Lateral movement telemetry: identifying remote execution traces

// Introduction

When an attacker moves laterally within a network, the traces they leave behind are often subtle but detectable. Understanding these artifacts is key for effective incident response and threat hunting. This post dissects the telemetry left by common remote execution techniques, focusing on PowerShell and WMI, and outlines how to identify them.

// PowerShell Remoting

PowerShell Remoting is a common method for lateral movement. When a remote command is executed, it generates specific log entries that can be pivotal in tracking malicious activity.

Key Logs to Monitor

• Windows Event Logs: Look for Event ID 4103 (PowerShell). This indicates that a command was executed remotely.
• Security Event Logs: Event ID 4624 (An account was successfully logged on) can indicate the use of credentials for accessing another system.

Example Command for Remote Execution

To execute a command on a remote host:

Invoke-Command -ComputerName TargetPC -ScriptBlock { Get-Process }

This command retrieves running processes from TargetPC. The logs generated from this execution will show up in the central event logs.

Log Analysis

Here are example entries you might find in the event logs:

LogName: Security
Source: Microsoft-Windows-Security-Auditing
Date: 2023-07-20 10:25:00
EventID: 4624
...User: DOMAIN\User
...Workstation Name: TargetPC

The Workstation Name field indicates the machine from which the remote execution was initiated. Pay attention to unusual user accounts or workstations.

// WMI as a Lateral Movement Technique

Windows Management Instrumentation (WMI) can also be misused for lateral movement. The WMIC command can be used to remotely execute processes on other systems.

Example WMIC Command

To execute a command using WMI:

wmic /node:TargetPC process call create "cmd.exe /c whoami"

This command runs whoami on TargetPC and can be logged similarly in the Security Event Logs.

WMI Log Traces

WMI activity can be tracked through:

• Event ID 5858: This event indicates that a WMI query was executed.
• Event ID 5861: Indicates a WMI method call was executed.

Example WMI Log Entry

LogName: Security
Source: Microsoft-Windows-Security-Auditing
Date: 2023-07-20 10:30:00
EventID: 5861
...User: DOMAIN\User
...TargetInstance: 

The TargetInstance field can provide additional context on what was executed remotely, including parameters passed.

// Common Pitfalls and Mistakes

Be aware of the potential for noise in your logs. Not every instance of PowerShell or WMI execution is malicious. False positives can arise from:

• Automated monitoring tools that use PowerShell for legitimate purposes.
• Scheduled tasks that execute scripts using WMI.

Checklist for Identifying Malicious Activity

• Cross-reference user accounts with known baselines for unusual behavior.
• Validate the timing of execution against typical usage patterns for the environment.
• Look for remote execution commands from atypical hosts or accounts.

// Defensive Implications

With the knowledge of what to watch for, consider the following defensive strategies:

• Harden PowerShell: Implement logging and constrained language modes to limit what PowerShell can do.
• WMI Filtering: Use Group Policy to restrict WMI access to trusted users and systems.
• SIEM Correlation Rules: Develop and deploy correlation rules within your SIEM to raise alerts on suspicious patterns detected in the logs.

Suggested SIEM Query Example

For a SIEM, consider a query like:

SELECT * FROM SecurityEvent
WHERE EventID IN (4103, 4624, 5858, 5861)
AND TimeGenerated > NOW() - INTERVAL 1 DAY
AND (User NOT IN ('admin', 'service-account'))

This query retrieves remote execution events while ignoring known, legitimate accounts.

// Conclusion

Detecting lateral movement requires an understanding of the telemetry generated by remote executions. By monitoring PowerShell and WMI logs, you can uncover unauthorized activities effectively. Always test your detection capabilities in a controlled environment to refine your approach.

The techniques discussed here belong in a disposable lab environment you own. DaemonCore Academy’s curriculum is free for further exploration.