsExec
> New PsExec service installations are run each time PsExec is used.
> When started as a service, it is obvious to view malicious use, as you will see it being run by a user account rather than SYSTEM or LOCAL SERVICE accounts.
> Service name is PSEXESVC on remote system.
> Malicious PsExec usage is also typically encoded, such as when deployed via MetaSploit. You can also look for strange service names.
> Also see Per-User Service (2.100)
