Chapter 6 · Q017 to Q020

Credential access

jen.walker is a regular user, so to go further the attacker needed an account that can do more. This starts with the net use loop from chapter 4.

The sprayed password Q017

net use with /user: takes a password on the command line, and Sysmon records command lines:

bifract_category="process_creation" | image=$"\\net.exe" | commandline=~"/user:" | table(timestamp, computer_name, user, commandline) | sort(timestamp)

Four net use attempts against WS03, about 16 seconds apart.

Starting at 15:19:17, WS02 runs the same command four times against \\WS03\IPC$, with four different accounts and one password:

net.exe use \\WS03\IPC$ /user:MERIDIAN\john.reyes Meridian2026! /persistent:no

One password tried against many accounts is a password spray (T1110.003). Company name, year and ! is a common guess.

Finding · Q017

The sprayed password is Meridian2026! (case sensitive).

Which accounts said no? Q018 Q019

Each net use triggers a Kerberos login at the domain controller, which Zeek sees on the wire:

channel="kerberos" request_type="AS" | NOT client=~"$/" | groupBy(src_ip, client, success, error_msg) | sort(client)

Kerberos AS requests from WS02, machine accounts removed.

KDC_ERR_PREAUTH_REQUIRED is the normal first round trip of every Kerberos login. KDC_ERR_PREAUTH_FAILED means the password was wrong. NOT client=~"$/" drops machine accounts like WS02$.

DC01 logs the same failures as event 4771:

event_id="4771" | groupBy(computer_name, target_user_name, status, ip_address)

Status 0x18 means a bad password. All three come from WS02.

All three come from 10.1.10.22, which is WS02.

Finding · Q018 and Q019

Regular users john.reyes and maria.chen rejected the password, and so did the admin-named account it.admin.

The one that worked Q020

List successful logons that came from WS02:

event_id="4624" ip_address="10.1.10.22" | groupBy(computer_name, target_user_name, logon_type, authentication_package_name)

Successful logons from WS02.

WS02's machine account and jen.walker log on to DC01 all the time. The new row is svc.wksdeploy: a network logon (type 3) on WS03, 15 times, first at 15:20:06. It matches the only successful AS request in the Zeek output.

Finding · Q020

MERIDIAN\svc.wksdeploy accepted the sprayed password. Deployment accounts like this usually have local admin on workstations.

Next: what the attacker did with it.