# Revisiting the Detection of Lateral Movement through Sysmon
## 6 Methodology
### Exploitation of Remote Services
#### 6.1.3 Deployment of WannaCry  
In addition to the two aforementioned versions of the _\"Exploitation of Remote Services\"_ attack, the well-known _WannaCry_ ransomware was propagated deliberately to the VMs of the testbed. To assist the expansion of the malware, server's UAC was disabled remotely with the use of the _smhexec 2.0_ tool. The latter is a post-exploitation tool, which, among the many disabling UAC, is particularly useful for malware establishment on a network host. WannaCry was downloaded from GitHub and used to infect the Windows Server 2019 VM. After the exploitation of the EternalBlue vulnerability, WannaCry encrypted every file in the targeted server, displaying a message demanding payment in Bitcoin. At the same time, _Wireshark_ has been used to capture the network activity. As expected, after the VM's infection, a mass packet exchange started, demonstrating unknown packets to the proposed testBed IP addresses, such as 89.163.210.241 and 34.107.221.82.  
_Discussion:_ Regarding the _WannaCry_ spread on the targeted server, _\"ProcessCreation\"_ and _\"ProcessChanged\"_ events (_Event IDs 1 and 2_) were identified as the most relevant to the target's infection, representing more than 40% (or 12,000 logs) of the logging activity during the execution of the experiments. Specifically, both events are generated when a _Process_ alters a file and do not constitute an indication of malicious activity when used in isolation. However, when combined with a number of factors, namely _CommandLine_, _CurrentDirectory_, _Hashes_, _ParentImage_, _Parent_ and _CommandLine_ rules, they form an effective data-driven proactive detection mechanism towards the identification of _WannaCry_ expansion. With reference to the identified processes after the deliberate execution of _WannaCry_, _Wcry.exe_ and _tasksche.exe_ were isolated as the most relevant logs to the attack, along with their _path_ and _ProcessID 3024_. On the other hand, the execution of the _Wcry.exe_ process generated a number of interrelated _\"r.wury\"_ executables. Precisely, those files are generated during the decryption of the infected files and after the ransom's payment in bitcoin through the \"_s.wnry_\" file. The _\"tasksee.exe\"_ process was identified as a _ProcessCreation_ log that was also created by _Wcry.exe_ for reasons of Windows RDP sessions enumeration, whereas _\"taskdl.exe\"_ was also created for file encryption with the _\".WNCRYT\"_ extension. The creation of the _\".wnry\"_ and _\"u.wnry\"_ files was also identified as generated by _Wcry.exe_ for reasons of AES encryption and decryption, respectively. Malware spreading behavior produced two more log categories, namely \"attrib.exe\" and \"iacals.exe\", which are related to the execution of commands altering the attributes of the targeted files. The former is related to the malware's tendency to hide the infected files, whereas the latter grants administrative access to all the directories and sub-directories. Regarding the above-mentioned behavior, there were 12,000 (or \(\approx\)40%) \"ProcessCreation\" and \"ProcessChange\" Sysmon's event-logs, and 3258 (or \(\approx\)11%) were identified as exclusively related to the WannaCry infection.