# Revisiting the Detection of Lateral Movement through Sysmon
## 6 Methodology
### Credential Exploitation Attacks
#### 6.2.4. Discussion on Mimikatz-Related Attacks
Regarding _DNSEvents_, 80 logs were collected by _Sysmon_ with _\"EventField: Image::.../PSEXEC.exe\"_ and _\"QueryName: sysmon_set\"_ as the domain's name, all revealing potential domain exfiltration for stored hashes and passwords with Mimikatz. ```
1<ProcessCreateomatch=\"include\">
2<CommandLinename=\"PrivilegeEscalation\"condition=\"contains\">Get-Keystrokes</CommandLine><!- keylogging or keyboard capturing, in the action of logging keys pressed, time and the active window. -->
3<CommandLinename=\"PrivilegeEscalation\"condition=\"contains\">Get-TimedScreenshot</:- Takes screenshotts and saves them to a folder, with a timestamp to reveal the time and date of the screenshot. -->
4<CommandLinename=\"PrivilegeEscalation\"condition=\"contains\">Get-VaultCredential</CommandLine><!- Displays Windows vault credential objects including cleartext web credentials. -->
5<CommandLinename=\"PrivilegeEscalation\"condition=\"contains\">Invoke-CredentialIncjection</CommandLine><!- Displays Windows vault credential objects including cleartext web credentials. -->
6<CommandLinename=\"PrivilegeEscalation\"condition=\"contains\">mimikatz</CommandLine><!- Mimikatz is an open-source application that allows users to view and save Kerberostickets and hashes. -->
7</ProcessCreate>
```  
Listing 3: Privilege escalation ProcessCreate rules. To make the collected features as generic as possible, two more interventions were implemented in the targeted server. The former is related to the activation of the _\"WDigest\"_ authentication and the latter with enabling _\"Manages Microsoft Base Smart Card Crypto\"_ capability. As it concerns _WDigest_, if enabled, it forces _lass.exe_ to store on the system's memory user-related passwords in plaintext form. On the other hand, when _Smart Card Crypto_ capability is enabled, it makes _LSASS_ store the NT hash dedicated to each user along with the unique key of the card itself. Both events were captured by _Sysmon_ as _Event ID 13 (RegistryEvent (Value Set))_, with _\"Image: C:/WINDOWS/tregedit.exe\"_ and _\"TargetObject: HKLM/SYSTEM/CurrentControlSet/Control/SecurityProviders/WDigest\"_, _\"TargetObject: HKLM/SOFTWARE/Microsoft/Cryptography/Defaults/Provider/Microsoft Base Smart Card Crypto Provider\"_, respectively. Many rules have also been _excluded_, meaning that they were filtered continuously until their rule was matched. Most of the time, these are common Windows OS processes that should be excluded to avoid causing unwanted noise to the _Sysmon_ event filtering. _Mimikatz's DLL Analysis:_ In addition to the _rule-based EDR_ policy proposed, log analysis was taken further to the identification of the DDL information that was transferred during the Mimikatz execution. The captured DLLs were included within the collected 60,000 System logs that were taken during the extraction of the NTLM hashes, the exploitation of PtH, PtT, GT, and ST attacks. According to the authors in [10], even though adversaries tend to rename or even rebuild malicious applications such as Mimikatz, the existence of legitimate DLLs, which are loaded together with the aforesaid tool, may give great insight regarding the uniqueness of the DLL relationship between distinct editions of Mimikatz and Windows OS, leading eventually to a robust and effective proactive identification of LM. Specifically, 3500 _DLL files_ (\(\approx\) 6% of the total log record corpus) were identified over the 60,000 logs; however, only 460 of them (\(\approx\)13%) were related to _Minitkatz_.