# Revisiting the Detection of Lateral Movement through Sysmon
## 6 Methodology
### Credential Exploitation Attacks
#### 6.2.4. Discussion on Mimikatz-Related Attacks  
From an attacker's perspective, during PtH execution, a recognizable number of more than 1500 (or 2.5% of the total log file) _ProcessAccess_ event logs (_Event ID 10_) were identified as the most pertinent to Mimikatz-related attacks of Section 6.2. Specifically, the aforesaid activity is related to the unauthorized access in the _Windows LSASS_ process by the adversary with Mimikatz (as in this paper) or any other dumping tool of password and hashes. As shown in the fourth column of Table 2, the log activity analysis revealed a significant number of Sysmon's _\"EventFields\"_ related to _Event ID 10_ events. Specifically, _lssss.exe_ (_\"EventField: TargetImage\"_) executable was the most prominent, with 600 out of 1500 identified logs due to the repeated execution of the attack and exploitation of the _LSASS_ process through _NTLM hash dumping_. It is important to note that the identified activity of _LSASS_ accessing was executed in parallel with an equal number of elevated privileges on access granting events, with _0x1010_ and _0x1410_ identifiers (_\"EventField: GrantedAccess\"_). The limited presence of three more _\"GrantedAccess\"_ identifiers was also perceived, namely _0x1438(a)_, _0x1 FFFF_ and _0x143a_, all scattered throughout 50 _Event ID 10_ events out of the 600 logs. Above that, a number of \(\approx\)600 _mimikatz.exe_ executable processes (_\"EventField: SourceImage\"_) with _\"TargetProcessId\"_ equal to 492 were identified in combination with \(\approx\)200 powershell.exe and cmd.exe instances. Note that the aforesaid features in isolation do not guarantee the identification of PtH; however, in combination, they could be considered the springboard of the overall process of unveiling the _\"sekurlsa\"_ module of the Mimikatz-related credential theft techniques presented in this section. Overall, we consider that the application of the hitherto recognized _PtH-related_ rule-based features is fully compatible to be extended in _PtT_, _GT_, and _ST_ attacks. This conclusion emerges from the study of each attack's functionality presented in this section. Specifically, _PtH_ is based on the successful extraction of _NTLM hashes_, which are used via the _\"sekurlsa:pth\"_ module of Mimikatz to pass the hash and acquire a legit and stealth access to the targeted system. On the other hand, PtT is strongly related to the extraction of TGT tickets in _.kirbi_ files, and their utilization of authenticating as a legitimate user. As in PtH, PtT also leverages Mimikatz's _\"sekurlsa\"_ module to pass the ticket to the target. Moreover, the GT and ST techniques comprise both NTLM hash dumping techniques and TGT ticketforging for the creation of the migrated Golden and Silver passed tickets. Summing up, in terms of the common behavior and operation of the three aforementioned attacks, the rule-based policy proposed for the PH attack finds scope in them as well. Despite the vast existence of _ProcessAccess_ events (_Event ID 10_) related to the abuse of the _lasss.exe_ process, another 3200 events with _Event ID 1_ (_ProcessCreation_), _ID 5_ (_ProcessTermination_) and _ID 11_ (_FileCreate_) stood out in the collected Sysmon's logs. Precisely, the events with _IDs 1_ and \(5\) were exclusively related to [PERSON]'s execution in the targeted system, either via _psexec_ or _Metasploi_. On the other hand, events described with the _\"FileCreate\"_ rule flag were captured by Sysmon during the extraction with [PERSON] of all the Kerberos tickets into a specified folder to be used for the final exploitation of Kerberos tickets in Ptf, GT, and ST attacks. The identification of the _.kirbi_ extension in the filenames (_EventField: TargetFilename_) of the extracted files is the most obvious indication of the existence of tickets related to the Kerberos protocol. Among the aforesaid 3200 logs, the majority (or \(\approx\)2400) was flagged by the _\"TargetFilename\"_ rule.