330. Adversaries Use Windows Event Logs for Discovery
Hello everyone! We often use Windows Event Logs during our incident response engagements, but adversaries may also use it, for example, for discovery. Let's dig into this report . The adversary leveraged SharpADUserIP, which enables them to collect information about user names and their IP addresses from Security log, as we as the following PowerShell command to extract similar information from Microsoft-Windows-TerminalServices-LocalSessionManager/Operational: powershell -Command Get-WinEvent -LogName 'Microsoft-Windows-TerminalServices-LocalSessionManager/Operational' | Where-Object {$_.Id -eq 21} | ForEach-Object { $eventXml = [xml]$_.ToXml(); $username = $eventXml.Event.UserData.EventXML.User; $ipAddress = $eventXml.Event.UserData.EventXML.Address; $loginTime = $_.TimeCreated; if ($username -and $ipAddress -and $loginTime) { Write-Output ('User: ' + $username + ' IP: ' + $ipAddress + ' Login Time: ' + $loginTime) }} So, we can hunt for suspicious...