Chapter 7 · Q021 to Q025

Lateral movement

The attacker now had a service account that works on WS03. Next they copied a payload over an admin share, installed it as a service, and let Windows run it as SYSTEM.

Where the account was used Q021

Pivot from the account to everywhere it logged on:

event_id="4624" target_user_name="svc.wksdeploy" | groupBy(computer_name, ip_address, logon_type, function=multi(count(), min(timestamp, as=first)))

svc.wksdeploy logons: one host, one source.

All 15 logons are network logons on WS03, from 10.1.10.22 (WS02).

Finding · Q021

The second foothold is WS03.

The account is used against WS03 again on Oct 30 (01:28 and 11:08), so the attacker kept that access.

The tool Q022

Search for any command that names WS03 as a UNC path (\\WS03). In BQL that takes four backslashes:

event_id="1" commandline=~"\\\\WS03" | table(timestamp, hostname, user, original_file_name, commandline) | sort(timestamp)

Every command that targets \WS03, in order.

This shows the whole sequence: the spray loop, each net use, and at 15:28:45:

PAExec.exe \\WS03 -u MERIDIAN\svc.wksdeploy -p Meridian2026! -n 30 -s -c -f -cnodel -d
  -csrc ...\QuickConnect\QuickConnect.Service.exe QuickConnect.Service.exe

PAExec is an open source PsExec clone. -c copies the implant to the target, -s runs it as SYSTEM, and -d doesn't wait for it to finish.

Finding · Q022

Lateral movement used PAExec.exe, started by the implant on WS02.

Admin shares Q023

Zeek logs every SMB share mapping. Workstations normally only map shares on the domain controller, so leave DC01 out:

channel="smb_mapping" dst_ip!="10.1.10.10" | groupBy(src_ip, dst_ip, path, function=multi(count(), min(timestamp), max(timestamp)))

The only share mappings between workstations: WS02 to WS03.

\\WS03\IPC$ first shows up at 15:20:06, when the sprayed credential works. \\WS03\ADMIN$ shows up at 15:28:45, when PAExec copies its service binary into C:\Windows.

Finding · Q023

IPC$ carried the credential testing and ADMIN$ the payload staging (T1021.002).

The service Q024

List every service installed across the environment (System event 7045):

event_id="7045" | groupBy(hostname, service_name, image_path, account_name)

Service installs: a Defender driver on each workstation, and PAExec on WS03.

A Defender driver (KslD) is installed on every workstation. Only WS03 has PAExec-6740-WS02, running %SYSTEMROOT%\PAExec-6740-WS02.exe -service as LocalSystem. PAExec names its service after the process ID and host it came from.

Finding · Q024

The service name is PAExec-6740-WS02 (T1569.002).

Running as SYSTEM Q025

Follow the service binary to what it ran:

event_id="1" hostname="WS03" (image=~paexec OR parent_image=~paexec) | table(timestamp, user, parent_image, image, commandline)

The PAExec service and the implant it started on WS03.

services.exe starts the PAExec service at 15:29:06, and a second later it starts C:\Windows\QuickConnect.Service.exe. Both run as NT AUTHORITY\SYSTEM. The credential sent over the wire was svc.wksdeploy, but PAExec's -s flag runs the payload as SYSTEM.

Finding · Q025

The payload ran as NT AUTHORITY\SYSTEM on WS03.

Next: the attacker's infrastructure, and every host that called back.