“A junior SOC analyst on duty has reported multiple alerts indicating the presence of PsExec on a workstation. ”
A junior SOC analyst on duty has reported multiple alerts indicating the presence of PsExec on a workstation. They verified the alerts and escalated the alerts to tier II. As an Incident responder, you triaged the endpoint for artifacts of interest. Now, please answer the questions regarding this security event so you can report it to your incident manager.
Easy - DFIR
Let's use the Windows Pwnbox for this challenge. Before starting, we will parse all available artifacts using Eric Zimmerman's tools. There's prefetch files, MFT files, and Windows Event Logs.
To parse prefetch files, we will use PECmd:
To parse MFT related files, we will use MFTECmd. We should run this in a PowerShell terminal with admin privileges:
Finally, we will use EvtxECmd to parse all Windows Event Logs:
PS C:\Users\hiramf0\Downloads\EvtxECmd\EvtxeCmd> .\EvtxECmd.exe -d "C:\Users\hiramf0\Downloads\tracer\Tracer\C\Windows\System32\winevt\logs" --csv "C:\Users\hiramf0\Desktop\Artifacts" --csvf evtx-logs
...We will be using Timeline Explorer to analyze the created .csv files.
- The SOC Team suspects that an adversary is lurking in their environment and are using PsExec to move laterally. A junior SOC Analyst specifically reported the usage of PsExec on a WorkStation. How many times was PsExec executed by the attacker on the system?
At first, I tried using Timeline Explorer to find all instances of PSEXESVC.EXE that had been executed in the system, but the answer wasn't correct (8):
I also tried looking for PSEXESVC.exe mentions in the Windows Event Logs by filtering for Sysmon Event ID 1 logs, but I only found two logs mentioning it:
Going back to the Prefetch files themselves, I decided to analyze the single Prefetch file related to PSEXE using PECmd.exe:
- What is the name of the service binary dropped by PsExec tool allowing attacker to execute remote commands?
Event ID 7045 is created when new services are created in a local Windows machine (source). Let's filter for this Event ID inside our evtx-logs.csv file within Timeline Explorer to find any new services created that are related to PsExec:
- Now we have confirmed that PsExec ran multiple times, we are particularly interested in the 5th Last instance of the PsExec. What is the timestamp when the PsExec Service binary ran?
When we executed PECmd.exe against the prefetch file related to PsExec, we also received all timestamps related to the execution of the service:
- Can you confirm the hostname of the workstation from which attacker moved laterally?
During the middle of my investigation, I found this resource which provides us with a methodology on how to detect PsExec. One relevant bit of information is mentioned here that will help us find the hostname of the machine:
Looking at the USN journal obtained from $J, we can find these .key files being created and mentioning the hostname of the machine:
- What is full name of the Key File dropped by 5th last instance of the Psexec?
Looking at the key files inside the USN journal, we can correlated with the timestamp from the 5th last instace of PsExec (around 12:06:54) to find which key file corresponds to that instance:
- Can you confirm the timestamp when this key file was created on disk?
This timestamp is visible under the Update Timestamp field.
- What is the full name of the Named Pipe ending with the "stderr" keyword for the 5th last instance of the PsExec?
Sysmon uses Event IDs 17 (Pipe created) and 18 (Pipe connected) for pipe-related events. Using Event ID 17 and filtering for the stderr keyword, we can look for the pipe created for the 5th last instance of PsExec based on a timestamp:
