What users are logging into machines?
Windows.Sys.AllUsers
SELECT Name, UUID, Mtime, count()
FROM source(artifact="Windows.Sys.AllUsers")
WHERE Name
GROUP BY Name
May or may not be suspicious.
Use the VFS to navigate to the user's home directory - note the birth time.
User home directory creation time is a good proxy for when the user first logged in.
Hunt for FileFinder - post process by sorting the birth time of the
home directory.
Let's talk about file finder as a general purpose tool for fetching file metadata and data.
Get users who logged in recently.
SELECT ParsedF.LastLoginDate AS LastLoginDate, ParsedV, ClientId, Fqdn
FROM source(artifact="Windows.Forensics.SAM")
WHERE LastLoginDate > "2023-01-01"
The winsupport user seems suspicious... No one knows about it....
Collect RDP authentications from the event logs Windows.EventLogs.RDPAuth
SELECT EventTime, Computer, SourceIP, UserName, Description, ClientId , count() AS Count
FROM source(artifact="Windows.EventLogs.RDPAuth")
WHERE Description =~ "LOGON_SUCCESSFUL"
GROUP BY UserName, Description, ClientId
Get timeline of login - what is the blast radius?
Which machines are affected?
Get earliest use of winsupport:
SELECT * FROM source(artifact="Windows.EventLogs.RDPAuth")
WHERE UserName =~ "winsupport" and Description =~ "SUCCESS"
ORDER BY EventTime
Check local firewall rules Windows.Sys.FirewallRules for RDP access?
Use the artifact Windows.EventLogs.ServiceCreationComspec to search for created services - update the service regex to .
Look for all login sessions Exchange.Windows.EventLogs.LogonSessions
See this for logon types:
https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4624
Type 3: Network (i.e. connection to shared folder on this computer from elsewhere on network)
Hayabusa is a "SIEM in a box" - tool for running many Sigma rules over the event logs on the end point.
A lot of false positives so it is useful for a quick overview before digging deeper.
SELECT *, count()
FROM source(artifact="Exchange.Windows.EventLogs.Hayabusa/Results")
GROUP BY RuleTitle
Order by level to show critical first.
Lots of interesting activities!
- Look for
winsupportlogin events - Account creation alerts
- Service creation -
psexec
Mark of the web can sometimes give us a hint of where a file came from Windows.NTFS.ADSHunter
In this demo we use C:\Users\ to limit the time taken.
The USN Journal records file activity on the endpoint.
Limit by the earliest time
-
Look for interaction with powershell files - see new powershell file created
-
Look for
psexecfiles... -
Look for
prefetchfile -
Look for executable files being created - find
notsuspicious.execreated in Windows directory - very suspicious! -
search for file with a .key extension - typical tool mark of
psexec. This also tells us where the attacker came from.
The USN Journal allows us to look back in time
SELECT * FROM source(artifact="Windows.Forensics.Usn")
WHERE OSPath =~ "\\.exe$" AND Reason =~ "DELETE"
What executables were deleted? In the windows directory?
ISEAutosavePowershell ReadLine
Examine the powershell activity - disabling firewall
Prefetch timeline - see activity in prefetch
We still don't know exactly what the winsupport user did?
SQLiteHunter parses many artifacts
- browser artifacts - History downloads etc. Reveal the watering hole.
Lets find evidence of the attacker interacting with the system.
RecentDocsLnk analysis
This confirms the attacker opened the documents to view them and potentially ex-filtrated them.
Windows.System.Services
Closely inspect unsigned services.
SELECT Name, PathName, HashServiceExe, CertinfoServiceExe
FROM source(artifact="Windows.System.Services")
WHERE NOT CertinfoServiceExe.Trusted
Services with low frequency
SELECT Name, PathName, HashServiceExe, CertinfoServiceExe, count() AS Count
FROM source(artifact="Windows.System.Services")
GROUP BY HashServiceExe
SELECT *, count() AS Count
FROM source(artifact="Windows.System.TaskScheduler/Analysis")
GROUP BY Command