Investigating Persistence and Lateral Movement Using Windows Event Logs

Attackers must maintain their foothold in the victim's environment to not repeat all infection phases again and they must keep pivoting in the victim's environment to search for sensitive data and high-value systems. As an SOC analyst and incident responder, you must be aware of the common persistence and lateral movement techniques used by attackers and be able to detect and investigate them by analyzing the event logs provided by Microsoft.

The objective of this chapter is to teach you common persistence and lateral movement techniques. You will also be able to investigate such activities by analyzing the recorded event logs on both the source and the target systems.

In this chapter, we will cover the following main topics:

• Understanding and investigating persistence techniques
• Understanding and investigating lateral movement techniques

Let’s get started!

Important...

Understanding and investigating persistence techniques

Persistence is the way that malware authors (attackers) maintain their access to a compromised system even after the system changes, such as by rebooting, logging off, or credential change. To achieve persistence, attackers follow several methods and techniques, such as creating an account, adding a malware path to registry run keys, installing a service, creating a scheduled task, or developing a WMI consumer.

In this section, we will explain some of the persistence techniques and how to investigate them by using the Windows event logs. To do so, we will first explain the persistence technique and then analyze the recorded Windows event logs that allow us to investigate such activities.

We will divide this section into four subsections; each subsection explains a specific persistence technique and the analysis of Windows event logs that help us to investigate related activities:

• Registry run keys
• Windows scheduled...

Understanding and investigating lateral movement techniques

Lateral movement refers to the techniques that an attacker conducts after gaining initial access to a system and discovering the victim's network, to pivoting from the compromised machine to another machine in the same network to search for sensitive data and high-value systems. To move from one machine to another, the attacker must use one of several lateral movement techniques, such as the remote desktop application, PowerShell remoting, the PsExec tool, remote admin share, or creating a remote service or scheduled task. In this section, we will discuss these lateral movement techniques and how to investigate them, by analyzing the Windows event logs recorded on both source and target machines.

In this section, we will deep dive into the following list of lateral movement techniques:

• Remote Desktop application
• Windows admin shares
• The PsExec Sysinternals tool
• PowerShell remoting

Remote...

Summary

In this chapter, you learned about persistence techniques such as registry run keys, Windows scheduled tasks, Windows services, and WMI event subscription. You also learned how to investigate any suspicious persistence entries by analyzing Windows event logs. Also, you learned about lateral movement techniques, such as Remote Desktop application, Windows admin shares, the PsExec Sysinternals tool, and PowerShell remoting, and you learned how to investigate such activities by analyzing the Windows event logs recorded on both source and target machines.

In the next chapter, we will learn how to analyze network firewall logs.