# Part 4

## 🚨 **Exploitation of Remote Services**

***

### 🔍 **1. Attack Breakdown**

#### 📝 **What is Exploitation of Remote Services?**

* **Exploitation of Remote Services** occurs when attackers **abuse vulnerabilities in remote services** (e.g., RDP, SMB, SSH, FTP) to gain unauthorized access to systems.
* Common remote services targeted include:
  * **Remote Desktop Protocol (RDP)**
  * **Server Message Block (SMB)**
  * **Secure Shell (SSH)**
  * **Telnet**
  * **FTP**

#### 📑 **Why Attackers Exploit Remote Services?**

* **Initial Access:** Gain foothold on a target system.
* **Privilege Escalation:** Exploit misconfigurations or weak credentials.
* **Persistence:** Maintain long-term access.
* **Lateral Movement:** Move across systems within the network.
* **Data Exfiltration:** Steal sensitive information.

#### 📌 **Common Exploited Services and Techniques**

| **Service** | **Common Exploitation Techniques**                             | **Example Tools**        |
| ----------- | -------------------------------------------------------------- | ------------------------ |
| **RDP**     | Brute Force, Credential Stuffing, RDP BlueKeep (CVE-2019-0708) | `xfreerdp`, `Hydra`      |
| **SMB**     | EternalBlue (CVE-2017-0144), SMBGhost (CVE-2020-0796)          | `Metasploit`, `Impacket` |
| **SSH**     | Credential Stuffing, Weak Key Exploitation                     | `Hydra`, `CrackMapExec`  |
| **FTP**     | Anonymous Login Exploitation, Directory Traversal              | `Nmap`, `Hydra`          |
| **Telnet**  | Default Credential Exploitation                                | `Hydra`, `Metasploit`    |

***

### 🛡️ **2. Detection Techniques**

#### 📊 **Manual Inspection with PowerShell**

**🕵️ Check Active Remote Sessions**

```powershell
qwinsta
```

**🕵️ Review RDP Connection Logs**

```powershell
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624} | Where-Object { $_.Message -like "*RDP*" }
```

**🕵️ Check for Suspicious SMB Connections**

```powershell
Get-SmbSession | Select-Object ClientComputerName, UserName, SessionId
```

**🕵️ Review Active SSH Connections**

```powershell
netstat -ano | findstr ":22"
```

**🕵️ Identify Failed Login Attempts**

```powershell
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625}
```

***

#### 📊 **Microsoft Defender for Endpoint (MDE) Query (KQL)**

**🕵️ Detect Suspicious Remote Login Attempts**

```kusto
SecurityEvent
| where EventID == 4625
| where AccountName != "defaultaccount"
| summarize FailedAttempts = count() by AccountName, IpAddress
| where FailedAttempts > 5
```

**🕵️ Identify SMB Exploitation Attempts**

```kusto
DeviceNetworkEvents
| where RemotePort == 445
| where ActionType == "ConnectionFailed"
| summarize count() by RemoteIP
| where count_ > 10
```

**🕵️ Monitor RDP Brute Force Attempts**

```kusto
SecurityEvent
| where EventID == 4625
| where LogonType == 10 or LogonType == 7
| summarize FailedAttempts = count() by IpAddress, AccountName
| where FailedAttempts > 5
```

**🕵️ Detect EternalBlue Exploitation Patterns**

```kusto
DeviceProcessEvents
| where FileName contains "ms17-010"
| project Timestamp, DeviceName, FileName, ProcessCommandLine, AccountName
```

**🕵️ SSH Access Attempts**

```kusto
DeviceNetworkEvents
| where RemotePort == 22
| where ActionType == "ConnectionSuccess"
| summarize ConnectionCount = count() by RemoteIP, AccountName
| where ConnectionCount > 5
```

**🕵️ Monitor FTP Connections**

```kusto
DeviceNetworkEvents
| where RemotePort == 21
| where ActionType == "ConnectionSuccess"
| summarize ConnectionCount = count() by RemoteIP, AccountName
```

***

#### 📊 **Event Viewer Logs**

| **Event ID** | **Description**                                   |
| ------------ | ------------------------------------------------- |
| **4624**     | Successful logon.                                 |
| **4625**     | Failed logon attempt.                             |
| **4776**     | The computer attempted to validate credentials.   |
| **4648**     | A logon was attempted using explicit credentials. |
| **4672**     | Special privileges assigned to new logon.         |

**📌 Focus on Event ID 4625:**

* Repeated login failures from a single **IP address**.

**📌 Focus on Event ID 4672:**

* Look for **privileged account logins** from suspicious IPs.

***

### 🕵️ **3. Investigation Techniques**

#### 1️⃣ **Trace Failed Authentication Attempts**

* Analyze failed authentication patterns:

```powershell
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} | Where-Object { $_.Message -like "*RDP*" }
```

***

#### 2️⃣ **Identify Active Remote Sessions**

* List active RDP sessions:

```powershell
qwinsta
```

* Check SMB Sessions:

```powershell
Get-SmbSession
```

***

#### 3️⃣ **Inspect Process Activity Related to Remote Services**

* Look for suspicious processes:

```powershell
Get-Process | Where-Object { $_.Path -like "*Temp*" }
```

***

#### 4️⃣ **Check Open Ports**

* Verify open ports for remote services:

```powershell
netstat -ano | findstr ":3389 :445 :22"
```

***

#### 5️⃣ **Review Suspicious Network Connections**

* Identify remote connections:

```powershell
Get-NetTCPConnection | Where-Object { $_.RemoteAddress -notlike "192.168.*" }
```

***

### 🔧 **4. Remediation Steps**

#### 📌 **1. Terminate Unauthorized Sessions**

```powershell
logoff <SessionID>
```

#### 📌 **2. Disable Unused Remote Services**

```powershell
Set-Service -Name TermService -StartupType Disabled
```

#### 📌 **3. Reset Compromised Accounts**

```powershell
net user Administrator NewP@ssw0rd!
```

#### 📌 **4. Block Suspicious IPs**

```powershell
New-NetFirewallRule -DisplayName "Block Suspicious IP" -Direction Inbound -RemoteAddress <IP> -Action Block
```

#### 📌 **5. Patch Known Vulnerabilities**

* Apply patches for vulnerabilities like **BlueKeep (CVE-2019-0708)** and **EternalBlue (CVE-2017-0144)**.

#### 📌 **6. Enable Network Level Authentication (NLA) for RDP**

```powershell
reg add "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /t REG_DWORD /d 1 /f
```

#### 📌 **7. Perform Full Antivirus Scan**

```powershell
Start-MpScan -ScanType FullScan
```

***

### 🛡️ **5. Prevention Steps**

1. **Disable Unused Remote Services:**
   * Turn off RDP, SMB, FTP, and Telnet if not needed.
2. **Implement Multi-Factor Authentication (MFA):**
   * Add MFA to remote access.
3. **Apply Network Segmentation:**
   * Isolate systems with sensitive remote services.
4. **Use Strong Password Policies:**
   * Enforce complex passwords.
5. **Patch Systems Regularly:**
   * Keep systems updated to prevent exploitation.
6. **Enable Account Lockout Policies:**

```powershell
powershellنسخ الكودnet accounts /lockoutthreshold:5
```

7. **Monitor Service Logs:**
   * Regularly review **Event IDs 4625, 4672, 4648**.

***

### 🧠 **6. Key Takeaways**

* **Remote Services Are Prime Targets:** Monitor RDP, SMB, SSH, and FTP.
* **Patch Known Vulnerabilities:** Keep services updated.
* **Implement Logging and Auditing:** Enable **Event IDs 4625, 4672**.
* **Use Network Segmentation:** Restrict access to critical services.
* **Apply Least Privilege Principle:** Limit admin access on remote services.

***

## 🚨 **File and Directory Discovery: Advanced Threat Analysis**

***

### 🔍 **1. Attack Breakdown**

#### 📝 **What is File and Directory Discovery?**

* **File and Directory Discovery** involves **identifying sensitive files, folders, and directories** on a compromised system.
* Attackers use discovery techniques to:
  * Locate **sensitive data** (e.g., credentials, configuration files).
  * Identify **critical system directories** for further attacks.
  * Determine **backup locations** and **log files**.
  * Plan **data exfiltration paths**.

***

#### 📑 **Why Attackers Use File and Directory Discovery?**

* **Gather Information:** Locate files with sensitive data (e.g., `.env`, `config.xml`, `password.txt`).
* **Privilege Escalation:** Identify configuration files with hardcoded credentials.
* **Persistence:** Locate startup folders for persistence mechanisms.
* **Data Exfiltration:** Identify large or important datasets for exfiltration.
* **Evasion:** Identify antivirus logs or security tools to bypass them.

***

#### 📌 **Common Techniques for File and Directory Discovery**

| **Technique**                  | **Command/Tool Example**                                           | **Description**                        |
| ------------------------------ | ------------------------------------------------------------------ | -------------------------------------- |
| **List Directories**           | `dir /s` (Windows), `ls -R` (Linux)                                | Recursive directory listing            |
| **Search for Sensitive Files** | `find / -name *.env`                                               | Search for specific file types         |
| **Locate Hidden Files**        | `ls -la`                                                           | Reveal hidden files                    |
| **Check Startup Folders**      | `dir C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup` | Identify persistence locations         |
| **System Configuration Files** | `cat /etc/passwd` (Linux)                                          | Extract system user information        |
| **PowerShell Enumeration**     | `Get-ChildItem -Recurse -Force`                                    | Recursive file discovery in PowerShell |

***

#### 📊 **Common Tools Used**

| **Tool**            | **Purpose**                                  |
| ------------------- | -------------------------------------------- |
| **PowerShell**      | Recursive file enumeration                   |
| **CMD (dir)**       | Directory listing                            |
| **Findstr**         | Search within files                          |
| **Find (Linux)**    | Search for files by name or type             |
| **grep (Linux)**    | Search within files                          |
| **Tree**            | Visual directory structure                   |
| **WinPEAS/LinPEAS** | Enumerate sensitive files and configurations |

***

### 🛡️ **2. Detection Techniques**

#### 📊 **Manual Inspection with PowerShell**

**🕵️ Identify Suspicious File Searches**

```powershell
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688} | Where-Object { $_.Message -like "*dir*" -or $_.Message -like "*find*" }
```

**🕵️ Monitor Access to Sensitive Files**

```powershell
Get-ChildItem -Path "C:\Users\*" -Recurse -Include "*.env", "*.xml", "*.config", "*password*"
```

**🕵️ Check Recent File Access**

```powershell
Get-ChildItem -Path "C:\" -Recurse | Where-Object { $_.LastAccessTime -gt (Get-Date).AddHours(-24) }
```

**🕵️ Look for Hidden File Access**

```powershell
Get-ChildItem -Path "C:\" -Hidden -Recurse
```

***

#### 📊 **Microsoft Defender for Endpoint (MDE) Query (KQL)**

**🕵️ Detect Directory Listing Commands**

```kql
DeviceProcessEvents
| where ProcessCommandLine contains "dir" or ProcessCommandLine contains "ls"
| project Timestamp, DeviceName, ProcessCommandLine, AccountName
```

**🕵️ Identify Sensitive File Access**

```kql
DeviceFileEvents
| where FileName matches regex ".*(password|config|credentials|backup).*"
| where ActionType == "FileAccessed"
| project Timestamp, DeviceName, FileName, FolderPath, AccountName
```

**🕵️ Monitor Recursive Directory Scans**

```kql
DeviceProcessEvents
| where ProcessCommandLine contains "-Recurse" or ProcessCommandLine contains "/s"
| project Timestamp, DeviceName, ProcessCommandLine, AccountName
```

**🕵️ Look for Startup Folder Access**

```kql
DeviceFileEvents
| where FolderPath contains "Startup"
| where ActionType == "FileAccessed"
| project Timestamp, DeviceName, FileName, FolderPath, AccountName
```

**🕵️ Track Access to System Configuration Files**

```kql
DeviceFileEvents
| where FileName contains "passwd" or FileName contains "shadow"
| project Timestamp, DeviceName, FileName, FolderPath, AccountName
```

***

#### 📊 **Event Viewer Logs**

| **Event ID** | **Description**                                         |
| ------------ | ------------------------------------------------------- |
| **4688**     | A new process was created (e.g., `dir`, `find`, `grep`) |
| **4663**     | Object access attempt (e.g., file read/write)           |
| **4660**     | An object was deleted                                   |
| **4656**     | A handle to an object was requested                     |

**📌 Focus on Event ID 4688:**

* Look for commands like:
  * `dir /s`
  * `ls -R`
  * `find / -name`
  * `grep password`

**📌 Focus on Event ID 4663:**

* Monitor file access activity:
  * `password.txt`
  * `config.xml`
  * `sensitive_data.zip`

***

### 🕵️ **3. Investigation Techniques**

#### 1️⃣ **Identify Suspicious File Access Commands**

* Search executed commands related to file discovery:

```powershell
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688} | Where-Object { $_.Message -like "*dir*" -or $_.Message -like "*find*" }
```

***

#### 2️⃣ **Trace Process Tree**

* Identify parent and child processes of discovery commands:

```powershell
Get-CimInstance Win32_Process | Where-Object { $_.ParentProcessId -eq <PID> }
```

***

#### 3️⃣ **Inspect Access to Sensitive Folders**

* Check critical directories:

```powershell
Get-ChildItem -Path "C:\Users\*" -Recurse -Include "*.env", "*.xml", "*.config"
```

***

#### 4️⃣ **Identify Recently Accessed Files**

* List files accessed in the last 24 hours:

```powershell
Get-ChildItem -Path "C:\" -Recurse | Where-Object { $_.LastAccessTime -gt (Get-Date).AddDays(-1) }
```

***

#### 5️⃣ **Analyze Command History**

* Inspect PowerShell command history:

```powershell
(Get-PSReadlineOption).HistorySavePath | Get-Content
```

***

### 🔧 **4. Remediation Steps**

#### 📌 **1. Revoke Unnecessary File Permissions**

```powershell
icacls "C:\SensitiveFolder" /inheritance:r
```

#### 📌 **2. Monitor Critical Directories**

* Enable File Integrity Monitoring (FIM).

#### 📌 **3. Quarantine Suspicious Processes**

```powershell
Stop-Process -Name "cmd" -Force
```

#### 📌 **4. Remove Unauthorized Access**

* Disable compromised accounts:

```powershell
Disable-LocalUser -Name "suspiciousUser"
```

#### 📌 **5. Perform Full Antivirus Scan**

```powershell
Start-MpScan -ScanType FullScan
```

***

### 🛡️ **5. Prevention Steps**

1. **Enable File Auditing:**
   * Monitor **Event IDs 4663, 4688**.
2. **Implement Least Privilege Access:**
   * Limit access to sensitive folders.
3. **Monitor Sensitive File Access:**
   * Alert on unauthorized access to files like `password.txt`, `config.xml`.
4. **Disable Command-Line Access for Non-Admins:**
   * Restrict tools like `cmd.exe`, `powershell.exe`.
5. **Use File Integrity Monitoring (FIM):**
   * Detect unauthorized changes to sensitive files.
6. **Educate Users:**
   * Train users to recognize unauthorized file access patterns.

***

### 🧠 **6. Key Takeaways**

* **File Discovery is Often Reconnaissance:** Attackers seek sensitive data before launching further attacks.
* **Focus on Command-Line Patterns:** Commands like `dir /s`, `ls -R`, `find /` are key indicators.
* **Audit Sensitive Folders:** Regularly monitor access and modifications.
* **Implement File Integrity Monitoring (FIM):** Detect unauthorized file access.
* **Enforce Least Privilege Principle:** Restrict file access to only necessary users.

***

## 🚨 **Persistence via Registry Run Keys/Startup Folder**

***

### 🔍 **1. Attack Breakdown**

#### 📝 **What is Persistence via Registry Run Keys/Startup Folder?**

* **Persistence** ensures an attacker maintains access to a compromised system across reboots or interruptions.
* Attackers often use:
  * **Registry Run Keys:** Automatically execute malicious code at system startup.
  * **Startup Folder:** Place malicious files in folders that run programs at user login.

#### 📑 **Why Attackers Use These Techniques?**

* **Stealth:** Blend into legitimate startup processes.
* **Reliability:** Ensure malware executes every time the system reboots.
* **Ease of Access:** Run keys and startup folders are often overlooked in security audits.
* **Flexibility:** Works across Windows versions and configurations.

***

#### 📌 **Common Techniques for Persistence**

| **Technique**             | **Description**                           | **Registry Key/Folder**                                                         |
| ------------------------- | ----------------------------------------- | ------------------------------------------------------------------------------- |
| **Registry Run Key**      | Run malicious code at startup.            | `HKCU\Software\Microsoft\Windows\CurrentVersion\Run`                            |
| **RunOnce Key**           | Run code only on the next startup.        | `HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce`                        |
| **Startup Folder**        | Add malicious files to startup directory. | `C:\Users\<User>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup` |
| **Scheduled Tasks**       | Create scheduled tasks to execute code.   | `schtasks /create`                                                              |
| **Service Configuration** | Modify Windows service binaries.          | `HKLM\SYSTEM\CurrentControlSet\Services`                                        |

***

#### 📌 **Example Commands**

* **Add to Registry Run Key:**

```cmd
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v MaliciousKey /t REG_SZ /d "C:\malware.exe"
```

* **Add to Startup Folder:**

```cmd
copy C:\malware.exe "C:\Users\<User>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup"
```

* **Add to RunOnce Key:**

```cmd
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v Update /t REG_SZ /d "C:\malware.exe"
```

***

### 🛡️ **2. Detection Techniques**

#### 📊 **Manual Inspection with PowerShell**

**🕵️ Check Run and RunOnce Registry Keys**

```powershell
Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run"
Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce"
```

**🕵️ Check Startup Folder for Suspicious Files**

```powershell
Get-ChildItem -Path "C:\Users\*\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup"
```

**🕵️ Check Scheduled Tasks for Suspicious Entries**

```powershell
Get-ScheduledTask | Where-Object { $_.TaskPath -like "*Update*" }
```

**🕵️ Check Service Binaries for Suspicious Paths**

```powershell
Get-WmiObject Win32_Service | Select-Object Name, PathName | Where-Object { $_.PathName -like "*Temp*" }
```

***

#### 📊 **Microsoft Defender for Endpoint (MDE) Query (KQL)**

**🕵️ Detect Registry Key Modifications**

```kusto
DeviceRegistryEvents
| where RegistryKey contains "CurrentVersion\\Run" or RegistryKey contains "CurrentVersion\\RunOnce"
| where ActionType == "RegistryValueSet"
| project Timestamp, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, AccountName
```

**🕵️ Detect Startup Folder Modifications**

```kusto
DeviceFileEvents
| where FolderPath contains "Startup"
| where ActionType == "FileCreated" or ActionType == "FileModified"
| project Timestamp, DeviceName, FolderPath, FileName, AccountName
```

**🕵️ Identify Suspicious Service Configurations**

```kusto
DeviceRegistryEvents
| where RegistryKey contains "SYSTEM\\CurrentControlSet\\Services"
| where RegistryValueData contains "Temp" or RegistryValueData contains ".exe"
| project Timestamp, DeviceName, RegistryKey, RegistryValueName, RegistryValueData
```

**🕵️ Monitor Processes Executing from Startup Locations**

```kusto
DeviceProcessEvents
| where FolderPath contains "Startup"
| where FileName endswith ".exe" or FileName endswith ".bat"
| project Timestamp, DeviceName, FileName, FolderPath, ProcessCommandLine, AccountName
```

***

#### 📊 **Event Viewer Logs**

| **Event ID** | **Description**                                 |
| ------------ | ----------------------------------------------- |
| **4657**     | A registry value was modified.                  |
| **4688**     | A new process was created.                      |
| **4697**     | A service was installed in the system.          |
| **4663**     | Object access attempt (Startup Folder changes). |

**📌 Focus on Event ID 4657:**

* Look for modifications to:
  * `HKCU:\Software\Microsoft\Windows\CurrentVersion\Run`
  * `HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce`

**📌 Focus on Event ID 4688:**

* Look for processes running from:
  * `C:\Users\<User>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup`

**📌 Focus on Event ID 4697:**

* Check for newly installed services.

***

### 🕵️ **3. Investigation Techniques**

#### 1️⃣ **Identify Malicious Registry Entries**

* Look for unexpected keys in `Run` or `RunOnce`:

```powershell
Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run"
```

***

#### 2️⃣ **Analyze Startup Folder**

* Identify suspicious files:

```powershell
Get-ChildItem -Path "C:\Users\*\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup"
```

***

#### 3️⃣ **Trace Malicious Processes**

* Correlate process activity:

```powershell
Get-EventLog -LogName Security -InstanceId 4688 | Select-String "Startup"
```

***

#### 4️⃣ **Inspect Services for Persistence**

* Review service binaries:

```powershell
Get-WmiObject Win32_Service | Where-Object { $_.PathName -like "*Temp*" }
```

***

#### 5️⃣ **Review Scheduled Tasks**

* Look for unusual scheduled tasks:

```powershell
Get-ScheduledTask | Where-Object { $_.TaskPath -like "*Update*" }
```

***

### 🔧 **4. Remediation Steps**

#### 📌 **1. Remove Malicious Registry Keys**

```powershell
Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" -Name "MaliciousKey"
```

#### 📌 **2. Delete Malicious Startup Files**

```powershell
Remove-Item -Path "C:\Users\<User>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\malware.exe"
```

#### 📌 **3. Disable Malicious Services**

```powershell
sc stop "MaliciousService"
sc delete "MaliciousService"
```

#### 📌 **4. Terminate Suspicious Processes**

```powershell
Stop-Process -Name "malware" -Force
```

#### 📌 **5. Perform Full Antivirus Scan**

```powershell
Start-MpScan -ScanType FullScan
```

***

### 🛡️ **5. Prevention Steps**

1. **Enable Registry Auditing:**
   * Monitor **Event ID 4657** for `Run` and `RunOnce`.
2. **Restrict Startup Folder Access:**
   * Limit write permissions to startup folders.
3. **Use Least Privilege Principle:**
   * Restrict admin rights to essential users.
4. **Enable Application Control Policies:**
   * Block untrusted applications via **AppLocker**.
5. **Monitor Suspicious Scheduled Tasks:**
   * Periodically audit scheduled tasks.
6. **Regular Patching:**
   * Keep systems and software updated.

***

### 🧠 **6. Key Takeaways**

* **Registry Run Keys and Startup Folders are Common Persistence Mechanisms:** Monitor them closely.
* **Event IDs 4657, 4688, 4697 Are Crucial:** Set up alerts for modifications.
* **Audit Regularly:** Periodically inspect registry keys and startup folders.
* **Enforce Application Whitelisting:** Use tools like AppLocker.

***

## 🚨 **Valid Accounts: Default Accounts**

***

### 🔍 **1. Attack Breakdown**

#### 📝 **What is Default Account Exploitation?**

* **Default Accounts** are built-in user accounts that come preconfigured with operating systems, applications, and network devices (e.g., `Administrator`, `Guest`, `sa` for SQL Server).
* Attackers exploit these accounts if:
  * **Default credentials remain unchanged**.
  * Accounts are **enabled by default**.
  * Accounts have **excessive privileges**.
  * **Weak passwords** are set for these accounts.

***

#### 📑 **Why Attackers Target Default Accounts?**

* **Easy Access:** Many systems are deployed without disabling default accounts.
* **Privilege Escalation:** Default accounts often have administrative or privileged access.
* **Persistence:** Attackers use default accounts to maintain long-term access.
* **Stealth:** Legitimate accounts are less likely to trigger alerts.

***

#### 📌 **Common Default Accounts and Services**

| **Default Account** | **Platform/Service**              | **Purpose**          |
| ------------------- | --------------------------------- | -------------------- |
| **Administrator**   | Windows Systems                   | System Administrator |
| **root**            | Linux/Unix Systems                | Superuser Access     |
| **sa**              | SQL Server                        | Database Admin       |
| **admin**           | Network Devices (Cisco, Fortinet) | Device Admin         |
| **Guest**           | Windows Systems                   | Restricted Access    |
| **postgres**        | PostgreSQL Database               | Database Admin       |
| **pi**              | Raspberry Pi                      | Device Admin         |

***

#### 📌 **Common Techniques for Exploiting Default Accounts**

| **Technique**                | **Description**                       | **Example Command**                        |
| ---------------------------- | ------------------------------------- | ------------------------------------------ |
| **Brute Force Attack**       | Guess passwords for default accounts. | `hydra -l admin -P passwords.txt <target>` |
| **Default Credential Login** | Use known default credentials.        | `ssh root@<IP>`                            |
| **Account Misconfiguration** | Exploit accounts left enabled.        | `net user Administrator`                   |
| **SQL Default Account**      | Exploit `sa` accounts in SQL Server.  | `sqlcmd -S <server> -U sa`                 |
| **Remote Access via Admin**  | Use default accounts over RDP/SSH.    | `mstsc /v:<IP>`                            |

***

### 🛡️ **2. Detection Techniques**

#### 📊 **Manual Inspection with PowerShell**

**🕵️ List Default Accounts in Windows**

```powershell
Get-LocalUser | Where-Object { $_.Name -in @("Administrator", "Guest") }
```

**🕵️ Check if Default Accounts Are Enabled**

```powershell
Get-LocalUser | Where-Object { $_.Enabled -eq $true }
```

**🕵️ List Accounts with Elevated Privileges**

```powershell
Get-LocalGroupMember -Group "Administrators"
```

**🕵️ Check Recent Login Activity for Default Accounts**

```powershell
Get-EventLog -LogName Security -InstanceId 4624 | Where-Object { $_.Message -like "*Administrator*" }
```

***

#### 📊 **Microsoft Defender for Endpoint (MDE) Query (KQL)**

**🕵️ Detect Default Account Logins**

```kusto
SecurityEvent
| where EventID == 4624
| where AccountName in ("Administrator", "Guest", "sa", "root", "admin")
| project Timestamp, AccountName, IpAddress, LogonType, DeviceName
```

**🕵️ Identify Brute Force Attempts on Default Accounts**

```kusto
SecurityEvent
| where EventID == 4625
| where AccountName in ("Administrator", "Guest", "sa", "root", "admin")
| summarize FailedAttempts = count() by AccountName, IpAddress
| where FailedAttempts > 5
```

**🕵️ Detect Default Account Modifications**

```kusto
DeviceRegistryEvents
| where RegistryKey contains "SAM"
| where ActionType == "RegistryValueSet"
| project Timestamp, DeviceName, RegistryKey, AccountName
```

**🕵️ Monitor Default SQL Account Logins (`sa`)**

```kusto
DeviceProcessEvents
| where ProcessCommandLine contains "sqlcmd"
| where ProcessCommandLine contains "-U sa"
| project Timestamp, DeviceName, ProcessCommandLine, AccountName
```

**🕵️ Identify Default Accounts Used for Remote Access**

```kusto
DeviceNetworkEvents
| where RemotePort in (3389, 22)
| where AccountName in ("Administrator", "root", "admin")
| project Timestamp, DeviceName, RemoteIP, RemotePort, AccountName
```

***

#### 📊 **Event Viewer Logs**

| **Event ID** | **Description**                                          |
| ------------ | -------------------------------------------------------- |
| **4624**     | Successful login (Default accounts are often listed).    |
| **4625**     | Failed login attempt (Repeated attempts are suspicious). |
| **4720**     | User account created.                                    |
| **4728**     | User added to privileged group.                          |
| **4732**     | User added to global group.                              |

**📌 Focus on Event ID 4624:**

* Look for logins from:
  * `Administrator`
  * `Guest`
  * `sa`
  * `root`

**📌 Focus on Event ID 4728:**

* Look for additions to groups like:
  * `Administrators`
  * `Domain Admins`

***

### 🕵️ **3. Investigation Techniques**

#### 1️⃣ **Identify Enabled Default Accounts**

```powershell
Get-LocalUser | Where-Object { $_.Name -in @("Administrator", "Guest") -and $_.Enabled -eq $true }
```

***

#### 2️⃣ **Trace Account Activity**

* Check event logs for recent usage:

```powershell
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624} | Where-Object { $_.Message -like "*Administrator*" }
```

***

#### 3️⃣ **Review Remote Access Logs**

* Investigate remote sessions:

```powershell
Get-EventLog -LogName Security -InstanceId 4624 | Where-Object { $_.Message -like "*RDP*" }
```

***

#### 4️⃣ **Check SQL Server Login Logs**

* Verify `sa` account activity:

```sql
SELECT login_time, host_name, program_name FROM sys.dm_exec_sessions WHERE login_name = 'sa';
```

***

### 🔧 **4. Remediation Steps**

#### 📌 **1. Disable Unused Default Accounts**

```powershell
Disable-LocalUser -Name "Administrator"
```

#### 📌 **2. Enforce Strong Passwords for Default Accounts**

```powershell
net user Administrator StrongP@ssw0rd!
```

#### 📌 **3. Remove Default Accounts from Admin Groups**

```powershell
Remove-LocalGroupMember -Group "Administrators" -Member "Administrator"
```

#### 📌 **4. Monitor SQL Server `sa` Account**

* Disable `sa` if not required:

```sql
ALTER LOGIN sa DISABLE;
```

#### 📌 **5. Enable Account Lockout Policies**

```powershell
net accounts /lockoutthreshold:5
```

#### 📌 **6. Perform Full Antivirus Scan**

```powershell
Start-MpScan -ScanType FullScan
```

***

### 🛡️ **5. Prevention Steps**

1. **Disable Default Accounts if Not Required:**
   * Disable accounts like `Administrator`, `Guest`, and `sa`.
2. **Enforce Strong Password Policies:**
   * Ensure default accounts have strong, unique passwords.
3. **Monitor Default Account Activity:**
   * Alert on usage of default accounts in remote sessions or privileged tasks.
4. **Limit Default Account Permissions:**
   * Remove default accounts from sensitive groups.
5. **Use Multi-Factor Authentication (MFA):**
   * Add MFA to privileged accounts.
6. **Audit Regularly:**
   * Periodically review account usage logs and group memberships.

***

### 🧠 **6. Key Takeaways**

* **Default Accounts are Low-Hanging Fruit:** Attackers often target them first.
* **Disable Unused Accounts:** Remove or disable accounts like `Administrator` and `Guest`.
* **Monitor Account Activity:** Use **Event IDs 4624, 4625, 4728**.
* **Enforce Strong Passwords:** Always change default passwords.
* **Use Multi-Factor Authentication:** Secure critical accounts with MFA.

***

## 🚨 **Data Transfer Size Limits**

***

### 🔍 **1. Attack Breakdown**

#### 📝 **What is Data Transfer Size Limit Abuse?**

* Attackers often **manipulate data transfer limits** to **evade detection** while exfiltrating large volumes of data from a compromised network.
* By transferring data in smaller chunks or obfuscating file sizes, attackers can bypass **Data Loss Prevention (DLP)** controls and avoid raising red flags.

***

#### 📑 **Why Attackers Manipulate Data Transfer Size?**

* **Avoid Detection:** Small or irregular data transfers may not trigger monitoring tools.
* **Evade Threshold Alerts:** Many DLP systems flag unusually large transfers.
* **Blend with Normal Traffic:** Break data into chunks to mimic typical user behavior.
* **Exfiltrate Large Volumes Over Time:** Steady, small transfers are harder to detect.

***

#### 📌 **Common Techniques for Data Transfer Size Manipulation**

| **Technique**              | **Description**                                                      | **Example Tools**      |
| -------------------------- | -------------------------------------------------------------------- | ---------------------- |
| **Chunking**               | Split large data files into smaller pieces for gradual exfiltration. | `split`, `7zip`        |
| **Compression**            | Compress files to reduce size before transfer.                       | `gzip`, `WinRAR`       |
| **Encryption/Obfuscation** | Encrypt or encode data to hide its true size/type.                   | `openssl`, `base64`    |
| **Data Hiding**            | Embed data within other file types (e.g., images, PDFs).             | `steghide`, `ExifTool` |
| **Low-Bandwidth Channels** | Use slow protocols (e.g., DNS tunneling) to avoid suspicion.         | `dnscat2`, `iodine`    |
| **Alternate Protocols**    | Use FTP, SFTP, or HTTP for stealthy data transfer.                   | `curl`, `scp`          |

***

#### 📌 **Common Attack Scenarios**

1. **Chunked Transfers Over FTP:** Files broken into small chunks and exfiltrated slowly.
2. **HTTP POST Data Exfiltration:** Small POST requests carrying encoded data.
3. **DNS Tunneling for Data Transfers:** Data exfiltrated over DNS queries.
4. **Email Attachment Abuse:** Data hidden in small email attachments.
5. **Cloud Services Abuse:** Small file uploads to cloud storage (e.g., Dropbox, Google Drive).

***

### 🛡️ **2. Detection Techniques**

#### 📊 **Manual Inspection with PowerShell**

**🕵️ Monitor Unusual File Transfers**

```powershell
Get-ChildItem -Path "C:\Users\*\Documents" -Recurse | Where-Object { $_.Length -gt 10485760 }
```

* Flag files larger than **10MB**.

**🕵️ Monitor Recent Compressed Files**

```powershell
Get-ChildItem -Path "C:\*" -Include *.zip, *.rar, *.7z -Recurse | Where-Object { $_.LastWriteTime -gt (Get-Date).AddHours(-24) }
```

**🕵️ Inspect Network Connections for Large Transfers**

```powershell
Get-NetTCPConnection | Where-Object { $_.RemoteAddress -notlike "192.168.*" }
```

**🕵️ Check Outbound DNS Traffic for Large Payloads**

```powershell
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-DNS-Client/Operational'}
```

***

#### 📊 **Microsoft Defender for Endpoint (MDE) Query (KQL)**

**🕵️ Detect Large File Transfers**

```kusto
DeviceFileEvents
| where ActionType == "FileCopied" or ActionType == "FileUploaded"
| where FileSize > 10485760 // Files larger than 10MB
| project Timestamp, DeviceName, FileName, FolderPath, AccountName, FileSize
```

**🕵️ Monitor Chunked Data Transfers Over HTTP**

```kusto
DeviceNetworkEvents
| where Protocol == "HTTP"
| where RemoteUrl contains "upload"
| summarize TotalDataTransferred = sum(NetworkBytesSent) by RemoteUrl, AccountName
| where TotalDataTransferred > 10485760
```

**🕵️ Identify Compressed File Transfers**

```kusto
DeviceFileEvents
| where FileName endswith ".zip" or FileName endswith ".rar" or FileName endswith ".7z"
| where ActionType == "FileCopied"
| project Timestamp, DeviceName, FileName, FolderPath, AccountName
```

**🕵️ Detect DNS Tunneling Activity**

```kusto
DeviceNetworkEvents
| where RemotePort == 53
| where NetworkBytesSent > 512
| summarize TotalDataTransferred = sum(NetworkBytesSent) by RemoteIP
| where TotalDataTransferred > 1048576
```

**🕵️ Monitor Email Attachments with Large Files**

```kusto
EmailEvents
| where AttachmentSize > 10485760
| project Timestamp, SenderEmailAddress, RecipientEmailAddress, AttachmentSize, FileName
```

***

#### 📊 **Event Viewer Logs**

| **Event ID** | **Description**                                              |
| ------------ | ------------------------------------------------------------ |
| **4663**     | Object Access: File copied or transferred.                   |
| **5156**     | Network connection allowed (large data transfers).           |
| **4688**     | Process creation (e.g., `curl`, `scp`).                      |
| **4104**     | PowerShell script block execution (e.g., `split`, `base64`). |
| **6005**     | DNS requests (DNS tunneling detection).                      |

**📌 Focus on Event ID 4663:**

* Look for unusual file access or copying activity:

  ```powershell
  Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4663} | Where-Object { $_.Message -like "*copy*" }
  ```

**📌 Focus on Event ID 5156:**

* Look for outbound connections with large amounts of data transferred.

***

### 🕵️ **3. Investigation Techniques**

#### 1️⃣ **Analyze Network Traffic**

* Identify outbound traffic spikes to unknown destinations:

```powershell
Get-NetTCPConnection | Where-Object { $_.RemoteAddress -notlike "192.168.*" }
```

***

#### 2️⃣ **Inspect Compressed/Archived Files**

* Search for recent `.zip`, `.rar`, or `.7z` files:

```powershell
Get-ChildItem -Path "C:\*" -Include *.zip, *.rar, *.7z -Recurse
```

***

#### 3️⃣ **Trace DNS Queries for Data Transfer**

* Identify large DNS payloads:

```powershell
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-DNS-Client/Operational'}
```

***

#### 4️⃣ **Review HTTP/S Traffic for Repeated Small Transfers**

* Inspect log files for recurring patterns of file uploads.

***

### 🔧 **4. Remediation Steps**

#### 📌 **1. Block Malicious IPs**

```powershell
New-NetFirewallRule -DisplayName "Block Suspicious IP" -Direction Outbound -RemoteAddress <IP> -Action Block
```

#### 📌 **2. Quarantine Suspicious Files**

```powershell
Move-Item -Path "C:\Users\*\Documents\large_archive.zip" -Destination "C:\Quarantine"
```

#### 📌 **3. Terminate Malicious Processes**

```powershell
Stop-Process -Name "curl" -Force
```

#### 📌 **4. Monitor DNS Traffic for Tunneling**

* Enable deep packet inspection on DNS traffic.

#### 📌 **5. Enable Data Loss Prevention (DLP) Policies**

* Apply limits to outbound file sizes.

#### 📌 **6. Perform Full Antivirus Scan**

```powershell
Start-MpScan -ScanType FullScan
```

***

### 🛡️ **5. Prevention Steps**

1. **Enable Data Loss Prevention (DLP):**
   * Set thresholds for maximum file sizes.
2. **Implement Network Traffic Monitoring (NTM):**
   * Track large outbound connections.
3. **Monitor DNS Traffic:**
   * Detect DNS tunneling patterns.
4. **Block Unauthorized File Transfer Tools:**
   * Restrict tools like `curl`, `scp`, `ftp`.
5. **Encrypt Sensitive Files:**
   * Prevent plaintext data exfiltration.
6. **Implement Rate-Limiting Policies:**
   * Limit bandwidth for external file transfers.

***

### 🧠 **6. Key Takeaways**

* **Data Exfiltration Often Hides in Plain Sight:** Small, frequent transfers can go unnoticed.
* **DNS and HTTP/S Are Common Channels:** Monitor these protocols.
* **Compression and Obfuscation Are Common Tactics:** Look for `.zip`, `.rar`, and `.7z` files.
* **Enable DLP Policies:** Set file transfer thresholds.
* **Regular Auditing is Crucial:** Monitor logs, network traffic, and DNS queries.

***

## 🚨 **Process Doppelgängingysis**

***

### 🔍 **1. Attack Breakdown**

#### 📝 **What is Process Doppelgänging?**

* **Process Doppelgänging** is an advanced **code injection technique** that **bypasses antivirus and endpoint protection** by exploiting the Windows NTFS transaction feature.
* It allows attackers to **create a malicious process** in a way that:
  * It **does not create a new file on disk**.
  * It **appears as a legitimate process**.
  * It **bypasses process monitoring tools**.

#### 📑 **Why Attackers Use Process Doppelgänging?**

* **Stealth:** Avoid detection by antivirus and monitoring tools.
* **Fileless Execution:** No malicious file needs to be saved on disk.
* **Privilege Escalation:** Run code with high privileges under a legitimate process name.
* **Persistence:** Maintain stealthy access across reboots.

***

#### 📌 **How Does Process Doppelgänging Work?**

1. **Transacted File Creation:** A malicious executable is written to disk using **Windows NTFS transactions**.
2. **Rollback Transaction:** The transaction is rolled back, making the file invisible.
3. **Process Creation:** The process is launched in a suspended state using the **rollback file**.
4. **Mapped Section Replacement:** Replace the memory section of the suspended process with malicious code.
5. **Process Execution:** Resume the process to execute the malicious payload.

#### 📌 **Common Tools for Process Doppelgänging**

| **Tool**           | **Purpose**                       |
| ------------------ | --------------------------------- |
| **Mimikatz**       | Credential theft                  |
| **Cobalt Strike**  | Post-exploitation framework       |
| **Metasploit**     | Exploitation and payload delivery |
| **Process Hacker** | Memory and process manipulation   |

***

### 🛡️ **2. Detection Techniques**

#### 📊 **Manual Inspection with PowerShell**

**🕵️ Check for Suspicious Processes Running in Suspended State**

```powershell
Get-Process | Where-Object { $_.StartInfo.FileName -eq $null }
```

**🕵️ Inspect Processes Without Valid Executable Paths**

```powershell
Get-CimInstance Win32_Process | Where-Object { $_.ExecutablePath -eq $null }
```

**🕵️ Monitor NTFS Transactions**

```powershell
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-NTFS/Operational'; Id=142} | Select-Object TimeCreated, Message
```

**🕵️ Inspect Process Tree Anomalies**

```powershell
Get-WmiObject Win32_Process | Select-Object ProcessId, ParentProcessId, Name, CommandLine
```

***

#### 📊 **Microsoft Defender for Endpoint (MDE) Query (KQL)**

**🕵️ Detect Suspended Processes with Malicious Command Line**

```kusto
DeviceProcessEvents
| where ProcessCreationTime > ago(1d)
| where ProcessIntegrityLevel == "System"
| where ProcessCommandLine contains "suspended"
| project Timestamp, DeviceName, ProcessCommandLine, ParentProcessName, AccountName
```

**🕵️ Look for NTFS Transaction Abuse**

```kusto
DeviceFileEvents
| where ActionType == "FileCreated"
| where FolderPath contains "NTFS"
| where FileName endswith ".tmp"
| project Timestamp, DeviceName, FileName, FolderPath, AccountName
```

**🕵️ Identify Process Injection via Doppelgänging**

```kusto
DeviceProcessEvents
| where ProcessCommandLine contains "NtCreateTransaction"
| where ProcessCommandLine contains "NtRollbackTransaction"
| project Timestamp, DeviceName, ProcessCommandLine, ParentProcessName, AccountName
```

**🕵️ Identify Suspicious Child Processes**

```kusto
DeviceProcessEvents
| where ParentProcessFileName in ("svchost.exe", "explorer.exe")
| where ProcessCommandLine contains ".exe"
| where ProcessCreationTime > ago(1d)
| project Timestamp, DeviceName, ProcessCommandLine, ParentProcessName, AccountName
```

**🕵️ Detect Memory Manipulation**

```kusto
DeviceProcessEvents
| where ProcessCommandLine contains "VirtualAlloc"
| where ProcessCommandLine contains "WriteProcessMemory"
| project Timestamp, DeviceName, ProcessCommandLine, ParentProcessName, AccountName
```

***

#### 📊 **Event Viewer Logs**

| **Event ID** | **Description**                            |
| ------------ | ------------------------------------------ |
| **4688**     | A new process was created.                 |
| **4656**     | A handle to an object was requested.       |
| **4663**     | An attempt was made to access an object.   |
| **142**      | NTFS transaction activity.                 |
| **592**      | A new process was created (older systems). |

**📌 Focus on Event ID 4688:**

* Look for:

  ```kusto
  ProcessCommandLine: NtCreateTransaction
  ParentProcess: svchost.exe, explorer.exe
  ```

**📌 Focus on Event ID 142:**

* Check NTFS transaction logs for suspicious activity.

**📌 Focus on Event ID 4663:**

* Look for access to unusual memory objects:

  ```makefile
  ObjectName: \Device\HarddiskVolumeShadowCopy
  ```

***

### 🕵️ **3. Investigation Techniques**

#### 1️⃣ **Trace Suspicious Processes**

* Identify parent-child process relationships:

```powershell
Get-WmiObject Win32_Process | Where-Object { $_.ParentProcessId -eq <PID> }
```

***

#### 2️⃣ **Inspect Memory Regions**

* Check for suspicious memory sections in processes:

```powershell
Get-Process -Id <PID> | Select-Object Handles, NPM, PM, WS
```

***

#### 3️⃣ **Analyze NTFS Transactions**

* Investigate NTFS logs:

```powershell
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-NTFS/Operational'; Id=142}
```

***

#### 4️⃣ **Check Recent Executable Activity**

* Identify recently created temporary executables:

```powershell
Get-ChildItem -Path "C:\Windows\Temp\" -Recurse -Include *.tmp, *.exe
```

***

#### 5️⃣ **Trace DLL Injections**

* List loaded DLLs for suspicious processes:

```powershell
Get-Process -Id <PID> -Module
```

***

### 🔧 **4. Remediation Steps**

#### 📌 **1. Terminate Suspicious Processes**

```powershell
Stop-Process -Id <PID> -Force
```

#### 📌 **2. Remove Malicious Files**

```powershell
Remove-Item -Path "C:\Windows\Temp\suspicious.exe" -Force
```

#### 📌 **3. Clear NTFS Transaction Logs**

```powershell
fsutil usn deletejournal /d /n c:
```

#### 📌 **4. Isolate Compromised Hosts**

* Disconnect the system from the network.

#### 📌 **5. Perform Full Antivirus Scan**

```powershell
Start-MpScan -ScanType FullScan
```

***

### 🛡️ **5. Prevention Steps**

1. **Enable Windows Defender Advanced Threat Protection (ATP):**
   * Monitor advanced attack techniques.
2. **Enable Process Auditing:**
   * Monitor Event IDs **4688**, **4663**, **142**.
3. **Disable Unnecessary NTFS Features:**
   * Limit NTFS transactions if not required.
4. **Use Application Control (AppLocker/WDAC):**
   * Block untrusted binaries.
5. **Apply Patches and Updates:**
   * Keep Windows OS updated.
6. **Restrict Admin Privileges:**
   * Limit the ability to create NTFS transactions.
7. **Educate Admins and IT Staff:**
   * Raise awareness about fileless attacks.

***

### 🧠 **6. Key Takeaways**

* **Process Doppelgänging is Stealthy:** It bypasses traditional antivirus solutions.
* **Focus on NTFS Logs:** Event ID **142** can reveal NTFS transaction abuse.
* **Monitor Suspended Processes:** Check for processes with `VirtualAlloc` and `WriteProcessMemory`.
* **Use Threat Intelligence:** Stay updated on tools like **Mimikatz** and **Cobalt Strike**.
* **Implement Application Whitelisting:** Prevent untrusted binaries from executing.

***

## 🚨 **Spearphishing via Service: Advanced Threat Analysis**

***

### 🔍 **1. Attack Breakdown**

#### 📝 **What is Spearphishing via Service?**

* **Spearphishing via Service** is a technique where attackers exploit **trusted third-party services (e.g., collaboration tools, cloud platforms, email services)** to deliver **malicious payloads** or **phishing links**.
* Common targets include:
  * **Microsoft 365 (Outlook, Teams, SharePoint)**
  * **Google Workspace (Gmail, Drive, Docs)**
  * **Cloud Storage Platforms (Dropbox, OneDrive, Box)**
  * **Communication Platforms (Slack, Discord)**

***

#### 📑 **Why Attackers Use Spearphishing via Service?**

* **Trusted Platforms:** Emails and links originating from known services bypass traditional security filters.
* **Spoofing Trust:** Legitimate domains increase user trust and click-through rates.
* **Bypass Email Security:** Emails from trusted domains are less likely to be flagged.
* **Credential Harvesting:** Fake login prompts on known services fool users.
* **Payload Delivery:** Malicious attachments or links are hosted on legitimate platforms.

***

#### 📌 **Common Techniques Used in Spearphishing via Service**

| **Technique**                 | **Description**                                  | **Example**                                 |
| ----------------------------- | ------------------------------------------------ | ------------------------------------------- |
| **Cloud Hosted Payloads**     | Malicious files hosted on cloud services.        | `https://drive.google.com/file/d/123xyz`    |
| **Fake Login Pages**          | Spoofed service login pages.                     | `https://microsoft-login.xyz`               |
| **Embedded Malicious Macros** | Documents with hidden malicious scripts.         | `Document.docm`                             |
| **URL Shorteners**            | Obscure malicious links.                         | `bit.ly/abc123`                             |
| **OAuth Token Theft**         | Abuse OAuth permissions for unauthorized access. | `https://accounts.google.com/o/oauth2/auth` |
| **Service Account Hijacking** | Compromise legitimate service accounts.          | Attacker takes over `user@domain.com`       |

***

#### 📌 **Common Attack Scenarios**

1. **Malware via OneDrive Link:** A document hosted on OneDrive contains embedded malware.
2. **Phishing via Teams Message:** Fake login page sent through Microsoft Teams.
3. **OAuth Abuse in Google Workspace:** Attacker gains access via rogue OAuth app.
4. **Fake Dropbox Notification:** “Your document is ready, click here to view.”

***

### 🛡️ **2. Detection Techniques**

#### 📊 **Manual Inspection with PowerShell**

**🕵️ Search Recent Suspicious Emails**

```powershell
Get-EventLog -LogName Security | Where-Object { $_.Message -like "*phishing*" }
```

**🕵️ Monitor Downloads from Cloud Services**

```powershell
Get-ChildItem -Path "C:\Users\*\Downloads" | Where-Object { $_.LastWriteTime -gt (Get-Date).AddHours(-24) }
```

**🕵️ Check for Suspicious URLs in Logs**

```powershell
Get-WinEvent -LogName Microsoft-Windows-PowerShell/Operational | Where-Object { $_.Message -like "*http*" }
```

**🕵️ Inspect Browser History for Suspicious Links**

```powershell
Get-ChildItem -Path "C:\Users\*\AppData\Local\Microsoft\Edge\User Data\Default\History"
```

***

#### 📊 **Microsoft Defender for Endpoint (MDE) Query (KQL)**

**🕵️ Identify Suspicious URLs in Emails**

```kusto
EmailEvents
| where EmailDirection == "Inbound"
| where ThreatTypes contains "Phishing"
| where Url contains "drive.google.com" or Url contains "dropbox.com"
| project Timestamp, SenderEmailAddress, RecipientEmailAddress, ThreatTypes, Url
```

**🕵️ Detect Malicious Document Downloads**

```kusto
DeviceFileEvents
| where FolderPath contains "Downloads"
| where FileName endswith ".docm" or FileName endswith ".xlsm"
| project Timestamp, DeviceName, FileName, FolderPath, AccountName
```

**🕵️ Identify OAuth Token Abuse**

```kusto
CloudAppEvents
| where ActionType == "OAuthGrant"
| where AppDisplayName contains "Unknown"
| project Timestamp, AppDisplayName, AccountName, IpAddress
```

**🕵️ Monitor Microsoft Teams/Slack Activity**

```kusto
DeviceProcessEvents
| where ProcessCommandLine contains "teams.exe" or ProcessCommandLine contains "slack.exe"
| where ProcessCommandLine contains "http"
| project Timestamp, DeviceName, ProcessCommandLine, AccountName
```

**🕵️ Check for Suspicious File Execution**

```kusto
DeviceProcessEvents
| where FolderPath contains "Downloads"
| where ProcessCommandLine contains ".docm" or ProcessCommandLine contains ".js"
| project Timestamp, DeviceName, ProcessCommandLine, AccountName
```

***

#### 📊 **Event Viewer Logs**

| **Event ID** | **Description**                               |
| ------------ | --------------------------------------------- |
| **4688**     | A new process was created.                    |
| **4663**     | Object access attempt (e.g., file download).  |
| **4104**     | PowerShell script block logging.              |
| **5156**     | Network connection allowed (HTTP/S requests). |
| **1202**     | OAuth grant (Azure AD).                       |

**📌 Focus on Event ID 4688:**

* Look for:

  ```vbnet
  ProcessName: powershell.exe
  ProcessCommandLine: Invoke-WebRequest -Uri "https://malicious.link"
  ```

**📌 Focus on Event ID 4663:**

* File downloaded from:

  ```makefile
  FolderPath: C:\Users\<User>\Downloads
  FileType: .docm, .xlsm
  ```

***

### 🕵️ **3. Investigation Techniques**

#### 1️⃣ **Analyze Malicious URLs**

* Verify URL reputation:
  * **VirusTotal:** `https://www.virustotal.com`
  * **URLScan:** `https://urlscan.io`

***

#### 2️⃣ **Inspect OAuth Grants**

* Review recent OAuth permissions:

```powershell
Get-AzureADServicePrincipal -All $true
```

***

#### 3️⃣ **Trace Malicious Downloads**

* List recent downloads:

```powershell
Get-ChildItem -Path "C:\Users\*\Downloads"
```

* Check file hash:

```powershell
Get-FileHash -Path "C:\Users\User\Downloads\malware.docm"
```

***

#### 4️⃣ **Inspect User Activity**

* Review sign-in logs:

```kql
SigninLogs
| where AppDisplayName contains "Microsoft Teams"
| where Status == "Failure"
```

***

#### 5️⃣ **Check OAuth Audit Logs**

* Look for suspicious app grants:

```kql
AuditLogs
| where OperationName == "Consent to application"
```

***

### 🔧 **4. Remediation Steps**

#### 📌 **1. Revoke OAuth Permissions**

* Revoke malicious OAuth grants:

```powershell
Remove-AzureADServiceAppRoleAssignment
```

#### 📌 **2. Quarantine Malicious Files**

```powershell
Move-Item -Path "C:\Users\User\Downloads\malware.docm" -Destination "C:\Quarantine"
```

#### 📌 **3. Block Malicious URLs**

```powershell
New-NetFirewallRule -DisplayName "Block Malicious URL" -Direction Outbound -RemoteAddress <IP> -Action Block
```

#### 📌 **4. Reset Compromised Accounts**

* Force password reset:

```powershell
net user User NewP@ssw0rd!
```

#### 📌 **5. Terminate Malicious Processes**

```powershell
Stop-Process -Name "powershell" -Force
```

***

### 🛡️ **5. Prevention Steps**

1. **Enable Safe Links and Safe Attachments (Microsoft 365):**
   * Prevent malicious URLs and attachments.
2. **Enforce Multi-Factor Authentication (MFA):**
   * Reduce credential theft risk.
3. **Block Macros by Default:**
   * Prevent execution of malicious macros.
4. **Restrict OAuth Consent:**
   * Require admin approval for OAuth permissions.
5. **Train Users:**
   * Educate employees about phishing indicators.
6. **Enable DLP (Data Loss Prevention):**
   * Monitor cloud-based file activities.

***

### 🧠 **6. Key Takeaways**

* **Spearphishing via Services Leverages Trust:** Hosted on legitimate services like OneDrive or Dropbox.
* **OAuth is a Growing Attack Vector:** Monitor app grants closely.
* **Focus on Event IDs:** **4688, 4663, 5156, 1202.**
* **Use Threat Intelligence Tools:** Validate links with **VirusTotal** and **URLScan**.
* **User Awareness is Key:** Continuous training is essential.

***


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://0xmedhat.gitbook.io/whoami/attacks-and-detections/part-4.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.