Checking user logons

Sometimes, we are semi-lucky as an analyst and can find a user logon event that corresponds to the malicious activity, as we have observed in our EDR platform of choice or SIEM event.

Frequently with threat actors, malicious code will be immediately preceded by an RDP (Remote Desktop Protocol) logon via brute-force or dumped credentials, or even via PSExec or WMI lateral movement. These methods all have one thing in common: they will create a Type 3 or Type 10 logon event in the Windows Security log. Being able to quickly ascertain which user credentials are compromised, or may have been compromised, is key to quickly containing an incident.

PowerShell makes parsing event logs very easy with the Get-WinEvent cmdlet. Here, we can filter by day, utilizing the $Before and $After variables, and return the corresponding events, to be correlated with the malicious activity observed in our SIEM or EDR:

Figure 3.26 – Checking terminal...