Event Log Analysis

Event Log 101• What is Event Log?
• Windows version of “syslog”.

• Where are these artifacts located in?
• %SystemRoot%\System32\winevt\Logs• %SystemRoot% is “C:\Windows” typically.

Copyright Internet Initiative Japan Inc.

2

Event Log 101• There are three standard logs and lots of custom logs.
Standard logs
• Security• System• Application
Custom logs (Applications and Services Logs)• RDP• PowerShell• Windows Firewall• ...
Copyright Internet Initiative Japan Inc.

3

Event Log 101• Each log contains following items.
• Source• Event ID• LevelInformation / Warning / Error• User

The target user of a event's message.

• Date and Time• Computer

The target host of a event's message.

• Description

The details are described in this un-normalized field!

• The event ID number is unique within each log, such as System, Security,
Application, and other custom logs. However, the same ID number may be used if
the log is different.
Copyright Internet Initiative Japan Inc.

4

Event Log 101• Audit policy• For security log, all logs are not enabled by default. “Audit policy” manages this.
• You can confirm/edit the current audit policy with these applications / commands.
• localpol.msc (online)• gpedit.msc (online)• auditpol (online)• Regripper auditpol plugin (offline)• Volatility auditpol plugin (offline)• Refs• http://www.kazamiya.net/en/PolAdtEv• https://github.com/keydet89/
RegRipper2.8/blob/master/plugins/
auditpol.pl• https://github.com/volatilityfoundation/
volatility/blob/master/volatility/plugins/registry/auditpol.py
Copyright Internet Initiative Japan Inc.

5

Event Log 101• There are lots of tools to view and/or parse event logs.
• Event Viewer (default)• PowerShell (default)• Event Log Explorer (commercial) [1]• python-evtx [2]• EvtXtract [3]• Evtx Parser [4]• Libevtx [5]• Log Parser [6]Copyright Internet Initiative Japan Inc.

6

Event Log 101• Before we dive into the event log world, we should discuss two basic
authentication protocols for Windows.
Kerberos• The default authentication protocol for Windows domain networks.
• But, if a session starts with IP address instead of host name, the NTLM authentication is
used.

NTLM
• A traditional authentication protocol.

Copyright Internet Initiative Japan Inc.

7

Event Log 101• Kerberos Authentication Mechanism
1.
2.
3.

4.
5.
6.

A user on client requests a Ticket-granting
Tickets (TGT)The Authentication Service (AS) sends a TGT,
which is encrypted with password hash of
the user.
The client decrypt the TGT and send it to
Ticket Granting Service (TGS) for a Service
Ticket.
The TGS sends the Service Ticket to theclient.
The client send the Service Ticket to theserver.
Then a service session start.

TGT: Ticket-granting Tickets

ST: Service Ticket

Domain Controller

Key Distribution
Center (KDC)[1] AS req
TGTClientCopyright Internet Initiative Japan Inc.

[2] AS rep[3] TGS req

ST[4] TGS rep

ST

Authentication
Service (AS)TGT

Ticket Granting
Service (TGS)

Active DirectoryServer8

Event Log 101
Domain Controller (DC)• NTLM Authentication Mechanism
1.
2.
3.
4.
5.

6.

A client requests access to a server.
The server respond challenge message to theclient.
Clients sends response message to the server.
The server sends challenge and response
messages to the Domain Controller (DC).
The DC confirms them to authenticate theuser. If the authentication was successful, theDC sends to the server the confirmation thatthe user was authenticated.
The server respond to the client to start a
service.
Copyright Internet Initiative Japan Inc.

Active Directory

[4]

[5]

[1]
Client[2][3]Server[6]

9

Event Log 101• Challenge Response Authentication Basic
Client Side

Server SideEntering
password
by User[1] Authentication
Request[2] Generating"Challenge"

Password

Challenge

Challenge

Getting User's
password hashfrom account DB

Calculatinghash[3] Calculate"Response"[4] Calculate"Response"

Password
Hash

Password
Hash

Response

Response

Response[5] Comparing"Responses"
Copyright Internet Initiative Japan Inc.

10

Event Log 101• The most important logs for incident response are...
• Credential validation (Authentication, Account Logon)• 4768: requested a TGT• 4769: requested a Service Ticket• 4776: NTLM authentication

Kerberos related• Logon (Authorization?)• 4624: Logon• 4625: Logoff• 4634: Logon Failed (not default)• These all events are logged in the standard "Security" log.
Copyright Internet Initiative Japan Inc.

11

Event Log 101• 4768: requested a TGT• This event logged on the Domain Controller.
And both of success and failure requests arelogged.
Key Distribution Center(KDC)
Get TGT from AS

4768 Authentication

Service (AS)TGT

ClientTGT

Get ST from TGS
ST

Ticket Granting
Service (TGS)

Request Service
ST

Session Start

ServerCopyright Internet Initiative Japan Inc.

12

Event Log 101• 4769: requested a Service Ticket• This event is logged on the Domain
Controller. Both succeeded and failed
requests are logged.
Key Distribution Center(KDC)

Authentication
Service (AS)Get TGT from AS
TGTClientTGT

Get ST from TGS

4769

ST

Ticket Granting
Service (TGS)

Request Service
ST

Session Start

ServerCopyright Internet Initiative Japan Inc.

13

Event Log 101• 4624: Logon• This event documents successful logon
attempt to various components on thelocal computer.
• This event also indicates "logon type".
Key Distribution Center(KDC)

Authentication
Service (AS)Get TGT from AS
TGTClientTGT

Get ST from TGS
ST

Ticket Granting
Service (TGS)

Request Service
ST

Session Start

Server4624

Copyright Internet Initiative Japan Inc.

14

Event Log 101• What is “logon type”?

• Interactive (2)• Network (3)• Batch (4)• Service (5)• Proxy (6)• Unlock (7)• NetworkCleartext (8)• NewCredentials (9)• RemoteInteractive (10)• CachedInteractive (11)• CachedRemoteInteractive (12)• CachedUnlock (13)https://msdn.microsoft.com/en-us/library/aa394189.aspx
Copyright Internet Initiative Japan Inc.

15

Event Log 101• What is “logon type”?
• Interactive (2)• For Local logon with a user credential.
• For example, if you sit in front of your PC, press Ctrl+Alt+Del keys, and type your user nameand password; the log will be produced when the logon is attempted.

• Network (3)• This is the most generic logon type. This type of logon is used for SSO (Single-Sign-On). You
don’t need to input any additional credentials if you have already had a rights to use services(E.g. connecting to a file server with SMB).

• Batch (4)• For Task Scheduler and AT.

• Service (5)• For Windows Services.
Copyright Internet Initiative Japan Inc.

16

Event Log 101• What is “logon type”?
• Unlock (7)• For unlocking the screen lock.

• RemoteInteractive (10)• For RDP.

• CachedInteractive (11)• If the machine cannot communicate with the domain controllers and if you have logged on to themachine in the past, this type is logged when you log on in that situation.
• E.g. If you take your laptop out with you, and log on to the laptop with a domain account offline.

• CachedRemoteInteractive (12)• A similar situation to 11, but logged for RDP.

• CachedUnlock (13)

• A similar situation to 11, but logged for unlocking screen.
Copyright Internet Initiative Japan Inc.

17

Event Log 101• There are three "account types" for account/user names logged in
Events.
• User accounts• Its just user account. Generally this type of accounts are bind to each person or roll.

• Computer accounts• This account type indicates each host. A name of this account type is terminated withcharacter "$". For example, "DESKTOP-SHCTJ7L$" is a name of a computer account.

• Service accounts• Each service account is created to be owner of a certain service. For example, IUSR is theowner of IIS, and krbtgt is the owner of a service that is a part of Key Distribution Center.

Copyright Internet Initiative Japan Inc.

18

Remote Logon Events

Remote Logon Events• There are a lot of remote logon methods that are used by attackers for
Windows.
• RDP• Task Scheduler/AT• Powershell Remoting• WinRS• WMIC• PsExec• Wmiexec• ...
Copyright Internet Initiative Japan Inc.

20

RDP

RDP (1)• Why this event is important?

• Attackers sometimes use RDP to logon to remote computers while users are away from clients,
or to penetrate servers. So, you should check this event.

• Important event IDs• Security.evtx••••

4624: An account was successfully logged on.
4648: A logon was attempted using explicit credentials.
4778: A session was reconnected to a Window Station. (Not default)
4779: A session was disconnected from a Window Station. (Not default)• Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx••••

1149: User authentication succeeded
21: Remote Desktop Services: Session logon succeeded
24: Remote Desktop Services: Session has been disconnected
25: Remote Desktop Services: Session reconnection succeeded
Copyright Internet Initiative Japan Inc.

22

RDP (2)• How can we detect this event?
• Logon with RDP• 4624 (Security.evtx)• Description• An account was successfully logged on.
• How can we recognize RDP logon with this ID?
• Filter with these logon types in this ID.
• Logon type 10 (RemoteInteractive) or type 12 (CachedRemoteInteractive)• Why?
• RemoteInteractive (10) and CachedRemoteInteractive (12) indicate RDP used clearlybecause these logon types are dedicated for RDP usage.

Copyright Internet Initiative Japan Inc.

23

RDP (3)• How can we detect this event?
• Logon with RDP• 4648 (Security.evtx)
This message is not related to RDP• Description
since its SPN indicates the CIFS service.
• A logon was attempted using explicit credentials.
• How can we recognize RDP logon with this ID?
• Find events with the following conditions.
• Filter out computer accounts and localhost.
• Filter out included SPNs or filter with “TERMSERV/”.
• Why?
• If a user inputs a credential clearly when the user logs on to remote machines with RDP, thenthis ID is logged at the source machine.
• But when “Restricted Admin mode” is used, this ID is not logged for the admin accounts.
• This event ID logs SPNs (Service Principal Name) that indicates service names which a user
wants to use. And SPN for RDP is “TERMSERV” or any SPNs are NOT included for RDP andseveral cases (E.g. local logon).
Copyright Internet Initiative Japan Inc.

24

RDP (4)• Let’s assume these conditions are
given.

D

E

C

client-win10-1(admin-PC)

Bclientwin10-2• client-win10-1 (192.168.52.40)• Administrator’s PC• He uses toyoda, ninja-rdp, ninja-master accounts.

• client-win10-2 (192.168.52.44)• Honda’s PC• He is a general employee and he don’t have any admin rights.
• He uses only this PC and “honda” account.

Anormalabnormal• The owner of the “client-win10-1” often use RDP to logon to remote hosts. But notvise versa.
• Since event ID 4624 is recorded on the target host, which is the destination host when
it was logged on from a remote host, let's check "client-win10-1" first to see if there
are any logons from a remote host is recorded.
Copyright Internet Initiative Japan Inc.

25

RDP (5)• Open the below log with Event Log Explorer.
• Training_Materials\EventLogAnalysis\RDP\Win10-1_Security.evtx• Original log file name : Security.evtx(1) Select this option (default)• Notice:• You should drag the log file and drop it to the
Event Log Explorer.
• If you double-click the log file, Event Viewer,
which is the Windows' default log viewer, starts
instead. The viewer is not capable of complex
filtering.
Copyright Internet Initiative Japan Inc.

(2) Click "OK"26

RDP (6)• Click the “Filter Events” button.

Copyright Internet Initiative Japan Inc.

27

RDP (7)(2) Choose “ Training_Materials\EventLogAnalysis\RDP\Sec4624_rdp.elc”,
then click “Open” button.

(1) Click “Load” button.
Copyright Internet Initiative Japan Inc.

28

RDP (8)Filter with Event ID 4624.
Filter with logon type 10 or 12.

Copyright Internet Initiative Japan Inc.

29

RDP (9)• How To Analyze• Logon with RDP
Event ID

Log Location

Logged Host

Where You Should Look

What You Get

4624

Security.evtx

Destination(remote host)Date, Time

Date/Time around RDP used

Computer Name

Destination computer name

New Logon\Security ID

Logon user’s SID

New Logon\Account Name

Logon user’s account name

New Logon\Logon ID

An ID to combine with 4648 and others

New Logon\Logon GUID

An ID to combine with 4769

Network Information\Source Network
Address

Source IP address

Copyright Internet Initiative Japan Inc.

30

RDP (9)This message logged on client-win-10-1 which is thedestination of this RDP Session.
client-win10-1(admin-PC)

clientwin10-2

ninja-rdp account logged on to “client-win10-1”
which is the administrator’s PC from 192.168.52.44
with RDP.
It’s suspicious logon!
Destdestination
The
host
host
ID 4624 is always logged on thedestination host.
Copyright Internet Initiative Japan Inc.

31

RDP (11)• If the attackers do not use RestrictedAdmin mode when they logon toremote servers, event ID 4648 is logged on the both source anddestination hosts because they need to input a credential to use RDP.
Let’s check this.
• Open the below log with Event Log Explorer, and click “Filter Events”
button.
• Training_Materials\EventLogAnalysis\RDP\Win10-2_Security.evtx• Original log file name : Security.evtx
Notice:You should drag the log file and drop
it to the Event Log Explorer.

Copyright Internet Initiative Japan Inc.

32

RDP (11)(2) Choose “ Training_Materials\EventLogAnalysis\RDP\Sec4648_rdp_src.elc”,
then click “Open” button.
(1) Click “Load” button.
Copyright Internet Initiative Japan Inc.

33

RDP (12)Filter with the event ID 4648.

Filter out localhost, computer accounts and SPNs.

Some kinds of rdp sessions are logged with a SPN for terminal server"TERMSRV". You should tweak the last condition to filter with that.
Copyright Internet Initiative Japan Inc.

34

RDP (14)• How To Analyze• LogonEvent ID
Log
Location
Logged Host

Where You Should Look

What You Get

4648

Date, Time

Date/Time around RDP used

Computer Name

Source computer nameSubject\Security ID

SID of RDP used

Subject\Account Name

User name of RDP used

Target Server\Target Server Name

Destination computer nameAccount Whose Credentials WereUsed\Account Name

Logon user name of the remote hostDate, Time

Date/Time around RDP used

Computer Name

Destination computer nameAccount Whose Credentials WereUsed\Account Name

Logon user name of the remote host

Network Information\Source Network
AddressCopyright Internet Initiative Japan Inc.

Source IP address

Security.evtx

SourceDestination

35

RDP (14)client-win10-1(admin-PC)

clientwin10-2This message logged on client-win-10-2 which is thesource of this RDP Session.

The attackers have already had honda’s credential
and ninja-rdp’s credential. And they moved laterally
to “client-win10-1” with RDP.
Copyright Internet Initiative Japan Inc.

36

RDP (16)• We found “honda” account logged on to ninja-rdp@client-win10-1(192.168.52.40) from client-win10-2 (192.168.52.44) with RDP.
• It is a suspicious logon because 192.168.52.40 is the systemadministrator’s PC, and Honda, who is a general employee, does not
own that PC. And, he cannot know the credential of the “ninja-rdp”
account, which is an administrative account.

Copyright Internet Initiative Japan Inc.

37

Task Scheduler/AT EventsTask Scheduler/AT Events (1)• Why is this event important?
• Attackers often use Task Scheduler and AT to execute commands on remotecomputers in lateral movement phase. So you should check this event.

• Important event IDs• Security.evtx• 4624: An account was successfully logged on.

• Microsoft-Windows-TaskScheduler%4Operational.evtx• 100: Task started• 102: Task completed• 106: Task registered• 107: Task triggered on scheduler• 110: Task triggered by user

•
•
•
•
•

129: Created Task Process (Launched)140: Task updated
141: Task deleted
200: Action Started
325: Launch request queued

Copyright Internet Initiative Japan Inc.

40

Task Scheduler/AT Events (2)• How can we detect this event?
• 106 (Microsoft-Windows-TaskScheduler%4Operational.evtx)• Description• Task registered• How can we recognize Task Scheduler/AT with this ID?
• This ID is dedicated for task registration.
• And 4624 with logon type 3 (Security.evtx) is logged at the same time if the task is registeredfrom remote hosts. You can get the source address information by combining with date/timeand the user name of these logs.

• 4624 (Secuirty.evtx)• How can we recognize Task Scheduler/AT with this ID?
• We can filter with logon type 4 with this ID to get tasks triggered and those dates.
Copyright Internet Initiative Japan Inc.

41

Task Scheduler/AT Events (3)• Let’s assume this condition is given.
• We have already known attackers moved laterally around 25 th February 2018 from forensic
analysis so far.
• So we should look for registrations of tasks around that time at first.

• Open the below log with Event Log Explorer, and click “Filter Events” button.
• Training_Materials\EventLogAnalysis\TaskSched\Win10-2_TaskSchedOpe.evtx• Original log name: Microsoft-Windows-TaskScheduler%4Operational.evtx

Notice:You should drag the log file and drop
it to the Event Log Explorer.
Copyright Internet Initiative Japan Inc.

42

Task Scheduler/AT Events (4)Filter with Event ID 106.

Copyright Internet Initiative Japan Inc.

43

Task Scheduler/AT Events (5)Event ID
106

Log Location

Logged Host

*1 To Analyze
Destination• How(remote host)4624

Security.evtx

Destination(remote host)

Where You Should Look

What You Get

Date, Time

Date/Time around Task Scheduler used

Computer Name

Destination computer name

User

User name or SID of task registered

Task

Task nameDate, Time

Date/Time around Task Scheduler used

Computer Name

Destination computer name

New Logon\Security ID

Logon user’s SID

New Logon\Account Name

Logon user’s account name

New Logon\Logon ID

An ID to combine with 4648 and others

New Logon\Logon GUID

An ID to combine with 4769

Network Information\Source Network
Address

Source IP address

Copyright Internet Initiative Japan Inc.

*1 : Microsoft-Windows-TaskScheduler%4Operational.evtx

44

Task Scheduler/AT Events (6)Registered event dates

User’s name or SID

Task name
If the AT is used, task name is always “\At*”.
“*” means a number.

Now, you can check whether legitimate tasks or not.

Copyright Internet Initiative Japan Inc.

45

Task Scheduler/AT Events (7)• We got date/time, task name and registered user name from 106.
• But where did this user register this task from?
• If the task is registered from the remote host, then you can find 4624 type 3 log.
• If the task is registered locally, 4624 type 3 message is not logged at the same time.

Copyright Internet Initiative Japan Inc.

46

Task Scheduler/AT Events (8)• Let's find the ID 4624 with logon type 3 logs, which is logged at thesame time with the ID 106 we confirmed before.
• Open the log below with Event Log Explorer, and click “Filter Events”
button.
• Training_Materials\EventLogAnalysis\TaskSched\Win10-2_Security.evtx• Original log name: Security.evtx

Notice:You should drag the log file and drop
it to the Event Log Explorer.

Copyright Internet Initiative Japan Inc.

47

Task Scheduler/AT Events (1)(2) Choose “ Training_Materials\EventLogAnalysis\TaskSched\Sec4624_type3_Feb25_9PM.elc”,
then click “Open” button.

(1) Click “Load” button.
Copyright Internet Initiative Japan Inc.

48

Task Scheduler/AT Events (1)Filter with the event ID 4624.

Filter with logon type 3

Filter with Feb/25/2018 9 PM to 10 PM

Copyright Internet Initiative Japan Inc.

49

Task Scheduler/AT Events (3)ID 4624 is always logged ondestination host.

You can see the same time and the same user namebetween 106 and 4624.

Task name
If the AT is used, task name is always “\At*”.
“*” means a number.

We got the remote IP (source) address!
Copyright Internet Initiative Japan Inc.

50

Task Scheduler/AT Events (12)• We confirmed “ninja-master” registered the task named “task_name”
from 192.168.52.40 at 9:06:55 PM on 25th Feb.
• What process is executed?
• And how many times were this command executed?
• You should see the below log again!
• Artifacts\evtx\remote_logon\TaskSched\Win10-2_TaskSchedOpe.evtx

Copyright Internet Initiative Japan Inc.

51

Task Scheduler/AT Events (13)• We should see the IDs below.
• 107: Task triggered on scheduler• We can get execution times by counting this logs.

• 110: Task triggered by user
• We can get execution times by counting this logs.

• 200: Action Started• We can see the execution file name.

Copyright Internet Initiative Japan Inc.

52

Task Scheduler/AT Events (2)Filter with Event ID 107, 110 and 200.

Filter with the task name “\task_name”.

Copyright Internet Initiative Japan Inc.

53

Task Scheduler/AT Events (15)Event ID
200

Log Location

Logged Host

*1 To Analyze
Destination• How(remote host)

107

110

*1

*1

Destination(remote host)

Destination(remote host)

Where You Should Look

What You Get

Date, Time

Date/Time around Task Scheduler used

Computer Name

Destination computer nameactionExecution file nametask

Task nameDate, Time

Date/Time around Task Scheduler used

Computer Name

Destination computer name

This event ID

Task triggered on scheduler

Date, Time

Date/Time around Task Scheduler used

Computer Name

Destination computer name

This event ID

Task triggered by user

user

User name which task triggered

Copyright Internet Initiative Japan Inc.

*1 : Microsoft-Windows-TaskScheduler%4Operational.evtx

54

Task Scheduler/AT Events (3)The task was executed
three times.

Execution file was found in the ID 200!

Copyright Internet Initiative Japan Inc.

55

Task Scheduler/AT Events (17)• We confirmed “ninja-master” registered the “task_name” task from
192.168.52.40 on February 25, 2018 at 21:06:55.
• “cmd.exe” was executed three times in the task.

Copyright Internet Initiative Japan Inc.

56

Task Scheduler/AT Events (18)• We can also find Task Scheduler/AT events with 4624, logon type 4 in“Security.evtx”.
• Type 4 means “Batch”.
• This logon type is dedicated for Task Scheduler/AT.
• It logs every task trigger and launch requests.

Copyright Internet Initiative Japan Inc.

57

Task Scheduler/AT Events (19)Event ID
4624

Log Location

Logged Host

Security.evtx
Destination• How
To Analyze(remote host)

Where You Should Look

What You Get

Date, Time

Date/Time around Task Scheduler used

Computer Name

Destination computer name

New Logon\Security ID

Logon user’s SID

New Logon\Account Name

Logon user’s account name

New Logon\Logon ID

An ID to combine with 4648 and others

New Logon\Logon GUID

An ID to combine with 4769

Copyright Internet Initiative Japan Inc.

58

Task Scheduler/AT Events (1)Copyright Internet Initiative Japan Inc.

59

Task Scheduler/AT Events (21)
• Unified Background Process Manager (UBPM)• Service Control Manager – manages Windows Services• Task Scheduler – manages Windows Tasks• Windows Management Instrumentation – manages WMI providers• DCOM Server Process Launcher – manages out-of-process COM applications.

https://blogs.technet.microsoft.com/askperf/2009/10/04/windows-7-windows-server-2008-r2-unified-backgroundprocess-manager-ubpm/

Copyright Internet Initiative Japan Inc.

60

Task Scheduler/AT Events (22)• You should also check the “Tasks” folders below.
• C:\Windows\System32\Tasks• C:\Windows\SysWOW64\Tasks• For AT command, you should look this folder.
• c:\windows\tasks•*.job

Copyright Internet Initiative Japan Inc.

61

Task Scheduler/AT Events (23)• You might also need to check these logs below.
• Microsoft-Windows-TaskScheduler%4Operational.evtx• 100: Task started• 102: Task completed• 140: Task updated• 141: Task deleted

Copyright Internet Initiative Japan Inc.

62

PsExecPsExec Detection (1)• PSExec is a remote command execution tool for system administrators thatis included in “Sysinternals Suite” tools, but this is often used for lateral
movement in targeted attacks as well.
• Typical behavior of PsExec• It copies the PsExec service execution file (default: PSEXESVC.exe) to %SystemRoot%on remote computers with network logon (type 3).
• It copies a file to execute command to %SystemRoot% through $Admin share if -c
option is used.
• It registers the service (default: PSEXESVC), and starts the service to execute thecommand on the remote computer.
• It stops the service (default: PSEXESVC), and removes the service on the remotecomputer after execution.
Copyright Internet Initiative Japan Inc.

64

PsExec Detection (2)• Important behaviors of PSExec options
• -r

• -s
• -c

• -u

• To change the copied file name and the service name for remote computers(default: %SystemRoot%\PSEXESVC.exe and PSEXESVC)• To be executed by SYSTEM account.
• To copy a program to remote computers• It is copied to Admin$ (%SystemRoot%)• To use a specific credential to log on to remote computers.
• Logon type 2 & logon type 3 is occurred.
Copyright Internet Initiative Japan Inc.

65

PsExec Detection (3)• Important event IDs• Security.evtx• 4624: An account was successfully logged on.

• Ssystem.evtx• 7045: A service was installed in the system.

• How can we find PsExec?

• You can find PsExec execution by finding service registration logs.
• Event ID 7045 in “System.evtx”• There are two methods.

• Method 1: Finding default service name• Method 2: Finding changed service name
Copyright Internet Initiative Japan Inc.

66

PsExec Detection Method 1

PsExec Detection Method 1 (1)• How can we detect this event?
• PsExec creates a service on remote hosts when it executes a command.
• The default service name is “PSEXESVC”.
• We can detect this service name.

• System.evtx• 7045• Description• A service was installed in the system.
• How can we recognize PsExec execution with this ID?
• Filter with “PSEXE” string in this ID.
• Why?
• PsExec creates a service including this string by default.

Copyright Internet Initiative Japan Inc.

68

PsExec Detection Method 1 (2)• Open the below log with Event Log Explorer, and click “Filter Events”
button.
• Training_Materials\EventLogAnalysis\PSExec\win7_system_psexec_en.evtx
Notice:You should drag the log file and drop
it to the Event Log Explorer.

Copyright Internet Initiative Japan Inc.

69

PsExec Detection Method 1(1)Filter with a part of default service and execution name.

Copyright Internet Initiative Japan Inc.

70

PsExec Detection Method 1(4)• How To Analyze
Event ID

Log Location

Logged Host

Where You Should Look

What You Get

7045

System.evtx

Destination(remote host)Date, Time

Date/Time around Task Scheduler used

Computer Name

Destination computer name

User

Actual user name or SID for execution

Service Name

Installed service nameService File Name

Copied execution file nameService Type

Whether user or kernel mode service

Copyright Internet Initiative Japan Inc.

71

PsExec Detection
Method 1(1)You can find 7045 (Service registration) and 7036 (Change service state).
Note that 7036 could not be not logged on Windows 8/10 hosts.

You can also get the SID or the user nameof the actual user even if the -s option is
used.

PSEXESVC is found in “Service Name” andPSEXESVC.exe is found in “Service File Name”.

Copyright Internet Initiative Japan Inc.

72

PsExec Detection Method 1 (6)• If you look for the ID 4624 logs in the “Security” log around the time
when the ID 7045 is logged, you can get the same user name/SID andthe source address of the remote computer.

Copyright Internet Initiative Japan Inc.

73

PsExec Detection Method 1 (7)• Open the below log with Event Log Explorer, and click “Filter Events”
button.
• Artifacts\evtx\remote_logon\PSExec\win7_security_psexec_en.evtx

Notice:You should drag the log file and drop
it to the Event Log Explorer.

Copyright Internet Initiative Japan Inc.

74

PsExec Detection Method 1(1)(2) Choose “Training_Materials\EventLogAnalysis\PSExec\Sec4624_remote_logon_type3.elc”,
then click “Open” button.
(1) Click “Load” button.
Copyright Internet Initiative Japan Inc.

75

PsExec Detection Method 1(1)Filter with event ID 4624.

Filter out :- localhost- computer accounts- system account- anonymous accountFilter with logon type 3.

Copyright Internet Initiative Japan Inc.

76

PsExec Detection Method 1 (10)Event ID
7045

Log Location

Logged Host

System.evtx
Destination• How
To Analyze(remote host)4624

Security.evtx

Destination(remote host)

Where You Should Look

What You Get

Date, Time

Date/Time around Task Scheduler used

Computer Name

Destination computer name

User

Actual user name or SID for execution

Service Name

Installed service nameService File Name

Copied execution file nameService Type

Whether user or kernel mode service

Date, Time

Date/Time around Task Scheduler used

Computer Name

Destination computer name

New Logon\Security ID

Logon user’s SID

New Logon\Account Name

Logon user’s account name

New Logon\Logon ID

An ID to combine with 4648 and others

New Logon\Logon GUID

An ID to combine with 4769

Network Information\Source Network
Address

Source IP address

Copyright Internet Initiative Japan Inc.

77

PsExec Detection Method 1(1)You can get the actual account name and the source address.

Copyright Internet Initiative Japan Inc.

78

PsExec Detection Method 1 (12)• We found PsExec execution from ninja-master@192.168.52.40 at
8:11:18 PM on February 20, 2018.
• We can find another PsExec execution in this log.
• 2/20/2018• 2/20/2018• 2/20/2018

8:10:42 PM
8:08:09 PM
8:07:56 PM

Copyright Internet Initiative Japan Inc.

79

PsExec Detection Method 2

PsExec Detection Method 2 (1)• If the attackers change the execution name and the service name of PSExec
with -r option, we can still detect PSExec execution because of the following
characteristics.
• The PSExec service execution file (default: PSEXESVC.exe) is copied to“%SystemRoot%” directory on the remote computer.
• The service name is the same as the execution name without the “.exe” extension.
• The service is executed in “user mode”, not “kernel mode”.

• “LocalSystem” account is used for the service account.
• The actual account is used to execute the service execution file, not “SYSTEM”.
Copyright Internet Initiative Japan Inc.

81

PsExec Detection Method 2 (2)• We use the same log as the previous exercise’s one. Click “Filter
Events” button.
• Training_Materials\EventLogAnalysis\PSExec\win7_system_psexec_en.evtx

Copyright Internet Initiative Japan Inc.

82

PsExec Detection Method 2(1)(2) Choose “ Training_Materials\EventLogAnalysis\PSExec\Sys7045_psexec.elc”,
then click “Open” button.
(1) Click “Load” button.
Copyright Internet Initiative Japan Inc.

83

PsExec Detection Method 2(1)Filter out the “SYSTEM” account.

Filter with the event ID 7045.

Filter with:- containing .exe in the file name- containing %SystemRoot% in the file name- user mode service for service type
- LocalSystem as service account- demand start as service start type

Copyright Internet Initiative Japan Inc.

84

PsExec Detection Method 2(1)The file name is not the default PSExec name, but...

This execution file is directly
under the %SystemRoot% directory.

The same name

This is a user mode service, not kernel mode.
The service account is “LocalSystem”

Copyright Internet Initiative Japan Inc.

It seems this entry is a PsExec used with -r option!

85

PsExec Detection Method 2 (6)• We found PsExec execution with -r option at 8:11:46 PM on 20 th Feb.
• The temporary service name is “WindowsWMIService”.

Copyright Internet Initiative Japan Inc.

86

To be continued…
Copyright Internet Initiative Japan Inc.

87