Effective Threat Investigation for SOC Analysts by Mostafa Yahia

Author:Mostafa Yahia
Language: eng
Format: epub
Publisher: Packt
Published: 2023-11-15T00:00:00+00:00

Target machine event logs

Like all lateral movement techniques, the most valuable event log artifacts of PowerShell remoting are recorded on the target machine. The first recorded event is event ID 4624, which records successful authentication to the target system with logon type 3. The event provides valuable information, such as the login account and the source workstation name and IP. Then, event ID 4688 logs and records the execution of the wsmprovhost.exe process, which is the process of the Windows Remote PowerShell session when using the WinRM service.

The wsmprovhost.exe process executes on the target system to receive the entered commands from the source machine’s PowerShell process, for execution on the target system. To effectively monitor and trace these actions, we leverage event ID 4688 to track any command executed or process spawned from the wsmprovhost.exe process on the target system (see Figure 7.21).

Download

Copyright Disclaimer:
This site does not store any files on its server. We only index and link to content provided by other sites. Please contact the content providers to delete copyright contents if any and email us, we'll remove relevant links or contents immediately.