# Revisiting the Detection of Lateral Movement through Sysmon
## 6 Methodology
### Credential Exploitation Attacks
#### 6.2.4. Discussion on Mimikatz-Related Attacks
In addition, through Sysmon's log traffic observation, and due to the nature of the three executed Kerberos ticket attacks, the identified number of \(\approx\)360 _Event ID 11_ (_FileCreate_) can be considered a strong indicator of the Kerberos _TGT_ ticket exploitation of _.kirbi_ extension files. Moreover, the presented research was extended to identify extra features for each specified attack vector in isolation. Remotely executable tools were identified as applicable to the process of compromising the targeted server and the successful acquisition of administrative rights, namely _klist.exe_, _minikatz.exe_, _lazagne.exe_, _psexec.exe_, _smb.exe_, as shown in Listing 2. These tools are strongly related to the extraction of _NTLM hashes_ and _TGT tickets_, which follow the privilege escalation phase. Moreover, with reference to Listing 2, _klist.exe ProcessCreate_ was included as one of the most obvious proofs of the execution of Kerberos tickets related to LM, namely PtH, Ptf, GT, and ST. Specifically, _\"klist.exe\"_ is an executable Windows command line that prints a list with the most recently cached Kerberos tickets. It should be noted that for _\"klist\"_, as for most aforesaid executables, administrative privileges come as a prerequisite. ```
1<ProcessCreateomatch=\"include\">
2<CommandLinecondition=\"contains\">C:\Windows\system32\Isass.exe</CommandLine><t-. Possible indication for the execution of the Lateral Movement Skeleton Key Attack ->
3<CommandLinecondition=\"contains\">C:\Windows\system32\smb.exe</CommandLine>
4<ParentCommandLinecondition=\"is=\">lazagne.exewindows</ParentCommandLine>
5<CommandLinecondition=\"is=\">C:\[PERSON]\Administrator\mimikatz.trunk\x64\mimikatz.exe</. CommandLine>
6<Imagename=\"lasesProcessCreate\"condition=\"is\">C:\Windows\system32\Isass.exe</. Image>
7<Imagename=\"svchostProcessCreate\"condition=\"is\">C:\Windows\system32\svchost.exe</. Image>
8<Imagename=\"ProcessCreate\"condition=\"endwith\">smb.exe/Image>
9<Imagename=\"MimikatzExecution\"condition=\"is\">C:\[PERSON]\Administrator\mimikatz.trunk\x64\mimikatz.exe/.Image>
10<Imagename=\"lazagne\"condition=\"is\">C:\[PERSON]\Administrator\Download\lazagne.exe</. Image><... The LaZagne project is an open source application used to retrieve lots of passwords stored on a local computer. ->
11<Imagename=\"klist\"condition=\"is\">C:\Windows\system32\klist.exe</Image>
12</ProcessCreate>
```  
Listing 2: The lsass.exe \"include\" rule related to the executed tickets attacks. As concerns privilege escalation techniques, _Event ID 1 ProcessCreate_ rules were the most extensively identified during the execution of LM. Precisely, the _CommandLine EventFields_ presented in Listing 3, comprise the identification of _keylogging_ or _keyboard capturing_ (_\"Get-Keystrokes\"_), the capturing of screenshots from the targeted machine (_\"Get-TimedScreenshot\"_), and the extraction of cleartext credential Windows objects (_\"Get-VaultCredential\"_, _\"Invoke-CredentialInjection\"_). Further, the aforesaid executables refer to _PowerShell_ Windows modules, which can be executed during the target's enumeration and privilege escalation phases, within the context of a penetration test or a real-life LM. In addition, the possibility of the execution of credential extraction and manipulation attacks via _PsExec_ as an escalation of one of the aforementioned exploitations of remote services operations revealed the importance of _Event ID 3 NetworkConnection_ and _Event ID 22 DNSEvent_ (_DNS query_) events. Regarding the former, 150 logs were collected as related to successful remote connections via the RDP protocol (_\"C:/Windows/PSEXESVC.exe\"_ (_EventField: Image_)\") and also associated with the source and destination IP addresses of the attacker's machine and the targeted server host, respectively (SourceIP: 192.168.1.11, DestinationIP: 192.168.1.8, as presented in Table 2).