Japan Computer Emergency
Response Team Coordination
Center

電子署名者 : Japan Computer
Emergency Response Team
Coordination Center
日付 : 2017.06.12 13:45:12 +09'00'

Detecting Lateral Movement through Tracking Event Logs

JPCERT Coordination Center
June 12, 2017

Table of Contents
1.

Introduction.......................................................................................................................42.

Research Method .............................................................................................................5

3.

2.1.

Approach ................................................................................................................................ 5

2.2.

Tested Tools ........................................................................................................................... 6

2.3.

Research Environment .......................................................................................................... 8

Research Results .............................................................................................................9
3.1.

Layout of This Chapter .......................................................................................................... 9

3.2.

Command Execution ............................................................................................................11

3.2.1.

PsExec...........................................................................................................................11

3.2.2.

wmic .............................................................................................................................. 13

3.2.3.

PowerShell.................................................................................................................... 14

3.2.4.

wmiexec.vbs ................................................................................................................. 16

3.2.5.

BeginX .......................................................................................................................... 18

3.2.6.

WinRM .......................................................................................................................... 19

3.2.7.

WinRS........................................................................................................................... 21

3.2.8.

AT.................................................................................................................................. 23

3.2.9.

BITS .............................................................................................................................. 25

3.3.

Obtaining Password Hash ................................................................................................... 26

3.3.1.

PWDump7 .................................................................................................................... 26

3.3.2.

PWDumpX .................................................................................................................... 27

3.3.3.

Quarks PwDump .......................................................................................................... 29

3.3.4.

Mimikatz (Obtaining Password Hash) .......................................................................... 30

3.3.5.

Mimikatz (Obtaining Ticket) ........................................................................................... 31

3.3.6.

WCE.............................................................................................................................. 32

3.3.7.

gsecdump ..................................................................................................................... 33

3.3.8.

lslsass ........................................................................................................................... 34

3.3.9.

Find-GPOPasswords.ps1 ............................................................................................. 35

3.3.10.

Mail PassView ........................................................................................................... 36

3.3.11.

WebBrowserPassView.............................................................................................. 37

3.3.12.

Remote Desktop PassView ...................................................................................... 38

3.4.

Malicious Communication Relay ......................................................................................... 39

3.4.1.

Htran ............................................................................................................................. 39

3.4.2.

Fake wpad .................................................................................................................... 40

3.5.

Remote Login....................................................................................................................... 42

3.5.1.
3.6.

RDP (Remote Desktop Protocol) ................................................................................. 42

Pass-the-hash, Pass-the-ticket............................................................................................ 43

3.6.1.

WCE (Remote Login) ................................................................................................... 431

3.6.2.
3.7.

Mimikatz (Remote login) ............................................................................................... 45

Escalation to the SYSTEM Privilege ................................................................................... 46

3.7.1.

MS14-058 Exploit ......................................................................................................... 46

3.7.2.

MS15-078 Exploit ......................................................................................................... 47

3.8.

Privilege Escalation ............................................................................................................. 48

3.8.1.
3.9.

SDB UAC Bypass ......................................................................................................... 48

Capturing Domain Administrator Rights Account ................................................................ 50

3.9.1.

MS14-068 Exploit ......................................................................................................... 50

3.9.2.

Mimikatz (Golden Ticket) .............................................................................................. 52

3.9.3.

Mimikatz (Silver Ticket)................................................................................................. 54

3.10.

Capturing Active Directory Database ............................................................................... 55

3.10.1.

ntdsutil ....................................................................................................................... 55

3.10.2.

vssadmin ................................................................................................................... 56

3.11.

Adding or Deleting Local User and Group ....................................................................... 57

3.11.1.
3.12.

File Sharing ...................................................................................................................... 58

3.12.1.

net use ...................................................................................................................... 58

3.12.2.

net share ................................................................................................................... 59

3.12.3.

icacls ......................................................................................................................... 60

3.13.

Deleting Evidence ............................................................................................................ 61

3.13.1.

sdelete....................................................................................................................... 61

3.13.2.

timestomp.................................................................................................................. 62

3.14.

Deleting Event Log ........................................................................................................... 63

3.14.1.
3.15.

5.

wevtutil ...................................................................................................................... 63

Obtaining Account Information ......................................................................................... 64

3.15.1.

csvde ......................................................................................................................... 64

3.15.2.

ldifde.......................................................................................................................... 66

3.15.3.

dsquery ..................................................................................................................... 67

3.16.
4.

net user ..................................................................................................................... 57

Evidence That Can Be Observed for Successful Tool Execution .................................... 68

Acquiring Additional Logs...............................................................................................70
4.1.

Importance of Acquiring Additional Logs ............................................................................. 70

4.2.

Precautions When Changing the Additional Log Acquisition Settings ................................ 70

How to Use This Report in Incident Investigation ..........................................................71
5.1.

Incident Investigation Using This Report ............................................................................. 71

6.

Conclusion......................................................................................................................72

7.

Appendix A .....................................................................................................................73

8.

7.1.

How to Install Sysmon ......................................................................................................... 73

7.2.

How to Enable the Audit Policy............................................................................................ 73

Appendix B .....................................................................................................................772

Index ......................................................................................................................................793

1. Introduction
Many recent cyberattacks have been confirmed in which malware infects a host and in turnspreads to other hosts and internal servers, resulting in the whole organization becoming
compromised. In such cases, many points need to be investigated. Accordingly, an approach forquickly and thoroughly investigating such critical events, ascertaining the overall picture of thedamage as accurately as possible, and collecting facts necessary for devising remedial measures isrequired.
While the configuration of the network that is targeted by an attack varies depending on theorganization, there are some common patterns in the attack methods. First, an attacker that has
infiltrated a network collects information of the host it has infected using "ipconfig", "systeminfo", andother tools installed on Windows by default. Then, they examine information of other hosts
connected to the network, domain information, account information, and other information using "net"and other tools. After choosing a host to infect next based on the examined information, the attacker
obtains the credential information of the user using "mimikatz", "pwdump", or other password dump
tools. Then, by fully utilizing "net", "at", or other tools, the attacker infects other hosts and collects
confidential information.
For such conventional attack methods, limited set of tools are used in many different incidents. The
many points that need to be investigated can be dealt with quickly and systematically by
understanding typical tools often used by such attackers, and what kind of and where evidence isleft.
For such use of tools, the Japan Computer Emergency Response Team Coordination
Center (JPCERT/CC) extracted tools used by many attackers by investigating recently confirmed
cases of targeted attacks. Then, a research was conducted to investigate what kind of logs wereleft on the server and clients by using such tools, and what settings need to be configured toobtain logs that contain sufficient evidential information. This report is a summary of the results ofthis research.
The outline of this report is as follows. First, Chapter 2 describes the environment and thetools used for this research. Next, Chapter 3 describes the results of this research. Then,
Chapter 4 explains how to investigate an incident based on this research results described in
Chapter 3.

4

2. Research Method
This chapter describes the method that was used for this research.

2.1.

Approach

The research aims to provide basic information which is useful in log analysis by investigating
evidence of tools used by many attackers. More specifically, this report aims to be a dictionary thatcan be used as a guide for effective log analysis by identifying which tools were used based on logs
or which log is recorded when a certain tool is executed.
In this research, tools that are used by many attackers were investigated. The specific tools that
JPCERT/CC knows are used by many attackers are described in the next section. The following log
items were investigated so that persons who are not experts in incident investigation can analyze
more easily:•

Event log•

Execution history•

Registry entry

Note that a sufficient amount of event logs cannot be acquired with the default Windows settings. In
this research, logs that are recorded with the default setting and the following setting were
investigated:•

Enabling the audit policy•

Installing Sysmon

The audit policy is a default Windows setting for acquiring detailed logs about logon, logoff, fileaccess, etc. The audit policy can be confirmed and its settings can be changed from the local group
policy.
Sysmon is a tool provided by Microsoft that enables process startup, network communication, filechanges, etc., to be recorded in event logs. Installing Sysmon enables recorded logs from Event
Viewer to be checked as shown below.

5Fig. 2-1: Checking Sysmon Logs from Event Viewer

In this research, the tools listed in Section 2.2 were actually executed on a virtual network made up
of Windows Domain Controller and a client. By checking changes in the system before and after
executing each tool, execution history, event logs, and registry entry records were collected andsummarized in Chapter 3. The network environment used for this research are described in detail in
Section 2.3.

2.2.

Tested Tools

Among tools observed in multiple incidents that JPCERT/CC handled, 44 tools that are directly
related to attack operations were selected as typical tools, such as command execution, obtaining
password hash, and remote login. Table 2-1 shows these tools grouped by the attackers' purpose ofuse.
Table 2-1: List of Tested Tools
Attacker's Purpose of Using Tool

Tool

ChapterNumberCommand execution

6

PsExec

3.2.1

wmic

3.2.2

PowerShell

3.2.3

wmiexec.vbs

3.2.4

Attacker's Purpose of Using Tool

Tool

ChapterNumber

BeginX

3.2.5

winrm

3.2.6

at

3.2.7

winrs

3.2.8

BITS

3.2.9

PWDump7

3.3.1

PWDumpX

3.3.2

Quarks PwDump

3.3.3

Mimikatz (Obtaining password hash)

3.3.4

Mimikatz (Obtaining ticket)

3.3.5

WCE

3.3.6

gsecdump

3.3.7

lslsass

3.3.8

Find-GPOPasswords.ps1

3.3.9

Mail PassView

3.3.10

WebBrowserPassView

3.3.11

Remote Desktop PassView

3.3.12

Malicious communication relay

Htran

3.4.1

(Packet tunneling)

Fake wpad

3.4.2

Remote login

RDP

3.5.1

Pass-the-hash

WCE (Remote login)

3.6.1

Pass-the-ticket

Mimikatz (Remote login)

3.6.2

MS14-058 Exploit

3.7.1

MS15-078 Exploit

3.7.2

SDB UAC Bypass

3.8.1

MS14-068 Exploit

3.9.1

Golden Ticket (Mimikatz)

3.9.2

Silver Ticket (Mimikatz)

3.9.3

ntdsutil

3.10.1adding it to an administrator group)

vssadmin3.10.2

Adding or deleting a user group

net user3.11.1

net use3.12.1

net share

3.12.2

icacls3.12.3

Obtaining password hash

Escalation to SYSTEM privilege
Privilege escalation
Capturing domain administrator
rights accountCapturing Active Directory database(Creating a domain administrator user orFile sharing

7

Attacker's Purpose of Using Tool

Tool

ChapterNumberDeleting evidence
Deleting event log

Obtaining account information

2.3.

sdelete3.13.1timestomp

3.13.2

wevtutil

3.14.1csvde

3.15.1ldifde3.15.2dsquery

3.15.3

Research Environment

A simplified system with a pair of client and server, was built on a virtual network as a target. The
selected tools were executed in the environment to observe changes to files and registries resulting
from the execution. By installing the following Windows versions on the server and client, a total offour types of system configurations were tested. In each system configuration, Active Directory
service was configured on the server to manage the client computer.
••

OS installed on the clientWindows 7 Professional Service Pack 1

Windows 8.1 Pro

OS installed on the serverWindows Server 2008 R2 Service Pack 1

Windows Server 2012 R2

83. Research Results
This chapter summarizes the basic information including functionality of the tools tested in thisresearch and log information recorded when the relevant tools were executed. The attacker's
perspective was also taken into account in the description of the basic information so that thesignificance of each tool in an attack sequence can be easily understood. This chapter also
describes the details of logs that can be acquired when the settings described in section 2.1 are
configured. (Note that how to set up the audit policy and how to install Sysmon are described in
Chapter 7.)

3.1.

Layout of This Chapter

The following describes the 44 tools using the table format shown below.

Fig. 3-1: Content of the Descriptions in the Subsequent Sections

9

The following describes the content described for each item.
(1) Description of the toolThe impact from the use of the tool, privileges for using the tool, communication protocol,and related services are described.

(2) Test environmentInformation about the OS at the source host and destination host.

(3) Log storage location


Storage location of registries and event logs.

(4) Evidence that can be confirmed when execution is successfulThe method to confirm successful execution of the tool.

(5) Information described in event logs, registries, and files

If the record in an event log, registry, or file match the description in this item, it is likelythat the record was made by executing the relevant tool and thus investigation isrequired.

(6) Important information that can be confirmed in a log
Important information that can be used for the investigation of records in the targeted logs
(This does not necessarily mean that all information that is recorded is described.)(7) Whether or not an additional setting is required for acquiring the relevant log
Indicated as "-" when the log can be obtained in the standard setting, or "Required" whenan additional setting is needed.

(8) Additional event logs that may be output


Any logs that may be additionally recorded.

103.2.1. PsExec
Basic Information
Tool Name
Category
Tool Overview
Tool

PsExecCommand Execution
Executes a process on a remote system

Legend- Acquirable
Information- Event ID/Item Name
- Field Name- "Field Value"

The tool may be used to remotely execute a command on client and servers in a domain.
Example ofPresumed Tool Use - Source host: PsExec command execution source
During an Attack - Destination host: The destination logged in by the PsExec command- Source host: Standard user
- Destination host: Administrator
Windows
Targeted OS
Operating
Not required
DomainCondition
Communication 135/tcp, 445/tcp, a random high port
*When executing in a domain environment, communication for Kerberos authentication with the domain controller occurs.
ProtocolService- Source host: A registry to the effect that the PsExec License Agreement has been entered is registered.
Standard Settings- Destination host: The fact that the "PSEXESVC" service has been installed, started, and ended is recorded.
Information- Execution history (Sysmon/audit policy)- Source host: The fact that the PsExec process was executed and that connection was made to the destination via the network, as well as the command name and argument for a
Acquired from
Additional Settings
remotely executed command are recorded.
Log- Destination host: The fact that the PSEXESVC's binary was created and accessed, and that connection was made from the source via the network, as well as the command name andargument for a remotely executed command are recorded.
If the following is confirmed, it is possible that PsExec was executed.
Evidence That Can Be Confirmed - Source host: If the following log is in the event log- The Event ID 4689 (A process has exited) of psexec.exe was recorded in the event log "Security" with the execution result (return value) of "0x0".
When Execution is Successful- Destination host: PSEXESVC.exe is installed.
Authority

Points to be Confirmed
Log Generation
Communication
Location

Acquired Information Details

Log Type and Name

Additional
Settings

Event ID : 4688 (A new process has been created)
4689 (A process has exited)- Process Information -> Process Name : "[Execution File (psexec.exe)]"
Event Log
Security- Confirmable Information- Process Start/End Time and Date:- Name of User Who Executed the Process:- Domain of User Who Executed the Process:- Presence of Privilege Escalation at Process Execution:- Process Return Value:

Log Date
Subject -> Account Name
Subject -> Account Domain
Process Information -> Token Escalation Type
Process Information -> Exit Status

Required

Event ID : 1 (Process Create)
5 (Process Terminated)- Image : "[Execution File (psexec.exe)]"

Source Host
Event Log
SysmonExecution history
Registry- Confirmable Information- Process Start/End Time and Date (UTC): UtcTime- Process Command Line:
CommandLine *The remotely executed command is recorded in the argument in- User Name:
User
the command line.
- Process ID:
ProcessId
Registry Entry: HKEY_USERS\[SID]\Software\Sysinternals\PsExec- EulaAccepted*If PsExec has not been executed in the past, the registry to the effect that the License Agreement has been entered is output.
(If the service was executed in the past, the registry will remain unchanged.)

Required-

Event ID : 7045 (A service was installed in the system)
Event Log
System- Confirmable Information- Process Name: "PSEXESVC"- Path:"%SystemRoot%\PSEXESVC.exe"-

Event ID : 7036 (The service state has changed)*The "PSEXESVC" service enters the "Executing" state before executing a remote process, and enters the "Stopped" state
after the execution.

OS: Windowsuser↓
OS: Windows
administrator

Event ID : 5156 (The Windows Filtering Platform has allowed a connection)*Communication occurs from the source host to the destination with destination ports 135 and 445.
(Example: The Windows Filtering Platform has allowed communication from 192.168.0.10:49210 to 192.168.0.2: 445 )*Communication occurs from the source host to the destination with a random high port (1024 and higher) as the destination port.
Event ID : 5140 (A network share object was accessed)- Confirmable Information- Connection Date and Time:
Log Date *The date and time before the start of PSEXESVC.exe- Account Used for Connection: Subject -> Security ID and Account Name
- Source Host:
Network Information -> Source Address and Source Port
- Connected Share:"\??\C:\Windows" (administrative share)
Destination Host
Event ID : 4672 (Special privileges assigned to new logon)

Event Log
Security*Before this event occurs, the event 4624 occurs.
An account logged on when the event 4624 occurs is assigned privileges.

- Confirmable Information- Account Used for Connection: Subject -> Security ID and Account Name
- Assigned Privileges:
Privileges
Event ID : 4656 (A handle to an object was requested), 4663 (An attempt was made to access an object)- Object -> Object Name :"C:\Windows\PSEXESVC.exe"
Event ID : 5140 (A network share object was accessed)- Confirmable Information- Account Used for Connection: Subject -> Security ID and Account Name
- Source Host:
Network Information -> Source Address and Source Port
- Connected Share:"\\*\IPC$" (administrative share)
Event ID : 5145 (A network share object was checked to see whether client can be granted desired access)*The Event ID is recorded several times.
- Confirmable Information- Account Used for Connection: Subject -> Security ID and Account Name
- Source Host Machine:
Network Information -> Source Address and Source Port
- Targeted Share:
Share Information -> Share Path*The share path contains "PSEXESVC" and "\\??\C:\Windows".

11

RequiredCommunication

Log Generation
Location

Acquired Information Details

Log Type and Name

Event Log
Security(Continued from theprevious entry)"

OS: Windows
user↓
Destination Host
OS: Windows(Continued from theadministrator
previous entry)(Continued fromthe previous
entry)

Additional
Settings

Event ID : 4656 (A handle to an object was requested)
4660 (An object was deleted)4658 (The handle to an object was closed)- Process Information -> Process ID : "0x4" (SYSTEM)- Confirmable Information- Targeted File:
Object -> Object Name ("C:\Windows\PSEXESVC.exe" )- Handle ID:
Object -> Handle ID *This is used for association with other logs.
- Process Details:
Access Request Information -> Access ("DELETE", "ReadAttributes" )- Success or Failure: Keywords ("Audit Success" )Required

Event ID : 1 (Process Create)
5 (Process Terminated)- Image : "C:\Windows\PSEXESVC.exe"- User : "SYSTEM"- Confirmed Information- Date and Time PSEXESVC.exe was Executed: Log Date
Event Log
SysmonRequired
Event ID : 1 (Process Create)
5 (Process Terminated)- Confirmable Information- Remotely Executed Process:- Argument:- Process Start/End Date and Time (UTC):- Account Used for Remote Execution:

Image
CommandLine
UtcTime *The date and time after the start of PSEXESVC.exe and before its end
User

Remarks
Additional Event Logs That Can Be Output

Information related to the process execution using PsExec may be recorded to the "Destination host".

123.2.2. WMIC (Windows Management Instrumentation Command Line)
Basic Information
Tool Name
Category
Tool Overview
Tool

WMIC (Windows Management Instrumentation Command Line)
Command execution
A tool used for Windows system management

Example of
The tool is believed to be used to acquire information on the remote system or to execute a command with WMI.
Presumed Tool Use - Source host: wmic command execution source
During an Attack - Destination host: The host accessed by the wmic command

Legend- Acquirable
Information- Event ID/Item Name
- Field Name- "Field Value"Standard user *Depending on the command executed on the remote side, administrator privileges may be required.
Authority
Windows
Targeted OS
Operating
Not required
DomainCommunication
Condition
135/tcp, 445/tcp, a randomly selected TCP port 1024 or higher
ProtocolWindows Management Instrumentation, Remote Procedure Call (RPC)
Service
Information
Standard Settings - Execution history (Prefetch)
Acquired from
Additional Settings - Process execution details (the argument to wmic) and execution success or failure (the return value) (Sysmon and audit policy)
If the following logs that have the same log time are found at "source host" and "destination host", it is possible that a remote connection was made.
- Source host: If the following log is in the event log:
Evidence That Can Be Confirmed- The event ID 4689 (A process has exited) of WMIC.exe was recorded in the event log "Security" with the execution result (return value) of "0x0".
When Execution is Successful- Destination host: If the following log is in Sysmon:- It is recorded in the event log "Sysmon" that WmiPrvSE.exe was executed with the event IDs 1 and 5.
Points to be Confirmed
Log Generation
Communication
Location

Acquired Information Details

Log Type and Name

Additional
Settings

Event ID : 4688 (A new process has been created)
4689 (A process has exited)- Process Information -> Process Name : "C:\Windows\System32\wbem\WMIC.exe"
Event Log
Security

Log Date
Subject -> Account Name
Subject -> Account Domain
Process Information -> Token Escalation Type
Process Information -> Exit Status

Required

Event ID : 1 (Process Create)
5 (Process Terminated)- Image : "C:\Windows\System32\wbem\WMIC.exe"

Source Host
Event Log
Sysmon

OS: Windowsuser↓
OS: Windows
administrator- Confirmable Information- Process Start/End Time and Date:- Name of User Who Executed the Process:- Domain of User Who Executed the Process:- Presence of Privilege Escalation at Process Execution:- Process Return Value:- Confirmable Information- Process Start/End Time and Date (UTC): UtcTime- Process Command Line: CommandLine *Based on the wmic.exe argument, the remote host and executed command can be

Requiredconfirmed.

- Executing user Name:- Process ID:

Execution History
Prefetch

User
ProcessId

File Name: C:\Windows\Prefetch\WMIC.EXE-98223A30.pf- Confirmable Information (the following can be confirmed using this tool: WinPrefetchView)- Last Execution Time and Date:
Last Executed Time-

Event ID : 1 (Process Create)
5 (Process Terminated)- Image : "C:\Windows\System32\wbem\WmiPrvSE.exe"
Event Log
SysmonDestination Host

Execution History
Prefetch- Confirmable Information- Process Start/End Time and Date (UTC): UtcTime- Process Command Line:
CommandLine ("C:\Windows\System32\wmiprvse.exe -secured -Embedding")- User Name:
User ( "NT AUTHORITY\NETWORK SERVICE")- Process ID:
ProcessId
File Name: C:\Windows\Prefetch\WMIPRVSE.EXE-1628051C.pf- Confirmable Information (the following can be confirmed using this tool: WinPrefetchView)- Last Execution Time and Date:
Last Execution Time

Remarks

Additional Event Logs That Can Be Output

Required- Depending on the process called by wmic, the process-specific logs may be recorded.
- If the user exists on the Active Directory, the authentication request may be recorded in the Domain Controller.
However, it is not possible to determine whether such an authentication request was made by wmic or others.

13-3.2.3. PowerShell (Remote Command Execution)
Basic Information
Tool Name
Category
Tool Overview

Tool

PowerShell (Remote Command Execution)
Command Execution
A command line tool that can be used for Windows management and settings (it is available by default in Windows 7 or later)
In addition to the host that executes PowerShell, this tool enables commands to be executed on other hosts via a network.

The tool may be used to change settings to enable the Domain Controller and other hosts on the network to perform operations requiring administrator rights.
Example ofPresumed Tool Use - Source host: PowerShell command execution source
During an Attack - Destination host: The destination logged in by the PowerShell command

Legend- Acquirable
Information- Event ID/Item Name
- Field Name- "Field Value"

Execution Example Execute the following commands *The Windows Remote Management (WS-Management) service needs to be started at the destination host.
(with commands > Enable-PSRemoting -force> Set-Item WSMan:\localhost\Client\TrustedHosts -Value *used for> Enter-PSSession "[Destination Host]" -Credential Administrator
verification)
PowerShell can be used by standard users. *To execute a script for changing settings, appropriate rights are needed on the host to change settings.
Authority
Windows
TargetedOS
Operating
Not required
DomainCondition
Communication Protocol Not required to manage within local machines. *To manage other hosts, use 80/tcp or 5985/tcp for HTTP and 443/tcp or 5986/tcp for HTTPS.
Destination host: Windows Remote Management (WS-Management)
Service
Information
Standard Settings Execution history (Prefetch)
Acquired from
Execution history (Sysmon, audit policy) *The end event of PowerShell allows execution results to be confirmed.
Additional Settings
With audit policy, it is possible to confirm the occurence of communication from the source host to the destination host 5985/tcp (HTTP) or 5986/tcp (HTTPS).
Log
If the following logs that have the same log time are found, it is possible that a remote command was executed. *This also applies to Prefetch.
- Source host: If the following log is in the event log:
Evidence That Can Be Confirmed- The event ID 4689 (A process has exited) of PowerShell was recorded in the event log "Security" with the execution result (return value) of "0x0".
When Execution is Successful- Destination host: If the following log is in the event log:
- The event ID 4689 (A process has exited) of wsmprovhost.exe was recorded in the event log "Security" with the execution result (return value) of "0x0".
Points to be Confirmed
Log Generation
Communication
Location

Acquired Information Details

Log Type and Name

Additional
Settings

Event ID : 4688 (A new process has been created)
4689 (A process has exited)- Process Information -> Process Name : "C:\Windows\System32\Windows PowerShell\v1.0\powershell.exe"- Confirmable Information- Process Start/End Time and Date:- Name of User Who Executed the Process:- Domain of User Who Executed the Process:- Presence of Privilege Escalation at Process Execution:- Process Return Value:
Event Log
Security

Log Date
Subject -> Account Name
Subject -> Account Domain
Process Information -> Token Escalation Type
Process Information -> Exit Status

Event ID : 5156 (The Windows Filtering Platform has allowed a connection)- Process Name : "\device\harddiskvolume 2 \windows\system32\windowspowershell\v1.0\powershell.exe"- Network Information -> Direction :"Outbound"- Network Information -> Destination Address : "::1"- Network Information -> Destination Port / Protocol : "47001" / "6" (TCP)

Required

Event ID : 5156 (The Windows Filtering Platform has allowed a connection)- Process Name : "\device\harddiskvolume 2 \windows\system32\windowspowershell\v1.0\powershell.exe"- Network Information -> Direction :"Outbound"- Network Information -> Destination Address : "[Destination Host]"
・Network Information -> Destination Port / Protocol : "5985"(HTTP) or "5986"(HTTPS) / "6"(TCP)*A port number can be changed by specifying it on the destination host side.

Source Host

Event ID : 1 (Process Create)
5 (Process Terminated)- Image : "C:\Windows\System32\Windows PowerShell\v1.0\powershell.exe"
Event Log
SysmonExecution History
Prefetch

OS: Windowsuser↓
OS: Windows
administrator- Confirmable Information- Process Start/End Time and Date (UTC):- Process Command Line:- User Name:- Process ID:

Required
UtcTimeCommandLine : "C:\Windows\System32\Windows
User
ProcessId

File Name: C:\Windows\Prefetch\POWERSHELL.EXE-920BBA2A.pf- Confirmable Information (the following can be confirmed using this tool: WinPrefetchView)- Last Execution Time and Date:
Last Execution Time-

Event ID : 5156 (The Windows Filtering Platform has allowed a connection)- Process ID :"4"
- Application Name :"System"- Network Information -> Direction : "Inbound"
Required- Confirmed Information- Source Host:- Incoming Call Port:- Protocol:
Event Log
Security

Network Information -> Source Address
Network Information -> Source Port ("5985" for HTTP, "5986" for HTTPS)
Network Information -> Protocol ("6" )Event ID : 4624 (An account was successfully logged on)- Logon Type : "3"- Confirmable Information- Date and Time of Successful Logon:
Log Date*The date immediately after the wsmprovhost.exe process was created (Event ID 4688) and before it ended (Event ID 4689).
- Name of Account That Executed the Process on the Destination Host: New Logon -> Security ID / Account Name

Destination Host-

Event ID : 4634 (An account was logged off)
- Confirmable Information- Date and Time of Logoff: Log Date

*The date after the end of the wsmprovhost.exe process (Event ID 4689) at the source host.

Event ID : 1 (Process Create)
5 (Process Terminated)- Image: "C:\Windows\System32\at.exe"
Event Log
SysmonExecution History
Prefetch- Confirmable Information- Process Start/End Time and Date (UTC): UtcTime- Process Command Line:
CommandLine: "C:\Windows\System32\wsmprovhost.exe -Embedding"- User Name:
User- Process ID:
ProcessId

RequiredFile Name: C:\Windows\Prefetch\WSMPROVHOST.EXE-EF06207C.pf- Confirmable Information (the following can be confirmed using this tool: WinPrefetchView)- Last Execution Time and Date:
Last Execution Time

14-

Remarks
Additional Event Logs That Can Be Output

Depending on the command that is executed, logs output by the command may be recorded at the destination host.

15

3.2.4. wmiexec.vbs
Basic Information
Tool Name
Category
Tool Overview
Toolwmiexec.vbs
Command Execution
A tool used for Windows system management

Legend- Acquirable
Information- Event ID/Item Name
- Field Name- "Field Value"

Example ofThis tool executes a script for other hosts.
Presumed Tool Use - Source host: The source that executes wmiexec.vbs
During an Attack - Destination host: The machine accessed by the wmiexec.vbs

Standard user
Windows
Operating
Not required
Condition
Communication Protocol 135/tcp, 445/tcp
Service
Information
Standard Settings - Execution history (Prefetch)- File creation/delete history (Audit policy)
Acquired from
Additional Settings- Execution history (Sysmon)
Log
Evidence That Can Be Confirmed
Destination host: The "WMI_SHARE" share has been created and deleted.
When Execution is Successful
Authority
Targeted OS
DomainPoints to be Confirmed
Log Generation
Communication
Location

Acquired Information Details

Log Type and Name

Additional
Settings

Event ID : 4688 (A new process has been created)
4689 (A process has exited)- Process Information -> Process Name : "C:\Windows\System32\cscript.exe"

Event Log
Security- Confirmable Information- Process Start/End Time and Date:- Name of User Who Executed the Process:- Domain of User Who Executed the Process:- Presence of Privilege Escalation at Process Execution:- Process Return Value:

Log Date
Subject -> Account Name
Subject -> Account Domain
Process Information -> Token Escalation Type
Process Information -> Exit Status

Required

Event ID : 5156 (The Windows Filtering Platform has allowed a connection)- Process Name : "\device\harddiskvolume 2 \windows\system32\cscript.exe"- Confirmable Information- Source Port: Network Information -> Destination Port

Source Host

*A port number can be changed by specifying it on the destination.

Event ID : 1 (Process Create)
5 (Process Terminated)- Image : "C:\Windows\System32\cscript.exe"
Event Log
SysmonExecution History
Prefetch- Confirmable Information- Process Start/End Time and Date (UTC):- Process Command Line:- User Name:- Process ID:

Required
UtcTimeCommandLine
User
ProcessId

File Name: C:\Windows\Prefetch\CSCRIPT.EXE-D1EF4768.pf- Confirmable Information (the following can be confirmed using this tool: WinPrefetchView)- Last Execution Time and Date:
Last Execution Time-

Event ID : 4656 (A handle to an object was requested)4663 (An attempt was made to access an object)4658 (The handle to an object was closed)- Object -> Object Name : "(C:\Windows\Temp\wmi.dll)"- Access Request Information -> Access / Reason for Access : ("WriteData (or AddFile)", "AppendData (or AddSubdirectory or
CreatePipeInstance)")- Confirmable Information- Process Name: "C:\Windows\System32\cmd.exe"- Handle ID:
Object -> Handle ID *This is used for association with other logs.

OS: Windowsuser↓
OS: Windows
user

Event ID : 5142 (A network share object was added.)- Confirmable Information- Process Start/End Time and Date:
Log Date- Name of User Who Executed the Process: Subject -> Account Name
- Domain of User Who Executed the Process: Subject -> Account Domain- Share Name:
Share Information -> Share Name: ("\\*\WMI_SHARE")- Share Path:
Share Information -> Share Path: ("C:\Windows\Temp")

Event Log
Security

Destination Host

Event ID : 5145 (A network share object was checked to see whether the client can be granted the desired access)- Confirmable Information- Process Start/End Time and Date:
Log Date- Name of User Who Executed the Process: Subject -> Account Name
- Domain of User Who Executed the Process: Subject -> Account Domain- Share Name:
Share Information -> Share Name ("\\*\WMI_SHARE" )- Share Path:
Share Information -> Share Path ("\??\C:\windows\temp" )- Share Path:
Share Information -> Relative Target Name: ("wmi.dll")

Required

Event ID : 4656 (A handle to an object was requested)
4660 (An object was deleted)4658 (The handle to an object was closed)- Object -> Object Name :"(C:\Windows\Temp\wmi.dll)"- Access Request Information -> Access/Reason for Access : "DELETE"- Confirmable Information- Process Name: "(C:\Windows\System32\cmd.exe)"
Event ID : 5144 (A network share object was deleted.)- Confirmable Information- Share Name: Share Information -> Share Name ( "\\*\WMI_SHARE")- Share Path: Share Information -> Share Path: ( "C:\Windows\Temp")

Event Log
SysmonEvent ID : 1 (Process Create)
5 (Process Terminated)- Image : "C:\Windows\System32\wbem\WmiPrvSE.exe""C:\Windows\System32\cmd.exe"- Confirmable Information- Process Start/End Time and Date (UTC):- Process Command Line:- User Name:- Process ID:

Required
UtcTimeCommandLine
User
ProcessId

16

Communication

Log Generation
Location

OS: Windows
user
Destination Host↓
OS: Windows(Continued from theuserprevious entry)(Continued fromthe previous entry)

Acquired Information Details

Log Type and Name

Execution History
Prefetch

File Name: C:\Windows\Prefetch\CSCRIPT.EXE-D1EF4768.pf
C:\Windows\Prefetch\WMIPRVSE.EXE-1628051C.pf- Confirmable Information (the following can be confirmed using this tool: WinPrefetchView)- Last Execution Time and Date:
Last Execution Time

Remarks
Additional Event Logs That Can Be Output

Additional
Settings-

17

3.2.5. BeginX
Basic Information
Tool Name
Category
Tool Overview
Tool

OperatingCondition

BeginX
Command Execution
Executes a remote command from a client to the server

Legend- Acquirable
Information- Event ID/Item Name
- Field Name- "Field Value"

This tool is used to change settings on and acquire information from the remote host.
Example ofPresumed Tool Use - Source host: BeginX client execution source
During an Attack - Destination host: BeginX server execution source
Reference
Authority
Targeted OS
Domainhttps://www.jpcert.or.jp/present/2015/20151028_codeblue_apt-en.pdf
Standard user
Windows
Not required

Communication
ProtocolTCP or UDP, and the port number varies depending on the tool.

- Both hosts: Execution history (Prefetch)
Information
Standard Settings- Destination host: The Windows Firewall settings are changed.
Acquired from- Both hosts: Execution history (Sysmon / audit policy)
Additional Settings
Log
The fact that communication via a specified port occurred is recorded.
Evidence That Can Be Confirmed - Source host: The fact that communication via a permitted port occurred unintentionally at the destination host is recorded.
- Destination host: Unintended communication is permitted for Windows Firewall, and a tool that is listening at the relevant port exists.
When Execution is Successful
Service

Points to be Confirmed
Log Generation
Communication
Location

Acquired Information Details

Log Type and Name

Additional
Settings

Event ID : 4688 (A new process has been created)
4689 (A process has exited)- Process Information -> Process Name : "[File Name]"- Confirmable Information- Process Start/End Time and Date:- Name of User Who Executed the Process:- Domain of User Who Executed the Process:- Presence of Privilege Escalation at Process Execution:- Process Return Value:

Event Log
Security

Log Date
Subject -> Account Name
Subject -> Account Domain
Process Information -> Token Escalation Type
Process Information -> Exit Status-

Event ID : 5156 (The Windows Filtering Platform has allowed a connection)- Application Name : "[File Name]"- Confirmable Information- Communication Direction:- Source Port:- Destination Host:- Destination Port:

Source host

Network Information -> Direction ("Outbound" )Network Information -> Source Port
Network Information -> Destination Address (the host with a tool name specified during execution)
Network Information -> Destination Port / Protocol

Event ID : 1 (Process Create)
5 (Process Terminated)- Image : "[File Name]"
Event Log
SysmonExecution History
Prefetch- Confirmable Information- Process Start/End Time and Date (UTC):- Process Command Line:- User Name:- Process ID:

Required
UtcTimeCommandLine *Recorded in Event ID 1.
User
ProcessId

File name: C:\Windows\Prefetch\[File Name]-[RANDOM].pf- Confirmable Information (the following can be confirmed using this tool: WinPrefetchView)- Last Execution Time and Date:
Last Execution Time-The following is recorded immediately after the tool is executed.
OS: Windowsuser↓
OS: Windows
user

Event ID : 5154 (The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections)- Application Name : "[File Name]"- Confirmable Information- Source Port:
Network Information -> Source Port
- Protocol to Use: Network Information -> Protocol

Event Log
Security

Event ID : 5447 (A Windows Filtering Platform filter has been changed) * Reflection of changes in the firewall settings.
4946 (A change has been made to Windows Firewall exception list. A rule was added) * Reflection of changes in the firewall-

When the source host executes a command, the following is recorded.
Event ID : 5156 (The Windows Filtering Platform has allowed a connection)- Application Name : "[File Name]"- Confirmable Information- Communication Direction:- Source Port:- Destination Host:- Destination Port:

Destination host

Network Information -> Direction ("Inbound" )Network Information -> Source Port
Network Information -> Destination Address (the remote source host)
Network Information -> Destination Port / Protocol

Event ID : 1 (Process Create)
5 (Process Terminated)- Image : "[File Name]","netsh.exe","rundll32.exe"
Event Log
SysmonExecution History
Prefetch

Execution History
Registry- Confirmable Information- Process Start/End Time and Date (UTC): UtcTime- Process Command Line:
CommandLine *The details of the process that was executed are described for each Image .
- User Name:
User- Process ID:
ProcessId
File name: C:\Windows\Prefetch\CMD.EXE-4A81B364.pf
C:\Windows\Prefetch\[File Name]-[RANDOM].pf- Confirmable Information (the following can be confirmed using this tool: WinPrefetchView)- Last Execution Time and Date:
Last Execution Time
Registry Entry: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules*The Windows Firewall settings are changed when a tool is executed, and accordingly, the registry value is changed.
The executable file name of a tool is included in the rule.

Remarks
Additional Event Logs That Can Be Output

Required-18-

3.2.6. WinRM
Basic Information
Tool Name
Category
Tool Overview
Tool

OperatingCondition

WinRM
Command Execution
Executes a command on a remote hostLegend- Acquirable
Information- Event ID/Item Name
- Field Name- "Field Value"

Example ofThis tool is used for an investigation before executing a remote command.
Presumed Tool Use - Source host: WinRM command execution source
During an Attack - Destination host: The machine accessed by the WinRM command
Authority
Targeted OS
DomainAdministrator
Windows-

Communication
Protocol5985/tcp (HTTP) or 5986/tcp (HTTPS)

Destination host: Windows Remote Management (WS-Management)
ServiceStandard Settings - Execution history (Prefetch)- Source host: Execution history (Sysmon / audit policy)
Additional Settings- Destination host: Connection from the source host
Evidence That Can Be Confirmed - Source host: If the following log exists, it is possible that WinRM was executed.
- A log indicating that cscript.exe accessed the destination host with Event IDs 1 and 5 of the event log "Sysmon" is recorded.
When Execution is Successful
Information
Acquired from
Log

Points to be Confirmed
Log Generation
Communication
Location

Acquired Information Details

Log Type and Name

Additional
Settings

Event ID : 4688 (A new process has been created)
4689 (A process has exited)- Process Information -> Process Name : "C:\Windows\System32\cscript.exe"

Event Log
Security- Confirmable Information- Process Start/End Time and Date:- Name of User Who Executed the Process:- Domain of User Who Executed the Process:- Presence of Privilege Escalation at Process Execution:- Process Return Value:

Log Date
Subject -> Account Name
Subject -> Account Domain
Process Information -> Token Escalation Type
Process Information -> Exit Status

Required

Event ID : 5156 (The Windows Filtering Platform has allowed a connection)- Application Name : "\device\harddiskvolume 2 \windows\system32\cscript.exe"- Confirmable Information- Communication Direction: Direction ("Outbound" )- Destination Host:
Network Information -> Destination Address- Destination Port:
Destination Port ("5958"(HTTP) or "5986"(HTTPS) ), Protocol ("6" = TCP)
Event ID : 1 (Process Create)
5 (Process Terminated)- Image : "C:\Windows\System32\cscript.exe"
Event Log
SysmonSource host- Confirmable Information- Process Start/End Time and Date (UTC):
UtcTime- Specified Time, Execution Process, Target Host: CommandLine- User Name:
User- Process ID:
ProcessId

Required

Event ID : 166 (The chosen authentication mechanism is Negotiate)- Confirmable Information- Authentication Method: Authentication Mechanism (the selected authentication mechanism is Kerberos)

Event Log
Application andService

Event ID : 80 (Sending the request for operation Get to destination host and port)- Confirmable Information- Send Destination Computer and Port: "[Host Name]:[Port]"-

Microsoft\Window Event ID : 143 (Received the response from Network layer)s\Windows Remote- Confirmable Information
Management- Status: Status (200 (HTTP_STATUS_OK))

OS: Windows
administrator↓
OS: Windows
administrator

Event ID : 132 (WSMan operation Identify completed successfully)- Confirmable Information- Completion Time and Date (UTC): UtcTime

Execution History
Prefetch

File name: C:\Windows\Prefetch\CSCRIPT.EXE-D1EF4768.pf- Confirmable Information (the following can be confirmed using this tool: WinPrefetchView)- Last Execution Time and Date: Last Execution Time-

Event ID : 5156 (The Windows Filtering Platform has allowed a connection)- Application Information -> Application Name : "SYSTEM"- Network Information -> Direction :"Inbound"- Network Information -> Source Port :"5985" (HTTP) or "5986" (HTTPS)- Network Information -> Protocol :"6" (TCP)- Confirmable Information- Source Host: Network Information -> Destination Address- Source Port: Network Information -> Destination Port
Event ID : 4624 (An account was successfully logged on)- Logon Type : "3"
Destination hostEvent Log
Security- Confirmable Information- Used Security ID: New Logon -> Security ID- Logon ID:
Subject -> Logon ID- Account:
Account Name - Account Domain
Event ID : 4656 (A handle to an object was requested)4658 (The handle to an object was closed)- Process Information -> Process Name : "C:\Windows\System32\svchost.exe"- Object -> Object Name :"\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN\Client"- Object -> Object Name :"\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN\Service"- Confirmable Information- Handle ID:- Access Request Details:

Object -> Handle ID
Access Request Information -> Access("READ_CONTROL", "Query key value", "Enumerate sub-keys", "Notify about changes to keys")*This process is performed multiple times.

19

RequiredCommunication

OS: Windows
administrator↓
OS: Windows
administrator(Continued fromthe previous
entry)Log Generation
Location

Acquired Information Details

Log Type and Name

Additional
Settings

Event ID : 5156 (The Windows Filtering Platform has allowed a connection)- Application Information -> Application Name : "\device\harddiskvolume 2 \windows\system32\lsass.exe"- Network Information -> Direction :"Inbound"- Network Information -> Source Port :"88"
Active Directory
DomainController- Confirmable Information- Source Host: Network Information -> Destination Address

Event Log
Security

Event ID : 4769 (A Kerberos service ticket was requested)- Network Information -> Client Address : "[Source Host]"- Confirmable Information- Used User: Account Information -> Account Name

Remarks
Additional Event Logs That Can Be Output-

20

Required3.2.7. WinRS
Basic Information
Tool Name
Category
Tool Overview
Tool

Legend- Acquirable
Information- Event ID/Item Name
- Field Name- "Field Value"

This tool is sent by the BITS, etc. and remotely executed using winrs.
Example ofPresumed Tool Use - Source host: WinRS command execution source
During an Attack - Destination host: The machine accessed by the WinRS command
Authority

OperatingCondition

WinRS
Command Execution
Executes a command on a remote hostTargeted OS
DomainCommunication
Protocol- Source host: Standard user
- Destination host: Administrator
Windows
Not required
5985/tcp (HTTP) or 5986/tcp (HTTPS)

Destination host: Windows Remote Management (WS-Management)- WinRM execution log
Information
Standard Settings- Execution history (Prefetch)
Acquired from- Execution history (Sysmon / audit policy)
Additional SettingsLog- Recording of communication via Windows Filtering Platform
Evidence That Can Be Confirmed- The execution of WinRS is recorded in the event log "Application and Service\Microsoft\Windows\Windows Remote Management\Operational".
When Execution is Successful
Service

Points to be Confirmed
Log Generation
Communication
Location

Acquired Information Details

Log Type and Name

Additional
Settings

Event ID : 4688 (A new process has been created)
4689 (A process has exited)- Process Information -> Process Name : "C:\Windows\System32\winrs.exe"- Confirmable Information- Process Start/End Time and Date:- Name of User Who Executed the Process:- Domain of User Who Executed the Process:- Presence of Privilege Escalation at Process Execution:- Process Return Value:

Event Log
Security

Log Date
Subject -> Account Name
Subject -> Account Domain
Process Information -> Token Escalation Type
Process Information -> Exit Status

Event ID : 4648 (A logon was attempted using explicit credentials)- Process Information -> Process Name : "C:\Windows\System32\winrs.exe"
Required- Confirmable Information- Account Used:
Account for which a Credential was Used -> Account Name - Account Domain- Destination Host:
Target Server -> Target Server Name
- Protocol Used:
Target Server -> Additional Information ("[Protocol]/[Target Server Name]" )- Event ID : 5156 (The Windows Filtering Platform has allowed a connection)- Application Information -> Application Name : "\device\harddiskvolume 2 \windoows\system32\winrs.exe"- Network Information -> Direction :"Outbound"- Network Information -> Destination Port :"5985" (HTTP) or "5986" (HTTPS)- Network Information -> Protocol :"6" (TCP)- Confirmable Information- Destination Host: Network Information -> Destination Address

Source hostEvent ID : 1 (Process Create)
5 (Process Terminated)- Image : "C:\Windows\System32\winrs.exe"
Event Log
Sysmon- Confirmable Information- Process Start/End Time and Date (UTC): UtcTime- Process Command Line:
CommandLine *Destination Host, Account Used, Command Executed, etc. are recorded.
- User Name:
User- Process ID:
ProcessId

RequiredThat fact that WinRS was executed is recorded.
Event Log
Application and Service

OS: Windows
standard user↓
OS: Windows
administrator

Event ID : 80 (Processing of a request)
Microsoft\Windows\Windows Remote
Management\Operational

Execution History
Prefetch-- Confirmable Information- Destination Host: Details Tab -> EventData\url- Destination Port: Details Tab -> EventData\port
File name: C:\Windows\Prefetch\WINRS.EXE-483CEB0F.pf- Confirmable Information (the following can be confirmed using this tool: WinPrefetchView)- Last Execution Time and Date:
Last Execution Time-

Event ID : 4688 (A new process has been created)
4689 (A process has exited)- Process Information -> Process Name : "C:\Windows\System32\winrshost.exe"- Confirmable Information- Process Start/End Time and Date:- Name of User Who Executed the Process:- Domain of User Who Executed the Process:- Presence of Privilege Escalation at Process Execution:- Process Return Value:

Destination hostEvent Log
Security

Log Date
Subject -> Account Name
Subject -> Account Domain
Process Information -> Token Escalation Type
Process Information -> Exit Status

Event ID : 4688 (A new process has been created)
4689 (A process has exited)- Process Information -> Process Name : "[Command Specified by Source Host]"- Confirmable Information- Process Start/End Time and Date:- Name of User Who Executed the Process:- Domain of User Who Executed the Process:- Presence of Privilege Escalation at Process Execution:- Process Return Value:

Required
Log Date
Subject -> Account Name
Subject -> Account Domain
Process Information -> Token Escalation Type
Process Information -> Exit Status

Event ID : 5156 (The Windows Filtering Platform has allowed a connection)- Application Information -> Application Name : "System"- Network Information -> Direction :"Inbound"- Network Information -> Source Port :"5985" (HTTP) or "5986" (HTTPS)- Network Information -> Protocol :"6" (TCP)- Confirmable Information- Source Host: Network Information -> Destination Address

21Communication

Log Generation
Location

Acquired Information Details

Log Type and Name

Additional
Settings

Event ID : 1 (Process Create)
5 (Process Terminated)- Image : "C:\Windows\System32\winrshost.exe"

Event Log
Sysmon
OS: Windows
standard user↓
Destination host
OS: Windows(Continued from theadministrator
previous entry)(Continued fromthe previous
entry)- Confirmable Information- Process Start/End Time and Date (UTC):- Process Command Line:- User Name:- Process ID:

Required
Event ID : 1 (Process Create)
5 (Process Terminated)- Image : "[Command Specified by Source Host]"- Confirmable Information- Process Start/End Time and Date (UTC):- Process Command Line:- User Name:- Process ID:

Event Log
Application andService\Microsoft\Windows\Windows Remote

Execution History
Prefetch

UtcTimeCommandLine
User
ProcessId

UtcTimeCommandLine
User
ProcessId

The fact that the WinRS process corresponding to the log at the source host was executed is recorded.
Event ID : 81 (Sending the request for operation Get to destination host and port)
File name: C:\Windows\Prefetch\WINRSHOST.EXE-ECE7169D.pf- Confirmable Information (the following can be confirmed using this tool: WinPrefetchView)- Last Execution Time and Date:
Last Execution Time

Remarks
Additional Event Logs That Can Be Output

Logs by a command execution via WinRS may be recorded.

22-3.2.8. AT Command
Basic Information
Tool Name
Category
Tool Overview
Tool

The tool may be used to secretly place an application or script without being recognized by the user in advance and then execute it at the desired time.
Example ofPresumed Tool Use - Source host: at command execution source
During an Attack - Destination host: The machine for which a task was registered by the AT command
Authority

OperatingConditionAT
Command Execution
Executes a task at the specified timeTargeted OS
DomainCommunication
ProtocolLegend- Acquirable
Information- Event ID/Item Name
- Field Name- "Field Value"

Administrator*Setting a task on the remote host can be performed by a standard user.
Windows 7 / Server 2008
The AT command was abolished in Windows 8 and later and Server 2012 and later.
Not required
445/tcp

Task Scheduler- Source host: Execution history (Prefetch)
Standard Settings- Destination host: Task creation / execution history in the task scheduler event log
Additional Settings - Execution history (Sysmon / audit policy)- Source host: If the following log is in the event log, it is considered that a task was registered.
- The Event ID 4689 (A process has exited) of at.exe was recorded in the event log "Security" with the execution result (return value) of "0x0".
Evidence That Can Be Confirmed - Destination host: If the following log is in the event log, it is considered that a task was executed.
- The Event ID 106 (A task has been registered) was recorded in the event log "\Microsoft\Windows\TaskScheduler\Operational".
When Execution is Successful- The Event IDs 200 (The operation that has been started) and 201 (The operation has been completed) are registered in the event log"\Microsoft\Windows\TaskScheduler\Operational", and the return value of the Event ID 201 is set to success.
Service

Information
Acquired from
Log

Points to be Confirmed
Log Generation
Communication
Location

Acquired Information Details

Log Type and Name

Additional
Settings

Event ID : 4688 (A new process has been created)
4689 (A process has exited)- Process Information -> Process Name : "C:\Windows\System32\at.exe"
Event Log
Security- Confirmable Information- Process Start/End Time and Date:- Name of User Who Executed the Process:- Domain of User Who Executed the Process:- Presence of Privilege Escalation at Process Execution:- Process Return Value:

Log Date
Subject -> Account Name
Subject -> Account Domain
Process Information -> Token Escalation Type
Process Information -> Exit Status

Required

Event ID : 1 (Process Create)
5 (Process Terminated)- Image : "C:\Windows\System32\at.exe"

Source host(Windows 7)
Event Log
SysmonExecution History
Prefetch- Confirmable Information- Process Start/End Time and Date (UTC):
UtcTime- Process Command Line:
CommandLine- Specified Time, Execution Process, Target Host: CommandLine *This information is recorded when the process is executed for- User Name:
User
the remote host.
- Process ID:
ProcessId

RequiredFile name: C:\Windows\Prefetch\AT.EXE-BB02E639.pf- Confirmable Information (the following can be confirmed using this tool: WinPrefetchView)- Last Execution Time and Date:
Last Execution Time-

When a task has been registered, the following logs are output.
Event ID : 4656 (A handle to an object was requested)4663 (An attempt was made to access an object)4658 (The handle to an object was closed)- Object -> Object Name : "C:\Windows\Tasks\[Task Name].job""C:\Windows\System32\Tasks\[Task Name]- Confirmable Information- Handle ID (Used for Association with Other Logs):
Object -> Handle ID- Process ID of the Process that Requested the Handle: Process Information -> Process ID (matches the ID of theprocess created in event 4688)- Process Details:
Access Request Information -> Access / Reason for Access ("WriteData (or AddFile)""AppendData (or AddSubdirectory or CreatePipeInstance)")- Success or Failure:
Keywords ("Audit Success" )OS: Windows 7
user↓
OS: Windows
Server 2008 R2
administrator

Event ID : 4698 (A scheduled task was created)- Task Information -> Task Name
- Confirmable Information- Task Details:
Task Information -> Task Content Described in the XML format.
- Execution Trigger:
Triggers- Priority and Other Settings: Principals- Execution Details:
Actions
Destination host(Windows Server
2008 R2)

Event log
Security

When a task has been executed, the following logs are output.
Event ID : 4688 (A new process has been created)- Process Information -> Process Name : "C:\Windows\System32\taskeng.exe"- Confirmable Information- Process Start/End Time and Date:
Log Date- Name of User Who Executed the Process: Subject -> Account Name
- Domain of User Who Executed the Process: Subject -> Account Domain- Process ID:
Process Information -> New Process ID*This will be the parent process of the process to be executed later.
- Presence of Privilege Escalation at Process Execution: Process Information -> Token Escalation TypeEvent ID : 4688 (A new process has been created)
4689 (A process has exited)- Process Information -> Process Name : Process Executed by the Task
- Confirmable Information- Process Start/End Time and Date:
Log Date- Name of User Who Executed the Process: Subject -> Account Name
- Domain of User Who Executed the Process: Subject -> Account Domain- Process ID :Process Information -> New Process ID*If another child process is executed in the task, this process becomes the parent process.
- Presence of Privilege Escalation at Process Execution: Process Information -> Token Escalation Type- Parent Process ID:
Process Information -> Creator Process ID *taskeng.exe, which was
executed first, is the parent process.
- Process Return Value: Process Information -> Exit Status

23

RequiredCommunication

Log Generation
Location

Acquired Information Details

Log Type and Name

Event log
Security(Continued from theprevious entry)

Event ID : 4656 (A handle to an object was requested)4663 (An attempt was made to access an object)- Object -> Object Name : "C:\Windows\Tasks\[Task Name].job"- Access Request Information -> Access / Reason for Access : "WriteData (or AddFile)" / "AppendData(or AddSubdirectory or CreatePipeInstance)"- Confirmable Information- Handle ID: Object -> Handle ID *Used for association with other logs.

Additional
Settings

RequiredWith respect to task registration, no beneficial information is output. When a task has been executed, the following logs are registered.

Event Log
SysmonEvent ID : 1 (Process Create)
5 (Process Terminated)- ParentImage Name: "C:\Windows\System32\taskeng.exe"

Required- Confirmable Information- Process Start/End Time and Date (UTC): UtcTime- Process Command Line:
CommandLine *The execution process and argument are recorded.
- Process ID:
ProcessId *This can be used for investigating the execution and access history of a
executed by
When a task has been registered, the following logs are output.
Event ID : 106 (A task has been registered)

OS: Windows 7
user
Destination host↓(Windows Server
OS: Windows2008 R2)
Server 2008 R2
administrator (Continued from theprevious entry)(Continued fromthe previous
entry)- Confirmable Information- User Who Registered the Task:
Details Tab -> EventData\UserContext- Task Name:
Details Tab -> EventData\TaskName
When a task has been executed, the following logs are output.
Event ID : 200 (The operation that has been started)- Confirmable Information

Event Log
- Task Name:
Details Tab -> EventData\TaskName- Command that was Executed: Details Tab -> EventData\ActionName
Application and Service- Task Instance ID:
Details Tab -> EventData\TaskInstanceId
Log\Microsoft\Windows\TaskScheduler
Event ID : 129 (A task process has been created)\Operational- Details Tab -> EventData\TaskName matches TaskName output to the start event (Event ID 200).
- Confirmable Information- Process that was Executed: Details Tab -> EventData\Path- Process ID:
Details Tab -> EventData\ProcessID*This can be used for investigating the execution history and access history of a process executed

Event ID : 201 (The operation has been completed)- Details Tab -> EventData\InstanceId matches TaskInstanceId output to the start event (Event ID 200).
- Confirmable Information- Task Name:
Details Tab -> EventData\TaskName- Command that was Executed:
Details Tab -> EventData\TaskActionName- Execution Results (Return Value): Details Tab -> EventData\ResultCode*The meaning of a return value varies depending on the process that is executed.

Remarks
Additional Event Logs That Can Be Output

Logs related to the command called from the task may be recorded.

24-

3.2.9. BITS
Basic Information
Tool Name
Category
Tool Overview
Tool

OperatingCondition

Example ofThis tool is used to send or receive files at a bandwidth that is less noticeable than other communications.
Presumed Tool Use - Source host: The machine that sends and receives files by BITS
During an Attack - Destination host: File transmission destination
Authority
Targeted OS
DomainStandard user
Windows
Not required

Communication
Protocol445/tcp

Service
Information
Acquired from
Log

BITS
Command Execution
Sends and receives files in background (the priority, etc. for sending and receiving files can be set)

Standard Settings

Legend- Acquirable
Information- Event ID/Item Name
- Field Name- "Field Value"

Background Intelligent Transfer Service- Source host: It is possible that the use of BITS can be determined based on a change in the execution status of the Background Intelligent Transfer Service. *However, it is not possible when BITS is already running.

- Destination host: No beneficial information is recorded.
- Source host:
Writing to the temporary file created by BITS "BITF[Random Number].tmp" is recorded.
Additional Settings- Destination host: No beneficial information is recorded.
Evidence That Can Be Confirmed If the following log is in the event log, it is considered that a file was transferred.
- The event ID: 60 is recorded in the event log "Application and Service Log\Microsoft\Windows\Bits-Client", and the status code is set to "0x0".
When Execution is Successful
Points to be Confirmed
Log Generation
Communication
Location

Log Type and Name

Acquired Information Details

Additional
Settings

Event Log
Security

Event ID : 4656 (A handle to an object was requested)4663 (An attempt was made to access an object)4658 (The handle to an object was closed)- Object -> Object Name : "[Path to Created File]\BITF[Random Number].tmp"*Since a temporary file with a name starting with "BITF" is created, it is confirmed that a file transfer by BITS
- Confirmable Information- Handle ID (Used for Association with Other Logs):
Object -> Handle ID- Process ID of the Process that Requested the Handle: Process Information -> Process ID (matches the ID of theprocess created in event 4688)- Process Details:
Access Request Information -> Access / Reason for Access ("WriteData (or AddFile)" /"AppendData (or AddSubdirectory or CreatePipeInstance)" / "DELETE")- Success or Failure:
Keywords ("Audit Success")

Required

Event Log
SysmonEvent ID : 2 (File creation time changed)- Image Name : "C:\Windows\system32\svchost.exe"
Required- Confirmable Information- Temporary File for which Time Stamp was Changed: "[Path to Created File]\BITF[Random Number].tmp"
Event ID : 7036 (The [Service Name] service entered the [Status] state)- Details Tab -> System\Provider\Name is set to "Service Control Manager" .
- Details Tab -> EventData\param1 is set to "Background Intelligent Transfer Service" .

Source host
OS: Windowsuser↓
OS: Windows
user

Event Log
System- Confirmable Information- Executing the Service: Details Tab -> EventData\param2 ("Executing" )-- Remarks- If a process that uses BITS has been executed after the last startup of the machine, logs may not be output(For example, when BITS is used by Windows Update, logs may not be output after a file is downloaded by Windows Update).
Event Log
Event ID : 60
Application and Service- Confirmable Information
Log- Targeted File:
Details Tab -> ventData\url\Microsoft\Windows
Successor
Failure:General
Tab -> Status Code
\Bits-Client-

Registry Entry: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\BITS
Execution History
Registry- Confirmable Information- Service State: StateIndex- Remarks- The value changes as a result of the BITS status changing to "Executing".
- If BITS is already in the executing status when the command is executed, the value does not change.

Destination hostEvent Log
Security

Event ID : 5145 (A network share object was checked to see whether client can be granted desired access)- Network Information -> Source Address : "[Source Host]"- Network Information -> Source Address : "[Source Port]"- Confirmable Information- Share Name:
Shared Information -> Share Name
- Share Path:
Shared Information -> Share Path
- Placed File Name: Shared Information -> Relative Target Name

Remarks
Additional Event Logs That Can Be Output- If an audit of object reading is conducted, reading of transferred files may be recorded.

25

Required3.3.1. PwDump7
Basic Information
Tool Name
Category
Tool Overview
Tool

OperatingCondition

PwDump7
Password and Hash Dump
Displays a list of password hashes in the system

Example ofPresumed Tool Use This tool is used to perform logon authentication on other hosts using the acquired hash information.
During an Attack
Authority
Targeted OS
DomainAdministrator
Windows
Not required

Communication
Protocol-Service-

Legend- Acquirable
Information- Event ID/Item Name
- Field Name- "Field Value"

Information
Standard Settings - Execution history (Prefetch)
Acquired from
Additional Settings - Execution history (Sysmon / audit policy)
Evidence That Can Be Confirmed
The successful execution of the tool cannot be determined from event logs or execution history.
When Execution is Successful

Points to be Confirmed
Log Generation
Communication
Location

Acquired Information Details

Log Type and Name

Additional
Settings

Event ID : 4688 (A new process has been created)
4689 (A process has exited)- Process Information -> Process Name : "[File Name (PwDump7.exe)]"
Event Log
Security-- Points to be Confirmed- Process Start/End Time and Date:
Log Date- Name of User Who Executed the Process:Subject -> Account Name
- Domain of User Who Executed the Process:Subject -> Account Domain- Presence of Privilege Escalation at Process Execution: Process Information -> Token Escalation Type- Process Return Value:
Process Information -> Exit Status

Required

Event ID : 1 (Process Create)
5 (Process Terminated)- Image : "[File Name (PwDump7.exe)]"

Host(Windows)
Event Log
SysmonExecution History
Prefetch- Confirmable Information- Process Start/End Time and Date (UTC):- Process Command Line:- User Name:- Process ID:*The used option is recorded as an argument.

File name: C:\Windows\Prefetch\[Executable File(PWDUMP7.EXE)]-[RANDOM].pf- Confirmable Information (the following can be confirmed using this tool: WinPrefetchView)- Last Execution Time and Date:
Last Execution Time

Remarks
Additional Event Logs That Can Be Output

Required
UtcTimeCommandLine
User
ProcessId

-

26

-

3.3.2. PWDumpX
Basic Information
Tool Name
Category
Tool Overview
Tool

Legend- Acquirable
Information- Event ID/Item Name
- Field Name- "Field Value"

Example ofThis tool uses the acquired hash to perform attacks such as pass-the-hash.
Presumed Tool Use - Source host: PWDumpX execution source
During an Attack - Destination host: The destination logged in by PWDumpX
Authority

OperatingCondition

PWDumpX
Password and Hash Dump
Acquires a password hash from a remote hostTargeted OS
DomainCommunication
Protocol- Source host: Standard user
- Destination host: Administrator
Windows
Not required
135/tcp, 445/tcp- Both hosts: Execution history (Prefetch)
Standard Settings- Destination host: The fact that the PWDumpX service has been installed and executed is recorded.
- The fact that the PWDumpX service has been sent from the source host to the destination host and then executed is recorded.
Additional Settings- The fact that a text file is used to create and receive hash information is recorded.
Service

Information
Acquired from
Log

Evidence That Can Be Confirmed
When Execution is Successful

Points to be Confirmed
Log Generation
Communication
Location- Source host: If "[Path to Tool]\[Destination Address]-PWHashes.txt" has been created, it is considered that it was successfully executed.

Acquired Information Details

Log Type and Name

Additional
Settings

Event ID : 4688 (A new process has been created)
4689 (A process has exited)- Process Information -> Process Name : " [File Name (PWDumpX.exe)]"- Confirmable Information- Process Start/End Time and Date:- Name of User Who Executed the Process:- Domain of User Who Executed the Process:- Presence of Privilege Escalation at Process Execution:- Process Return Value:

Log Date
Subject -> Account Name
Subject -> Account Domain
Process Information -> Token Escalation Type
Process Information -> Exit Status

A temporary file is created.

Event Log
Security

Event ID : 4663 (An attempt was made to access an object)- Process Information -> Process Name : " [File Name (PWDumpX.exe)]"- Object -> Object Name :"[Path to Tool]\[Destination Address]-PWHashes.txt"*Data is written to the above file multiple times.
Required
Event ID : 4663 (An attempt was made to access an object)- Process Information -> Process Name : " [File Name (PWDumpX.exe)]"- Object -> Object Name :"[Path to Tool]\[Destination Address]-PWHashes.txt.Obfuscated"- Confirmable Information- Handle ID: Object -> Handle ID *Used for association with other logs.
*Data is written to the above file multiple times.

Source host
The temporary file is deleted.
Event ID : 4663 (An attempt was made to access an object)- Process Information -> Process Name : " [File Name (PWDumpX.exe)]"- Object -> Object Name :"[Path to Tool]\[Destination Address]-PWHashes.txt.Obfuscated"- Confirmable Information- Handle ID: Object -> Handle ID *Used for association with other logs.
- Process Details: Access Request Information -> Access ("DELETE" )OS: Windowsuser↓
OS: Windows
administrator

Event ID : 1 (Process Create)
5 (Process Terminated)- Image: " [File Name (PWDumpX.exe)]"
Event Log
SysmonExecution History
Prefetch- Confirmable Information- Process Start/End Time and Date (UTC):- Process Command Line:- User Name:- Process ID:

Required
UtcTimeCommandLine *The destination host or used account is taken as an argument.
User
ProcessId

File name: C:\Windows\Prefetch\[File Name (PWDUMPX.EXE)]-[File Name].pf- Confirmable Information (the following can be confirmed using this tool: WinPrefetchView)- Last Execution Time and Date:
Last Execution Time-

Event ID : 4688 (A new process has been created)
4689 (A process has exited)- Process Information -> Process Name : "[File Name (DumpSvc.exe)]"- Confirmable Information- Process Start/End Time and Date:- Name of User Who Executed the Process:- Domain of User Who Executed the Process:- Presence of Privilege Escalation at Process Execution:- Process Return Value:

Destination hostEvent Log
Security

Log Date
Subject -> Account Name
Subject -> Account Domain
Process Information -> Token Escalation Type
Process Information -> Exit Status

Event ID : 5145 (A network share object was checked to see whether client can be granted desired access)- Network Information -> Source Address :"[Source host]"- Shared Information -> Share Name :"\\*\ADMIN$"- Shared Information -> Relative Target Name : "system32\DumpSvc.exe"/ "system32\DumpExt.dll"
Event ID : 4663 (An attempt was made to access an object)- Process Information -> Process Name : "C:\Windows\System32\lsass.exe"- Object -> Object Name :"C:\Windows\System32\PWHashes.txt""C:\Windows\System32\PWHashes.txt.Obfuscated"- Confirmable Information- Handle ID (Used for Association with Other Logs): Object -> Handle ID*Data is written to the above file multiple times.

27

RequiredCommunication

Log Generation
Location

Acquired Information Details

Log Type and Name

Event Log
Security(Continued from theprevious entry)

Event ID : 4663 (An attempt was made to access an object)- Process Information -> Process Name : "C:\Windows\System32\lsass.exe"- Object -> Object Name : "C:\Windows\System32\PWHashes.txt.Obfuscated"/"C:\Windows\System32\PWHashes.txt""C:\Windows\System32\DumpExt.dll" /"C:\Windows\System32\DumpSvc.exe"

Additional
Settings

Required- Confirmable Information- Handle ID:
Object -> Handle ID *Used for association with other logs.
- Process Details: Access Request Information -> Access ("DELETE" )Event ID : 1 (Process Create)
5 (Process Terminated)- Image : "C:\Windows\System32\DumpSvc.exe"

OS: Windows
user↓
Destination host
OS: Windows(Continued from theadministrator
previous entry)(Continued fromthe previous
entry)- Confirmable Information- Process Start/End Time and Date (UTC):- Process Command Line:- User Name:- Process ID:

Event Log
SysmonUtcTimeCommandLine
User
ProcessId

Required

Event ID : 8 (CreateRemoteThread detected:)- Image :"C:\Windows\System32\DumpSvc.exe"- TargetImage : "C:\Windows\System32\lsass.exe"

Event Log
SystemEvent ID : 7045 (A service was installed in the system)- Service Name : ("PWDumpX Service" )- Service File Name : ("%windir%\system32\DumpSvc.exe " )Event ID : 7036 (The [Service Name] service entered the [Status] state)- Service Name : ("PWDumpX Service" )* The "PWDumpX Service" service enters the "Executing" state before executing a remote process, andenters the "Stopped" state after the execution.
File name: C:\Windows\Prefetch\DUMPSVC.EXE-DB3A90FA.pf

Execution History
Prefetch- Confirmable Information (the following can be confirmed using this tool: WinPrefetchView)- Last Execution Time and Date:
Last Execution Time

Remarks
Additional Event Logs That Can Be Output

-

28

-

3.3.3. Quarks PwDump
Basic Information
Tool Name
Category
Tool

Tool Overview
Example of Presumed
Tool Use During an
AttackOperatingCondition

Quarks PwDump
Password and Hash Dump
Acquires the NTLM hash of a local domain account and cached domain password.
Information in a machine including NTDS.DIT files can be specified and analysed.
This tool is used to perform logon authentication on other hosts using the acquired hash information.

Authority
Targeted OS
DomainAdministrator
Windows
Not required

Communication
Protocol-Legend- Acquirable
Information- Event ID/Item Name
- Field Name- "Field Value"

ServiceStandard Settings - Execution history (Prefetch)- Execution history (Sysmon / audit policy)
Additional Settings- A record that the temporary file ("SAM-[Random Number].dmp" ) has been created
Evidence That Can Be Confirmed- A temporary file ("SAM-[Random Number].dmp") was created and deleted.
When Execution is Successful
Information
Acquired from
Log

Points to be Confirmed
Log Generation
Communication
Location

Acquired Information Details

Log Type and Name

Additional
Settings

Event ID : 4688 (A new process has been created)
4689 (A process has exited)- Process Information -> Process Name : "[File Name (QuarksPwDump.exe)]"- Confirmable Information- Process Start/End Time and Date:- Name of User Who Executed the Process:- Domain of User Who Executed the Process:- Presence of Privilege Escalation at Process Execution:- Process Return Value:

Event Log
Security-

Log Date
Subject -> Account Name
Subject -> Account Domain
Process Information -> Token Escalation Type
Process Information -> Exit Status *"0x0" if successful, or
another value if failed.

Event ID : 4656 (A handle to an object was requested)4663 (An attempt was made to access an object)4658 (The handle to an object was closed)- Process Information -> Process Name : "[File Name (QuarksPwDump.exe)]"- Confirmable Information- Targeted File: Object -> Object Name ("C:\Users\[User Name]\AppData\Local\Temp\SAM-[Random Number].dmp" )- Handle ID:
Object -> Handle ID *Used for association with other logs.
- Process Details: Access Request Information -> Access ("WriteData (or AddFile)" )Required

Event ID : 4656 (A handle to an object was requested)
4660 (An object was deleted)4658 (The handle to an object was closed)- Process Information -> Process Name : "[File Name (QuarksPwDump.exe)]"- Process Information -> Process ID :"[Process ID of the Tool]"- Object -> Object Name :"C:\Users\[User Name]\AppData\Local\Temp\SAM-[Random Number].dmp"

Host(Windows)- Confirmable Information- Handle ID:
Object -> Handle ID *Used for association with other logs.
- Requested Process: Access Request Information -> Access / Reason for Access ("DELETE" )- Success or Failure: Keywords ("Audit Success" )Event ID : 1 (Process Create)
5 (Process Terminated)- Image : "[File Name (QuarksPwDump.exe)]"
Event Log
SysmonExecution History
Prefetch- Confirmable Information- Process Start/End Time and Date (UTC): UtcTime- Process Command Line:

CommandLine *The specified option (the type of the acquired password) is recorded as an argument.

- User Name:- Process ID:

User
ProcessId

File name: C:\Windows\Prefetch\[File Name (QUARKSPWDUMP.EXE)]-[RANDOM].pf- Confirmable Information (the following can be confirmed using this tool: WinPrefetchView)- Last Execution Time and Date:
Last Execution Time

Remarks
Additional Event Logs That Can Be Output

Required-29-

3.3.4. Mimikatz (Obtaining Password Hash)
Basic Information
Tool Name
Tool

Category
Tool Overview
Example of Presumed
Tool Use During an
AttackOperatingCondition

mimikatz > sekurlsa::logonpasswords
mimikatz > lsadump::sam
Password and Hash Dump
Steals recorded authentication information
This tool is executed to acquire passwords or escalate the privileges to the domain Administrator privileges.

Authority
Targeted OS
DomainAdministrator
Windows
Not required

Communication
Protocol-Legend- Acquirable
Information- Event ID/Item Name
- Field Name- "Field Value"

ServiceStandard Settings - Execution history (Prefetch)
Additional Settings - Execution history (Sysmon / audit policy)
Evidence That Can Be Confirmed
The successful execution of the tool cannot be determined from event logs or execution history.
When Execution is Successful
Information
Acquired from

Points to be Confirmed
Log Generation
Communication
Location

Acquired Information Details

Log Type and Name

Additional
Settings

Event ID : 4688 (A new process has been created)
4689 (A process has exited)- Process Information -> Process Name : "[File Name (mimikatz.exe)]"
Event Log
Security-- Confirmable Information- Process Start/End Time and Date:
Log Date- Name of User Who Executed the Process:Subject -> Account Name
- Domain of User Who Executed the Process:Subject -> Account Domain- Presence of Privilege Escalation at Process Execution: Process Information -> Token Escalation Type- Process Return Value:
Process Information -> Exit Status

Required

Event ID : 1 (Process Create)
5 (Process Terminated)- Image : "[File Name (mimikatz.exe)]"

Host(Windows)
Event Log
SysmonExecution History
Prefetch- Confirmable Information- Process Start/End Time and Date (UTC): UtcTime- Process Command Line:
CommandLine- User Name:
User- Process ID:
ProcessId*The used option is recorded as an argument.

File name: C:\Windows\Prefetch\[Executable File(MIMIKATZ.EXE)]-[RANDOM].pf- Confirmable Information (the following can be confirmed using this tool: WinPrefetchView)- Last Execution Time and Date:
Last Execution Time

Remarks
Additional Event Logs That Can Be Output

Required-30-

3.3.5. Mimikatz (Obtaining Ticket)
Basic Information
Tool Name
Category
Tool Overview
Tool

OperatingCondition

mimikatz > sekurlsa::tickets
Password and Hash Dump
Acquires tickets for all sessions in a hostLegend- Acquirable
Information- Event ID/Item Name
- Field Name- "Field Value"

Example ofPresumed Tool Use This tool is used to acquire tickets to remotely execute a command.
During an Attack
Authority
Targeted OS
DomainAdministrator
Windows
Not required

Communication
Protocol-ServiceStandard Settings - Execution history (Prefetch)
Additional Settings - Execution history (Sysmon / audit policy) *The fact that a file that output a ticket was generated is recorded.
Evidence That Can Be Confirmed- If a file that output a ticket is generated, it is considered that the process was successful.
When Execution is Successful
Information
Acquired from

Points to be Confirmed
Log Generation
Communication
Location

Acquired Information Details

Log Type and Name

Additional
Settings

Event ID : 4688 (A new process has been created)
4689 (A process has exited)- Process Information -> Process Name : "[File Name (mimikatz.exe)]"- Confirmable Information- Process Start/End Time and Date:
Log Date- Name of User Who Executed the Process:Subject -> Account Name
- Domain of User Who Executed the Process:Subject -> Account Domain- Presence of Privilege Escalation at Process Execution: Process Information -> Token Escalation Type- Process Return Value:
Process Information -> Exit Status
Until all tickets are processed, the processing of the Event IDs: 4656, 4663, and 4658 are repeated.

Event Log
Security-

Event ID : 4656 (A handle to an object was requested)- Process Information -> Process Name : "[File Name (mimikatz.exe)]"- Confirmable Information- Targeted File: Object -> Object Name ("[Ticket File Name]" )- Handle ID:
Object -> Handle ID *Used for association with other logs.
- Process Details: Access Request Information -> Access ("READ_CONTROL", "SYNCHRONIZE", "WriteData (or AddFile)","AppendData (or AddSubdirectory or CreatePipeInstance)", "WriteEA", "ReadAttributes", "WriteAttributes" )Required

Event ID : 4663 (An attempt was made to access an object)

Host(Windows)- Confirmable Information- Handle ID:
Object -> Handle ID *Used for association with other logs.
- Process Details: Access Request Information -> Access ("WriteData (or AddFile)", "AppendData (or AddSubdirectory or
CreatePipeInstance)")
Event ID : 4658 (The handle to an object was closed)- Confirmable Information- Handle ID: Object -> Handle ID
Event ID : 1 (Process Create)
5 (Process Terminated)- Image : "[File Name (mimikatz.exe)]"
Event Log
SysmonExecution History
Prefetch- Confirmable Information- Process Start/End Time and Date (UTC): UtcTime- Process Command Line:
CommandLine- User Name:
User- Process ID:
ProcessId*The used option is recorded as an argument (it is recorded in Event ID 1).

File name: C:\Windows\Prefetch\[Executable File (MIMIKATZ.EXE)]-[RANDOM].pf- Confirmable Information (the following can be confirmed using this tool: WinPrefetchView)- Last Execution Time and Date:
Last Execution Time

Remarks
Additional Event Logs That Can Be Output

Required-31-

3.3.6. WCE (Windows Credentials Editor)
Basic Information
Tool Name
Category
Tool Overview
Tool

OperatingCondition

WCE (Windows Credentials Editor)
Password and Hash Dump
Acquires password hash information in the memory of a logged in hostLegend- Acquirable
Information- Event ID/Item Name
- Field Name- "Field Value"

Example ofPresumed Tool Use This tool uses the acquired hash information to perform pass-the-hash and other attacks.
During an Attack
Authority
Targeted OS
DomainAdministrator
Windows
Not required

Communication
Protocol-ServiceStandard Settings - Execution history (Prefetch)
Information- The fact that a tool was executed, and the option used during tool execution (Sysmon).
Acquired from
Additional Settings - Reference of lsass.exe by the tool (Sysmon)
Log- Creation / deletion of a file (audit policy)
Evidence That Can Be Confirmed- The "C:\Users\[User Name]\AppData\Local\Temp\wceaux.dll" file was created and deleted.
When Execution is Successful
Points to be Confirmed
Log Generation
Communication
Location

Acquired Information Details

Log Type and Name

Additional
Settings

Event ID : 4688 (A new process has been created)
4689 (A process has exited)- Process Information -> Process Name : "[File Name (wce.exe)]"- Confirmable Information- Process Start/End Time and Date:- Name of User Who Executed the Process:- Domain of User Who Executed the Process:- Presence of Privilege Escalation at Process Execution:- Process Return Value:

Log Date
Subject -> Account Name
Subject -> Account Domain
Process Information -> Token Escalation Type
Process Information -> Exit Status

Event ID : 4656 (A handle to an object was requested)4663 (An attempt was made to access an object)4658 (The handle to an object was closed)- Process Information -> Process Name : "[File Name (wce.exe)]"
Event Log
Security－- Confirmable Information- Targeted File:
Object -> Object Name : ("C:\Users\[User Name]\AppData\Local\Temp\wceaux.dll" )- Handle ID:
Object -> Handle ID *Used for association with other logs.
- Process Details: Access Request Information -> Access ("READ_CONTROL" , "SYNCHRONIZE" , "ReadData (or"WriteData (or AddFile)" , "AppendData (or AddSubdirectory or CreatePipeInstance)" ,"ReadEA" , "WriteEA" , "ReadAttributes" , "WriteAttributes")- Success or Failure: Keywords ("Audit Success" )Required

Event ID : 4656 (A handle to an object was requested)
4660 (An attempt was deleted)4658 (The handle to an object was closed)- Process Information -> Process Name : "[File Name (wce.exe)]"

Host(Windows)- Confirmable Information- Targeted File:
Object -> Object Name : ("C:\Users\[User Name]\AppData\Local\Temp\wceaux.dll")- Handle ID:
Object -> Handle ID *Used for association with other logs.
- Process Details:
Access Request Information -> Access ("DELETE" )- Success or Failure: Keywords ("Audit Success" )Event ID : 1 (Process Create)
5 (Process Terminated)- Image ： "[File Name (wce.exe)]"- Confirmable Information- Process Start/End Time and Date (UTC):- Process Command Line:- User Name:- Process ID:

Event Log
SysmonUtcTimeCommandLine
User
ProcessId

Required

Event ID : 8 (CreateRemoteThread detected)- Image ："[File Name (wce.exe)]"- TargetImage : "C:\Windows\System32\lsass.exe"- Confirmable Information- Process Start Time and Date (UTC): UtcTime

Execution History
Prefetch

File name: C:\Windows\Prefetch\[File Name (WCE.EXE)]-[RANDOM].pf- Confirmable Information (the following can be confirmed using this tool: WinPrefetchView)- Last Execution Time and Date:
Last Execution Time

Remarks
Additional Event Logs That Can Be Output

-

32

-

3.3.7. gsecdump
Basic Information
Tool Name
Category
Tool Overview
Tool

OperatingCondition

gsecdump
Password and Hash Dump
Extracts hash from SAM/AD or logon sessions

Legend- Acquirable
Information- Event ID/Item Name
- Field Name- "Field Value"

Example ofPresumed Tool Use This tool is used to log on to other hosts using acquired hash information.
During an Attack
Authority
Targeted OS
DomainAdministrator
Windows 32-bit (a tool that operates in the 64-bit environment has yet to be confirmed)
Not required

Communication
Protocol-ServiceStandard Settings - Execution history (Prefetch)
Additional Settings - Execution history (Sysmon / audit policy)
Evidence That Can Be Confirmed
The successful execution of the tool cannot be determined from event logs or execution history.
When Execution is Successful
Information
Acquired from

Points to be Confirmed
Log Generation
Communication
Location

Acquired Information Details

Log Type and Name

Additional
Settings

Event ID : 4688 (A new process has been created)
4689 (A process has exited)- Process Information -> Process Name : "[File Name]"
Event Log
Security-- Confirmable Information- Process Start/End Time and Date:- Name of User Who Executed the Process:- Domain of User Who Executed the Process:- Presence of Privilege Escalation at Process Execution:- Process Return Value:

Log Date
Subject -> Account Name
Subject -> Account Domain
Process Information -> Token Escalation Type
Process Information -> Exit Status

Required

Event ID : 1 (Process Create)
5 (Process Terminated)- Image : "[File Name]"

Host(Windows)
Event Log
SysmonExecution History
Prefetch- Confirmable Information- Process Start/End Time and Date (UTC):- Process Command Line:- User Name:- Process ID:

File name: C:\Windows\Prefetch\[File Name (GSECDUMP.EXE)]-[RANDOM].pf- Confirmable Information (the following can be confirmed using this tool: WinPrefetchView)- Last Execution Time and Date:
Last Execution Time

Remarks
Additional Event Logs That Can Be Output

Required
UtcTimeCommandLine *The used option is recorded as an argument.
User
ProcessId

-

33

-

3.3.8. lslsass
Basic Information
Tool Name
Category
Tool Overview
Tool

OperatingConditionlslsass
Password and Hash Dump
Acquires a password hash of active logon sessions from the Isass process

Example ofPresumed Tool Use This tool is used to perform logon authentication on other hosts using the acquired hash information.
During an Attack
Authority
Targeted OS
DomainAdministrator
Windows
Not required

Communication
Protocol-Legend- Acquirable
Information- Event ID/Item Name
- Field Name- "Field Value"

ServiceStandard Settings - Execution history (Prefetch)
Additional Settings - Execution history (Sysmon/access history)
Evidence That Can Be Confirmed
The successful execution of the tool cannot be determined from event logs or execution history.
When Execution is Successful
Information
Acquired from

Points to be Confirmed
Log Generation
Communication
Location

Acquired Information Details

Log Type and Name

Additional
Settings

Event ID : 4688 (A new process has been created)
4689 (A process has exited)- Process Information -> Process Name : "[File Name (Islsass[Bit Number].exe)]"
Event Log
Security-

Host(Windows)- Confirmable Information- Process Start/End Time and Date:- Name of User Who Executed the Process:- Domain of User Who Executed the Process:- Process Return Value:

Required
Log Date
Subject -> Account Name
Subject -> Account Domain
Process Information -> Exit Status

Event ID : 1 (Process Create)
5 (Process Terminated)- Image ： "[File Name (Islsass[Bit Number].exe)]"
Event Log
Sysmon- Confirmable Information- Process Start/End Time and Date (UTC):- Process Command Line:- User Name:- Process ID:

Required
UtcTimeCommandLine *The used option is recorded as an argument.
User
ProcessId

File name: C:\Windows\Prefetch\[Executable File(LSLSASS[Number of Bits].EXE）]-[RANDOM].pf
Execution History
Prefetch- Confirmable Information (the following can be confirmed using this tool: WinPrefetchView)- Last Execution Time and Date:
Last Execution Time

Remarks
Additional Event Logs That Can Be Output

34-

3.3.9. Find-GPOPasswords.ps1
Basic Information
Tool Name
Category
Tool Overview
Tool

Example ofPresumed Tool Use This tool attempts to infiltrate other hosts using acquired passwords (by executing the tool on Active Directory).
During an Attack
Authority
Targeted OS

OperatingCondition

Find-GPOPasswords.ps1
Password and Hash Dump
Acquires any password descriptions in a group policy file

DomainCommunication
ProtocolLegend- Acquirable
Information- Event ID/Item Name
- Field Name- "Field Value"

Administrator
Windows ServerThis investigation is conducted on the Domain Controller.
Required-- Execution history (Prefetch)
Information
Standard Settings*The information is not of use when PowerShell is used in regular operations.
Acquired from- The fact that PowerShell was started is recorded.
Additional Settings
Log- The fact that a file in which passwords are dumped (GPPDataReport-[Domain Name]-[Time and Date].csv) is output is recorded.
Evidence That Can Be Confirmed- A file in which a password was dumped (GPPDataReport-[Domain Name]-[Time and Date].csv) is output.
When Execution is Successful
Service

Points to be Confirmed
Log Generation
Communication
Location

Acquired Information Details

Log Type and Name

Additional
Settings

Event ID : 4688 (A new process has been created)
4689 (A process has exited)- Process Information -> Process Name : "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"- Confirmable Information- Process Start/End Time and Date:- Name of User Who Executed the Process:- Domain of User Who Executed the Process:- Presence of Privilege Escalation at Process Execution:- Process Return Value:

Log Date
Subject -> Account Name
Subject -> Account Domain
Process Information -> Token Escalation Type
Process Information -> Exit Status

Event ID : 4656 (A handle to an object was requested)- Process Information -> Process Name : "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"- Confirmable Information- Targeted File:
Object -> Object Name : ("C:\Users\[User Name]\AppData\Local\Microsoft\Windows\SchCache\[Domain Controller FQDN].sch")- Handle ID:
Object -> Handle ID *Used for association with other logs.
- Process Details: Access Request Information -> Access ("READ_CONTROL", "SYNCHRONIZE", "WriteData (or AddFile)","AppendData (or AddSubdirectory or CreatePipeInstance)","WriteEA","ReadAttributes","WriteAttributes" )Event ID : 4663 (An attempt was made to access an object)- Process Information -> Process Name : "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"- Confirmable Information- Handle ID:
Object -> Handle ID *Used for association with other logs.
- Process Details: Access Request Information -> Access ("WriteData (or AddFile)", "AppendData (or AddSubdirectoryor CreatePipeInstance)")
Event ID : 4658 (The handle to an object was closed)- Process Information -> Process Name : "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
Event Log
Security-- Confirmable Information- Handle ID: Object -> Handle ID

Required*The same as the handle ID recorded in event 4663 that is output first.

Event ID : 4656 (A handle to an object was requested)- Process Information -> Process Name : "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"

Active Directory
Domain Controller(Windows Server)- Confirmable Information- Targeted File:
Object -> Object Name : ("GPPDataReport-[Domain Name]-[Time and Date].csv")- Handle ID:
Object -> Handle ID *Used for association with other logs.
- Process Details: Access Request Information -> Access ("READ_CONTROL", "SYNCHRONIZE", "WriteData (or AddFile)","AppendData (or AddSubdirectory or CreatePipeInstance)","WriteEA","ReadAttributes","WriteAttributes")
Event ID : 4663 (An attempt was made to access an object)- Process Information -> Process Name : "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"- Confirmable Information- Targeted File:
Object -> Object Name : ("GPPDataReport-[Domain Name]-[Time and Date].csv")- Handle ID:
Object -> Handle ID *Used for association with other logs.
- Process Details: Access Request Information -> Access ("WriteData (or AddFile)", "AppendData(or AddSubdirectory or CreatePipeInstance)")
Event ID : 4658 (The handle to an object was closed)- Process Information -> Process Name : "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"- Confirmable Information- Handle ID: Object -> Handle ID *The same as the handle ID recorded in event 4663 that is output first.
Event ID : 4689 (A process has exited)- Process Information -> Process Name : "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"- Confirmable Information- Process End Time and Date: Log Date
- Process Return Value:
Process Information -> Exit Status

Event Log
SysmonEvent ID : 1 (Process Create)
5 (Process Terminated)- Image : "C:\Windows\System32\Windows PowerShell\v1.0\powershell.exe"- Confirmable Information- Process Start/End Time and Date (UTC): UtcTime- User Name:
User- Process ID:
ProcessId

Remarks
Additional Event Logs That Can Be Output-

35

Required3.3.10. Mail PassView
Basic Information
Tool Name
Category
Tool Overview
Tool

OperatingCondition

Information
Acquired from
Log

Mail PassView
Password and Hash Dump
Extracts account information saved in the mail client settings on the machine

Example ofE-mails are transmitted using information obtained with this tool.
Presumed Tool Use
If the same user name and password obtained with this tool are used for others, they might have been misused.
During an Attack
Authority
Targeted OS
DomainStandard user
Windows
Not required

Communication
Protocol-Legend- Acquirable
Information- Event ID/Item Name
- Field Name- "Field Value"

ServiceStandard Settings - Execution history (Prefetch)

Additional Settings - Execution history (Sysmon / audit policy)
The successful execution of the tool cannot be determined from event logs or execution history.
Evidence That Can Be Confirmed*If the extracted password is saved, it is considered that the execution was successful.
If the saved information is protected by a password, it cannot be read with this tool. Therefore, a successful execution andWhen Execution is Successful
successful collection of information do not always match.
Points to be Confirmed
Log Generation
Communication
Location

Acquired Information Details

Log Type and Name

Additional
Settings

Event ID : 4688 (A new process has been created)
4689 (A process has exited)- Process Information -> New Process Name : "[File Name (mailpv.exe)]"

Event Log
Security- Confirmable Information- Process Start/End Time and Date:
Log Date- Name of User Who Executed the Process:Subject -> Account Name
- Domain of User Who Executed the Process:Subject -> Account Domain- Presence of Privilege Escalation at Process Execution: Process Information -> Token Escalation Type- Process Return Value:
Process Information -> Exit Status
Required
Event ID : 4663 (An attempt was made to access an object)4656 (A handle to an object was requested)4658 (The handle to an object was closed)- Process Information -> Process Name : "[File Name (mailpv.exe)]"-- Confirmable Information- Targeted File:
Object -> Object Name : "[File Specified in Argument]"- Handle ID:
Object -> Handle ID *Used for association with other logs.
- Process Details: Access Request Information -> Access ("WriteData (or AddFile)" )Host(Windows)

Event ID : 1 (Process Create)
5 (Process Terminated)- Image : "[File Name (mailpv.exe)]"
Event Log
SysmonExecution History
Prefetch- Confirmable Information- Process Start/End Time and Date (UTC):
UtcTime- Process Command Line:
CommandLine *The text file name used as the output destination is specified in the argument.
- User Name:
User- Process ID:
ProcessId
File name: C:\Windows\Prefetch\[File Name (MAILPV.EXE)]-[RANDOM].pf- Confirmable Information (the following can be confirmed using this tool: WinPrefetchView)- Last Execution Time and Date:
Last Execution Time

Remarks
Additional Event Logs That Can Be Output

Required

A read access could occur to the profile of an e-mail client that Mail PassView supports.

36-

3.3.11. WebBrowserPassView
Basic Information
Tool Name
Category
Tool Overview
Tool

OperatingCondition

WebBrowserPassView
Password and Hash Dump
Extracts user names and passwords saved in the web browser of a machine

Example ofPresumed Tool Use This tool is used to extract and use account information entered for accessing an intranet or external services.
During an Attack
Authority
Targeted OS
DomainStandard user
Windows
Not required

Communication
Protocol-Legend- Acquirable
Information- Event ID/Item Name
- Field Name- "Field Value"

ServiceStandard Settings - Execution history (Prefetch)
Additional Settings - Execution history (Sysmon / audit policy)
Evidence That Can Be Confirmed The successful execution of the tool cannot be determined from event logs or execution history. *If the extracted password is saved, it is considered that the execution was successful.
If the saved information is protected by a password, it cannot be read with this tool. Therefore, a successful execution and successful collection of information
When Execution is Successful
do not always match.
Information
Acquired from

Points to be Confirmed
Log Generation
Communication
Location

Acquired Information Details

Log Type and Name

Additional
Settings

Event ID : 4688 (A new process has been created)
4689 (A process has exited)- Process Information -> Process Name : "[File Name (WebBrowserPassView.exe)]"

Event Log
Security- Confirmable Information- Process Start/End Time and Date:- Name of User Who Executed the Process:- Domain of User Who Executed the Process:- Presence of Privilege Escalation at Process Execution:- Process Return Value:

Log Date
Subject -> Account Name
Subject -> Account Domain
Process Information -> Token Escalation Type
Process Information -> Exit Status
Required

Event ID : 4663 (An attempt was made to access an object)4656 (A handle to an object was requested)4658 (The handle to an object was closed)- Process Information -> Process Name : "[File Name (WebBrowserPassView.exe)]"-- Confirmable Information- Targeted File:
Object -> Object Name : "[File Specified in Argument]"- Handle ID:
Object -> Handle ID *Used for association with other logs.
- Process Details:
Access Request Information -> Access ("WriteData (or AddFile)" )Host(Windows)

Event ID : 1 (Process Create)
5 (Process Terminated)- Image : "[File Name (WebBrowserPassView.exe)]"
Event Log
Sysmon- Confirmable Information- Process Start/End Time and Date (UTC):
UtcTime- Process Command Line:
CommandLine *The text file name used as the output destination is specified in the argument.
- User Name:
User- Process ID:
ProcessId

RequiredFile name: C:\Windows\Prefetch\[File Name (WEBBROWSERPASSVIEW.EXE)]-[RANDOM].pf
Execution History
Prefetch- Confirmable Information (the following can be confirmed using this tool: WinPrefetchView)- Last Execution Time and Date:
Last Execution Time

Remarks
Additional Event Logs That Can Be Output- If browsers supported by WebBrowserPassView are installed on the system, the profile of each browser is read.
- The latest WebBrowserPassView is designed for GUI and saves settings in "[Tool Name].cfg" after it is executed.

37-

3.3.12. Remote Desktop PassView
Basic Information
Tool Name
Category
Tool Overview
Tool

OperatingCondition

Remote Desktop PassView
Password and Hash Dump
Extracts account information saved in the RDP settings on the machine

Example ofPresumed Tool Use This tool is used to extract passwords saved in the settings file for Remote Desktop and to log in to other hosts with such passwords.
During an Attack
Authority
Targeted OS
DomainStandard user
Windows
Not required

Communication
Protocol-Legend- Acquirable
Information- Event ID/Item Name
- Field Name- "Field Value"

ServiceStandard Settings - Execution history (Prefetch)
Additional Settings - Execution history (Sysmon / audit policy)
Evidence That Can Be Confirmed
The successful execution of the tool cannot be determined from event logs or execution history. *If the extracted password is saved, it is considered that the execution was successful.
When Execution is Successful
Information
Acquired from

Points to be Confirmed
Log Generation
Communication
Location

Acquired Information Details

Log Type and Name

Additional
Settings

Event ID : 4688 (A new process has been created)
4689 (A process has exited)- Process Information -> Process Name : "[File Name (rdpv.exe)]"- Confirmable Information- Process Start/End Time and Date:
Log Date- Name of User Who Executed the Process:Subject -> Account Name
- Domain of User Who Executed the Process:Subject -> Account Domain- Presence of Privilege Escalation at Process Execution: Process Information -> Token Escalation Type- Process Return Value:
Process Information -> Exit Status
Event ID : 4656 (A handle to an object was requested)- Process Name in Process Information : "[File Name (rdpv.exe)]"
Event Log
Security- Confirmable Information- Targeted File:
Object -> Object Name : ("The file name of the target tool is specified to the tool in the argument")- Handle ID:
Object -> Handle ID *Used for association with other logs.
- Process Details: Access Request Information -> Access ("READ_CONTROL","SYNCHRONIZE","WriteData (orAddFile)","AppendData (or AddSubdirectory or CreatePipeInstance)","WriteEA","ReadAttributes","WriteAttributes" )Required

Event ID : 4663 (An attempt was made to access an object)-

Host(Windows)- Confirmable Information- Handle ID:
Object -> Handle ID *Used for association with other logs.
- Process Details:
Access Request Information -> Access ("WriteData (or AddFile)","AppendData (or AddSubdirectory or
CreatePipeInstance)")
Event ID : 4658 (The handle to an object was closed)- Confirmable Information- Handle ID: Object -> Handle ID
Event ID : 1 (Process Create)
5 (Process Terminated)- Image : "[File Name (rdpv.exe)]"
Event Log
SysmonExecution History
Prefetch- Confirmable Information- Process Start/End Time and Date (UTC): UtcTime- Process Command Line:
CommandLine *The used option is recorded as an argument. (It is recorded in Event ID 1.)- User Name:
User- Process ID:
ProcessId
File name: C:\Windows\Prefetch\[Executable File(RDPV.EXE)]-[RANDOM].pf- Confirmable Information (the following can be confirmed using this tool: WinPrefetchView)- Last Execution Time and Date:
Last Execution Time

Remarks
Additional Event Logs That Can Be Output

Required-38-

3.4.1. Htran
Basic Information
Tool Name
Category
Tool Overview
Tool

OperatingCondition

Htran
Malicious Communication Relay
Creates a TCP session and tunnel other port communications

Legend- Acquirable
Information- Event ID/Item Name
- Field Name- "Field Value"

Pass communication from unallowed ports through whitelisted ports.
Example ofPresumed Tool Use - Source host: Htran execution source
During an Attack - Destination host: the machine connected by Htran
Authority
Targeted OS
DomainCommunication
ProtocolServiceStandard user
Windows
Not required
Any TCP port

- Source host: Execution history (Prefetch)
Standard Settings
Information- Destination host: Depends on the application that uses the communication made via a tunnel
Acquired from- Source host: Execution of the tool (Audit of process tracking)
Additional
Settings
Presence or absence of communications with the tunnel host (attacker) and tunnel destination host (destination host) (Audit of object access)Log- Destination host: Depends on the application that uses the communications made via a tunnel
Evidence That Can Be Confirmed - Source host: If the following log is in the event log, it is possible that communication occurred:- It is recorded in the event ID 5156 in the event log "Security" that a communication occurred with the tunnel host and tunnel destination host.
When Execution is Successful
Points to be Confirmed*In this report, "the machine on which Htran was executed" and "the machine connected via Htran" are referred to as "the source host" and "the destination host", respectively.
Log Generation
Acquired Information Details
Communication
Log Type and Name
Location

Additional
Settings

Event ID : 4688 (A new process has been created)
4689 (A process has exited)- Process Information -> Process Name : "[File Name]"- Confirmable Information- Process Start/End Time and Date:- Name of User Who Executed the Process:- Domain of User Who Executed the Process:- Presence of Privilege Escalation at Process Execution:- Process Return Value:

Log Date
Subject -> Account Name
Subject -> Account Domain
Process Information -> Token Escalation Type
Process Information -> Exit Status

A communication from the "source host" to two locations occurs.

Event Log
Security

Event ID : 5156 (The Windows Filtering Platform has allowed a connection)- Application Information -> Application Name : "[File Name]"- Network Information -> Direction :"Inbound"- Network Information -> Source Address :"[IP Address of Source Host]"- Network Information -> Protocol :"6" (TCP)

Required- Confirmable Information- Tunnel Host:
Destination Address- Port Used for Tunneling: Destination Port
Event ID : 5156 (The Windows Filtering Platform has allowed a connection)- Application Information -> Application Name : "[File Name]"- Network Information -> Direction :"Inbound"- Network Information -> Source Address :"[IP Address of Source Host]"
・Network Information -> Protocol :"6" (TCP)

Source host
OS: Windowsuser↓
OS: Windows
user- Confirmable Information- Tunnel Host:
Destination Address- Port Used for Tunneling: Destination Port
Event ID : 1 (Process Create)
5 (Process Terminated)- Image : "[File Name]"
Event Log
Sysmon- Confirmable Information- Process Start/End Time and Date (UTC):
UtcTime- Process Command Line:
CommandLine- Specified Time, Execution Process, Targeted Host: CommandLine *The following is recorded in the argument:
The IP address and port number of the tunnel host (attacker) and the tunnel
destination host (destination host)- User Name:- Process ID:

Execution History
Prefetch

Required

User
ProcessId

File name: C:\Windows\Prefetch\[File Name]-[RANDOM].pf- Confirmable Information (the following can be confirmed using this tool: WinPrefetchView)- Last Execution Time and Date:
Last Execution Time-Multiple logs could be recorded by applications using communications made via a tunnel.
Destination host

Various Logs

Remote Desktop (RDP) is an example of applications often used via Htran. In this case, a communication on the destination port 3389/tcp withthe source host IP address of the "source host" where Htran was executed is recorded in the "destination host", which is the tunnel destination.
*For details on RDP logs, see the separate RDP document.

Remarks
Additional Event Logs That Can Be Output

When a version that supports a HTTP proxy is used, HTTPS communication is recorded in the proxy.
If SSL cannot be decoded due to HTTPS, only the CONNECT method is recorded.

39

Required3.4.2. Fake wpad
Basic Information

Tool

OperatingCondition

Fake wpad
Tool Name
LegendMalicious Communication Relay
Category- Acquirable
Acquires and changes communication content by operating as the wpad server
Tool Overview
Information
This tool modifies the response so that the attacker's site is embedded without the user noticing.
Example of- Event ID/Item Name
- Field Name
Presumed Tool Use - Source host: Receives a spoofed wpad file- "Field Value"
Destination
host:
Becomes
the
proxy
of
the
sourcehostbysendingthespoofed
wpad
file
to
the
sourcehostDuring an Attack
Referencehttps://www.jpcert.or.jp/present/2015/20151028_codeblue_apt-en.pdf
Information- Destination host (wpad server): Listens on 80/tcp and 8888/tcp. Administrator privileges are required because changes, such as to Windows Firewall to allow files to be
Authority
received, need to be made.
Targeted OS
DomainCommunication
Protocol- Source host: Standard user
Windows
Not required
80/tcp, 8888/tcp- Source host: The last acquired proxy setting (registry) is recorded. *The setting cannot be distinguished if wpad is used in regular operations.
Standard Settings- Destination host: Execution history (Prefetch)
Information- Source host: The fact that communications were made via 80/tcp and 8888/tcp to the host that executes the tool is recorded (audit object access).
Acquired fromThe fact that a wpad.dat cache was created is recorded (audit object access).
Additional Settings
Log- Destination host: The fact that 80/tcp and 8888/tcp were listened to is recorded (audit object access).
Handle requests to wpad.dat and the proxy log proxy.log are recorded (audit object access).
- Source host: Communication via 80/tcp and 8888/tcp was made with a host that is originally neither a proxy nor HTTP server.
Evidence That Can Be Confirmed- Destination host: A host that is originally neither a proxy nor HTTP server was listening to 80/tcp and 8888/tcp.
When Execution is Successful
wpad.dat and proxy.log were created.
Service

Points to be Confirmed
Log Generation
Communication
Location

Acquired Information Details

Log Type and Name

Additional
Settings

The following is recorded when wpad is acquired. (The following shows an example using Internet Explorer. The storage location
and behavior are different when using other browsers.)
Note that because event IDs 4656, 4663, and 4658 are recorded when wpad is used, malicious communication
cannot be distinguished if wpad is used in normal operations.
Event ID : 5156 (The Windows Filtering Platform has allowed a connection)- Application Information -> Application Name :"\device\harddiskvolume2\program files\internet explorer\iexplore.exe"- Network Information -> Direction :"Outbound"- Network Information -> Destination Port / Protocol : "80" / "6" (TCP)- Confirmable Information- Connected Host: Network Information -> Destination Address
Event ID : 4656 (A handle to an object was requested)4663 (An attempt was made to access an object)4658 (The handle to an object was closed)
Event Log
Security

Source host- Confirmable Information- Target File:
Object -> Object Name ("C:\Users\[User Name]\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\[Text]\wpad[1].htm" )- Handle ID:
Object -> Handle ID *Used for association with other logs.
- Process Details:
Access Request Information -> Access ("WriteAttributes"/"WriteData (or AddFile)"/"AppendData (or AddSubdirectory or CreatePipeInstance" )- Success or Failure: Keywords ("Audit Success" )Required

The following is recorded if a proxy is used.
If a condition that the relevant host is not to be used as a proxy is defined in wpad.dat, the Destination Address is the host at the destination
to be actually connected.
Event ID : 5156 (The Windows Filtering Platform has allowed a connection)- Application Information -> Application Name :"\device\harddiskvolume2\program files\internet explorer\iexplore.exe"- Network Information -> Direction :"Outbound"- Network Information -> Destination Port / Protocol : "8888" / "6" (TCP)- Confirmable Information- Host Used as the Proxy: Network Information -> Destination Address

OS: Windowsuser↓
OS: Windows
user

Access History
Registry

Registry Entry: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\
SavedLegacySettings
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings-- Confirmable Information- Last Acquired Proxy Setting *The setting cannot be distinguished if wpad is used in regular operations.
Event ID : 4688 (A new process has been created)
4689 (A process has exited)- Process Information -> New Process Name : "[File Name (wpad.exe)]"- Confirmable Information- Process Start/End Time and Date:- Name of User Who Executed the Process:- Domain of User Who Executed the Process:- Presence of Privilege Escalation at Process Execution：- Process Return Value:

Log Date
Subject -> Account Name
Subject -> Account Domain
Process Information -> Token Escalation Type
Process Information -> Exit Status

The following is recorded immediately after the tool is executed.

Destination hostEvent Log
Security

Event ID : 5154 (The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections)- Application Information -> Process ID :The Process ID recorded in event ID 4688.
- Application Information -> Application Name : "\device\harddiskvolume 2 \[File Name (wpad.exe)]"- Confirmable Information- Port Listened to: Network Information -> Source Port ("80" /"8888" )- Protocol:
Network Information -> Protocol ("6" = TCP)
Event ID : 5156 (The Windows Filtering Platform has allowed a connection)- Application Information -> Process ID :"4"
- Application Information -> Application Name :"System"- Network Information -> Direction :"Outbound"- Network Information -> Source Address :"[Host that Executed the Tool]"- Network Information -> Address Port Source Port Protocol : "137" (both destination and source) / "17"The following is recorded when the source host acquires wpad.

40

RequiredCommunication

Log Generation
Location

Acquired Information Details

Log Type and Name

Event ID : 5156 (The Windows Filtering Platform has allowed a connection)- Application Information -> Process ID :The Process ID recorded in event 4688.
- Application Information -> Application Name : "\device\harddiskvolume 2 \[File Name (wpad.exe)]"- Network Information -> Direction :"Inbound"- Network Information -> Source Port / Protocol : "80" / "6" (TCP)

Additional
Settings

Required- Confirmable Information- Connected Host: Network Information -> Destination Address
Event ID : 4656 (A handle to an object was requested)4663 (An attempt was made to access an object)4658 (The handle to an object was closed)- Process Information -> Process Name : "[File Name (wpad.exe)]"- Confirmable Information- Target File:
Object -> Object Name ("[Path to Tool]\wpad.dat" )- Handle ID:
Object -> Handle ID *Used for association with other logs.
- Process Details:
Access Request Information -> Access ("SYNCHRONIZE" / "ReadData (or ListDirectory)" / "WriteData (or"AppendData (or AddSubdirectory or CreatePipeInstance)" / "ReadEA" / "WriteEA" / "ReadAttributes" /- Success or Failure: Keywords ("Audit Success" )The following is recorded when the source host uses the host as a proxy.
The log file (proxy.log) is created on the same path as that of the executable file (a handle for the log is requested and closed each time).

Event Log
Security

Event ID : 5156 (The Windows Filtering Platform has allowed a connection)- Application Information -> Process ID :The Process ID recorded in event 4688.
- Application Information -> Application Name : "\device\harddiskvolume 2 \[File Name (wpad.exe)]"- Network Information -> Direction :"Inbound"- Network Information -> Source Port / Protocol : "8888" / "6" (TCP)- Confirmable Information- Connected Host: Network Information -> Destination Address

OS: Windows
user↓
Destination host
OS: Windows(Continued from theuserprevious entry)(Continued fromthe previous
entry)

Required

Event ID : 4656 (A handle to an object was requested)4663 (An attempt was made to access an object)4658 (The handle to an object was closed)- Process Information -> Process Name : "[File Name (wpad.exe)]"- Confirmable Information- Target File:
Object -> Object Name ("[Path to Tool]\proxy.log" )- Handle ID:
Object -> Handle ID *Used for association with other logs.
- Process Details:
Access Request Information -> Access ("WriteData (or AddFile)" )- Success or Failure: Keywords ("Audit Success" )Event ID : 5156 (The Windows Filtering Platform has allowed a connection)- Application Information -> Process ID :The Process ID recorded in event 4688.
- Application Information -> Application Name : "\device\harddiskvolume 2 \[File Name (wpad.exe)]"- Network Information -> Direction :"Outbound"- Network Information -> Source Address :"[Host that Executed the Tool]"- Network Information -> Source Port / Protocol : "[Destination Server Port] (80 if nothing is specified)" / "6" (TCP)- Confirmable Information- Destination Host: Network Information -> Destination Address
Event ID : 1 (Process Create)
5 (Process Terminated)- Image ： "[File Name (wpad.exe)]"
Event Log
Sysmon- Confirmable Information- Process Start/End Time and Date (UTC): UtcTime- Process Command Line:
CommandLine *If iframe, etc. is used, it can be read from the argument.
- User Name:
User- Process ID:
ProcessId

RequiredFile name: C:\Windows\Prefetch\WPAD.EXE-[RANDOM].pf
Execution History
Prefetch- Confirmable Information (the following can be confirmed using this tool: WinPrefetchView)- Last Execution Time and Date:
Last Execution Time

Remarks
Additional Event Logs That Can Be Output

-

41

-

3.5.1. RDP (Remote Desktop Protocol)
Basic Information
Tool Name
Category
Tool Overview
Tool

Legend- Acquirable
Information- Event ID/Item Name
- Field Name- "Field Value"- View files on the logged in machine
Example ofPresumed Tool Use - Collect information (required) for connecting to other servers and clients
During an Attack - Use as a stepping stone to connect to other equipment
Authority
Targeted OS

OperatingCondition

RDP (Remote Desktop Protocol)
Remote Login
A protocol to connect to a server on which Remote Desktop Service (RDS) is running

DomainCommunication
ProtocolStandard user
- Source host: Windows- Destination host: Windows with Remote Desktop enabled
Not required3389/tcp- Destination host: Remote Desktop Services- Destination host: RDP session connection start/end time and date
Information
Source host IP address
Standard Settings
Acquired fromLogged in user name, andSuccess or failure of account domain connection
Log
Additional Settings - Source host: mstsc.exe execution history, file access history- Destination host: If the following logs are in the event log, it is considered that the connection was successful.
Evidence That Can Be Confirmed- Event ID: 4624 is recorded in the event log "Security".
When Execution is Successful- Event IDs 21 and 24 are recorded in the event log "Microsoft\Windows\TerminalServices-LocalSessionManager\Operational"
Service

Points to be Confirmed
Log Generation
Communication
Location

Acquired Information Details

Log Type and Name

Additional
Settings

Event ID : 4688 (A new process has been created)
4689 (A process has exited)- Process Information - > New Process Name : "C:\Windows\System32\mstsc.exe- Confirmable Information- Process Start/End Time and Date:- Name of User Who Executed the Process:- Domain of User Who Executed the Process:- Presence of Privilege Escalation at Process Execution:- Process Return Value:
Event Log
Security

Log Date
Subject -> Account Name
Subject -> Account Domain
Process Information -> Token Escalation Type
Process Information -> Exit Status
Required

Event ID : 4663 (An attempt was made to access an object)4656 (A handle to an object was requested)4658 (The handle to an object was closed)- Process Information -> Process Name : "C:\Windows\System32\mstsc.exe"- Confirmable Information- Target File:

Object -> Object Name (Example: "C:\Users\[User Name]\Documents\Default.rdp" )- Handle ID (Used for Association with Other Logs): Object -> Handle ID- Process Details:
Access Request Information -> Access ("WriteData (or AddFile)""AppendData (or AddSubdirectory or- Success or Failure:
Keywords ("Audit Success" )Event ID : 1 (Process Create)
5 (Process Terminated)- Image : "C:\Windows\System32\mstsc.exe"
Source host

Execution history
SysmonExecution History
Prefetch
OS: Windowsuser↓
OS: Windows
user- Confirmable Information- Process Start/End Time and Date (UTC):- Process Command Line:- User Name:- Process ID:

Required
UtcTimeCommandLine
User
ProcessId

File name: C:\Windows\Prefetch\MSTSC.EXE-76A46E8A.pf- Confirmable Information (the following can be confirmed using this tool: WinPrefetchView)- Last Execution Time and Date:
Last Execution Time-

Registry Entry: HKEY_USERS\[SID]\Software\Microsoft\Terminal Server Client\Default\- Confirmable Information- Remote Desktop Connection History: Value Name = "MRU0" to "MRU9"

Access History
Registry*As the data of the above value , an IP address that was connected to in the past is recorded.
MRU0 is the last connected history
As the last write time for a key, the update time and date (time of the first connection
to a destination host notfound in the connection history) for the "MRU0" value data is recorded.

-

Registry Entry: HKEY_USERS\[SID]\Software\Microsoft\Terminal Server Client\Servers\[Destination Host IP Address]\- Confirmable Information- The Last Accessed Account Domain and User Name: Value Name = "UsernameHint"*As the value data, the last accessed account domain and user name arerecorded for each IP address that was connected to in the past.

Access History
Audit Policy

Event ID : 4624 (An account was successfully logged on)- Logon Type : "10"- Network Information -> Source Network Address : Destination Address for event 5156
- Network Information -> Source Port : Destination Port recorded in event 5156
- Detailed Authentication Information -> Logon Process : "Kerberos"- Confirmable Information- Connection Source Host:- Used User:- New Logon ID (used for association with other logs):

Required

Network Information -> Source Network Address
New Logon -> Account Name / Account Domain
New Logon -> Logon ID

Event ID: 21 (Remote Desktop Services: Session logon succeeded)

Destination hostEvent Log
Application andService Log- Confirmable Information- Session Connection Start Time and Date:- Logged in Account Domain and User Name:- Connection Source IP Address:

Log Date
User
Source Network Address\Microsoft\Windows\TerminalServices- Event ID: 24 (Remote Desktop Services: Session has been disconnected)
LocalSessionManager- Confirmable Information\Operational- Session Connection Start Time and Date:
Log Date of an Event Log with the Same Session ID in Event ID: 21- Logged in Account Domain and User Name: User
- Connection Source IP Address:
Source Network Address

Remarks
Additional Event Logs That Can Be Output

Depending on the environment, the following log may be recorded in the destination host event log "Security".
Event ID : 4624 (An account was successfully logged on)- Logon Type : "12"42-

3.6.1. WCE (Remote Login)
Basic Information
Tool Name
Category
Tool Overview
Tool

OperatingCondition

WCE (Remote Login)
pass-the-hash, pass-the-ticket
Executes a command with higher privileges using the hash of the acquired password

Example ofRemotely executes a command on another machine by using a password hash for a user with Administrator privileges who belongs to Active Directory
Presumed Tool Use - Source host: WCE execution source
During an Attack - Destination host: The destination logged in by WCE
Authority
Targeted OS
DomainLocal administrator
Windows
Not required

Communication
ProtocolA random 5-digit port (WMIC)

Legend- Acquirable
Information- Event ID/Item Name
- Field Name- "Field Value"- Source host: Execution history (Prefetch)
Information
Standard Settings
A record of the fact that WCESERVICE was installed and executed
Acquired from- Both source host and destination host: WMI execution history and Windows Filtering Platform log
Additional Settings
Log- Destination host: Login has occurred remotely.
- Source host: The fact that WCESERVICE was installed and executed is recorded.
Evidence That Can Be Confirmed- Destination host: The fact that a logon was made from a remote host is recorded.
When Execution is Successful- Both source host and destination host: The fact that communication using WMI occurred is recorded.
Service

Points to be Confirmed
Log Generation
Communication
Location

Acquired Information Details

Log Type and Name

Additional
Settings

Event ID : 4656 (A handle to an object was requested)4663 (An attempt was made to access an object)4658 (The handle to an object was closed)- Object -> Object Name :"(C:\Windows\Temp\wceaux.dll)"- Access Request Information -> Access / Reason for Access : ("WriteData (or AddFile)" )- Confirmable Information- Process Name: "[File Name (wce.exe)]"- Handle ID:
Object -> Handle ID

Event ID : 4656 (A handle to an object was requested)
4660 (An attempt was deleted)4658 (The handle to an object was closed)- Object -> Object Name :"(C:\Windows\Temp\wceaux.dll )"- Access Request Information -> Access / Reason for Access : ("DELETE")- Confirmable Information- Process Name: "[File Name (wce.exe)]"- Handle ID:
Object -> Handle ID
Event Log
Security

Processes for events 4656, 4663, and 4658 are performed for multiple files.

Required

Event ID : 4656 (A handle to an object was requested)4663 (An attempt was made to access an object)4658 (The handle to an object was closed)- Object -> Object Name : "(C:\Users\[User Name]\AppData\Local\Microsoft\Windows\
Temporary Internet Files\Content.IE5)"- Access Request Information -> Access / Reason for Access : ("SYNCHRONIZE" ,"WriteAttributes" ,"WriteData (or AddFile)")- Process Information -> Process Name :"C:\Windows\System32\wbem\WMIC.exe"- Confirmable Information- Handle ID: Object -> Handle ID *Used for association with other logs.

Event ID : 5156 (The Windows Filtering Platform has allowed a connection)- Application Information -> Application Name :("C:\Windows\System32\wbem\WMIC.exe")- Network Information -> Direction :"Outbound"
OS: Windows
administrator↓
OS: Windows
administrator- Confirmable Information- Destination Host: Destination Address- Destination Port: Destination Port

Source host(Windows)

Event ID : 7045 (A service was installed in the system)- Service Name : "WCESERVICE"

Event Log
System- Confirmable Information- Process Start Time and Date: Log Date
- Service File Name:"[File Name (wce.exe)] -S"
Event ID : 7036
- Detailed Tab -> System\Provider\Name : "Service Control Manager"- Details Tab -> EventData\param1 :"WCESERVICE"- Confirmable Information- Running the Service: Details Tab -> EventData\param2 ("Running" ) / ("Stopped" )Event ID : 1 (Process Create)
5 (Process Terminated)- Image : "[File Name (wce.exe)]"- Image : "C:\Windows\System32\wbem\WMIC.exe"- Confirmable Information- Process Start/End Time and Date (UTC): UtcTime- Process Command Line:
CommandLine- User Name:
User- Process ID:
ProcessId

Event Log
SysmonEvent ID : 8 (CreateRemoteThread detected)- SourceImage ： "[File Name (wce.exe)]"- TargetImage ： ("C:\Windows\System32\lsass.exe" )- Confirmable Information- Process Start Time and Date (UTC):

UtcTimeEvent ID : 9 (RawAccessRead detected)- Image ： "C:\Windows\System32\cmd.exe"- Confirmable Information- Process Start Time and Date (UTC):- Access Destination:

UtcTime
Device43

RequiredCommunication

Log Generation
Location

Acquired Information Details

Log Type and Name

Execution History
Registry

Additional
Settings

File name: C:\Windows\Prefetch\[File Name (WCE.EXE）]-[RANDOM].pf
C:\Windows\Prefetch\WMIC.EXE-A7D06383.pf- Confirmable Information (the following can be confirmed using this tool: WinPrefetchView)- Last Execution Time and Date:
Last Execution Time
Event ID : 5156 (The Windows Filtering Platform has allowed a connection)- Application Information -> Application Name : ("\device\harddiskvolume 2 \windows\system32\svchost.exe")- Network Information -> Direction :"Inbound"- Confirmable Information- Source Host: Destination Address- Source Port: Destination Port
Event ID : 4624 (An account was successfully logged on)
4634 (An account was logged off)
- Confirmable Information- Process Start Time and Date: Log Date
- Source Host Account Name: New Logon -> Account Name / Domain Name
- Source Host:
Network Information -> Source Network Address

Event Log
Security

OS: Windows
administrator↓
OS: Windows
administrator(Continued fromthe previous
entry)

Required

Event ID : 4688 (A new process has been created)
4689 (A process has exited)- Process Information -> Process Name : "C:\Windows\System32\wbem\WmiPrvSE.exe"- Confirmable Information- Process Start/End Time and Date:- Name of User Who Executed the Process:- Domain of User Who Executed the Process:- Presence of Privilege Escalation at Process Execution:- Process Return Value:- Parent Process ID:

Destination host(Windows)

Log Date
Subject -> Account Name
Subject -> Account Domain
Process Information -> Token Escalation Type
Process Information -> Exit Status
Process Information -> Creator Process ID :Event ID : 1 (Process Create)
5 (Process Terminated)- Image : "C:\Windows\System32\wbem\WmiPrvSE.exe"- Confirmable Information- Process Start/End Time and Date (UTC): UtcTime- Process Command Line:
CommandLine- User Name:
User- Process ID:
ProcessId

Event Log
SysmonRequired

Event ID : 9 (RawAccessRead detected)- Image : "C:\Windows\System32\wbem\WmiPrvSE.exe"- Confirmable Information- Process Start Time and Date (UTC):- Access Destination:

Execution History
Prefetch

UtcTime
DeviceFile name: C:\Windows\Prefetch\WMIPRVSE.EXE-1628051C.pf- Confirmable Information (the following can be confirmed using this tool: WinPrefetchView)- Last Execution Time and Date:
Last Execution Time

Remarks
Additional Event Logs That Can Be Output

-

44

-

3.6.2. Mimikatz (Remote Login)
Basic Information
Tool Name
Category
Tool Overview
Tool

Example ofRemotely executes a command on another machine by using a password hash for a user with Administrator privileges
Presumed Tool Use - Source host: Mimikatz execution source
During an Attack - Destination host: The destination logged in by Mimikatz
Authority

OperatingCondition

Mimikatz (Remote Login)
pass-the-hash, pass-the-ticket
Executes a command with another user's privileges using a hash of the acquired password

Targeted OS
DomainCommunication
ProtocolLegend- Acquirable
Information- Event ID/Item Name
- Field Name- "Field Value"

Source host: Administrator
Destination host: Privileges of the user whose hash was used
Windows
Not required
A random 5-digit port (WMIC)

Windows Management Instrumentation
ServiceStandard Settings - Execution history (Prefetch)- Communication logs during a remote connection
Additional Settings- Process logs when a connection occurs
Evidence That Can Be Confirmed - Destination host: If the following log is in the event log, it is considered that a remote login was made.
- The event ID 4624 is recorded in the event log "Security" regarding access from an unintended source host.
When Execution is Successful
Information
Acquired from
Log

Points to be Confirmed
Log Generation
Communication
Location

Acquired Information Details

Log Type and Name

Additional
Settings

Event ID : 4688 (A new process has been created)
4689 (A process has exited)- Process Information -> Process Name : "[File Name (mimikatz.exe)]""C:\Windows\System32\cmd.exe""C:\Windows\System32\wbem\WMIC.exe"- Confirmable Information- Process Start/End Time and Date:- Name of User Who Executed the Process:- Domain of User Who Executed the Process:- Presence of Privilege Escalation at Process Execution:- Process Return Value:

Event Log
Security

Log Date
Subject -> Account Name
Subject -> Account Domain
Process Information -> Token Escalation Type
Process Information -> Exit Status

Event ID : 5156 (The Windows Filtering Platform has allowed a connection)- Application Information -> Application Name : "C:\Windows\System32\wbem\WMIC.exe"- Network Information -> Direction :"Outbound"

Required- Confirmable Information- Source Port: Source Port
- Destination Host: Destination Address- Destination Port: Destination Port (5-digit port)
Event ID : 4648 (A logon was attempted using explicit credentials)- Process Information -> Process Name : "C:\Windows\System32\wbem\WMIC.exe"
Source host- Confirmable Information- Process Start Time and Date:
Log Date- Account Name that Executed the Process on the Destination Host: Account for which Credentials were Used ->Account Name /- Destination Host:
Target Server -> Target Server Name

Event Log
Sysmon

OS: Windows
administrator↓
OS: Windows
user

Execution History
Registry

Event ID : 1 (Process Create)
5 (Process Terminated)- Image ： "C:\Windows\System32\at.exe""C:\Windows\System32\cmd.exe""C:\Windows\System32\wbem\WMIC.exe"
Required- Confirmable Information- Process Start/End Time and Date (UTC): UtcTime- Process Command Line:
CommandLine- User Name:
User- Process ID:
ProcessId
File name: C:\Windows\Prefetch\CMD.EXE-4A81B364.pf
C:\Windows\Prefetch\[File Name (MIMIKATZ.EXE)]-[RANDOM].pf
C:\Windows\Prefetch\WMIC.EXE-A7D06383.pf-- Confirmable Information (the following can be confirmed using this tool: WinPrefetchView)- Last Execution Time and Date:
Last Execution Time
Event ID : 4624 (An account was successfully logged on)- Logon Type : "3"- Confirmable Information- Process Start Time and Date: Log Date
- Source Host Account Name: New Logon -> Account Name / Domain Name
- Source Host:
Network Information -> Source Network Address

Event Log
Security

Required
Event ID : 5156 (The Windows Filtering Platform has allowed a connection)- Application Information -> Application Name : "\device\harddiskvolume 2 \windows\system32\svchost.exe"- Network Information -> Direction :"Inbound"- Confirmable Information- Source Host:
Destination Address- Source Port:
Destination Port *Matches the source port at the source host.
- Destination Port: Source Port *Matches the destination port at the source host.

Destination hostEvent Log
SysmonExecution History
Registry

Event ID : 1 (Process Create)- Image : "C:\Windows\System32\wbem\WmiPrvSE.exe"- Confirmable Information- Process Start Time and Date (UTC):- Process ID:

Required
UtcTimeProcessId

File name: C:\Windows\Prefetch\WMIPRVSE.EXE-1628051C.pf- Confirmable Information (the following can be confirmed using this tool: WinPrefetchView)- Last Execution Time and Date:
Last Execution Time

Remarks
Additional Event Logs That Can Be Output

-

45

-

3.7.1. MS14-058 Exploit
Basic Information
Tool Name
Category
Tool Overview
Tool

OperatingCondition

Information
Acquired fromLog

MS14-058 Exploit
Escalation to SYSTEM Privileges
Executes a specified command with SYSTEM privileges

Example ofPresumed Tool Use This tool is used for a user with standard privileges to execute a command that normally requires administrator privileges.
During an Attack
Authority
Targeted OS
DomainStandard user
Windows
Not required

Communication
Protocol-Legend- Acquirable
Information- Event ID/Item Name
- Field Name- "Field Value"

ServiceStandard Settings - Execution history (Prefetch)

Additional Settings - The name of a process executed by the tool with SYSTEM privileges, and argument (Sysmon / audit of process tracking)
Evidence That Can Be Confirmed If the following log is in the event log, it is considered that privilege escalation was successful.
- The event ID: 4688 is recorded regarding a process executed with SYSTEM privileges, whose parent process cannot be the parent of the tool or that process.
When Execution is Successful
Points to be Confirmed
Log Generation
Communication
Location

Acquired Information Details

Log Type and Name

Additional
Settings

Event ID : 4688 (A new process has been created)
4689 (A process has exited)- Process Information -> Process Name : "[File Name]"

Event Log
Security- Confirmable Information- Process Start/End Time and Date:
Log Date- Name of User Who Executed the Process:Subject -> Account Name
- Domain of User Who Executed the Process:Subject -> Account Domain- Presence of Privilege Escalation at Process Execution: Process Information -> Token Escalation Type- Process Return Value:
Process Information -> Exit Status
Required
Event ID : 4688 (A new process has been created)
4689 (A process has exited)- Process Information - > New Process Name : "[Process Executed with SYSTEM Privileges]"- Confirmable Information- Process Start/End Time and Date:
Log Date- Name of User Who Executed the Process:Subject -> Account Name ("[Computer Name]$" )- Domain of User Who Executed the Process:Subject -> Account Domain- Presence of Privilege Escalation at Process Execution: Process Information -> Token Escalation Type- Process Return Value:
Process Information -> Exit Status-

Event ID : 1 (Process Create)
5 (Process Terminated)- Image : "[File Name]"

Host(Windows)- Confirmable Information- Process Start/End Time and Date (UTC): UtcTime- Process Command Line:
CommandLine *A command executed with SYSTEM privileges is recorded in the argument.
- User Name:
User- Process ID:
ProcessId
Event Log
Sysmon- Confirmable Information- Process Start Time and Date (UTC):- Process Command Line:- User Name:- Process ID:- Parent Process Name:- Command Line Specified as the Parent Process:

Execution History
Prefetch

Required

Event ID : 1 (Process Create)
5 (Process Terminated)- Image : "[Process Executed with SYSTEM Privileges]"
UtcTimeCommandLine *An argument for the command is recorded.
User ("NT AUTHORITY\SYSTEM" )ProcessId
ParentImage ("[File Name]")ParentCommandLine

File name: C:\Windows\Prefetch\[File Name]-[RANDOM].pf- Confirmable Information (the following can be confirmed using this tool: WinPrefetchView)- Last Executed Time and Date:
Last Execution Time

Remarks
Additional Event Logs That Can Be Output

Other logs that are related to processes executed with SYSTEM privileges may be recorded.

46-

3.7.2. MS15-078 Exploit
Basic Information
Tool Name
Category
Tool Overview
Tool

Example ofPresumed Tool Use This tool is used for a user with standard privileges to execute a command that normally requires administrator privileges.
During an Attack
Authority
Targeted OS

OperatingCondition

MS15-078 Exploit
Escalation to SYSTEM Privileges
Executes a specified command with SYSTEM privileges

DomainCommunication
ProtocolLegend- Acquirable
Information- Event ID/Item Name
- Field Name- "Field Value"Standard user
Windows 7 / 8 / 2008
This tool cannot be executed in a test environment with Windows Server 2012.
Not required-

ServiceStandard Settings - Execution history (Prefetch)
Additional Settings - The name of a process executed by the tool with SYSTEM privileges, and argument (Sysmon / audit of process tracking)
Evidence That Can Be Confirmed If the following log is in the event log, it is considered that privilege escalation was successful.
- The event ID: 4688 is recorded regarding a process executed with SYSTEM privileges, whose parent process cannot be the parent of the tool or that process.
When Execution is Successful
Information
Acquired from

Points to be Confirmed
Log Generation
Communication
Location

Acquired Information Details

Log Type and Name

Additional
Settings

Event ID : 4688 (A new process has been created)
4689 (A process has exited)- Process Information - > New Process Name : "[File Name]"

Event Log
Security- Confirmable Information- Process Start/End Time and Date:
Log Date- Name of User Who Executed the Process:Subject -> Account Name
- Domain of User Who Executed the Process:Subject -> Account Domain- Presence of Privilege Escalation at Process Execution: Process Information -> Token Escalation Type- Process Return Value:
Process Information -> Exit Status
Required
Event ID : 4688 (A new process has been created)
4689 (A process has exited)- Process Information - > New Process Name : "[Process Executed with SYSTEM Privileges]"- Confirmable Information- Process Start/End Time and Date:- Name of User Who Executed the Process:- Domain of User Who Executed the Process:- Presence of Privilege Escalation at Process Execution:- Process Return Value:-

Log Date
Subject -> Account Name ("[Computer Name]$" )Subject -> Account Domain
Process Information -> Token Escalation Type
Process Information -> Exit Status

Event ID : 1 (Process Create)
5 (Process Terminated)- Image : "[File Name]"

Host(Windows)- Confirmable Information- Process Start/End Time and Date (UTC): UtcTime- Process Command Line:
CommandLine *A command executed with SYSTEM privileges is recorded in the argument.
- User Name:
User- Process ID:
ProcessId
Event Log
Sysmon- Confirmable Information- Process Start Time and Date (UTC):- Process Command Line:- User Name:- Process ID:- Parent Process Name:- Command Line Specified as the Parent Process:

Execution History
Prefetch

Required

Event ID : 1 (Process Create)
5 (Process Terminated)- Image : "[Process Executed with SYSTEM Privileges]"
UtcTimeCommandLine *An argument for the command is recorded.
User ("NT AUTHORITY\SYSTEM" )ProcessId
ParentImage ("[File Name]")ParentCommandLine

File name: C:\Windows\Prefetch\[File Name]-[RANDOM].pf- Confirmable Information (the following can be confirmed using this tool: WinPrefetchView)- Last Executed Time and Date:
Last Execution Time

Remarks
Additional Event Logs That Can Be Output

Other logs that are related to processes executed with SYSTEM privileges may be recorded.

47-

3.8.1. SDB UAC Bypass
Basic Information
SDB UAC Bypass
Privilege Escalation
Uses Application Compatibility Database (SDB) to execute applications that are normally controlled by User Account Control (UAC) as a user with
Tool Overview
administrator privileges
Example ofThis tool is used to execute an application that is not normally executed by pretending to execute a typical application.
Presumed Tool Use In doing so, the tool is capable of executing an application that normally requires administrator privileges without obtaining the permission of the relevant user.
During an Attack
Reference Information http://blog.jpcert.or.jp/2015/02/a-new-uac-bypass-method-that-dridex-uses.html
A user who has authority to use administrator privileges according to UAC without entering an administrator password.
Authority(A user who belongs to the Administrators group in the client)
Windows
Targeted OS
Not required
DomainTool Name
Category

Tool

OperatingCondition

Communication
ProtocolLegend- Acquirable
Information- Event ID/Item Name
- Field Name- "Field Value"-

ServiceStandard Settings - Execution history (Prefetch)
Information- Execution history (Sysmon / audit policy)
Acquired from
Additional Settings- A process whose parent process name includes an application that is normally assumed not to be a parent process starts.
Log- "The application used for a bypass" and "The application executed as a bypass" are recorded.
Evidence That Can Be Confirmed - The fact that a process whose parent process name includes an application that is normally assumed not to be a parent process was executed is recorded.
When Execution is Successful
Points to be Confirmed
Log Generation
Communication
Location

Acquired Information Details

Log Type and Name

Additional
Settings

The following is recorded when an SDB file is installed.
Event ID : 4688 (A new process has been created)
4689 (A process has exited)- Process Information -> Process Name : "C:\Windows\System32\sdbinst.exe"- Confirmable Information- Process Start/End Time and Date:
Log Date- Name of User Who Executed the Process:Subject -> Account Name
- Domain of User Who Executed the Process:Subject -> Account Domain- Presence of Privilege Escalation at Process Execution: Process Information -> Token Escalation Type- Process Return Value:
Process Information -> Exit Status
Event ID : 4656 (A handle to an object was requested)4663 (An attempt was made to access an object)4658 (The handle to an object was closed)- Process Information -> Process Name : "C:\Windows\System32\sdbinst.exe"

Event Log
Security- Confirmable Information- SDB File:
Object -> Object Name (" C :\Windows\AppPatch\Custom\{[GUID]}.sdb" )- Handle ID:
Object -> Handle ID *Used for association with other logs
- Process ID of the Process that Requested the Handle: Process Information -> Process ID(matches the ID of the process created in event 4688)- Process Details:
Access Request Information -> Access / Reason for Access( "WriteData (or AddFile)" / "AppendData(or AddSubdirectory, or CreatePipeInstance" )- Success or Failure:

Required

Keywords ("Audit Success" )If an application is executed as a bypass, the following is recorded.
Event ID : 4688 (A new process has been created)
4689 (A process has exited)- Process Information -> Process Name : "[Command Executed as Bypass]"-- Confirmable Information- Process Start/End Time and Date:
Log Date- Name of User Who Executed the Process:Subject -> Account Name
- Domain of User Who Executed the Process:Subject -> Account Domain- Presence of Privilege Escalation at Process Execution: Process Information -> Token Escalation Type- An ID of the Process of an Application Used for a Bypass That Executed the Application: Process Information -> Creator Process ID
Matches the process ID of an application used for a bypass- Process Return Value:
Process Information -> Exit Status"0x0" if successful. If failed, a different value is entered according to the error. Depending on the application
used for a bypass, such as one executed from a command prompt, the return value may not be "0x0" only byexecuting it as usual. For this reason, this information can be a reference for measuring whether the execution was

Host(Windows)*Although "an application executed as a bypass" is always started following "an application used for a bypass," it may be ended before or after
the other application depending on how it is called.
The following is recorded when an SDB file is installed.
Event ID : 1 (Process Create)
5 (Process Terminated)- Image : "C:\Windows\System32\sdbinst.exe"- Confirmable Information- Process Start/End Time and Date (UTC): UtcTime- Process Command Line:
CommandLine- Used SDB File:
CommandLine- User Name:
User- Process ID:
ProcessId
Event Log
SysmonIf an application is executed as a bypass, the following is recorded.
Required
Event ID : 1 (Process Create)
5 (Process Terminated)- Image : "[Command Executed as Bypass]"- Confirmable Information- Process Start Time and Date (UTC): UtcTime- Process Command Line:
CommandLine- User Name:
User- Process ID:
ProcessId- Parent Process Name:
ParentImage *An application specified in SDB.
An application that is normally assumed not to be the parent of a process becomes its parent process.
- Parent Process ID: ParentProcessId *Matches the process ID of an application specified in SDB that was executed first.
*If the process is for script files for batch processing or others, the process becomes the parent process and a child process will befurther executed. By tracking process IDs in order, it is possible to confirm the process tree of the executed applications.

48

Communication

Log Generation
Location

Acquired Information Details

Log Type and Name

Application and Service
Event ID : 500 (Compatibility fix applied)
Log\Microsoft\Windows- Confirmable Information\Application- Program Applied: Details Tab -> UserData\CompatibilityFixEvent\ExePathExperience- Program Fix:
Details Tab -> UserData\CompatibilityFixEvent\FixName\Program-Telemetry

Additional
Settings-

File name: C:\Windows\Prefetch\SDBINST.EXE-5CC2F88B.pf
Execution History
Prefetch- Confirmable Information (the following can be confirmed using this tool: WinPrefetchView)- Last Execution Time and Date:
Last Execution Time-

- Remarks- In addition to the above, the last execution date and time of the application used for a bypass and executed application will change.
Registry Entry: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{[GUID]}.sdb- Confirmable Information- Content of SDB: DisplayName (The name of an application used for a bypass)- Delete Command: UninstallString ("%windir%\system32\sdbinst.exe -u "C:\Windows\AppPatch\Custom\{[GUID]}.sdb" )Host(Continued from(Windows)
the previous (Continued from theentry)
previous entry)

Registry Entry: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom\{[Name of Application Used for UAC Bypass]}- Confirmable Information- SDB Installation Time Stamp: DatabaseInstallTimeStamp (A hexadecimal value)
Execution History
Registry

Registry Entry:
HKEY LOCAL MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\{[GUID]}- Confirmable Information- SDB File Path:
DatabasePath ("C:\Windows\AppPatch\Custom\{[GUID]}.sdb " )- SDB Type:
DatabaseType- Content of SDB:
DatabaseDescription (The name of an application used for a bypass)- SDB Installation Time Stamp: DatabaseInstallTimeStamp (A hexadecimal value. The same value as one under"Custom" stated the above.)- Remarks- The above registry value is deleted when the SDB file is uninstalled and will not always be left.
- Some tools in which an SDB file is uninstalled to delete evidence have been confirmed.

Remarks
Additional Event Logs That Can Be Output- In addition to the above, "the application used for a bypass" and "the application executed as a bypass" may be recorded.

49

3.9.1. MS14-068 Exploit
Basic Information
Tool Name
Category
Tool Overview
Tool

OperatingCondition

MS14-068 Exploit
Capturing the Domain Administrator Privilege and Account Credentials
Changes the privileges of the domain user to those of another user

This tool is used to perform operations requiring privileges pretending as an administrator by using an acquired domain user account.
Example of(For this test, Exploit is used to get the account's TGT ticket and mimikatz is used to log in remotely.)
Presumed Tool Use- Source host: Exploit execution source
During an Attack- Destination host: Machine logged in remotely with the acquired ticket
Authority
Targeted OS
DomainStandard user
Windows
RequiredCommunication
Protocol88/tcp, 445/tcp

Legend- Acquirable
Information- Event ID/Item Name
- Field Name- "Field Value"

Active Directory Domain Services
ServiceStandard Settings - Source host: Execution history (Prefetch)- Source host: Execution history (Sysmon / audit policy)
Additional Settings- Destination host: The fact that higher privileges than the normal privileges are granted to other accounts (audit policy)
Evidence That Can Be Confirmed - Destination host: In the Event ID: 4672 of the event log "Security", high level privileges are granted to a standard user.
When Execution is Successful
Information
Acquired from
Log

Points to be Confirmed
Log Generation
Communication
Location

Acquired Information Details

Log Type and Name

Additional
Settings

When a ticket is generated, the following process is executed.
Event ID : 4688 (A new process has been created)
4689 (A process has exited)- Process Information -> Process Name : "[File Name (ms14-068.exe)]"- Confirmable Information- Process Start/End Time and Date:
Log Date- Name of User Who Executed the Process:Subject -> Account Name
- Domain of User Who Executed the Process:Subject -> Account Domain- Presence of Privilege Escalation at Process Execution: Process Information -> Token Escalation Type- Process Return Value:
Process Information -> Exit Status
Event ID : 5156 (The Windows Filtering Platform has allowed a connection)- Application Information -> Application Name :"\device\harddiskvolume 2 \[File Name (ms14-068.exe)]"- Application Information -> Process ID :"[Process ID Recorded in Event 4688 ]"- Network Information -> Direction :"Outbound"- Network Information -> Destination Address :"[Domain Controller IP Address]"- Network Information -> Destination Port / Protocol : "88" / "6" (TCP)- Confirmable Information- Source Port: Source Port

*Used for association with logs on the Domain Controller side

When a ticket is used, the following process is executed.
Event ID : 4688 (A new process has been created)
4689 (A process has exited)- Process Information -> Process Name : "[File Name (mimikatz.exe)]"- Confirmable Information- Process Start/End Time and Date:- Name of User Who Executed the Process:- Domain of User Who Executed the Process:- Presence of Privilege Escalation at Process Execution:- Process Return Value:
OS: Windowsuser↓
OS: Windows
Serveradministrator

Source hostEvent Log
Security

Log Date
Subject -> Account Name
Subject -> Account Domain
Process Information -> Token Escalation Type
Process Information -> Exit Status

Event ID : 4656 (A handle to an object was requested)4663 (An attempt was made to access an object)4658 (The handle to an object was closed)- Process Information -> Process Name : "[File Name (ms14-068.exe)]"- Confirmable Information- Target File:
Object -> Object Name
- Handle ID:
Object -> Handle ID *Used for association with other logs
- Process Details:
Access Request Information -> Access ("WriteData (or AddFile)" / "AppendData(or AddSubdirectory, or CreatePipeInstance)")- Success or Failure: Keywords ("Audit Success" )Event ID : 5156 (The Windows Filtering Platform has allowed a connection)- Application Information -> Application Name :"System"- Network Information -> Direction :"Outbound"- Network Information -> Destination Address :"[Domain Controller IP Address]"- Network Information -> Destination Port / Protocol : "445" / "6" (TCP)- Confirmable Information- Source Port: Source Port

*Used for association with logs on the Domain Controller side

Event ID : 5156 (The Windows Filtering Platform has allowed a connection)- Application Information -> Application Name :"[\device\harddiskvolume 2 \windows\system32\lsass.exe"- Network Information -> Direction :"Outbound"- Network Information -> Destination Address :"[Domain Controller IP Address]"- Network Information -> Destination Port / Protocol : "88" / "6" (TCP)- Confirmable Information- Source Port: Source Port

*Used for association with logs on the Domain Controller side

In the case of mimikatz.exe, when an acquired ticket is used, the use of privileges (failure) occurs. (It does not occur when mimikatz.exe is
executed with administrator privileges.)
Event ID : 4673 (A privileged service was called)- Process Information -> Process Name :"[File Name (mimikatz.exe)]"- Process Information -> Process ID :"[Process ID of the Tool]"- Service Request Information -> Privileges : "SeTcbPrivilege"- Keyword :"Audit Failure"- Confirmable Information- Account That Attempted the Above Operation: Account Name

50

RequiredCommunication

Log Generation
Location

Acquired Information Details

Log Type and Name

Additional
Settings

Event ID : 1 (Process Create)
5 (Process Terminated)- Image : "[File Name (ms14-068.exe)]"

Event Log
SysmonSource host(Continued from theprevious entry)- Confirmable Information- Process Start/End Time and Date (UTC): UtcTime- Process Command Line:
CommandLine- User Name:
User- Process ID:
ProcessId
Required
Event ID : 1 (Process Create)
5 (Process Terminated)- Image : "[File Name (mimikatz.exe)]"- Confirmable Information- Process Start/End Time and Date (UTC): UtcTime- Process Command Line:
CommandLine- User Name:
User- Process ID:
ProcessId

Execution History
Prefetch

File name: C:\Windows\Prefetch\[File Name (MS14-068.EXE)]-[RANDOM].pf
C:\Windows\Prefetch\[File Name (MIMIKATZ.EXE)]-[RANDOM].pf- Confirmable Information (the following can be confirmed using this tool: WinPrefetchView)- Last Execution Time and Date:
Last Execution Time
When a ticket is generated, the following communication and authentication occur.
Event ID : 5156 (The Windows Filtering Platform has allowed a connection)- Application Information -> Application Name :"[\device\harddiskvolume 2 \windows\system32\lsass.exe"- Application Information -> Process ID :"[Process ID Recorded in Event 4688 ]"- Network Information -> Direction :"Outbound"- Network Information -> Destination Address :"[Domain Controller IP Address]"- Network Information -> Destination Port / Protocol : "88" / "6" (TCP)- Confirmable Information- Source Port: Source Port

*Used for association with logs on the Domain Controller side

Event ID : 4768 (A Kerberos authentication ticket (TGT) was requested)- Service Information -> Service Name : "krbtgt"- Additional Information -> Ticket Options : "0x50800000"- Confirmable Information- Executing Account: Account Information -> Account Name
- Source Host:
Network Information -> Client Address- Source Port:
Network Information -> Client Port
OS: Windowsuser↓
OS: Windows
Serveradministrator(Continued fromthe previous
entry)

Event ID : 4769 (A Kerberos service ticket was requested)- Service Information -> Service Name : "krbtgt"- Additional Information -> Ticket Option : "0x50800000"- Confirmable Information- Executing Account: Account Information -> Account Name / Account Domain- Source Host:
Network Information -> Client Address- Source Port:
Network Information -> Client Port
When an acquired ticket is used, the following communication occurs.

Destination hostEvent Log
Security

Event ID : 5156 (The Windows Filtering Platform has allowed a connection)- Application Information -> Application Name :"System"- Application Information -> Process ID :"[Process ID Recorded in Event 4688 ]"- Network Information -> Direction :"Outbound"- Network Information -> Destination Address :"[Domain Controller IP Address]"- Network Information -> Destination Port / Protocol : "445" / "6" (TCP)- Confirmable Information- Source Port: Source Port

*Used for association with logs on the Domain Controller side

Event ID : 5156 (The Windows Filtering Platform has allowed a connection)- Application Information -> Application Name :"[\device\harddiskvolume 2 \windows\system32\lsass.exe"- Application Information -> Process ID :"[Process ID Recorded in Event 4688 ]"- Network Information -> Direction :"Outbound"- Network Information -> Destination Address :"[Domain Controller IP Address]"- Network Information -> Destination Port / Protocol : "88" / "6" (TCP)- Confirmable Information- Source Port: Source Port

*Used for association with logs on the Domain Controller side

Event ID : 4769 (A Kerberos service ticket was requested)- Confirmable Information- Client IP Address: Network Information -> Client Address- Ticket Request Type (Two different pairs of ticket requests are output.)- Service Information : "[Host Name]$" , Ticket Option : "0x40810000"- Service Information : "krbtgt" , Ticket Option : "0x60810010"
Event ID : 4672 (Special privileges assigned to new logon)- Confirmable Information- Account with Escalated Privileges: Subject -> Account Name / Account Domain- Available Special Privileges:
Special Privileges ("SeSecurityPrivilege" / "SeRestorePrivilege" / "SeTakeOwnershipPrivilege" /"SeDebugPrivilege" / "SeSystemEnvironmentPrivilege" / "SeLoadDriverPrivilege" / "SeImpersonatePrivilege" /"SeEnableDelegationPrivilege")
Event ID : 4624 (An account was successfully logged on)- Logon Type : "3"- Confirmable Information- Used Security ID: New Logon -> Security ID*If the security ID used and the account does not correspond, this value is the security ID of the captured account.
- Account: Account Name / Account Domain- Host which Requested Logon: Network Information -> Source Network Address

Remarks
Additional Event Logs That Can Be Output

Logs of commands executed with escalated privileges may be recorded at the destination host.

51

Required3.9.2. Mimikatz (Golden Ticket)
Basic Information
Tool Name
Category
Tool Overview
Tool

Example ofThis tool is used to grant a host concealing a record of authentication requests access using the Golden Ticket.
Presumed Tool Use - Source host: Mimikatz execution source
During an Attack - Destination host: The host logon in by Mimikatz
Authority

OperatingCondition

Mimikatz (Golden Ticket)
Capturing the Domain Administrator Privilege and Account Credentials
Issues an unauthorized Kerberos ticket that is valid for an arbitrary period and grants access without additional authentication

Targeted OS
DomainCommunication
ProtocolLegend- Acquirable
Information- Event ID/Item Name
- Field Name- "Field Value"Standard user
*The NTLM password hash for a krbtgt account on the domain must have already been acquired.
Windows
Not required-

Active Directory Domain Service
Service- Source host: Execution history (Prefetch)
Standard
Settings
Information- Source host: Execution history (Sysmon / audit policy)
Acquired from
Additional Settings
Access history (Sysmon - RawAccessRead, audit policy - Use of important privileges)
Log- Destination host: Logon by an account with an illegal domain
Evidence That Can Be Confirmed - Destination host: If the following log is in the event log, it is considered that unauthorised logon was attempted.
- In the event IDs 4672, 4624, and 4634 in the event log "Security", a logon attempt by an account with an illegal domain is recorded.
When Execution is Successful
Points to be Confirmed
Log Generation
Communication
Location

Acquired Information Details

Log Type and Name

Additional
Settings

Event ID : 4688 (A new process has been created)
4689 (A process has exited)- Process Information -> Process Name : "[File Name (mimikatz.exe)]"- Confirmable Information- Process Start/End Time and Date:
Log Date- Name of User Who Executed the Process:Subject -> Account Name
- Domain of User Who Executed the Process:Subject -> Account Domain- Presence of Privilege Escalation at Process Execution: Process Information -> Token Escalation Type- Process Return Value:
Process Information -> Exit Status

Event Log
Security

Event ID : 4673 (A privileged service was called)- Process Information -> Process Name :"[File Name (mimikatz.exe)]"- Process Information -> Process ID :"[Process ID of the Tool]"- Service Request Information -> Privileges : "SeTcbPrivilege"- Keyword :"Audit Failure"

Required- Confirmable Information- Account That Attempted the Above Operation: Account Name (Standard user)- Event ID : 4663 (An attempt was made to access an object)4656 (A handle to an object was requested)4658 (The handle to an object was closed)- Process Information -> Process Name : "[File Name (mimikatz.exe)]"- Confirmable Information- Target File:
Object -> Object Name
- Handle ID:
Object -> Handle ID *Used for association with other logs
- Process Details:
Access Request Information -> Access ("WriteData (or AddFile)" / "AppendData (or AddSubdirectoryor CreatePipeInstance)" )- Success or Failure: Keywords ("Audit Success" )Source hostEvent ID : 1 (Process Create)
5 (Process Terminated)- Image : "[File Name (mimikatz.exe)]"

Event Log
Sysmon

OS: Windowsuser↓
OS: Windows
Serveradministrator- Confirmable Information- Process Start/End Time and Date (UTC): UtcTime- Process Command Line:
CommandLine- User Name:
User- Process ID:
ProcessId

Required

Event ID : 9 (RawAccessRead detected)- Process : The ProcessId recorded in the event 1.
- Image : "[File Name (mimikatz.exe)]"- Device : "\Device\HarddiskVolume 2 "Execution History
Prefetch

File name: C:\Windows\Prefetch\[Executable File(MIMIKATZ.EXE)]-[RANDOM].pf- Confirmable Information (the following can be confirmed using this tool: WinPrefetchView)- Last Executed Time and Date:
Last Execution Time-

Event ID : 4769 (A Kerberos service ticket was requested)- Confirmable Information- Client IP Address:
Network Information -> Client Address- Ticket Request Type (Two different pairs of ticket requests are output.)- Service Information : "[Host Name]$" , Ticket Options : "0x40810000"- Service Information : "krbtgt" , Ticket Options : "0x60810010"
Event ID : 4672 (Special privileges assigned to new logon)

Destination hostEvent Log
Security- Confirmable Information- Account for which a Golden Ticket was Obtained: Account (An existing account name)- Domain:Account Domain (An invalid value)- Logon ID:
Logon ID *Used for association with other logs
- Available Privileges:
Special Privileges
Required
Event ID : 4624 (An account was successfully logged on)- Logon Type : "3"- New Logon -> Account Name / Account Domain : "[ Account Name / Account Domain Recorded in Event 4672 ]"- New Logon -> Logon ID :"[ Logon ID Recorded in Event 4672 ]"- Confirmable Information- Used Security ID: New Logon -> Security ID- Host That Used Authentication Information: Network Information -> Source Network Address
Event ID : 4634 (An account was logged off)
- Logon Type : "3"- New Logon -> Account Name / Account Domain : "[ Account Name / Account Domain Recorded in Event 4672 ]"- New Logon -> Logon ID :"[ Logon ID Recorded in Event 4672 ]"52

Remarks
Additional Event Logs That Can Be Output

At the host for which access was granted by using a Golden Ticket, logs related to the executed command may be recorded.

53

3.9.3. Mimikatz (Silver Ticket)
Basic Information
Tool Name
Category
Tool Overview
Tool

This tool is used to grant a host concealing a record of authentication requests access using the Silver Ticket.
Example ofPresumed Tool Use - Source host: Mimikatz execution source
During an Attack - Destination host: The host logon in by Mimikatz
Authority

OperatingCondition

Mimikatz (Silver Ticket)
Capturing the Domain Administrator Privilege and Account Credentials
Issues an unauthorized Kerberos ticket that is valid for an arbitrary period and grants access without additional authentication

Targeted OS
DomainCommunication
ProtocolLegend- Acquirable
Information- Event ID/Item Name
- Field Name- "Field Value"Standard user
*The NTLM password hash for a service account on the domain must have already been acquired.
Windows
Not required-

Active Directory Domain Services
ServiceStandard Settings - Source host: Execution history (Prefetch)- Source host: Execution history (Sysmon / audit policy)
Additional Settings- Destination host: Logon by an account with an invalid domain
Evidence That Can Be Confirmed - Destination host: If the following log is in the event log, it is considered that unauthorised logon was attempted.
- In the event IDs 4672, 4624, and 4634 in the event log "Security", a logon attempt by an account with an illegal domain is recorded.
When Execution is Successful
Information
Acquired from
Log

Points to be Confirmed
Log Generation
Communication
Location

Acquired Information Details

Log Type and Name

Additional
Settings

Event ID : 4688 (A new process has been created)
4689 (A process has exited)- Process Information -> Process Name : "[File Name (mimikatz.exe)]"

Event Log
Security- Confirmable Information- Process Start/End Time and Date:
Log Date- Name of User Who Executed the Process:Subject -> Account Name
- Domain of User Who Executed the Process:Subject -> Account Domain- Presence of Privilege Escalation at Process Execution: Process Information -> Token Escalation Type- Process Return Value:
Process Information -> Exit Status

Required

Event ID : 4673 (A privileged service was called)- Process Information -> Process Name :"[File Name (mimikatz.exe)]"- Process Information -> Process ID :"[Process ID of the Tool]"- Service Request Information -> Privileges : "SeTcbPrivilege"- Keyword :"Audit Failure"- Confirmable Information- Account That Attempted the Above Operation: Account Name (Standard user)
Source hostEvent ID : 1 (Process Create)
5 (Process Terminated)- Image : "[File Name (mimikatz.exe)]"

Event Log
Sysmon- Confirmable Information- Process Start/End Time and Date (UTC): UtcTime- Process Command Line:
CommandLine- User Name:
User- Process ID:
ProcessId

Required

Event ID : 9 (RawAccessRead detected)- Process : The ProcessId recorded in the event 1- Image : "[File Name (mimikatz.exe)]"- Device : "\Device\HarddiskVolume 2 "OS: Windowsuser↓
OS: Windows
Serverserviceaccount

Execution History
Prefetch

File name: C:\Windows\Prefetch\[Executable File(MIMIKATZ.EXE)]-[RANDOM].pf- Confirmable Information (the following can be confirmed using this tool: WinPrefetchView)- Last Executed Time and Date:
Last Execution Time-- Unlike a Golden Ticket, communication with the Domain Controller does not occur when a ticket is generated.
- The following is a log recorded when an incoming connection is received using a ticket.
Event ID : 4672 (Special privileges assigned to new logon)- Special Privileges : "SeSecurityPrivilege" / "SeBackupPrivilege" / "SeRestorePrivilege" / "SeTakeOwnershipPrivilege" /"SeSystemEnvironmentPrivilege" / "SeLoadDriverPrivilege" / "SeImpersonatePrivilege" /"SeEnableDelegationPrivilege"- Confirmable Information- Captured Account Name: Account (An existing account name)- Domain:Account Domain (An invalid value)- Logon ID:
Logon ID *Used for association with other logs
- Available Privileges:
Special Privileges
Destination hostEvent Log
Security

Required
Event ID : 4624 (An account was successfully logged on)- Logon Type : "3"- New Logon -> Account Name / Account Domain : "[ Account Name / Account Domain Recorded in Event 4672 ]"- New Logon -> Logon ID :"[ Logon ID Recorded in Event 4672 ]"- Confirmable Information- Used Security ID: New Logon -> Security ID- Host That Used Authentication Information: - Network Information -> Source Network Address
Event ID : 4634 (An account was logged off)
- Logon Type : "3"- New Logon -> Account Name / Account Domain : "[ Account Name / Account Domain Recorded in Event 4672 ]"- New Logon -> Logon ID :"[ Logon ID Recorded in Event 4672 ]"Remarks
Additional Event Logs That Can Be Output

At the host for which access was granted by using a Silver Ticket, logs related to the executed command may be recorded.

54

3.10.1. ntdsutil
Basic Information
Tool Name
Category
Tool Overview
Tool

OperatingCondition

ntdsutil
Obtaining Active Directory database
A command to maintain Active Directory databases

Example ofPresumed Tool Use This tool is used to extract NTDS.DIT, a database for NTDS, and other tools are used to analyze passwords (executed in Active Directory).
During an Attack
Authority
Targeted OS
DomainAdministrator
Windows Server
RequiredCommunication
Protocol-Legend- Acquirable
Information- Event ID/Item Name
- Field Name- "Field Value"

Active Directory Domain Services- The fact that the service has started and that a driver was installed on a storage device
Standard Settings- History of shadow copy creation
Additional Settings - Execution history (Sysmon / audit policy)
If the following is confirmed, it is possible that information was breached.
- If ntdsutil.exe was executed and the following log is recorded in the event log:
Evidence That Can Be Confirmed- The Event ID 8222 is recorded in the event log "Security".
When Execution is Successful- A request for a handle for "[System Drive]\SNAP_[Date and Time]_VOLUME[Drive Letter]$" was successful*Additionally, if a log indicating that files under C:\Windows\NTDS, which cannot be normally read, were copied (Event ID: 4663) is recorded, it is possible that a shadow copy was used.
Service

Information
Acquired from
Log

Points to be Confirmed
Log Generation
Communication
Location

Acquired Information Details

Log Type and Name

Additional
Settings

Event ID : 4688 (A new process has been created)
4689 (A process has exited)- Process Information -> Process Name : "C:\Windows\System32\ntdsutil.exe"- Confirmable Information- Process Start/End Time and Date:- Name of User Who Executed the Process:- Domain of User Who Executed the Process:- Process ID:- Presence of Privilege Escalation at Process Execution:- Process Return Value:

Log Date
Subject -> Account Name
Subject -> Account Domain
Process Information -> New Process ID
Process Information -> Token Escalation Type
Process Information -> Exit Status

Event ID : 4673 (A privileged service was called)- Process -> Process Name : "C:\Windows\explorer.exe"

Event Log
Security- Confirmable Information- Privileges Used: Service Request Information -> Privileges ("SeTcbPrivilege")
Required
Event ID : 8222 (Shadow copy has been created)- Confirmable Information- Shadow Copy Name: Shadow Device Name
*This log is recorded without a need to configure additional settings.
Event ID : 4656 (A handle to an object was requested)- Process Information -> Process Name : "C:\Windows\System32\VSSVC.exe"- Confirmable Information- Mount Point:
Object -> Object Name ("C\SNAP_[Date and Time]_VOLUME[C]$" )- Success or Failure: Keywords ("Audit Success" )-- Remarks- If a log indicating that files under C:\Windows\NTDS, which cannot be normally read (event 4663) was successful, it is considered that access
was successful. Note that outputting the event 4663 requires the audit of object access.

Active Directory
Domain Controller

Event ID : 1 (Process Create)
5 (Process Terminated)- Image : "C:\Windows\System32\ntdsutil.exe"
Event Log
Sysmon- Confirmable Information- Process Start/End Time and Date (UTC):- Process Command Line:- User Name:- Process ID:

Required
UtcTimeCommandLine
User
ProcessId

Event ID : 7036
- Detailed Tab -> It is possible that a start of a service with EventData\param 1 set to one of the following may be recorded:- "Volume Shadow Copy"- "Microsoft Software Shadow Copy Provider"- "Windows Modules Installer"*If a service has already been executed, a log will not be output.
Event Log
SystemEvent ID : 20001- Details Tab -> System\Provider\Name is set to "Microsoft-Windows-UserPnp" .
- Confirmable Information- Process ID:
System\Execution\ProcessID*Matches the process ID of drvinst.exe output in the Sysmon log.
- Snapshot Name: UserData\InstallDeviceID\DeviceInstanceID*If a similar snapshot was mounted before, an event log may not be output.

Execution History
Registry

Registry Entry:
HKEY_LOCAL_MACHINE\CurrentControlSet\Enum\STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot[Snapshot Number]- If drvinst.exe has been executed, a new key is created.

-

Remarks
Additional Event Logs That Can Be Output

It is possible that the fact that a driver was installed is left in volsnap.inf as a difference. (*If a similar snapshot was mounted before, an event log may not berecorded.)55

3.10.2. vssadmin
Basic Information
Tool Name
Category
Tool Overview
Tool

OperatingCondition

vssadminObtaining Active Directory database
Creates Volume Shadow Copy and extracts NTDS.DIT

Example ofPresumed Tool Use This tool is used to extract NTDS.DIT, a database for NTDS, so that the password can be analysed using other tools.
During an Attack
Authority
Targeted OS
DomainAdministrator
Windows Server
RequiredCommunication
Protocol-Legend- Acquirable
Information- Event ID/Item Name
- Field Name- "Field Value"

Active Directory Domain Services- The fact that the service has started and that a driver was installed on a storage device
Information
Standard Settings
Acquired from- History of shadow copy creation
Log
Additional Settings - Execution history (Sysmon / audit policy)
If the following log is in the event log, it is considered that a shadow copy was created.
- The Event ID 8222 is recorded in the event log "Security".
Evidence That Can Be Confirmed*Additionally, if a log indicating that files under C:\Windows\NTDS, which cannot be normally read, were copied (Event ID: 4663) is recorded, it is possible
When Execution is Successfulthat a shadow copy was used.
Service

Points to be Confirmed
Log Generation
Communication
Location

Acquired Information Details

Log Type and Name

Additional
Settings

Event ID : 4688 (A new process has been created)
4689 (A process has exited)- Process Information -> Process Name : "C:\Windows\System32\vssadmin.exe"

Event Log
Security- Confirmable Information- Process Start/End Time and Date:- Name of User Who Executed the Process:- Domain of User Who Executed the Process:- Process ID:- Presence of Privilege Escalation at Process Execution:- Process Return Value:

Log Date
Subject -> Account Name
Subject -> Account Domain
Process Information -> New Process ID
Process Information -> Token Escalation Type
Process Information -> Exit Status

Required

Event ID : 8222 (A shadow copy was created)- Confirmable Information- Shadow Copy Name: Shadow Device Name
- Remarks- If a log indicating that files under C:\Windows\NTDS, which cannot be normally read (event 4663) was successful, it isconsidered that access was successful.
The content of an output log depends on the software used for copying. Note that outputting the event 4663 requires the audit ofobject access.
Event ID : 7036
- Detailed Tab -> System\Provider\Name : "Service Control Manager"- Details Tab -> EventData\param1 : "Volume Shadow Copy"-

Active Directory
Domain Controller- Confirmable Information- Executing the Service: Details Tab -> EventData\param2 ("Being executed" )Event Log
System

*If the Volume Shadow Copy service is already running, a log will not be output.
Event ID : 20001- Detailed Tab -> System\Provider\Name : "Microsoft-Windows-UserPnp"- Confirmable Information- Process ID:
System\Execution\ProcessID*Matches the process ID of drvinst.exe output in the Sysmon log.
- Snapshot Name: UserData\InstallDeviceID\DeviceInstanceID*If a similar snapshot was mounted before, an event log may not be output.
Event ID : 1 (Process Create)
5 (Process Terminated)- Image : "C:\Windows\System32\vssadmin.exe"

Event Log
SysmonExecution History
Registry- Confirmable Information- Process Start/End Time and Date (UTC):- Process Command Line:- User Name:- Process ID:

Required
UtcTimeCommandLine
User
ProcessId*Drives that are targeted for creating a shadow copy are recorded.

Registry Entry: HKEY_LOCAL_MACHINE\CurrentControlSet\Enum\STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot[Snapshot Number]- If drvinst.exe has been executed, a new key is created.

-

Remarks
Additional Event Logs That Can Be Output

The fact that a driver was installed may be left in volsnap.inf as a difference. (*If a similar snapshot was mounted before, an event log may not be recorded.)56

3.11.1. net user
Basic Information
Tool Name
Category
Tool Overview
Tool

net Command (net user)
Adding or Deleting a User/Adding or Deleting a Group
Adds a user account in a client or the domain

Example ofPresumed Tool Use This tool is used to create accounts or additional sessions in the machine the attacker has infected or to communicate with other hosts.
During an Attack

Legend- Acquirable
Information- Event ID/Item Name
- Field Name- "Field Value"

Administrator
Authority
Windows
Targeted OS
Operating
Not required
DomainCommunication Condition*With domain administrator, accounts can also be created on the Domain Controller.
ProtocolService
Information
Standard Settings - The fact that a user has been added is recorded in a log.
Acquired from
Additional Settings - A user name and password specified by the "net user" command are recorded (Sysmon).
Evidence That Can Be Confirmed If the following log is in the event log, it is considered that a user was added.
- The Event ID 4720 is recorded in the event log "Security".
When Execution is Successful
Points to be Confirmed
Log Generation
Communication
Location

Acquired Information Details

Log Type and Name

Additional
Settings

Event ID : 4688 (A new process has been created)
4689 (A process has exited)- Process Information -> Process Name :"C:\Windows\System32\net.exe ""C:\Windows\System32\net1.exe" *After net.exe is executed, net1.exe is
executed as a child process.
- Confirmable Information- Process Start/End Time and Date:
Log Date- Name of User Who Executed the Process:Subject -> Account Name
- Domain of User Who Executed the Process:Subject -> Account Domain- Presence of Privilege Escalation at Process Execution: Process Information -> Token Escalation Type*It is type 1 or 2 because administrator rights are required.
- Process Return Value:
Process Information -> Exit Status
Event Log
Security-

Event ID : 4656 (SAM - A handle to an object was requested)- Process Information -> Process Name : "C:\Windows\System32\lsass.exe"- Object -> Object Type :"SAM_DOMAIN"

Required- Confirmable Information- Handle ID:
Object -> Handle ID *Used for association with other logs
- Requested Process: Access Request Information -> Access ("ReadPasswordParameters" / "CreateUser" / "LookupIDs" )- Success or Failure: Keywords ("Audit Success" )Host(Windows)

Event ID : 4720 (A user account was created)- New Account -> Account Name : A user name specified by the "net user" command- Confirmable Information- User Group: Attribute -> Primary Group ID*Depending on the details of the process executed, a different event (such as 4722, 4724, 4726, 4737, and 4738) is recorded.
Event ID : 1 (Process Create)
5 (Process Terminated)- Image : "C\Windows\System32\net.exe""C:\Windows\System32\net1.exe"
Event Log
Sysmon- Confirmable Information- Process Start/End Time and Date (UTC): UtcTime- Process Command Line:
CommandLine *The fact that a user was added (user /add) and the user nameand password (if passed to the argument) are recorded in the argument.
- User Name:
User- Process ID:
ProcessId

Remarks
Additional Event Logs That Can Be Output

If addition to a group or others were performed, the relevant access history is recorded.

57

Required3.12.1. net use
Basic Information
Tool Name
Category
Tool Overview
Tool

OperatingCondition

net Command (net use)
File Sharing
Connects to shared folders that are publicly available on the network

Example ofThis tool is used to send in tools to be used during attacks via shared folders and to acquire information from a file server.
Presumed Tool Use - Source host: net command execution source
During an Attack - Destination host: the machine accessed by the net command
Authority
Targeted OS
DomainStandard user
Windows
Not required

Communication
Protocol445/tcp

Legend- Acquirable
Information- Event ID/Item Name
- Field Name- "Field Value"

Destination host: Server, Source host: Workstation
ServiceStandard
Settings
Information- Source host: Execution history (Sysmon / audit policy)
Acquired from
Additional Settings - Destination host: Although a record of using Windows Filtering Platform remains, audit policy of read data is required to confirm the specific access path.
Log*If a write is made to a shared point, it is recorded in the audit policy of write data.
Evidence That Can Be Confirmed - Source host: If the following log is in the event log, it is possible that file sharing occurred.
- The Event ID 4689 (A process has exited) of net.exe was recorded in the event log "Security" with the execution result (return value) of "0x0".
When Execution is Successful
Points to be Confirmed
Log Generation
Communication
Location

Acquired Information Details

Log Type and Name

Additional
Settings

Event ID : 4688 (A new process has been created)
4689 (A process has exited)- Process Information -> Process Name : "C:\Windows\System32\net.exe"

Event Log
Security- Confirmable Information- Process Start/End Time and Date:
Log Date- Name of User Who Executed the Process:Subject -> Account Name
- Domain of User Who Executed the Process:Subject -> Account Domain- Presence of Privilege Escalation at Process Execution: Process Information -> Token Escalation Type- Process Return Value:
Process Information -> Exit Status

Required

Event ID : 5156 (The Windows Filtering Platform has allowed a connection)- Network Information -> Direction :"Outbound"- Network Information -> Destination Address :"[Host Specified as a Shared Folder]"- Network Information -> Destination Port / Protocol : "445" / "6" (TCP)

Source host- Confirmable Information- Source Port: Network Information -> Source Port
Event ID : 1 (Process Create)
5 (Process Terminated)- Image : "C\Windows\System32\net.exe"

OS: Windowsuser↓
OS: Windows
user

Execution History
SysmonDestination host

Active Directory
Domain Controller

Event Log
Security

Event Log
Security- Confirmable Information- Process Start/End Time and Date (UTC): UtcTime- Process Command Line:
CommandLine- User Name:
User- Process ID:
ProcessId

Required*The destination host and share path are recorded.

Event ID : 5156 (The Windows Filtering Platform has allowed a connection)- Network Information -> Direction :"Inbound"- Network Information -> Source Address :"[IP Address of the File Server]"- Network Information -> Source Port / Protocol : "445" / "6" (TCP)- Confirmable Information- Source Host: Network Information -> Destination Address- Source Port: Network Information -> Destination Port *Matches the source port of the source hostEvent ID : 4624 (An account was successfully logged on)- Logon Type : "3"- Network Information -> Source Network Address : "[ Destination Address in Event 5156]"- Network Information -> Source Port :"[ Destination Port Recorded in Event 5156]"- Confirmable Information- Used User: New Logon -> Account Name / Account Domain

Remarks
Additional Event Logs That Can Be Output

Required- If read data is enabled in the audit policy, the connected share path is recorded in the event 5140 (file sharing).
- If write access is made to a share point, it is recorded in audit of object access.

58

Required3.12.2. net share
Basic Information
Tool Name
Category
Tool Overview
Tool

OperatingCondition

net Command (net share)
File Sharing
Shares particular folders so that they are available via network

Example ofPresumed Tool Use This tool is used to create a share path on the host the attacker has infected to read and write files.
During an Attack
Authority
Targeted OS
DomainAdministrator
Windows
Not required

Communication
Protocol- *Although a shared path is used via network, adding a shared folder with "net share" is completed on the machine.

Legend- Acquirable
Information- Event ID/Item Name
- Field Name- "Field Value"

ServerServiceStandard Settings - Information on a share path may be left on the registry. *The value will be cleared when shared folder is disabled.
Additional Settings - Execution history (Sysmon / audit policy) *The shared path and used share name are recorded.
Evidence That Can Be Confirmed If the following log is in the event log, it can be deemed that a shared folder was created.
- The event ID: 5142 is recorded in the event log "Security".
When Execution is Successful
Information
Acquired from

Points to be Confirmed
Log Generation
Communication
Location

Acquired Information Details

Log Type and Name

Event Log
Security

Event ID : 4688 (A new process has been created)
4689 (A process has exited)- Process Information -> Process Name : "C:\Windows\System32\net.exe""C:\Windows\System32\net1.exe"*After net.exe is executed, net1.exe is executed as a child process.
- Confirmable Information- Process Start/End Time and Date:
Log Date- Name of User Who Executed the Process:Subject -> Account Name
- Domain of User Who Executed the Process:Subject -> Account Domain- Presence of Privilege Escalation at Process Execution: Process Information -> Token Escalation Type*It is type 1 or 2 because administrator rights are required.
- Process Return Value:
Process Information -> Exit Status

Additional
Settings

Required

Event ID : 5142 (A network share object was added)-- Confirmable Information- Share Name:
Shared Information -> Share Name
- Folder Used for Sharing: Share Path

Host(Windows)

Event Log
SysmonAccess History
Registry

Event IDs : 1 (Process Create)
5 (Process Terminated)- Image : "C\Windows\System32\net.exe""C:\Windows\System32\net1.exe"- Confirmable Information- Process Start/End Time and Date (UTC): UtcTime- Process Command Line:
CommandLine *The share name and folder used for sharing are recorded in the argument.
- User Name:
User- Process ID:
ProcessId
Registry Entry: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\
Shares\Security\[Share Name]$*The entry is created when shared folder is enabled (when it is disabled, the value is cleared).
Since the value is cleared when sharing is disabled, it is difficult to detect an attack unless there is a system for always
monitoring the registry.

Remarks
Additional Event Logs That Can Be Output-

59

Required-3.12.3. icacls
Basic Information
Tool Name
Category
Tool Overview
Tool

Example of- This tool is used to change the rights to read a file that cannot be read by the used account.
Presumed Tool Use- It is also used to capture rights so that the content of a file created by the attacker will not be viewable.
During an Attack
Authority

OperatingCondition

Information
Acquired fromLog

icaclsFile Sharing
Changes the file access rights

Targeted OS
DomainCommunication
ProtocolLegend- Acquirable
Information- Event ID/Item Name
- Field Name- "Field Value"Standard user
* When the Access Control List (ACL) has been changed, appropriate rights for the relevant files are required.
Windows
Not required-

ServiceStandard Settings Execution history (Prefetch)

Additional Settings Execution history (Sysmon / audit policy)
If the following log is in the event log, it is considered that file access rights were changed.
Evidence That Can Be Confirmed- The Event IDs: 4688 and 4689 on icacls.exe are recorded in the event log "Security", and the Exit Status in the event ID: 4689 is set to "0x0" .
*Since it is not possible to determine the target files from the Event IDs 4688 and 4689, it is necessary to additionally check the command line of icacls.exe
When Execution is Successful
from the event ID 1 of sysmon.
Points to be Confirmed
Log Generation
Communication
Location

Acquired Information Details

Log Type and Name

Additional
Settings

Event ID : 4688 (A new process has been created)
4689 (A process has exited)- Process Information -> Process Name : "C:\Windows\System32\icacls.exe"
Event Log
Security-- Confirmable Information- Process Start/End Time and Date:
Log Date- Name of User Who Executed the Process:Subject -> Account Name
- Domain of User Who Executed the Process:Subject -> Account Domain- Presence of Privilege Escalation at Process Execution: Process Information -> Token Escalation Type- Process Return Value:
Process Information -> Exit Status

Required

Event ID : 1 (Process Create)
5 (Process Terminated)- Image : "C:\Windows\System32\icacls.exe"

Host(Windows)
Execution History
SysmonExecution History
Prefetch- Confirmable Information- Process Start/End Date and Time (UTC): UtcTime- Process Command Line:
CommandLine- User Name:
User- Process ID:
ProcessId*The target file and set rights are recorded in the argument.

File name: C:\Windows\Prefetch\ICACLS.EXE-CCAC2A58.pf- Confirmable Information (the following can be confirmed using this tool: WinPrefetchView)- Last Executed Time and Date:
Last Execution Time

Remarks
Additional Event Logs That Can Be Output

Required-60-

3.13.1. sdelete
Basic Information
Tool Name
Category
Tool Overview
ToolsdeleteDeleting Evidence
Deletes a file after overwriting it several times

Example ofPresumed Tool Use This tool is used to delete a file created in the course of an attack to make it impossible to be recovered.
During an Attack

Legend- Acquirable
Information- Event ID/Item Name
- Field Name- "Field Value"Standard user
Windows
Operating
Not required
Condition
Communication Protocol Service- Execution history (Prefetch)
Information
Standard Settings - A statement to the effect that a license agreement on the use of sdelete was consented is recorded in the registry. *If the tool was used in the past, it cannot be confirmed from theinformation obtained under the standard setting.
Acquired from- Execution history (Sysmon / audit policy)
Log
Additional Settings- A record of deleting and overwriting the file to be deleted during the audit of object access
Evidence That Can Be Confirmed - A file with its name similar to the following was repeatedly deleted.
- Example: sdeleAAAAAAAAAAAAAAAAAAAA.AAA, sdeleZZZZZZZZZZZZZZZZZZZZ.ZZZ when the target to be deleted is sdelete.txt
When Execution is Successful
Authority
Targeted OS
DomainPoints to be Confirmed
Log Generation
Communication
Location

Acquired Information Details

Log Type and Name

Additional
Settings

Event ID : 4688 (A new process has been created)
4689 (A process has exited)- Process Information -> Process Name : "[File Name (sdelete.exe)]"- Confirmable Information- Process Start/End Time and Date:
Log Date- Name of User Who Executed the Process:Subject -> Account Name
- Domain of User Who Executed the Process:Subject -> Account Domain- Presence of Privilege Escalation at Process Execution: Process Information -> Token Escalation Type- Process Return Value:
Process Information -> Exit Status
Event Log
Security-

Event ID : 4656 (A handle to an object was requested)4663 (An attempt was made to access an object)4658 (The handle to an object was closed)- Process Information -> Process Name : "[File Name (sdelete.exe)]"

Required- Confirmable Information- File to be Deleted: Object -> Object Name
*In the course of deleting a file by overwriting it, sdelete creates a file with its name consisting of a combination of
the name of the file to be deleted and some letters, and repeats the delete operation.
(Example: sdeleAAAAAAAAAAAAAAAAAAAA.AAA when the target to be deleted is sdelete.txt)- Process Details:
Access Request Information -> Access*For the same object, "DELETE " or "WriteData or AddFile " is repeated.
- Success or Failure: Keywords ("Audit Success" )Host(Windows)

Event ID : 1 (Process Create)
5 (Process Terminated)- Image : "[File Name (sdelete.exe)]"
Event Log
Sysmon- Confirmable Information- Process Start/End Time and Date (UTC): UtcTime- Process Command Line:
CommandLine *In addition to the executable file, the number of overwriting operations
and other options passed to sdelete.exe can be found.
- User Name:
User- Process ID:
ProcessId

Execution History
Prefetch

File name: C:\Windows\Prefetch\[File Name (SDELETE.EXE)]-[RANDOM].pf

Execution History
Registry

Registry Entry: HKEY_USERS\[SID]\Software\Sysinternals\Sdelete- When the tool is used for the first time, the effect that the license agreement was consented is recorded in EulaAccepted .
- If sdelete was used on the machine in the past, it is not possible to determine its use by the attacker.

- Confirmable Information (the following can be confirmed using this tool: WinPrefetchView)- Last Execution Time and Date:
Last Execution Time

Remarks
Additional Event Logs That Can Be Output-

61

Required--3.13.2. timestomp
Basic Information
Tool Name
Category
Tool Overview
Tool

OperatingCondition

timestomp
Deleting Evidence
Changes the file timestamp

Example ofPresumed Tool Use For a file whose timestamp has changed as a result of the use by the attacker, this tool is used to conceal the access to the file by restoring the timestamp.
During an Attack
Authority
Targeted OS
DomainStandard user
Windows
Not required

Communication
Protocol-Legend- Acquirable
Information- Event ID/Item Name
- Field Name- "Field Value"

ServiceStandard Settings - Execution history (Prefetch)- Execution history (Sysmon / audit policy)
Additional Settings- Auditing of change of file creation date and time
Evidence That Can Be Confirmed If the following log is in the event log, it is considered that the timestamp was changed.
- The Event ID: 4663 is recorded in the event log "Security", and the "WriteAttributes" keyword for the target file is set to "Audit Success" .
When Execution is Successful
Information
Acquired from
Log

Points to be Confirmed
Log Generation
Communication
Location

Acquired Information Details

Log Type and Name

Additional
Settings

Event ID : 4688 (A new process has been created)
4689 (A process has exited)- Process Information -> Process Name : "[File Name (timestomp.exe)]"- Confirmable Information- Process Start/End Time and Date:
Log Date- Name of User Who Executed the Process:Subject -> Account Name
- Domain of User Who Executed the Process:Subject -> Account Domain- Presence of Privilege Escalation at Process Execution: Process Information -> Token Escalation Type- Process Return Value:
Process Information -> Exit Status
Event ID : 4656 (A handle to an object was requested)- Process Information -> Process Name : "[File Name (timestomp.exe)]"- Confirmable Information- Targeted File:
Object -> Object Name
- Handle ID:
Object -> Handle ID *Used for association with other logs
- Process Details:
Access Request Information -> Access ("SYNCHRONIZE" , "ReadAttributes" , "WriteAttributes" )- Success or Failure: Keywords ("Audit Success" )Event Log
Security

Required

Event ID : 4663 (An attempt was made to access an object)- Process Information -> Process Name : "[File Name (timestomp.exe)]"- Confirmable Information- Targeted File:
Object -> Object Name
- Handle ID:
Object -> Handle ID *Used for association with other logs
- Process Details:
Access Request Information -> Access ("WriteAttributes" )- Success or Failure: Keywords ("Audit Success" )Event ID : 4658 (The handle to an object was closed)- Process Information -> Process Name : "[File Name (timestomp.exe)]"- Confirmable Information- Handle ID: Object -> Handle ID-*The same as the handle ID recorded in events 4663 and 4656 to be output first

Host(Windows)
Event ID : 1 (Process Create)
5 (Process Terminated)- Image : "[File Name (timestomp.exe)]"- Confirmable Information- Process Start/End Time and Date (UTC): UtcTime- Process Command Line:
CommandLine*The target file, properties to be changed, and new timestamp are recorded in the argument in the command line.
- User Name:
User
Event ID : 2 (File creation time changed)- Image : "[File Name (timestomp.exe)]"
Event Log
Sysmon- Confirmable Information- Date and Time (UTC) the Change Occurred: UtcTime- New File Name:
TargetFilename- New Timestamp (UTC):
CreationUtcTime- Previous Timestamp (UTC):
PreviousCreationUtcTime

Required*The Event ID: 2 shows a change in the file creation date and time, but it is output regardless of the type (creation, change, or access)of the changed timestamp. If an item other than the creation date and time is changed, the same time (original date and time) isrecorded in the timestamp before and after the change.
*Timestamps other than for the creation date and time will not be recorded.
Event ID : 9 (RawAccessRead detected - Direct disk read detected)- Image : "[File Name (timestomp.exe)]"- Confirmable Information- Name of the Device that has the Target File: Device ("\Device\HarddiskVolume 2 " )Execution History
Prefetch

File name: C:\Windows\Prefetch\[File Name (TIMESTOMP.EXE)]-[RANDOM].pf- Confirmable Information (the following can be confirmed using this tool: WinPrefetchView)- Last Execution Time and Date:
Last Execution Time

Remarks
Additional Event Logs That Can Be Output

-

62

-

3.14.1. wevtutil
Basic Information
Tool Name
Category
Tool Overview
Tool

wevtutil
Deleting Event Log
Deletes Windows event logs

Legend- Acquirable
Information- Event ID/Item Name
- Field Name- "Field Value"

Example ofThis tool is used to delete the evidence of an attack.
Presumed Tool Use - Source host: wevtutil command execution source
During an Attack - Destination host: The machine accessed by the wevtutil command

Administrator
Windows
Operating
Not required
Condition
Communication Protocol 135/tcp
Event Log
Service
Information
Standard Settings - The fact that an event log was cleared remains in each cleared log of the host.
Acquired from
Additional Settings - The account used for clearing logs and the host that executed the clear command can be confirmed.
Evidence That Can Be Confirmed - Source host: If the following log is in the event log, it is considered that logs were cleared.
- The Event ID: 104 is recorded in each target event log.
When Execution is Successful
Authority
Targeted OS
DomainPoints to be Confirmed
Log Generation
Communication
Location

Acquired Information Details

Log Type and Name

Additional
Settings

Event ID : 4688 (A new process has been created)
4689 (A process has exited)- Process Information -> Process Name : "C:\Windows\System32\wevtutil.exe"- Confirmable Information- Process Start/End Time and Date:
Log Date- Name of User Who Executed the Process:Subject -> Account Name
- Domain of User Who Executed the Process:Subject -> Account Domain- Presence of Privilege Escalation at Process Execution: Process Information -> Token Escalation Type- Process Return Value:
Process Information -> Exit Status

Event Log
Security

Required

Event ID : 4648 (A logon was attempted using explicit credentials)- Process Information -> Process Name : "C:\Windows\System32\wevtutil.exe"- Process Information -> Process ID :The same as the process ID recorded in the event 4688
Source host- Confirmable Information- Local Account:
Subject -> Account Name / Account Domain- Account Used at Destination Host: Account for which a Credential was Used -> Account Name / Account Domain- Destination Host:
Target Server -> Target Server Name
Event ID : 1 (Process Create)
5 (Process Terminated)- Image : "C:\Windows\System32\wevtutil.exe"

OS: Windowsuser↓
OS: Windows
administrator

Event Log
Sysmon- Confirmable Information- Process Start/End Time and Date (UTC):- Process Command Line:- User Name:- Process ID:

Required
UtcTimeCommandLine
User
ProcessId

Event ID : 104 (The System log file was cleared)
Event Log
Each Target Log- Confirmable Information- User:Detailed Tab -> UserData\SubjectUserName / SubjectDomainName- Target Log Name: Detailed Tab -> UserData\Channel-

Event ID : 4672 (Special privileges assigned to new logon)- Confirmable Information- Account with Escalated Privileges: Subject -> Account Name / Account Domain- Available Privileges: Special Privileges ("SeSecurityPrivilege" / "SeRestorePrivilege" / "SeTakeOwnershipPrivilege " /"SeDebugPrivilege" / "SeSystemEnvironmentPrivilege " / "SeLoadDriverPrivilege " / "SeImpersonatePrivilege " /"SeEnableDelegationPrivilege")

Destination hostEvent Log
Security

Required
Event ID : 4624 (An account was successfully logged on)- Logon Type : "3"- Confirmable Information- Used Security ID:- Account:- Host which Requested Logon:

New Logon -> Security ID
Account Name / Account Domain
Network Information -> Source Network Address

Remarks
Additional Event Logs That Can Be Output-

63

3.15.1. csvde
Basic Information
Tool Name
Category
Tool Overview
Tool

OperatingCondition

csvde
Acquisition of Account Information
Outputs account information on the Active Directory in the CSV format

This tool is used to extract information on an existing account and select users and clients available as attack targets.
Example ofPresumed Tool Use - Source host: csvde command execution source
During an Attack - Destination host: The machine in which information is collected by the csvde command
Authority
Targeted OS
DomainParticipation

Standard user
Windows
Not required*By entering correct authentication information, it is possible to obtain information remotely from a client that does not participate in the domain.

Communication
Protocol389/tcp

Legend- Acquirable
Information- Event ID/Item Name
- Field Name- "Field Value"

Active Directory Domain Services
Service
Source host: Execution history (Prefetch)
Standard
Settings
Information- Source host: The fact that a csv file was created by csvde.exe.
Acquired fromThe fact that "C:\Users\[User Name]\AppData\Local\Temp\csv[Random Number].tmp" was created as a temporary file when creating a csv file.
Additional Settings
Log- Destination host: Inbound to 389/tcp and login with Kerberos Authentication are recorded.
Evidence That Can Be Confirmed - Source host: csvde.exe was executed and a file specified by the "-f" option was created.
- "C:\Users\[User Name]\AppData\Local\Temp\csv[Random Number].tmp" was created and deleted.
When Execution is Successful
Points to be Confirmed
Log Generation
Communication
Location

Acquired Information Details

Log Type and Name

Additional
Settings

Event ID : 4688 (A new process has been created)
4689 (A process has exited)- Process Information -> Process Name : "[File Name (csvde.exe)]"- Confirmable Information- Process Start/End Time and Date:
Log Date- Name of User Who Executed the Process:Subject -> Account Name
- Domain of User Who Executed the Process:Subject -> Account Domain- Presence of Privilege Escalation at Process Execution: Process Information -> Token Escalation Type- Process Return Value:
Process Information -> Exit Status
Event ID : 5156 (The Windows Filtering Platform has allowed a connection)- Application Information -> Application Name :"[File Name (csvde.exe)]"- Network Information -> Direction :"Outbound"- Network Information -> Destination Address :"[Domain Controller IP Address]"- Network Information -> Destination Port / Protocol : "389" / "6" (TCP)- Confirmable Information- Source Port: Source Port

*Used for association with logs on the Domain Controller side

Event ID : 4663 (An attempt was made to access an object)4656 (A handle to an object was requested)4658 (The handle to an object was closed)- Process Information -> Process Name : "[File Name (csvde.exe)]"
Event Log
Security

OS: Windowsuser↓
OS: Windows
Serverdomain user

- Confirmable Information- Target File:

Object -> Object Name : ("C:\Users\[User Name]\AppData\Local\Temp\
csv[Random Number].tmp" )- Handle ID (Used for Association with Other Logs): Object -> Handle ID- Process Details:
Access Request Information -> Access ("SYNCHRONIZE" / "WriteData (or AddFile)" /"AppendData (or AddSubdirectory, or CreatePipeInstance) / "WriteEA" / "WriteAttributes" )- Success or Failure:
Keywords ("Audit Success" )Required

Event ID : 4663 (An attempt was made to access an object)4656 (A handle to an object was requested)4658 (The handle to an object was closed)- Process Information -> Process Name : "[File Name (csvde.exe)]"- Object -> Object Name : "[File specified with the "-f" option when executing csvde.exe]"

Source host- Confirmable Information- Handle ID (Used for Association with Other Logs): Object -> Handle ID- Process Details:
Access Request Information -> Access ("WriteData or AddFile" /"AppendData, AddSubdirectory, or CreatePipeInstance")- Success or Failure:
Keywords ("Audit Success" )Event ID : 4663 (An attempt was made to access an object)4656 (A handle to an object was requested)4658 (The handle to an object was closed)- Process Information -> Process Name : "[File Name (csvde.exe)]"- Object -> Object Name ("C:\Users\[User Name]\AppData\Local\Temp\csv[Random Number].tmp" )- Confirmable Information- Handle ID:
Object -> Handle ID *Used for association with other logs
- Process Details:
Access Request Information -> Access ("DELETE" )- Success or Failure: Keywords ("Audit Success" )Event ID : 1 (Process Create)
5 (Process Terminated)- Image : "[File Name (csvde.exe)]"
Event Log
SysmonExecution History
Prefetch- Confirmable Information- Process Start/End Time and Date (UTC): UtcTime- Process Command Line:
CommandLine- User Name:
User- Process ID:
ProcessId

Required*If a user or file name is specified, an argument is recorded.

File name: C:\Windows\Prefetch\[File Name(CSVDE.EXE)]-[RANDOM].pf- Confirmable Information (the following can be confirmed using this tool: WinPrefetchView)- Last Executed Time and Date:
Last Execution Time

64-

Communication

OS: Windowsuser↓
OS: Windows
Serverdomain user(Continued fromthe previous
entry)Log Generation
Location

Acquired Information Details

Log Type and Name

Additional
Settings

Event ID : 5156 (The Windows Filtering Platform has allowed a connection)- Application Information -> Application Name : "\device\harddiskvolume 2 \windows\system32\lsass.exe"- Network Information -> Direction :"Inbound"- Network Information -> Source Port / Protocol : "389" / "6" (TCP)- Network Information -> Destination Port :"[ Source Port recorded in the client which executed csvde.exe]"- Confirmable Information- Source Host: Destination Port
Destination hostEvent Log
Security

Required
Event ID : 4624 (An account was successfully logged on)
4634 (An account was logged off)
- Logon Type : "3"- Network Information -> Source Network Address : "[ Destination Address in Event 5156 ]"- Network Information -> Source Port :"[ Destination Port Recorded in Event 5156 ]"- Confirmable Information- Used User:
New Logon -> Account Name / Account Domain- New Logon ID: New Logon -> Logon ID *Used for association with other logs

Remarks
Additional Event Logs That Can Be Output-

65

3.15.2. ldifde
Basic Information
Tool Name
Category
Tool Overview
Tool

OperatingCondition

ldifdeAcquisition of Account Information
Outputs account information on the Active Directory in the LDIF format

This tool is used to extract information on an existing account and select users and clients available as attack targets.
Example ofPresumed Tool Use - Source host: ldifde command execution source
During an Attack - Destination host: The machine in which information is collected by the ldifde command
Authority
Targeted OS
DomainParticipation

Standard user
Windows
Not required*By entering correct authentication information, it is possible to obtain information remotely from a client that does not participate in the domain.

Communication
Protocol389/tcp

Legend- Acquirable
Information- Event ID/Item Name
- Field Name- "Field Value"

Active Directory Domain Services
ServiceStandard Settings - Source host: Execution history (Prefetch)- Source host:
The fact that a LDIF file was created by ldifde.exe.
Additional Settings- Destination host: Inbound to 389/tcp and login with Kerberos Authentication are recorded.
Evidence That Can Be Confirmed - Source host: ldifde.exe was executed and a file specified by the "-f" option was created.
When Execution is Successful
Information
Acquired from
Log

Points to be Confirmed
Communicatio Log GenerationnLocation

Acquired Information Details

Log Type and Name

Additional
Settings

Event ID : 4688 (A new process has been created)
4689 (A process has exited)- Process Information -> Process Name : "[File Name (ldifde.exe)]"- Confirmable Information- Process Start/End Time and Date:- Name of User Who Executed the Process:- Domain of User Who Executed the Process:- Presence of Privilege Escalation at Process Execution:- Process Return Value:

Event Log
Security

Log Date
Subject -> Account Name
Subject -> Account Domain
Process Information -> Token Escalation Type
Process Information -> Exit Status

Event ID : 5156 (The Windows Filtering Platform has allowed a connection)- Application Information -> Application Name :"[File Name (ldifde.exe)]"- Network Information -> Direction :"Outbound"- Network Information -> Destination Address :"[Domain Controller IP Address]"- Network Information -> Destination Port / Protocol : "389" / "6" (TCP)- Confirmable Information- Source Port: Source Port-

*Used for association with logs on the Domain Controller side

Event ID : 4656 (A handle to an object was requested)4663 (An attempt was made to access an object)4658 (The handle to an object was closed)- Process Information -> Process Name : "[File Name (ldifde.exe)]"- Object -> Object Name : "[File specified with the "-f" option when executing ldifde.exe]"

Source host- Confirmable Information- Handle ID:
Object -> Handle ID *Used for association with other logs
- Process Details:
Access Request Information -> Access ("WriteData or AddFile" / "AppendData,
AddSubdirectory, or CreatePipeInstance")- Success or Failure: Keywords ("Audit Success" )OS: Windowsuser↓
OS: Windows
Serverdomain user

Event ID : 1 (Process Create)
5 (Process Terminated)- Image : "[File Name (ldifde.exe)]"
Event Log
SysmonExecution History
Prefetch- Confirmable Information- Process Start/End Time and Date (UTC): UtcTime- Process Command Line:
CommandLine *If a user or file name is specified, an argument is recorded.
- User Name:
User- Process ID:
ProcessId

RequiredFile name: C:\Windows\Prefetch\[File Name (LDIFDE.EXE)]-[RANDOM].pf- Confirmable Information (the following can be confirmed using this tool: WinPrefetchView)- Last Execution Time and Date:
Last Execution Time-

Event ID : 5156 (The Windows Filtering Platform has allowed a connection)- Application Information -> Application Name :"\device\harddiskvolume 2 \windows\system32\lsass.exe"- Network Information -> Direction :"Inbound"- Network Information -> Source Port / Protocol : "389" / "6" (TCP)- Network Information -> Destination Port :"[ Source Port recorded in the client which executed ldifde.exe]"- Confirmable Information- Source Host:
Destination Port- Success or Failure: Keyword
Destination hostEvent Log
Security

Event ID : 4624 (An account was successfully logged on)- Logon Type :"3"- Network Information -> Source Network Address : "[ Destination Address in Event 5156 ]"- Network Information -> Source Port :"[ Destination Port Recorded in Event 5156 ]"- Confirmable Information- Used User:
New Logon -> Account Name / Account Domain- New Logon ID: New Logon -> Logon ID *Used for association with other logs
Event ID : 4634 (An account was logged off)
- Subject -> Account Name / Account Domain / Logon ID : "[The same as the one recorded in Event 4624 ]"Remarks
Additional Event Logs That Can Be Output-

66

Required3.15.3. dsquery
Basic Information
Tool Name
Category
Tool Overview
Tool

This tool is used to extract information on an existing account and select users and clients available as attack targets.
Example ofdsquery command execution source
Presumed Tool Use - Source host:During an Attack - Destination host: The machine in which information is collected by the dsquery command
Authority
Targeted OS

OperatingCondition

dsquery
Acquisition of Account Information
Obtains information, such as users and groups, from a directory service

DomainParticipation
Communication
ProtocolLegend- Acquirable
Information- Event ID/Item Name
- Field Name- "Field Value"Standard user
* Depending on the Access Control List (ACL) setting, some information cannot be obtained with standard user privileges.
Windows
Not required* This investigation is conducted on the Domain Controller.
By entering correct authentication information, it is possible to obtain information remotely from a client that does not participate in the domain.
389/tcp

Active Directory Domain Services
Service
Execution history (Prefetch)
Standard Settings - Source host:- Source host:
Execution history (Sysmon / audit policy)
Additional Settings- Destination host: Inbound to 389/tcp and login with Kerberos Authentication are recorded.
Evidence That Can Be Confirmed The successful execution of the tool cannot be determined from event logs, execution history, and so on. *If the extracted account information is saved, it can be considered thatthe tool execution was successful.
When Execution is Successful
Information
Acquired from
Log

Points to be Confirmed
Log Generation
Communication
Location

Acquired Information Details

Log Type and Name

Additional
Settings

Event ID : 4688 (A new process has been created)
4689 (A process has exited)- Process Information -> Process Name : "[File Name (dsquery.exe)]"- Confirmable Information- Process Start/End Time and Date:
Log Date- Name of User Who Executed the Process:Subject -> Account Name
- Domain of User Who Executed the Process:Subject -> Account Domain- Presence of Privilege Escalation at Process Execution: Process Information -> Token Escalation Type- Process Return Value:
Process Information -> Exit Status

Event Log
Security

Event ID : 5156 (The Windows Filtering Platform has allowed a connection)- Application Information -> Application Name :"[File Name (dsquery.exe)]"- Network Information -> Direction :"Outbound"- Network Information -> Destination Address :"[Domain Controller IP Address]"- Network Information -> Destination Port / Protocol : "389" / "6" (TCP)
Required- Confirmable Information- Source Port: Source Port

*Used for association with logs on the Domain Controller side

Event ID : 4663 (An attempt was made to access an object)4656 (A handle to an object was requested)4658 (The handle to an object was closed)- Process Information -> Process Name : "[File Name (dsquery.exe)]"- Object -> Object Name :"C:\Users\[User Name]\AppData\Local\Microsoft\Windows\
SchCache\[Domain Name].sch"- Confirmable Information- Handle ID:
Object -> Handle ID *Used for association with other logs
- Process Details:
Access Request Information -> Access ("WriteData or AddFile" / "AppendData,
AddSubdirectory, or CreatePipeInstance")- Success or Failure: Keywords ("Audit Success" )Source host

OS: Windowsuser↓
OS: Windows
Serveruser*The Event IDs 4656, 4663, and 4658 may not be output if a valid sch file already exists.
Event ID : 1 (Process Create)
5 (Process Terminated)- Image : "[File Name (dsquery.exe)]"
Event Log
SysmonExecution History
Prefetch- Confirmable Information- Process Start/End Time and Date (UTC): UtcTime- Process Command Line:
CommandLine- User Name:
User- Process ID:
ProcessId

Required*If a user or file name is specified, an argument is recorded.

File name: C:\Windows\Prefetch\[File Name (DSQUERY.EXE)]-[RANDOM].pf- Confirmable Information (the following can be confirmed using this tool: WinPrefetchView)- Last Executed Time and Date:
Last Execution Time-

Event ID : 5156 (The Windows Filtering Platform has allowed a connection)- Application Information -> Application Name : "\device\harddiskvolume2\windows\system32\lsass.exe"- Network Information -> Direction :"Inbound"- Network Information -> Source Port / Protocol : "389" / "6" (TCP)- Network Information -> Destination Port :"[ Source Port recorded in the client that executed dsquery.exe]"- Confirmable Information- Source Host: Destination Port
Destination hostEvent Log
Security

Required
Event ID : 4624 (An account was successfully logged on)
4634 (An account was logged off)
- Logon Type : "3"- Network Information -> Source Network Address : "[ Destination Address in Event 5156 ]"- Network Information -> Source Port :"[ Destination Port Recorded in Event 5156 ]"- Confirmable Information- Used User: New Logon -> Account Name / Account Domain- New Logon ID: New Logon -> Logon ID *Used for association with other logs

Remarks
Additional Event Logs That Can Be Output-

67

3.16. Evidence That Can Be Observed for Successful Tool Execution
The following table describes criteria to observe the execution of a tool and command, and the success of the attack.
Note that logs are described in each sheet in more detail.
Category

Investigation Target

Success or Failure Decision

PsExecIf the following is confirmed, it is possible that PsExec was executed.
- Source host:If the following log is in the event log- The Event ID 4689 (A process has exited) of psexec.exe was recorded in the event log "Security" with the execution result (return value) of "0x0".
- Destination host: PSEXESVC.exe is installed.

wmic

If the following logs that have the same log time are found at "source host" and "destination host", it is possible that a remote connection was made.
- Source host:If the following log is in the event log:
- The Event ID 4689 (A process has exited) of WMIC.exe was recorded in the event log "Security" with the execution result (return value) of "0x0".
- Destination host: If the following log is in Sysmon:- It is recorded in the event log "Sysmon" that WmiPrvSE.exe was executed with the Event IDs 1 and 5.

PowerShell

If the following logs that have the same log time are found, it is possible that a remote command was executed. *This also applies to Prefetch.
- Source host:If the following log is in the event log:
- The Event ID 4689 (A process has exited) of PowerShell was recorded in the event log "Security" with the execution result (return value) of "0x0".
- Destination host: If the following log is in the event log:
- The Event ID 4689 (A process has exited) of wsmprovhost.exe was recorded in the event log "Security" with the execution result (return value) of "0x0".

wmiexec.vbs- Destination host: The "WMI_SHARE" share has been created and deleted.

Command Execution
BeginX

WinRM

WinRS

- Source host:
The fact that communication via a permitted port occurred unintentionally at the destination host is recorded.
- Destination host: Unintended communication is permitted for Windows Firewall, and a tool that is listening at the relevant port exists.

- Source host:If the following log exists, it is possible that WinRM was executed.
- A log indicating that cscript.exe accessed the destination host with Event IDs 1 and 5 of the event log "Sysmon" is recorded.

- The execution of WinRS is recorded in the event log "Application and Service\Microsoft\Windows\Windows Remote Management\Operational".

- Source host:at

If the following log is in the event log, it is considered that a task was registered.
- The Event ID 4689 (A process has exited) of at.exe was recorded in the event log "Security" with the execution result (return value) of "0x0".
- Destination host: If the following log is in the event log, it is considered that a task was executed.
- The Event ID 106 (A task has been registered) was recorded in the event log "\Microsoft\Windows\TaskScheduler\Operational".
- The Event IDs 200 (The operation that has been started) and 201 (The operation has been completed) are registered in the event log"\Microsoft\Windows\TaskScheduler\Operational", and the return value of the Event ID 201 is set to success.

BITS

If the following log is in the event log, it is considered that a file was transferred.
- The Event ID 60 is recorded in the event log "Application and Service Log\Microsoft\Windows\Bits-Client", and the status code is set to "0x0".

PWDump7

The successful execution of the tool cannot be determined from event logs or execution history.

PWDumpX- Source host:Quarks PwDump

If "[Path to Tool]\[Destination Address]-PWHashes.txt" has been created, it is considered that it was successfully executed.

- A temporary file ("SAM-[Random Number].dmp") was created and deleted.

mimikatz
The successful execution of the tool cannot be determined from event logs or execution history.
(Password Hash Acquisition)
mimikatz(Ticket Acquisition)
WCE- If a file that output a ticket is generated, it is considered that the process was successful.

- The "C:\Users\[User Name]\AppData\Local\Temp\wceaux.dll" file was created and deleted.

Password Hash
Acquisition
gsecdump

The successful execution of the tool cannot be determined from event logs or execution history.

lslsass

The successful execution of the tool cannot be determined from event logs or execution history.

Find-GPOPasswords.ps1

Mail PassView- If the extracted password is saved, it is considered that the execution was successful.

WebBrowserPassView- If the extracted password is saved, it is considered that the execution was successful.

Remote Desktop PassView- If the extracted password is saved, it is considered that the execution was successful.

Htran
Malicious Communication Relay(Packet Tunneling)
Fake wpad

Remote Login- A file in which a password was dumped (GPPDataReport-[Domain Name]-[Time and Date].csv) is output.

- Source host:If the following log is in the event log, it is possible that communication occurred.
- It is recorded in the Event ID 5156 in the event log "Security" that a communication occurred with the tunnel host and tunnel destination host.

- Source host:Communication via 80/tcp and 8888/tcp was made with a host that is originally neither a proxy nor HTTP server.
- Destination host: A host that is originally neither a proxy nor HTTP server was listening to 80/tcp and 8888/tcp.
wpad.dat and proxy.log were created.

RDP- Destination host: If the following logs are in the event log, it is considered that the connection was successful.
- Event ID: 4624 is recorded in the event log "Security".
- Event IDs 21 and 24 are recorded in the event log "Microsoft\Windows\TerminalServices-LocalSessionManager\Operational"

WCE- Source host: The fact that WCESERVICE was installed and executed is recorded.
- Destination host: The fact that a logon was made from a remote host is recorded.
- Both source host and destination host: The fact that communication using WMI occurred is recorded.

Pass-the-hash,Pass-the-ticket
mimikatz- Destination host: If the following log is in the event log, it is considered that a remote login was made.
- The Event ID 4624 is recorded in the event log "Security" regarding access from an unintended source host.

MS14-058 Exploit- The Event ID: 4688 is recorded regarding a process executed with SYSTEM privileges, whose parent process cannot be the parent of the tool or that process.

MS15-078 Exploit- The Event ID: 4688 is recorded regarding a process executed with SYSTEM privileges, whose parent process cannot be the parent of the tool or that process.

SDB UAC Bypass- The fact that a process whose parent process name includes an application that is normally assumed not to be a parent process was executed is recorded.

MS14-068 Exploit- Destination host: In the Event ID: 4672 of the event log "Security", high level privileges are granted to a standard user.

Escalation to SYSTEM Privileges

Privilege Escalation

Capturing the Domain
Administrator and AccountCredentials

Golden Ticket(mimikatz)- Destination host: If the following log is in the event log, it is considered that unauthorised logon was attempted.
- In the Event IDs 4672, 4624, and 4634 in the event log "Security", a logon attempt by an account with an illegal domain is recorded.

Silver Ticket(mimikatz)- Destination host: If the following log is in the event log, it is considered that unauthorised logon was attempted.
- In the Event IDs 4672, 4624, and 4634 in the event log "Security", a logon attempt by an account with an illegal domain is recorded.

68Category

Investigation Target

ntdsutilIf the following is confirmed, it is possible that information was breached.
- If ntdsutil.exe was executed and the following log is recorded in the event log:
- The Event ID 8222 is recorded in the event log "Security".
- A request for a handle for "[ System Drive]\SNAP_[Date and Time]_VOLUME[Drive Letter]$ " was successful*Additionally, if a log indicating that files under C:\Windows\NTDS, which cannot be normally read, were copied (Event ID: 4663) is recorded,
it is possible that a shadow copy was used.

vssadminIf the following log is in the event log, it is considered that a shadow copy was created.
- The Event ID 8222 is recorded in the event log "Security".
*Additionally, if a log indicating that files under C:\Windows\NTDS, which cannot be normally read, were copied (Event ID: 4663) is recorded,
it is possible that a shadow copy was used.

net user- The Event ID 4720 is recorded in the event log "Security".

Capturing Active Directory
Database(Creation of Domain Administrator
or Addition of a User toAdministrator Group)

Adding or Deletinga Local User/Groupnet useFile Sharing

Success or Failure Decision

net share- Source host:If the following log is in the event log, it is possible that file sharing occurred.
- The Event ID 4689 (A process has exited) of net.exe was recorded in the event log "Security" with the execution result (return value) of "0x0".

- The Event ID: 5142 is recorded in the event log "Security".

icacls- The Event IDs: 4688 and 4689 on icacls.exe are recorded in the event log "Security", and the Exit Status in the Event ID: 4689 is set to "0x0".
*Since it is not possible to determine the target files from the Event IDs 4688 and 4689, it is necessary to additionally check the command line of icacls.exe
from the Event ID 1 of sysmon.

sdelete- A file with its name similar to the following was repeatedly deleted.
- Example: sdeleAAAAAAAAAAAAAAAAAAAA.AAA, sdeleZZZZZZZZZZZZZZZZZZZZ.ZZZ when the target to be deleted is sdelete.txt

timestomp- The Event ID: 4663 is recorded in the event log "Security", and the "WriteAttributes" keyword for the target file is set to "Audit Success".

wevtutil- The Event ID: 104 is recorded in each target event log.

csvde

- Source host: csvde.exe was executed and a file specified by the "-f" option was created.
- "C:\Users\[User Name]\AppData\Local\Temp\csv[Random Number].tmp" was created and deleted.

ldifde- Source host: ldifde.exe was executed and a file specified by the "-f" option was created.

dsquery- If the extracted account information is saved, it can be considered that the tool execution was successful.

Deleting Evidence

Deleting Event Log

Acquisition of
Account Information

69

4. Acquiring Additional Logs
This chapter describes the importance of acquiring detailed logs that cannot be obtained with thedefault settings as stated in the findings reported in Chapter 3, and matters that should be taken into
consideration when acquiring additional detailed logs.

4.1.

Importance of Acquiring Additional Logs

This research found that the tools installed by default in Windows leave execution traces ofevidence in event logs, but most tools that are not installed in Windows do not leave execution tracesof evidence anywhere. For example, Remote Desktop Protocol (RDP), a tool for remote login, and
"at",

a

tool

for

schedulingtasks,

leaveevidenceof

execution

in

the

event

logs

Microsoft\Windows\TerminalServices-LocalSessionManager\Operational and Microsoft\Windows\TaskScheduler\Operational, respectively, indicating that the tools have been executed.
Conversely, in an environment where the audit policy is enabled and Sysmon is installed for
acquiring additional logs, evidence of execution of most tools can be acquired. For example, byconfiguring audit policy settings, when a temporary file is created, it can be recorded in the event log.
As a result, if an attacker attempts to collect account information by using "csvde", the temporary filethat is created, C:\Users\[User_Name]\AppData\Local\Temp\csv[Random_Number].tmp, is recordedin the event log. To investigate the execution of tools, these settings need to be configured inadvance to acquire detailed logs.
Note that detailed logs can be acquired with audit software (such as asset management software)without enabling the audit policy and installing Sysmon. When such software monitors the following
Windows OS operations, it can be recorded in a similar manner as in an environment where the audit
policy is enabled and Sysmon is installed:•

Executing processes•

Writing files

4.2.

Precautions When Changing the Additional Log Acquisition Settings

The increase in the amount of logs should be considered in advance when acquiring additional
detailed logs. Because the amount of logs increases when the audit policy is enabled, log rotation
accelerates, and older logs are maintained for a shorter period of time. Therefore, when enabling theaudit policy, consider changing the maximum size of event logs at the same time. The maximum sizeof event logs can be changed with Event Viewer or the "wevtutil" command.
Note that changing the maximum size of event logs may exhaust storage capacity. JPCERT/CC
recommends that storage capacity be evaluated before changing the maximum size of event logs.

70

5. How to Use This Report in Incident Investigation
This chapter describes how this research report can be used in the field of incident investigation
through same examples using the results in Chapter 3 of this report.

5.1.

Incident Investigation Using This Report

Chapter 3 was created on the assumption that it will be used when identifying tools that might be
executed as part of incident investigations. Searching for keywords, such as an event ID and filename of a characteristic event log and a registry entry found during incident investigation, can findout possible tools that were executed.
An incident investigation often starts by checking any suspicious logs in the "Security" event log.
Then, if "Event ID: 4663 (An attempt was made to access an object)" is found for example, it isassumed that there is evidence that the file 192.168.100.100-PWHashes.txt was createdtemporarily (recorded when the audit policy is enabled). Searching Chapter 3 for the distinctive text
PWHashes.txt finds it is a file created when PWDumpX is executed.
Further proceeding with the investigation while referring to Section 3.3.2 finds that "PWDumpX" isa command attackers execute to acquire a password hash. Additionally, the fact that the temporary
file [Destination_Address]-PWHashes.txt was created implies that the attacker had completed the
purpose of acquiring the password hash on the server with IP address 192.168.100.100.
Investigating

theserverwithIP

address

192.168.100.100

explains

that

the

file

C:\Windows\System32\DumpSvc.exe was created and executed, and the fact that the service"PWDumpX Service" was installed is recorded as "Event ID: 7045 (A service was installed in thesystem)." This allows for determining that the attacker acquired the password hash for the IP address
192.168.100.100.
Section 3.16 describes how to verify that each tool was executed. Referring to the section forplanning an investigation strategy in advance of commencing an incident investigation is encouraged
as it shows information recorded by each tool in a list.

71

6. Conclusion
As it is becoming apparent that many organizations have suffered damage due to targeted attacks,
the importance of incident investigations to further examine such damage is increasing. This reportsummarizes and presents evidence suggesting the execution of tools and its corresponding
relationship with tools, which are the key to a successful incident investigation.
Many tools do not leave evidence of having been executed with the default Windows settings,
which may cause incident investigations to remain unsolved. To analyze what the attacker did in
detail, an environment that allows for more logs to be collected than those obtained with the default
settings needs to be prepared in advance.
Under the current circumstances where it is difficult to prevent infiltration of a network, it isimportant to always consider and improve the method for acquiring logs to analyze the amount ofdamage after an incident occurs in order to prevent the spread of damage and review post-incident
security measures. In addition to reviewing and being prepared for responses that are not limited tothe method for acquiring additional logs using Windows standard functionality as shown in this report,
also use other methods that combine the use of audit software or similar. Moreover, JPCERT/CC
recommends that this report be used to identify evidence of tool execution by attackers in the eventof a suspicious incident. JPCERT/CC hopes that this report will be of help in early detection andaccurate response to targeted attacks, which are becoming more sophisticated.

72

7. Appendix A
This appendix describes how to install Sysmon and how to enable the audit policy. Note that it has
been confirmed that setting up the audit policy and installing Sysmon will increase the amount of
event logs. Before enabling the setting and installing the tool, it is recommended to verify its impact.

7.1.
1.

How to Install Sysmon
Download Sysmon from the following site:
https://technet.microsoft.com/en-us/sysinternals/dn798348

2.

Execute the command prompt as a user with administrator privileges and execute thefollowing command:> Sysmon.exe -i* Although adding the option "-n" enables network connection logs to be acquired, network
connection should be dealt with in the audit policy.

7.2.

How to Enable the Audit Policy

The following describes how to enable the audit policy on a local computer. Note that the followingshows settings in Windows 10.
1.

Open the Local Group Policy Editor. (Enter "gpedit.msc" into the [Search] box and execute it.)2.

Select[Computer

Configuration]→[Windows

Settings]→[Security

Policies]→[Audit Policy], and enable "Success" or "Failure" for each policy.

73

Settings]→[Local

3.

Select [Local Disk (C:)]→[Properties]→[Security] tab→[Advanced].

74

4.

On the [Auditing] tab, add an object to be audited.

5.

As shown below, select the user to be audited and access method to be audited.

75

The "Permissions" set here are as follows. (Although recording file read enables a more detailed
investigation, it is excluded as doing so will increase the amount of logs.)
Create files / write dataCreate folders / append dataWrite attributes

Write extended attributes

Delete subfolders and files

Delete

Change permissions



Take ownership

Although configuring the above settings displays many errors as shown below, select "Continue."76

8. Appendix B
This list describes logs recorded by default and other logs recorded by configuring additional settings, including audit policy settings and installation of Sysmon.
The list only contains selected logs that can be used for incident investigation out of all logs that can be acquired.
TargetLog

How to Obtain

Required Setting

Acquirable Log
Identifier
Event Name
104
The System log file was cleared7036

The [Service Name] service entered the[Status] state

Security
7045

A service was installed in the system

20001

Device Installation

8222

Shadow copy has been created4624

An account was successfully logged on4634

An account was logged off

4648

A logon was attempted using explicit
credentials

4656

A handle to an object was requested

4658

The handle to an object was closed

4690

An attempt was made to duplicate ahandle to an object

4660

An object was deleted

4663

File System,"An attempt was made toaccess an object

4661

A handle to an object was requested

4672

Special privileges assigned to new logon

4673

A privileged service was called

Detailed tracking> Auditing of processcreation

4688

A new process has been createdDetailed tracking> Auditing of process
termination

4689

A process has exited

4720

A user account was created4726

A user account was deleted

Recorded by default Windows settings

SystemLogon/Logoff> Auditing of Logon

Object access> Auditing of handle
operations

Common to All

Windows Log

Object access

Security(audit policy)

Enable each audit. Auditing of afile system additionally requires
Object access
SACL settings. Each log is> Auditing of SAM
saved in "Windows Log >Security".

Use of special privileges

Account management> Auditing of user accountmanagement

77

Overview
Clearing of logs

Main Information That Can Be Acquired- The cleared log channel

A change of the service state- Service name(the same ID for execution and stop) - State- Service name- Executable file nameInstallation of a service- Service type
- Startup type
- Service account- Device instance ID
Installation of a device driver- Driver name- Success or failure- Account name, domain- UUID of a shadow copy
Creation of a shadow copy
- Computer name- Source of a shadow copy
- Created shadow device name- Security ID- Account name, domain- Logon ID
Used for association with other event logs
- Logon typeThe main logon types include 2 = Local
Interactive, 3 = Network, and 10 =Account logon
Remote Interactive- Process ID- Process name- Login source: Workstation name, source
network address,
source port
- Authentication method: Authentication
package- Security ID- Account name, domain
Account logoff- Logon ID- Logon type- Executing account information: Subject:- Security ID- Account name, domain- Logon ID- Account whose credentials were used
- Account name, domain- Target server
A specified logon attempt by a
- Target server nameparticular account- Process information- Process ID- Process name
- Network information- Network address- Port- Account name, domain- Handle object: Object nameA handle request for reading or- Handle ID
writing an object
Used for association with other event logs
- Process ID- Process name- Account name, domain
Ending the use of and releasing of a - Handle ID
handle- Process ID- Process name- Account name, domain- Source handle ID
Duplication of an existing handle for- Source process ID
use in other processes- Source handle ID- Source process ID- Account name, domain- Handle ID
Deleting an object- Process ID- Process name- Account name, domain- Logon ID- Object name
Access made to an object- Handle ID- Process name- Process ID- Requested processing- Account name, domain- Handle object: Object nameA handle request to SAM- Handle ID(Acquirable information
Used for association with other event logs
is the same as that of- Process ID
the event 4656)- Process name- Security ID
Assignment of special privileges to a - Executing account name, domain
particular logon instance- Logon ID- Assigned special privileges- Security ID- Account name, domain
Execution of a process requiring- Service nameparticular privileges- Process ID- Process name
- Used privileges- Account name, domain- Process ID- Process nameStartup of a process- Presence of privilege escalation: Token
escalation type
- Parent process ID: Creator process ID- Account name, domain- Process ID
Process termination- Process name
- Return value: Exit status- Executing account information: Subject:- Security ID- Account name, domain- Logon ID
Account creation- Information on the account to be added: New
account:- Security ID- Account name, domain- Other attribute information- Executing account information: Subject:- Security ID- Account name, domain- Logon ID
Account deletion- Information on the account to be deleted:
Target account:- Security ID- Account name, domain

TargetLog

How to Obtain

Required Setting

Identifier

Acquirable Log
Event Name

4728

A member was added to a securityenabled global group4729

A member was removed from a securityenabled global group

Account Logon> Auditing of the Kerberos
authentication service

4768

A Kerberos authentication ticket (TGT)
was requested

Account logon> Auditing of Kerberos
service ticket operations

4769

A Kerberos service ticket was requested

Policy change> Auditing of a change in
the MPSSVC rule level
policy4946

A change was made to the Windows
Firewall exception list. A rule was added.

Account management> Auditing of security groupmanagement

5140

Windows Log(Continued
from theprevious entry)

Security(audit policy)(Continued from theprevious entry)

ditto

Object access> Auditing of file sharing
5142

5144
Common to All(Continued
from theprevious entry)

Object access> Detailed auditing of filesharing

5145

5154
Object access> Auditing of Filtering
Platform connections
5156

1

SysmonApplication and service log
Downloaded from the Microsoft> Microsoft
website> Windows
https://technet.microsoft.com/en> Sysmon-us/sysinternals/bb842062.aspx> Operational

5

8

106

Application andServiceat200
Microsoft> Windows> TaskScheduler> Operational

129

201
102

Overview

Main Information That Can Be Acquired- Executing account information: Subject- Security ID- Account name, domain- Logon ID
Addition of a member to a group- Target user: Member(used when a member has been
- Security ID
added to a group on the domain)- Account name- Target group: Group- Security ID- Group name
- Group domain- Executing account information: Subject- Security ID- Account name, domain- Logon ID
Removal of a member from a group- Target user: Member(used when a member has been
- Security ID
removed from a group on the- Account namedomain)- Target group: Group- Security ID- Group name
- Group domain- Account name, domain- Security ID
An authentication request for an- Source address, source port
account- Ticket option- Return value- Account name, domain, logon ID
An access authentication request for - Service name, service ID
an account- Client address, port
- Ticket option
Addition of a Windows Firewall rule

- Profile- Target rule name- Security ID- Account name, domain- Logon ID
A network share object was accessed
Access to network share- Source address, source port
- Share name- Share path
- Requested process- Security ID- Account name, domain
A network share object was added
Creation of a new network share- Share name- Share path
- Security ID- Account name, domain
A network share object was deleted
Deletion of a network share- Share name- Share path
- Security ID- Account name, domain
A network share object was checked to
Confirmation of whether a file share - Logon ID
see whether client can be granted desired
point can be used
- Source address, source port
access- Share name- Share path, relative target name- Process ID
The Windows Filtering Platform has
Port listening by an application or- Process namepermitted an application or service toservice- Address, port
listen on a port for incoming connections- Protocol number- Process ID
Whether a connection is allowed by- Process namethe Windows Filtering Platform
The Windows Filtering Platform has- Direction (outbound, inbound)(Windows Firewall)
permitted a connection- Source address, source port
(if rejected, a different Event ID- Destination address, destination port
(5152) will be recorded)- Protocol number- Process start date and time: UtcTime- Process command line: CommandLine
The option passed to the executable fileis recorded.
Process Create
Startup of a process
If an IP address or user name of anotherhost is specified in the option, it is possible
to read it from here.
- User name: User
- Process ID: ProcessId- Process end date and time: UtcTime
Process TerminatedProcess termination- Process ID: ProcessId- Thread creation date and time: UtcTime- Caller process ID: SourceProcessId
Creating a new thread from another
CreateRemoteThread detected- Caller process name: SourceImage
process- Callee process ID: TargetProcessId- Callee process name: TargetImage- Executing account name, domain
Task registered
Registration of a new task
- Created task name- Task name
Action started
Execution of a task
- Executed operation- Task nameCreated Task Process
Process executing in a task
- Process ID- Executed process- Task nameTermination of a process executed in
Action completed- Terminated processa task- Return value- Executing account name, domain
Task completed
Termination of a task
- Task nameRecorded by default Windows settings
WinRM /WinRS

RDP

Microsoft > Windows> Windows Remote
Management >Operational

Microsoft > Windows> TerminalServices>
LocalSessionManager > Operational

6

Creating WSMan Session

Creation of a new session- Destination host name

169

User authentication： authenticatedsuccessfully

User authentication： authenticatedsuccessfully- User name, domain

21

Remote Desktop Services: Session logon
New logon via RDP
succeeded- Session connection start date and time
- Executing account name, domain- Source network address

24

Remote Desktop Services: Session has
been disconnected- Session connection start date and time
- Executing account name, domain- Source network address

78

Disconnection of an RDP session

Detecting Lateral Movement through Tracking Event Logs

Index

A

N

AT ........................................................................... 23

net share ................................................................. 59
net use..................................................................... 58

B

net user ................................................................... 57

BeginX .................................................................... 18

ntdsutil ..................................................................... 55

BITS ........................................................................ 25PCPowerShell .............................................................. 14

csvde ...................................................................... 64

PsExec .................................................................... 11
PWDump7 ............................................................... 26

D

PWDumpX............................................................... 27

dsquery ................................................................... 67

Q
F

Quarks PwDump ..................................................... 29

Fake wpad .............................................................. 40

R

Find-GPOPasswords.ps1 ....................................... 35

RDP ......................................................................... 42

G

Remote Desktop PassView ..................................... 38

gsecdump ............................................................... 33SH

SDB UAC Bypass .................................................... 48

Htran ....................................................................... 39

sdelete ..................................................................... 61

I

T

icacls ....................................................................... 60

timestomp ................................................................ 62LV

ldifde ....................................................................... 66

vssadmin ................................................................. 56

lslsass ..................................................................... 34

W
M

WCE .................................................................. 32, 43

Mail PassView......................................................... 36

WebBrowserPassView ............................................ 37

Mimikatz.......................................... 30, 31, 45, 52, 54

wevtutil .................................................................... 63

MS14-058 Exploit ................................................... 46

WinRM..................................................................... 19

MS14-068 Exploit ................................................... 50

WinRS ..................................................................... 21

MS15-078 Exploit ................................................... 47

wmic ........................................................................ 13
wmiexec.vbs ............................................................ 16

79

JPCERT/CC will not be liable for any loss or damage that may arise from any information
contained in this document.

80