電子署名者 : Japan Computer Emergency Response

Coordination Center
Japan Computer Emergency TeamDN : c=JP, st=Tokyo, l=Chiyoda-ku,
email=office@jpcert.or.jp, o=Japan Computer Emergency
Response Team Coordination Response Team Coordination Center, cn=Japan
Computer Emergency Response Team Coordination
CenterCenter
日付 : 2017.11.30 11:50:47 +09'00'

Detecting Lateral Movement through Tracking Event Logs
(Version 2)

JPCERT/CC
December 05, 2017

Detecting Lateral Movement through Tracking Event Logs (Version 2)

Table of Contents
1.

Introduction.......................................................................................................................22.

Research Method .............................................................................................................3

3.

2.1.

Approach ................................................................................................................................ 3

2.2.

Tested Tools ........................................................................................................................... 4

2.3.

Research Environment .......................................................................................................... 6

Research Results .............................................................................................................7
3.1.

4.

5.

Structure of Tool Analysis Result Sheet................................................................................. 7

Acquiring Additional Logs.................................................................................................9
4.1.

Importance of Acquiring Additional Logs ............................................................................... 9

4.2.

Precautions When Changing the Additional Log Acquisition Settings .................................. 9

How to Use the Tool Analysis Result Sheet in Incident Investigation............................10
5.1.

Incident Investigation Using This Report ............................................................................. 10

6.

Conclusion...................................................................................................................... 11

7.

Appendix A .....................................................................................................................12
7.1.

How to Install Sysmon ......................................................................................................... 12

7.2.

How to Enable the Audit Policy............................................................................................ 121

Detecting Lateral Movement through Tracking Event Logs (Version 2)

1. Introduction
Many recent cyberattacks have been confirmed in which malware infects a host and in turnspreads to other hosts and internal servers, resulting in the whole organization becoming
compromised. In such cases, many points need to be investigated. Accordingly, an approach forquickly and thoroughly investigating such critical events, ascertaining the overall picture of thedamage as accurately as possible, and collecting facts necessary for devising remedial measures isrequired.
While the configuration of the network that is targeted by an attack varies depending on theorganization, there are some common patterns in the attack methods. First, an attacker that has
infiltrated a network collects information of the host it has infected using "ipconfig", "systeminfo", andother tools installed on Windows by default. Then, they examine information of other hosts
connected to the network, domain information, account information, and other information using "net"and other tools. After choosing a host to infect next based on the examined information, the attacker
obtains the credential information of the user using "mimikatz", "pwdump", or other password dump
tools. Then, by fully utilizing "net", "at", or other tools, the attacker infects other hosts and collects
confidential information.
For such conventional attack methods, limited set of tools are used in many different incidents. The
many points that need to be investigated can be dealt with quickly and systematically by
understanding typical tools often used by such attackers, and what kind of and where evidence isleft.
For such use of tools, the Japan Computer Emergency Response Team Coordination Center(JPCERT/CC) extracted tools used by many attackers by investigating recently confirmed cases oftargeted attacks. Then, a research was conducted to investigate what kind of logs were left on theserver and clients by using such tools, and what settings need to be configured to obtain logs that
contain sufficient evidential information. This report is a summary of the results of this research.
The outline of this report is as follows. First, Chapter 2 describes the environment and the tools
used for this research. Next, Chapter 3 describes the "Tool Analysis Result Sheet" created based on
the results of this research. Then, Chapter 4 explains how to investigate an incident based on thisresearch results described in Chapter 3.

2

Detecting Lateral Movement through Tracking Event Logs (Version 2)

2. Research Method
This chapter describes the method that was used for this research.

2.1.

Approach

The research aims to provide basic information which is useful in log analysis by investigating
evidence of tools used by many attackers. More specifically, this report aims to be a dictionary thatcan be used as a guide for effective log analysis by identifying which tools were used based on logs
or which log is recorded when a certain tool is executed.
In this research, tools that are used by many attackers were investigated. The specific tools that
JPCERT/CC knows are used by many attackers are described in the next section. The following log
items, including event logs and execution history, were investigated so that persons who are notexperts in incident investigation can analyze more easily: Note that it was confirmed that traces oftool execution is most likely to be left in event logs. Accordingly, examination of event logs is themain focus in this report.
lEvent logl

Execution historylPrefetchl

USN journal

l

MFT

l

UserAssistlPacket Capture

Note that a sufficient amount of event logs cannot be acquired with the default Windows settings.
In this research, logs that are recorded with the following settings were examined:l

Audit policy enabledlSysmon installed

The audit policy is a default Windows setting for acquiring detailed logs about logon, logoff, fileaccess, etc. The audit policy can be confirmed and its settings can be changed from the local group
policy.
Sysmon is a tool provided by Microsoft that enables process startup, network communication, file3

Detecting Lateral Movement through Tracking Event Logs (Version 2)
changes, etc., to be recorded in event logs. Installing Sysmon enables recorded logs from Event
Viewer to be checked as shown below.

Fig. 2-1: Checking Sysmon Logs from Event Viewer

In this research, the tools listed in Section 2.2 were actually executed on a virtual network made up
of Windows Domain Controller and a client. By checking changes in the system before and after
executing each tool, logs recorded in the OS were examined. The network environment used for thisresearch are described in detail in Section 2.3.

2.2.

Tested Tools

Among tools observed in multiple incidents JPCERT/CC handled, 49 tools that are directly related
to attack operations were selected as typical tools, such as command execution, obtaining password
hash, and remote login, were selected as tools used by many attackers. Table 2-1 shows these tools
grouped by the attackers' purpose of use.
Table 2-1: List of Tested Tools
Attacker's Purpose of Using Tool

Tool

Command execution

PsExecwmic
schtasks
4

Detecting Lateral Movement through Tracking Event Logs (Version 2)
wmiexec.vbs
BeginX
WinRM
WinRS
BITS
PWDump7

Password and hash dump

PWDumpX
Quarks PwDump
Mimikatz(Password and hash dump lsadump::sam)Mimikatz(Password and hash dump
sekurlsa::logonpasswords)
Mimikatz (Ticket acquisition sekurlsa::tickets)
WCE
gsecdump
lslsass
AceHashFind-GPOPasswords.ps1
Get-GPPPassword (PowerSploit)
Invoke-Mimikatz (PowerSploit)
Out-Minidump (PowerSploit)
PowerMemory (RWMC Tool)
WebBrowserPassView
Malicious communication relay

Htran(Packet tunneling)

Fake wpad

Remote Login

RDP

Pass-the-hash

WCE (Remote login)Pass-the-ticket

Mimikatz (Remote login)

Escalation to SYSTEM privilege

MS14-058 Exploit
MS15-078 Exploit
SDB UAC Bypass

Capturing domain administrator

MS14-068 Exploit

rights accountGolden Ticket (Mimikatz)
Silver Ticket (Mimikatz)
net userAdding or deleting local user andgroup
5Detecting Lateral Movement through Tracking Event Logs (Version 2)
File sharing

net useDeleting evidence

sdeletetimestomp
klist purge
wevtutilntdsutil

Information collection

vssadmincsvde
ldifdedsquery
dcdiagnltestnmap

2.3.

Research Environment

A simplified system with a client and server, was built on a virtual network as a target. The selected
tools were executed in the environment to observe changes to files and registries resulting from theexecution. By installing the following versions of Windows OS on the server and client, the system
was tested. In each system configuration, Active Directory service was configured on the server tomanage the client computer.
ll

OS installed on the clientØWindows 7 Professional Service Pack 1

ØWindows 10

OS installed on the serverØWindows Server 2012 R2

6

Detecting Lateral Movement through Tracking Event Logs (Version 2)

3. Research Results
In this research, the tools listed in Section 2.2 were actually executed on a virtual network. By
checking changes in the system before and after executing each tool, execution history, event logs,
registry entry, and file system records were examined. In addition, for tools that perform a distinctive
pattern of communication, packet captures were also examined. The results of the research were
published on the following website.
Tool Analysis Result Sheet: https://jpcertcc.github.io/ToolAnalysisResultSheet/
The above website summarizes the basic information including functionality of the tools tested inthis research and log information recorded when the relevant tools were executed. The research
results also describe the details of logs that can be acquired when the settings described in section
2.1 are configured. (Note that how to set up the audit policy and how to install Sysmon are describedin Chapter 7.)

3.1.

Structure of Tool Analysis Result Sheet

The Tool Analysis Result Sheet describes the results of analyzing 49 tools. The analysis results foreach tool are described in a table format. The content described for each item is explained asfollows:① Tool Overview
ØAn explanation of the tool and an example of presumed tool use during an attack aredescribed.

② Tool Operation Overview
ØPrivileges for using the tool, communication protocol, and related services are described.

③ Information Acquired from LogØ

An overview of logs acquired at tool execution with the default settings (standard settings)
as well as when an audit policy is set or Sysmon is installed is described.

④ Evidence that can be confirmed when execution is successfulØThe method to confirm successful execution of the tool.

⑤ Main Information Recorded at ExecutionØ

Important information that can be used for the investigation of records in the target event
logs, registry, USN Journal, MFT, and so on.
7Detecting Lateral Movement through Tracking Event Logs (Version 2)⑥ DetailsØAll logs to be recorded, except ones included in (5), are described.

⑦ Remarks
ØAny logs that may be additionally recorded and items confirmed during verification are
described.

8

Detecting Lateral Movement through Tracking Event Logs (Version 2)

4. Acquiring Additional Logs
This chapter describes the importance of acquiring detailed logs that cannot be obtained with thedefault settings as stated in the findings, and matters that should be taken into consideration when
acquiring additional detailed logs.

4.1.

Importance of Acquiring Additional Logs

This research found that the tools installed by default in Windows leave execution traces ofevidence in event logs, but most tools that are not installed in Windows do not leave execution tracesof evidence anywhere. For example, Remote Desktop Protocol (RDP), a tool for remote login, and
"at",

a

tool

for

schedulingtasks,

leaveevidenceof

execution

in

the

event

logs

Microsoft¥Windows¥TerminalServices-LocalSessionManager¥Operational and Microsoft¥
Windows¥TaskScheduler¥Operational, respectively, indicating that the tools have been executed.
Conversely, in an environment where the audit policy is enabled and Sysmon is installed for
acquiring additional logs, evidence of execution of most tools can be acquired. For example, byconfiguring audit policy settings, when a temporary file is created, it can be recorded in the event log.
As a result, if an attacker attempts to collect account information by using "csvde", the temporary filethat is created, C:¥Users¥[User_Name]¥AppData¥Local¥Temp¥csv[Random_Number].tmp, isrecorded in the event log. To investigate the execution of tools, these settings need to be configured
in advance to acquire detailed logs.
Note that detailed logs can be acquired with audit software (such as asset management software)without enabling the audit policy and installing Sysmon. When such software monitors the following
Windows OS operations, it can be recorded in a similar manner as in an environment where the audit
policy is enabled and Sysmon is installed:l

Executing processeslWriting files

4.2.

Precautions When Changing the Additional Log Acquisition Settings

The increase in the amount of logs should be considered in advance when acquiring additional
detailed logs. Because the amount of logs increases when the audit policy is enabled, log rotation
accelerates, and older logs are maintained for a shorter period of time. Therefore, when enabling theaudit policy, consider changing the maximum size of event logs at the same time. The maximum sizeof event logs can be changed with Event Viewer or the "wevtutil" command.
Note that changing the maximum size of event logs may exhaust storage capacity. JPCERT/CC
recommends that storage capacity be evaluated before changing the maximum size of event logs.
9Detecting Lateral Movement through Tracking Event Logs (Version 2)

5. How to Use the Tool Analysis Result Sheet in Incident Investigation
This chapter describes how the Tool Analysis Result Sheet can be used through same incident
investigation examples.

5.1.

Incident Investigation Using This Report

The Tool Analysis Result Sheet was created on the assumption that it will be used when identifying
tools that might be executed as part of incident investigations. Searching for keywords, such as an
event ID and file name of a characteristic event log and a registry entry found during incident
investigation, can find out possible tools that were executed.
An incident investigation often checks any suspicious logs in the "Security" event log. Then, if"Event ID: 4663 (An attempt was made to access an object)" is found for example, it is assumed that
there is evidence that the file 192.168.100.100-PWHashes.txt was created temporarily (recorded
when the audit policy is enabled). Searching the Tool Analysis Result Sheet for the distinctive text
PWHashes.txt finds it is a file created when PWDumpX is executed.
Further proceeding with the investigation while referring to the Tool Analysis Result Sheet findsthat "PWDumpX" is a command attackers execute to acquire a password hash. Additionally, the factthat the temporary file [Destination_Address]-PWHashes.txt was created implies that the attacker
had completed the purpose of acquiring the password hash on the server with IP address
192.168.100.100.
Investigating

theserverwithIP

address

192.168.100.100

explains

that

the

file

C:¥Windows¥System32¥DumpSvc.exe was created and executed, and the fact that the service"PWDumpX Service" was installed is recorded as "Event ID: 7045 (A service was installed in thesystem)." This allows for determining that the attacker acquired the password hash for the IP address
192.168.100.100.
Section 3.2 describes how to verify that each tool was executed. Referring to the section forplanning an investigation strategy in advance of commencing an incident investigation is encouraged
as it shows information recorded by each tool in a list.

10Detecting Lateral Movement through Tracking Event Logs (Version 2)

6. Conclusion
As it is becoming apparent that many organizations have suffered damage due to targeted attacks,
the importance of incident investigations to further examine such damage is increasing. This report
and the Tool Analysis Result Sheet summarize and present evidence suggesting the execution oftools and their corresponding relationship with tools, which are the key to a successful incident
investigation.
Many tools do not leave evidence of having been executed with the default Windows settings,
which may cause incident investigations to remain unsolved. To analyze what the attacker did in
detail, an environment that allows for more logs to be collected than those obtained with the default
settings needs to be prepared in advance.
Under the current circumstances where it is difficult to prevent infiltration of a network, it isimportant to always consider and improve the method for acquiring logs to analyze the amount ofdamage after an incident occurs in order to prevent the spread of damage and review post-incident
security measures. In addition to reviewing and being prepared for responses that are not limited tothe method for acquiring additional logs using Windows standard functionality as shown in this report,
also use other methods that combine the use of audit software or similar. Moreover, JPCERT/CC
recommends that this report be used to identify evidence of tool execution by attackers in the eventof a suspicious incident. JPCERT/CC hopes that this report will be of help in early detection andaccurate response to targeted attacks, which are becoming more sophisticated.

11

Detecting Lateral Movement through Tracking Event Logs (Version 2)

7. Appendix A
This appendix describes how to install Sysmon and how to enable the audit policy. Note that it has
been confirmed that setting up the audit policy and installing Sysmon will increase the amount of
event logs. Before enabling the setting and installing the tool, it is recommended to verify its impact.

7.1.
1.

How to Install Sysmon
Download Sysmon from the following site:
https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon

2.

Execute the command prompt as a user with administrator privileges and execute thefollowing command:> Sysmon.exe -i* Although adding the option "-n" enables network connection logs to be acquired, network
connection should be dealt with in the audit policy.

7.2.

How to Enable the Audit Policy

The following describes how to enable the audit policy on a local computer. Note that the followingshows settings in Windows 10.
1.

Open the Local Group Policy Editor. (Enter "gpedit.msc" into the [Search] box and execute it.)2.

Select[Computer

Configuration]→[Windows

Settings]→[Security

Policies]→[Audit Policy], and enable "Success" or "Failure" for each policy.
12

Settings]→[Local

Detecting Lateral Movement through Tracking Event Logs (Version 2)

3.

4.

Select [Local Disk (C:)]→[Properties]→[Security] tab→[Advanced].

On the [Auditing] tab, add an object to be audited.

13

Detecting Lateral Movement through Tracking Event Logs (Version 2)

5.

As shown below, select the user to be audited and access method to be audited.

The "Permissions" set here are as follows. (Although recording file read enables a more detailed
investigation, it is excluded as doing so will increase the amount of logs.)lCreate files / write datalCreate folders / append datal

Write attributeslWrite extended attributeslDelete subfolders and fileslDeletelChange permissions
14

Detecting Lateral Movement through Tracking Event Logs (Version 2)l

Take ownership

Although configuring the above settings displays many errors as shown below, select "Continue."15

Detecting Lateral Movement through Tracking Event Logs (Version 2)

JPCERT/CC will not be liable for any loss or damage that may arise from any information
contained in this document.
16