Get-GPPPassword (PowerSploit)

- Table of Contents

Open all sections | Close all sections

- Tool Overview

Category
Password and Hash Dump
Description
Acquires plaintext passwords and other account information written in the group policy.
Example of Presumed Tool Use During an Attack
This tool is used to use the acquired passwords and log on to the other hosts.

- Tool Operation Overview

Item Source Host Domain Controller
OS Windows Windows Server
Belonging to Domain Required
Rights Administrator
Communication Protocol 445/tcp, 389/tcp, 88/tcp
Service - Active Directory Domain Services

- Information Acquired from Log

Standard Settings
  • Source host
    • Execution history (Prefetch)
    • Details of the script/command executed (Windows 10 only. They are recorded in "Microsoft-Windows-PowerShell/Operational" and C:\Users\[User Name]\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt)
Additional Settings
  • Source host
    • Execution history (audit policy, Sysmon)
    • Details of the script/command executed (when Windows Management Framework 5.0 is installed on Windows 7. They are recorded in "Microsoft-Windows-PowerShell/Operational" and C:\Users\[User Name]\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt)

- Evidence That Can Be Confirmed When Execution is Successful

- Main Information Recorded at Execution

- Source Host

Event log

# Log Event ID Task Category Event Details
1 Microsoft-Windows-Sysmon/Operational 1 Process Create (rule: ProcessCreate) Process Create.
  • CommandLine: Command line of the execution command
  • UtcTime: Process execution date and time (UTC)
  • ProcessGuid/ProcessId: Process ID
  • Image: Path to the executable file (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
  • User: Execute as user
2 Microsoft-Windows-Sysmon/Operational 3 Network connection detected (rule: NetworkConnect) Network connection detected.
  • Protocol: Protocol (tcp)
  • Image: Path to the executable file (System)
  • ProcessGuid/ProcessId: Process ID (4)
  • User: Execute as user (NT AUTHORITY\SYSTEM)
  • SourceIp/SourceHostname/SourcePort: Source IP address/Host name/Port number (source host)
  • DestinationIp/DestinationHostname/DestinationPort: Destination IP address/Host name/Port number (domain controller port: 445)
3 Microsoft-Windows-PowerShell/Operational 4104 Execute a Remote Command. Creating Scriptblock text.
  • Message: The content of the script executed. The content of the executed PowerShell script is recorded as is.

USN journal

# File Name Process
1 ConsoleHost_history.txt CLOSE+DATA_EXTEND

UserAssist

# Registry Data
1 HKEY_USERS\[User SID]\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\JvaqbjfCbjreFuryy\i1.0\cbjrefuryy.rkr Date and time of the initial execution, Total number of executions

MFT

# Path Header Flag Validity
1 [Drive Name]:\Users\[User Name]\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt FILE ALLOCATED

Prefetch

- Domain Controller

Event log

# Log Event ID Task Category Event Details
1 Security 5145 Detailed File Share A network share object was checked to see whether the client can be granted the desired access.
  • Network Information > Source Address: Source IP address (source host IP address)
  • Shared Information > Share Name: Share name (multiple files under \\*\SYSVOL)
  • Subject > Security ID/Account Name/Account Domain: SID/Account name/Domain of the user who executed the tool
  • Network Information > Source Port: Source port number (high port)
  • Access Request Information > Access: Requested privileges (including SYNCHRONIZE, ReadData or ListDirectory, and ReadAttributes)

- Details: Source Host

- USN Journal

# File Name Process Attribute
1 POWERSHELL.EXE-[RANDOM].pf FILE_CREATE archive
POWERSHELL.EXE-[RANDOM].pf FILE_CREATE+SECURITY_CHANGE archive
POWERSHELL.EXE-[RANDOM].pf DATA_EXTEND+FILE_CREATE+SECURITY_CHANGE archive
POWERSHELL.EXE-[RANDOM].pf DATA_EXTEND+DATA_OVERWRITE+FILE_CREATE+SECURITY_CHANGE archive
POWERSHELL.EXE-[RANDOM].pf BASIC_INFO_CHANGE+DATA_EXTEND+DATA_OVERWRITE+FILE_CREATE+SECURITY_CHANGE archive
POWERSHELL.EXE-[RANDOM].pf BASIC_INFO_CHANGE+CLOSE+DATA_EXTEND+DATA_OVERWRITE+FILE_CREATE+SECURITY_CHANGE archive
2 POWERSHELL.EXE-[RANDOM].pf DATA_TRUNCATION archive
POWERSHELL.EXE-[RANDOM].pf DATA_EXTEND+DATA_TRUNCATION archive
POWERSHELL.EXE-[RANDOM].pf CLOSE+DATA_EXTEND+DATA_TRUNCATION archive
3 CustomDestinations FILE_CREATE directory
CustomDestinations CLOSE+FILE_CREATE directory
4 [RANDOM].customDestinations-ms FILE_CREATE archive
[RANDOM].customDestinations-ms FILE_CREATE+SECURITY_CHANGE archive
[RANDOM].customDestinations-ms DATA_EXTEND+FILE_CREATE+SECURITY_CHANGE archive
[RANDOM].customDestinations-ms DATA_EXTEND+DATA_OVERWRITE+FILE_CREATE+SECURITY_CHANGE archive
[RANDOM].customDestinations-ms BASIC_INFO_CHANGE+DATA_EXTEND+DATA_OVERWRITE+FILE_CREATE+SECURITY_CHANGE archive
[RANDOM].customDestinations-ms BASIC_INFO_CHANGE+CLOSE+DATA_EXTEND+DATA_OVERWRITE+FILE_CREATE+SECURITY_CHANGE archive
5 [RANDOM].customDestinations-ms~RF[RANDOM].TMP FILE_CREATE hidden+archive+temporary
[RANDOM].customDestinations-ms~RF[RANDOM].TMP CLOSE+FILE_CREATE hidden+archive+temporary
[RANDOM].customDestinations-ms~RF[RANDOM].TMP CLOSE+FILE_DELETE hidden+archive+temporary
6 [RANDOM].ps1 FILE_CREATE archive
[RANDOM].ps1 DATA_EXTEND+FILE_CREATE archive
[RANDOM].ps1 CLOSE+DATA_EXTEND+FILE_CREATE archive
[RANDOM].ps1 CLOSE+FILE_DELETE archive
7 [RANDOM].psm1 FILE_CREATE archive
[RANDOM].psm1 DATA_EXTEND+FILE_CREATE archive
[RANDOM].psm1 CLOSE+DATA_EXTEND+FILE_CREATE archive
[RANDOM].psm1 CLOSE+FILE_DELETE archive
8 ConsoleHost_history.txt DATA_EXTEND archive
ConsoleHost_history.txt CLOSE+DATA_EXTEND archive

- Event Log

# Event Log Event ID Task Category Event Details
1 Microsoft-Windows-Sysmon/Operational 1 Process Create (rule: ProcessCreate) Process Create.
  • LogonGuid/LogonId: ID of the logon session
  • ParentProcessGuid/ParentProcessId: Process ID of the parent process
  • ParentImage: Executable file of the parent process
  • CurrentDirectory: Work directory
  • CommandLine: Command line of the execution command
  • IntegrityLevel: Privilege level (High)
  • ParentCommandLine: Command line of the parent process
  • UtcTime: Process execution date and time (UTC)
  • ProcessGuid/ProcessId: Process ID
  • User: Execute as user
  • Hashes: Hash value of the executable file
  • Image: Path to the executable file (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
Security 4688 Process Create A new process has been created.
  • Process Information > Required Label: Necessity of privilege escalation (Mandatory Label\High Mandatory Level)
  • Subject > Account Name: Name of the account that executed the tool ([Host Name]$)
  • Log Date and Time: Process execution date and time (local time)
  • Subject > Account Domain: Domain to which the account belongs (domain name)
  • Process Information > New Process Name: Path to the executable file (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
  • Process Information > Token Escalation Type: Presence of privilege escalation (1)
  • Process Information > New Process ID: Process ID (hexadecimal)
  • Subject > Security ID: SID of the user who executed the tool (SYSTEM)
  • Subject > Logon ID: Session ID of the user who executed the process
Microsoft-Windows-PowerShell/Operational 40961 PowerShell Console Startup The PowerShell console is starting up.
2 Microsoft-Windows-Sysmon/Operational 13 Registry value set (rule: RegistryEvent) Registry value set.
  • EventType: Process type (SetValue)
  • Image: Path to the executable file (C:\Windows\Explorer.EXE)
  • ProcessGuid/ProcessId: Process ID
  • Details: Setting value written to the registry (Binary Data)
  • TargetObject: Registry value at the write destination (\REGISTRY\USER\[User SID]\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\JvaqbjfCbjreFuryy\i1.0\cbjrefuryy.rkr)
3 Microsoft-Windows-Sysmon/Operational 11 File created (rule: FileCreate) File created.
  • Image: Path to the executable file (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
  • ProcessGuid/ProcessId: Process ID
  • TargetFilename: Created file (C:\Users\[User Name]\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\[RANDOM].temp)
  • CreationUtcTime: File creation date and time (UTC)
Microsoft-Windows-Sysmon/Operational 2 File creation time changed (rule: FileCreateTime) File creation time changed.
  • UtcTime: Date and time the change occurred (UTC)
  • CreationUtcTime: New timestamp (UTC)
  • Image: Path to the executable file (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
  • PreviousCreationUtcTime: Old timestamp (UTC)
  • TargetFilename: Name of the changed file (C:\Users\[User Name]\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\[RANDOM].temp)
Security 4656 File System/Other Object Access Events A handle to an object was requested.
  • Process Information > Process ID: Process ID (hexadecimal)
  • Access Request Information > Access/Reason for Access/Access Mask: Requested privileges (including WriteData or AddFile, and AppendData)
  • Subject > Security ID/Account Name/Account Domain: SID/Account name/Domain of the user who executed the tool
  • Object > Object Name: Target file name (C:\Users\[User Name]\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\[RANDOM].temp)
  • Process Information > Process Name: Name of the process that closed the handle (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
  • Object > Object Type: Type of the file (File)
  • Subject > Logon ID: Session ID of the user who executed the process
  • Object > Handle ID: ID of the relevant handle
Security 4663 File System An attempt was made to access an object.
  • Process Information > Process ID: Process ID (hexadecimal)
  • Access Request Information > Access/Reason for Access/Access Mask: Requested privileges (including WriteData or AddFile, and AppendData)
  • Subject > Security ID/Account Name/Account Domain: SID/Account name/Domain of the user who executed the tool
  • Object > Object Name: Target file name (C:\Users\[User Name]\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\[RANDOM].temp)
  • Audit Success: Success or failure (access successful)
  • Process Information > Process Name: Name of the process that closed the handle (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
  • Object > Object Type: Category of the target (File)
  • Subject > Logon ID: Session ID of the user who executed the process
  • Object > Handle ID: ID of the relevant handle (handle obtained with Event ID 4656)
Security 4658 File System The handle to an object was closed.
  • Process Information > Process ID: Process ID (hexadecimal)
  • Process Information > Process Name: Name of the process that requested the object (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
  • Subject > Security ID/Account Name/Account Domain: SID/Account name/Domain of the user who executed the tool
  • Subject > Logon ID: Session ID of the user who executed the process
  • Object > Handle ID: ID of the relevant handle (handle obtained with Event ID 4656)
4 Security 4656 File System/Other Object Access Events A handle to an object was requested.
  • Process Information > Process ID: Process ID (hexadecimal)
  • Access Request Information > Access/Reason for Access/Access Mask: Requested privileges (WriteData or AddFile)
  • Subject > Security ID/Account Name/Account Domain: SID/Account name/Domain of the user who executed the tool
  • Object > Object Name: Target file name (C:\Users\[User Name]\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations)
  • Process Information > Process Name: Name of the process that closed the handle (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
  • Object > Object Type: Type of the file (File)
  • Subject > Logon ID: Session ID of the user who executed the process
  • Object > Handle ID: ID of the relevant handle
Security 4663 File System An attempt was made to access an object.
  • Process Information > Process ID: Process ID (hexadecimal)
  • Access Request Information > Access/Reason for Access/Access Mask: Requested privileges (WriteData or AddFile)
  • Subject > Security ID/Account Name/Account Domain: SID/Account name/Domain of the user who executed the tool
  • Object > Object Name: Target file name (C:\Users\[User Name]\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations)
  • Audit Success: Success or failure (access successful)
  • Process Information > Process Name: Name of the process that closed the handle (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
  • Object > Object Type: Category of the target (File)
  • Subject > Logon ID: Session ID of the user who executed the process
  • Object > Handle ID: ID of the relevant handle (handle obtained with Event ID 4656)
Security 4658 File System The handle to an object was closed.
  • Process Information > Process ID: Process ID (hexadecimal)
  • Process Information > Process Name: Name of the process that requested the object (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
  • Subject > Security ID/Account Name/Account Domain: SID/Account name/Domain of the user who executed the tool
  • Subject > Logon ID: Session ID of the user who executed the process
  • Object > Handle ID: ID of the relevant handle (handle obtained with Event ID 4656)
5 Security 4656 File System/Other Object Access Events A handle to an object was requested.
  • Process Information > Process ID: Process ID (hexadecimal)
  • Access Request Information > Access/Reason for Access/Access Mask: Requested privilege (including DELETE)
  • Subject > Security ID/Account Name/Account Domain: SID/Account name/Domain of the user who executed the tool
  • Object > Object Name: Target file name (C:\Users\[User Name]\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\[RANDOM].temp)
  • Process Information > Process Name: Name of the process that closed the handle (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
  • Object > Object Type: Type of the file (File)
  • Subject > Logon ID: Session ID of the user who executed the process
  • Object > Handle ID: ID of the relevant handle
Security 4663 File System An attempt was made to access an object.
  • Process Information > Process ID: Process ID (hexadecimal)
  • Access Request Information > Access/Reason for Access/Access Mask: Requested privilege (including DELETE)
  • Subject > Security ID/Account Name/Account Domain: SID/Account name/Domain of the user who executed the tool
  • Object > Object Name: Target file name (C:\Users\[User Name]\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\[RANDOM].temp)
  • Audit Success: Success or failure (access successful)
  • Process Information > Process Name: Name of the process that closed the handle (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
  • Object > Object Type: Category of the target (File)
  • Subject > Logon ID: Session ID of the user who executed the process
  • Object > Handle ID: ID of the relevant handle (handle obtained with Event ID 4656)
Security 4658 File System The handle to an object was closed.
  • Process Information > Process ID: Process ID (hexadecimal)
  • Process Information > Process Name: Name of the process that requested the object (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
  • Subject > Security ID/Account Name/Account Domain: SID/Account name/Domain of the user who executed the tool
  • Subject > Logon ID: Session ID of the user who executed the process
  • Object > Handle ID: ID of the relevant handle (handle obtained with Event ID 4656)
6 Microsoft-Windows-Sysmon/Operational 11 File created (rule: FileCreate) File created.
  • Image: Path to the executable file (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
  • ProcessGuid/ProcessId: Process ID
  • TargetFilename: Created file (C:\Users\[User Name]\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\[RANDOM].customDestinations-ms~RF[RANDOM].TMP)
  • CreationUtcTime: File creation date and time (UTC)
Security 4656 File System/Other Object Access Events A handle to an object was requested.
  • Process Information > Process ID: Process ID (hexadecimal)
  • Access Request Information > Access/Reason for Access/Access Mask: Requested privilege (including DELETE)
  • Subject > Security ID/Account Name/Account Domain: SID/Account name/Domain of the user who executed the tool
  • Object > Object Name: Target file name (C:\Users\[User Name]\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\[RANDOM].customDestinations-ms~RF[RANDOM].TMP)
  • Process Information > Process Name: Name of the process that closed the handle (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
  • Object > Object Type: Type of the file (File)
  • Subject > Logon ID: Session ID of the user who executed the process
  • Object > Handle ID: ID of the relevant handle
Security 4663 File System An attempt was made to access an object.
  • Process Information > Process ID: Process ID (hexadecimal)
  • Access Request Information > Access/Reason for Access/Access Mask: Requested privilege (including DELETE)
  • Subject > Security ID/Account Name/Account Domain: SID/Account name/Domain of the user who executed the tool
  • Object > Object Name: Target file name (C:\Users\[User Name]\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\[RANDOM].customDestinations-ms~RF[RANDOM].TMP)
  • Audit Success: Success or failure (access successful)
  • Process Information > Process Name: Name of the process that closed the handle (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
  • Object > Object Type: Category of the target (File)
  • Subject > Logon ID: Session ID of the user who executed the process
  • Object > Handle ID: ID of the relevant handle (handle obtained with Event ID 4656)
Security 4658 File System The handle to an object was closed.
  • Process Information > Process ID: Process ID (hexadecimal)
  • Process Information > Process Name: Name of the process that requested the object (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
  • Subject > Security ID/Account Name/Account Domain: SID/Account name/Domain of the user who executed the tool
  • Subject > Logon ID: Session ID of the user who executed the process
  • Object > Handle ID: ID of the relevant handle (handle obtained with Event ID 4656)
7 Security 4703 Token Right Adjusted Events A token right was adjusted.
  • Disabled Privileges: Disabled privileges (-)
  • Target Account > Security ID/Account Name/Account Domain: Target user SID/Account name/Domain (NULL SID)
  • Target Account > Logon ID: Session ID of the target user
  • Enabled Privileges: Enabled privileges (SeDebugPrivilege)
  • Subject > Security ID/Account Name/Account Domain: SID/Account name/Domain of the user who executed the tool
  • Subject > Logon ID: Session ID of the user who executed the process
  • Process Information > Process ID: ID of the executed process
  • Process Information > Process Name: Name of the executed process (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
Security 4703 Token Right Adjusted Events A token right was adjusted.
  • Disabled Privileges: Disabled privileges (SeDebugPrivilege)
  • Target Account > Security ID/Account Name/Account Domain: Target user SID/Account name/Domain (NULL SID)
  • Target Account > Logon ID: Session ID of the target user
  • Enabled Privileges: Enabled privileges (-)
  • Subject > Security ID/Account Name/Account Domain: SID/Account name/Domain of the user who executed the tool
  • Subject > Logon ID: Session ID of the user who executed the process
  • Process Information > Process ID: ID of the executed process
  • Process Information > Process Name: Name of the executed process (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
8 Security 4673 Sensitive Privilege Use A privileged service was called.
  • Subject > Security ID/Account Name/Account Domain: SID/Account name/Domain of the user who executed the tool
  • Process > Process ID: ID of the process that used the privilege
  • Subject > Logon ID: Session ID of the user who executed the process
  • Service Request Information > Privilege: Privilege used (SeCreateGlobalPrivilege)
  • Process > Process Name: Process that used the privilege (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
9 Microsoft-Windows-Sysmon/Operational 10 Process accessed (rule: ProcessAccess) Process accessed.
  • SourceProcessGUID/SourceProcessId/SourceThreadId: Process of the access source process/Thread ID
  • TargetProcessGUID/TargetProcessId: Process ID of the access destination process
  • GrantedAccess: Details of the granted access (0x40)
  • SourceImage: Path to the access source process (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
  • TargetImage: Path to the access destination process (C:\Windows\Explorer.EXE)
10 Microsoft-Windows-Sysmon/Operational 13 Registry value set (rule: RegistryEvent) Registry value set.
  • EventType: Process type (SetValue)
  • Image: Path to the executable file (C:\Windows\Explorer.EXE)
  • ProcessGuid/ProcessId: Process ID
  • Details: Setting value written to the registry (QWORD)
  • TargetObject: Registry value at the write destination (\REGISTRY\USER\[User SID]\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\JumplistData\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\WindowsPowerShell\v1.0\powershell.exe)
Microsoft-Windows-Sysmon/Operational 12 Registry object added or deleted (rule: RegistryEvent) Registry object added or deleted.
  • EventType: Process type (CreateKey)
  • Image: Path to the executable file (C:\Windows\Explorer.EXE)
  • ProcessGuid/ProcessId: Process ID
  • TargetObject: Created/deleted registry key/value (\REGISTRY\USER\[User SID]\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps)
11 Microsoft-Windows-Sysmon/Operational 11 File created (rule: FileCreate) File created.
  • Image: Path to the executable file (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
  • ProcessGuid/ProcessId: Process ID
  • TargetFilename: Created file (C:\Users\[User Name]\AppData\Local\Temp\[RANDOM].ps1)
  • CreationUtcTime: File creation date and time (UTC)
Security 4656 File System/Other Object Access Events A handle to an object was requested.
  • Process Information > Process ID: Process ID (hexadecimal)
  • Access Request Information > Access/Reason for Access/Access Mask: Requested privilege (including DELETE)
  • Subject > Security ID/Account Name/Account Domain: SID/Account name/Domain of the user who executed the tool
  • Object > Object Name: Target file name (C:\Users\[User Name]\AppData\Local\Temp\[RANDOM].ps1)
  • Process Information > Process Name: Name of the process that closed the handle (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
  • Object > Object Type: Type of the file (File)
  • Subject > Logon ID: Session ID of the user who executed the process
  • Object > Handle ID: ID of the relevant handle
Security 4663 File System An attempt was made to access an object.
  • Process Information > Process ID: Process ID (hexadecimal)
  • Access Request Information > Access/Reason for Access/Access Mask: Requested privilege (including DELETE)
  • Subject > Security ID/Account Name/Account Domain: SID/Account name/Domain of the user who executed the tool
  • Object > Object Name: Target file name (C:\Users\[User Name]\AppData\Local\Temp\[RANDOM].ps1)
  • Audit Success: Success or failure (access successful)
  • Process Information > Process Name: Name of the process that closed the handle (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
  • Object > Object Type: Category of the target (File)
  • Subject > Logon ID: Session ID of the user who executed the process
  • Object > Handle ID: ID of the relevant handle (handle obtained with Event ID 4656)
Security 4658 File System The handle to an object was closed.
  • Process Information > Process ID: Process ID (hexadecimal)
  • Process Information > Process Name: Name of the process that requested the object (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
  • Subject > Security ID/Account Name/Account Domain: SID/Account name/Domain of the user who executed the tool
  • Subject > Logon ID: Session ID of the user who executed the process
  • Object > Handle ID: ID of the relevant handle (handle obtained with Event ID 4656)
Microsoft-Windows-Sysmon/Operational 11 File created (rule: FileCreate) File created.
  • Image: Path to the executable file (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
  • ProcessGuid/ProcessId: Process ID
  • TargetFilename: Created file (C:\Users\[User Name]\AppData\Local\Temp\[RANDOM].psm1)
  • CreationUtcTime: File creation date and time (UTC)
Security 4656 File System/Other Object Access Events A handle to an object was requested.
  • Process Information > Process ID: Process ID (hexadecimal)
  • Access Request Information > Access/Reason for Access/Access Mask: Requested privilege (including DELETE)
  • Subject > Security ID/Account Name/Account Domain: SID/Account name/Domain of the user who executed the tool
  • Object > Object Name: Target file name (C:\Users\[User Name]\AppData\Local\Temp\[RANDOM].psm1)
  • Process Information > Process Name: Name of the process that closed the handle (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
  • Object > Object Type: Type of the file (File)
  • Subject > Logon ID: Session ID of the user who executed the process
  • Object > Handle ID: ID of the relevant handle
Security 4663 File System An attempt was made to access an object.
  • Process Information > Process ID: Process ID (hexadecimal)
  • Access Request Information > Access/Reason for Access/Access Mask: Requested privilege (including DELETE)
  • Subject > Security ID/Account Name/Account Domain: SID/Account name/Domain of the user who executed the tool
  • Object > Object Name: Target file name (C:\Users\[User Name]\AppData\Local\Temp\[RANDOM].psm1)
  • Audit Success: Success or failure (access successful)
  • Process Information > Process Name: Name of the process that closed the handle (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
  • Object > Object Type: Category of the target (File)
  • Subject > Logon ID: Session ID of the user who executed the process
  • Object > Handle ID: ID of the relevant handle (handle obtained with Event ID 4656)
Security 4658 File System The handle to an object was closed.
  • Process Information > Process ID: Process ID (hexadecimal)
  • Process Information > Process Name: Name of the process that requested the object (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
  • Subject > Security ID/Account Name/Account Domain: SID/Account name/Domain of the user who executed the tool
  • Subject > Logon ID: Session ID of the user who executed the process
  • Object > Handle ID: ID of the relevant handle (handle obtained with Event ID 4656)
Microsoft-Windows-PowerShell/Operational 53504 PowerShell Named Pipe IPC Windows PowerShell has started an IPC listening thread on process [Process ID] of the [Domain].
Microsoft-Windows-PowerShell/Operational 40962 PowerShell Console Startup PowerShell console is ready for user input
12 Microsoft-Windows-Sysmon/Operational 13 Registry value set (rule: RegistryEvent) Registry value set.
  • EventType: Process type
  • Image: Path to the executable file (C:\Windows\Explorer.EXE)
  • ProcessGuid/ProcessId: Process ID
  • Details: Setting value written to the registry (Binary Data)
  • TargetObject: Registry value at the write destination (\REGISTRY\USER\[User SID]\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\JvaqbjfCbjreFuryy\i1.0\cbjrefuryy.rkr)
13 Security 4656 File System/Other Object Access Events A handle to an object was requested.
  • Process Information > Process ID: Process ID (hexadecimal)
  • Access Request Information > Access/Reason for Access/Access Mask: Requested privileges (including WriteData or AddFile, and AppendData)
  • Subject > Security ID/Account Name/Account Domain: SID/Account name/Domain of the user who executed the tool
  • Object > Object Name: Target file name (C:\Windows\Prefetch\POWERSHELL.EXE-[RANDOM].pf)
  • Process Information > Process Name: Name of the process that closed the handle (C:\Windows\System32\svchost.exe)
  • Object > Object Type: Type of the file (File)
  • Subject > Logon ID: Session ID of the user who executed the process
  • Object > Handle ID: ID of the relevant handle
Security 4663 File System An attempt was made to access an object.
  • Process Information > Process ID: Process ID (hexadecimal)
  • Access Request Information > Access/Reason for Access/Access Mask: Requested privileges (including WriteData or AddFile, and AppendData)
  • Subject > Security ID/Account Name/Account Domain: SID/Account name/Domain of the user who executed the tool
  • Object > Object Name: Target file name (C:\Windows\Prefetch\POWERSHELL.EXE-[RANDOM].pf)
  • Audit Success: Success or failure (access successful)
  • Process Information > Process Name: Name of the process that closed the handle (C:\Windows\System32\svchost.exe)
  • Object > Object Type: Category of the target (File)
  • Subject > Logon ID: Session ID of the user who executed the process
  • Object > Handle ID: ID of the relevant handle (handle obtained with Event ID 4656)
Security 4658 File System The handle to an object was closed.
  • Process Information > Process ID: Process ID (hexadecimal)
  • Process Information > Process Name: Name of the process that requested the object (C:\Windows\System32\svchost.exe)
  • Subject > Security ID/Account Name/Account Domain: SID/Account name/Domain of the user who executed the tool
  • Subject > Logon ID: Session ID of the user who executed the process
  • Object > Handle ID: ID of the relevant handle (handle obtained with Event ID 4656)
14 Security 4656 File System/Other Object Access Events A handle to an object was requested.
  • Process Information > Process ID: Process ID (hexadecimal)
  • Access Request Information > Access/Reason for Access/Access Mask: Requested privileges (including WriteData or AddFile, and AppendData)
  • Subject > Security ID/Account Name/Account Domain: SID/Account name/Domain of the user who executed the tool
  • Object > Object Name: Target file name (C:\Users\[User Name]\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt)
  • Process Information > Process Name: Name of the process that closed the handle (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
  • Object > Object Type: Type of the file (File)
  • Subject > Logon ID: Session ID of the user who executed the process
  • Object > Handle ID: ID of the relevant handle
Security 4663 File System An attempt was made to access an object.
  • Process Information > Process ID: Process ID (hexadecimal)
  • Access Request Information > Access/Reason for Access/Access Mask: Requested privileges (including WriteData or AddFile, and AppendData)
  • Subject > Security ID/Account Name/Account Domain: SID/Account name/Domain of the user who executed the tool
  • Object > Object Name: Target file name (C:\Users\[User Name]\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt)
  • Audit Success: Success or failure (access successful)
  • Process Information > Process Name: Name of the process that closed the handle (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
  • Object > Object Type: Category of the target (File)
  • Subject > Logon ID: Session ID of the user who executed the process
  • Object > Handle ID: ID of the relevant handle (handle obtained with Event ID 4656)
Security 4658 File System The handle to an object was closed.
  • Process Information > Process ID: Process ID (hexadecimal)
  • Process Information > Process Name: Name of the process that requested the object (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
  • Subject > Security ID/Account Name/Account Domain: SID/Account name/Domain of the user who executed the tool
  • Subject > Logon ID: Session ID of the user who executed the process
  • Object > Handle ID: ID of the relevant handle (handle obtained with Event ID 4656)
Microsoft-Windows-PowerShell/Operational 4104 Execute a Remote Command. Creating Scriptblock text.
  • Message: The content of the script executed. The content of the executed PowerShell script is recorded as is.
15 Microsoft-Windows-Sysmon/Operational 3 Network connection detected (rule: NetworkConnect) Network connection detected.
  • Protocol: Protocol (tcp)
  • DestinationIp: Destination IP address (Domain Controller IP address)
  • Image: Path to the executable file (System)
  • DestinationHostname: Destination host name (Domain Controller host name)
  • ProcessGuid/ProcessId: Process ID (4)
  • User: Execute as user (NT AUTHORITY\SYSTEM)
  • DestinationPort: Destination port number (445)
  • SourcePort: Source port number (high port)
  • SourceHostname: Source host name (source host name)
  • SourceIp: Source IP address (source host IP address)
Security 5156 Filtering Platform Connection The Windows Filtering Platform has allowed a connection.
  • Network Information > Destination Port: Destination port number (445)
  • Network Information > Source Port: Source port number (high port)
  • Network Information > Destination Address: Destination IP address (Domain Controller)
  • Network Information > Protocol: Protocol used (6=TCP)
  • Application Information > Application Name: Execution process (System)
  • Network Information > Direction: Communication direction (outbound)
  • Network Information > Source Address: Source IP address (source host)
  • Application Information > Process ID: Process ID (4)
16 Microsoft-Windows-Sysmon/Operational 3 Network connection detected (rule: NetworkConnect) Network connection detected.
  • Protocol: Protocol (tcp)
  • DestinationIp: Destination IP address (Domain Controller IP address)
  • Image: Path to the executable file (C:\Windows\System32\lsass.exe)
  • DestinationHostname: Destination host name (Domain Controller host name)
  • ProcessGuid/ProcessId: Process ID
  • User: Execute as user (NT AUTHORITY\SYSTEM)
  • DestinationPort: Destination port number (88)
  • SourcePort: Source port number (high port)
  • SourceHostname: Source host name (source host name)
  • SourceIp: Source IP address (source host IP address)
Security 5156 Filtering Platform Connection The Windows Filtering Platform has allowed a connection.
  • Network Information > Destination Port: Destination port number (88)
  • Network Information > Source Port: Source port number (high port)
  • Network Information > Destination Address: Destination IP address (Domain Controller)
  • Network Information > Protocol: Protocol used (6=TCP)
  • Application Information > Application Name: Execution process (\device\harddiskvolume2\windows\system32\lsass.exe)
  • Network Information > Direction: Communication direction (outbound)
  • Network Information > Source Address: Source IP address (source host)
  • Application Information > Process ID: Process ID
17 Security 4656 File System/Other Object Access Events A handle to an object was requested.
  • Process Information > Process ID: Process ID (hexadecimal)
  • Access Request Information > Access/Reason for Access/Access Mask: Requested privileges (including WriteData or AddFile, and AppendData)
  • Subject > Security ID/Account Name/Account Domain: SID/Account name/Domain of the user who executed the tool
  • Object > Object Name: Target file name (C:\Users\[User Name]\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive)
  • Process Information > Process Name: Name of the process that closed the handle (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
  • Object > Object Type: Type of the file (File)
  • Subject > Logon ID: Session ID of the user who executed the process
  • Object > Handle ID: ID of the relevant handle
Security 4663 File System An attempt was made to access an object.
  • Process Information > Process ID: Process ID (hexadecimal)
  • Access Request Information > Access/Reason for Access/Access Mask: Requested privileges (including WriteData or AddFile, and AppendData)
  • Subject > Security ID/Account Name/Account Domain: SID/Account name/Domain of the user who executed the tool
  • Object > Object Name: Target file name (C:\Users\[User Name]\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive)
  • Audit Success: Success or failure (access successful)
  • Process Information > Process Name: Name of the process that closed the handle (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
  • Object > Object Type: Category of the target (File)
  • Subject > Logon ID: Session ID of the user who executed the process
  • Object > Handle ID: ID of the relevant handle (handle obtained with Event ID 4656)
Security 4658 File System The handle to an object was closed.
  • Process Information > Process ID: Process ID (hexadecimal)
  • Process Information > Process Name: Name of the process that requested the object (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
  • Subject > Security ID/Account Name/Account Domain: SID/Account name/Domain of the user who executed the tool
  • Subject > Logon ID: Session ID of the user who executed the process
  • Object > Handle ID: ID of the relevant handle (handle obtained with Event ID 4656)
18 Microsoft-Windows-Sysmon/Operational 5 Process terminated (rule: ProcessTerminate) Process terminated.
  • UtcTime: Process terminated date and time (UTC)
  • ProcessGuid/ProcessId: Process ID
  • Image: Path to the executable file (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
Security 4689 Process Termination A process has exited.
  • Process Information > Process ID: Process ID (hexadecimal)
  • Subject > Security ID/Account Name/Account Domain: SID/Account name/Domain of the user who executed the tool
  • Process Information > Exit Status: Process return value (0xC000013A)
  • Log Date and Time: Process terminated date and time (local time)
  • Process Information > Process Name: Path to the executable file (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
  • Subject > Logon ID: Session ID of the user who executed the process

- UserAssist

# Registry entry Information That Can Be Confirmed
1 HKEY_USERS\[User SID]\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\JvaqbjfCbjreFuryy\i1.0\cbjrefuryy.rkr Date and time of the initial execution, Total number of executions

- MFT

# Path Header Flag Validity
1 [Drive Name]:\Windows\Prefetch\POWERSHELL.EXE-[RANDOM].pf FILE ALLOCATED
2 [Drive Name]:\Users\[User Name]\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations FOLDER ALLOCATED
3 [Drive Name]:\Users\[User Name]\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\[RANDOM].customDestinations-ms FILE ALLOCATED
4 [Drive Name]:\Users\[User Name]\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt FILE ALLOCATED

- Prefetch

# Prefetch File Process Name Process Path Information That Can Be Confirmed
1 POWERSHELL.EXE-[RANDOM].pf POWERSHELL.EXE \VOLUME{[GUID]}\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE Last Run Time (last execution date and time)

- Registry Entry

# Path Type Value
1 HKEY_USERS\[User SID]\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\JvaqbjfCbjreFuryy\i1.0\cbjrefuryy.rkr Binary [Binary Value]
2 HKEY_USERS\[User SID]\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\JumplistData\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\WindowsPowerShell\v1.0\powershell.exe Binary [Binary Value]

- Details: Domain Controller

- Event Log

# Event Log Event ID Task Category Event Details
1 Microsoft-Windows-Sysmon/Operational 3 Network connection detected (rule: NetworkConnect) Network connection detected.
  • Protocol: Protocol (tcp)
  • DestinationIp: Destination IP address (source host IP address)
  • Image: Path to the executable file (System)
  • DestinationHostname: Destination host name (source host name)
  • ProcessGuid/ProcessId: Process ID (4)
  • User: Execute as user (NT AUTHORITY\SYSTEM)
  • DestinationPort: Destination port number (high port)
  • SourcePort: Source port number (445)
  • SourceHostname: Source host name (Domain Controller host name)
  • SourceIp: Source IP address (Domain Controller IP address)
Security 5156 Filtering Platform Connection The Windows Filtering Platform has allowed a connection.
  • Network Information > Destination Port: Destination port number (high port)
  • Network Information > Source Port: Source port number (445)
  • Network Information > Destination Address: Destination IP address (source host)
  • Network Information > Protocol: Protocol used (6=TCP)
  • Application Information > Application Name: Execution process (System)
  • Network Information > Direction: Communication direction (inbound)
  • Network Information > Source Address: Source IP address (Domain Controller)
  • Application Information > Process ID: Process ID (4)
2 Microsoft-Windows-Sysmon/Operational 3 Network connection detected (rule: NetworkConnect) Network connection detected.
  • Protocol: Protocol (tcp)
  • DestinationIp: Destination IP address (source host IP address)
  • Image: Path to the executable file (C:\Windows\System32\lsass.exe)
  • DestinationHostname: Destination host name (source host name)
  • ProcessGuid/ProcessId: Process ID
  • User: Execute as user (NT AUTHORITY\SYSTEM)
  • DestinationPort: Destination port number (high port)
  • SourcePort: Source port number (88)
  • SourceHostname: Source host name (Domain Controller host name)
  • SourceIp: Source IP address (Domain Controller IP address)
Security 5156 Filtering Platform Connection The Windows Filtering Platform has allowed a connection.
  • Network Information > Destination Port: Destination port number (high port)
  • Network Information > Source Port: Source port number (88)
  • Network Information > Destination Address: Destination IP address (source host)
  • Network Information > Protocol: Protocol used (6=TCP)
  • Application Information > Application Name: Execution process (\device\harddiskvolume2\windows\system32\lsass.exe)
  • Network Information > Direction: Communication direction (inbound)
  • Network Information > Source Address: Source IP address (Domain Controller)
  • Application Information > Process ID: Process ID
Security 4768 Kerberos Authentication Service A Kerberos authentication ticket (TGT) was requested.
  • Network Information > Client Address: Source IP address that requested the ticket (source host)
  • Account Information > Supplied Realm Name: Domain of the account
  • Account Information > Account Name: Name of the account from which the ticket was requested
  • Additional Information > Ticket Option: Ticket settings (0x40810010)
  • Service Information > Service Name: Requested service name (krbtgt)
  • Additional Information > Result Code: Ticket processing result (0x12)
  • Network Information > Client Port: Source port number of the ticket request (high port)
  • Account Information > User ID: SID of the account
3 Microsoft-Windows-Sysmon/Operational 3 Network connection detected (rule: NetworkConnect) Network connection detected.
  • Protocol: Protocol (tcp)
  • DestinationIp: Destination IP address (source host IP address)
  • Image: Path to the executable file (C:\Windows\System32\lsass.exe)
  • DestinationHostname: Destination host name (source host name)
  • ProcessGuid/ProcessId: Process ID
  • User: Execute as user (NT AUTHORITY\SYSTEM)
  • DestinationPort: Destination port number (high port)
  • SourcePort: Source port number (88)
  • SourceHostname: Source host name (Domain Controller host name)
  • SourceIp: Source IP address (Domain Controller IP address)
Security 5156 Filtering Platform Connection The Windows Filtering Platform has allowed a connection.
  • Network Information > Destination Port: Destination port number (high port)
  • Network Information > Source Port: Source port number (88)
  • Network Information > Destination Address: Destination IP address (source host)
  • Network Information > Protocol: Protocol used (6=TCP)
  • Application Information > Application Name: Execution process (\device\harddiskvolume2\windows\system32\lsass.exe)
  • Network Information > Direction: Communication direction (inbound)
  • Network Information > Source Address: Source IP address (Domain Controller)
  • Application Information > Process ID: Process ID
Security 4769 A Kerberos service ticket was requested A Kerberos service ticket was requested.
  • Network Information > Client Address: Source IP address that requested the ticket (source host)
  • Account Information > Account Domain: Domain of the account
  • Account Information > Account Name: Name of the account from which the ticket was requested
  • Additional Information > Ticket Option: Ticket settings (0x40800000)
  • Additional Information > Error Code: Ticket processing result (0x0)
  • Service Information > Service Name: Service name of the ticket ([Host Name]$)
  • Account Information > Logon GUID: Session ID of the logon
  • Network Information > Client Port: Source port number of the ticket request (high port)
4 Microsoft-Windows-Sysmon/Operational 3 Network connection detected (rule: NetworkConnect) Network connection detected.
  • Protocol: Protocol (tcp)
  • DestinationIp: Destination IP address (source host IP address)
  • Image: Path to the executable file (C:\Windows\System32\lsass.exe)
  • DestinationHostname: Destination host name (source host name)
  • ProcessGuid/ProcessId: Process ID
  • User: Execute as user (NT AUTHORITY\SYSTEM)
  • DestinationPort: Destination port number (high port)
  • SourcePort: Source port number (88)
  • SourceHostname: Source host name (Domain Controller host name)
  • SourceIp: Source IP address (Domain Controller IP address)
Security 5156 Filtering Platform Connection The Windows Filtering Platform has allowed a connection.
  • Network Information > Destination Port: Destination port number (high port)
  • Network Information > Source Port: Source port number (88)
  • Network Information > Destination Address: Destination IP address (source host)
  • Network Information > Protocol: Protocol used (6=TCP)
  • Application Information > Application Name: Execution process (\device\harddiskvolume2\windows\system32\lsass.exe)
  • Network Information > Direction: Communication direction (inbound)
  • Network Information > Source Address: Source IP address (Domain Controller)
  • Application Information > Process ID: Process ID
Security 4769 A Kerberos service ticket was requested A Kerberos service ticket was requested.
  • Network Information > Client Address: Source IP address that requested the ticket (source host)
  • Account Information > Account Domain: Domain of the account
  • Account Information > Account Name: Name of the account from which the ticket was requested
  • Additional Information > Ticket Option: Ticket settings (0x60810010)
  • Additional Information > Error Code: Ticket processing result (0x0)
  • Service Information > Service Name: Service name of the ticket (krbtgt)
  • Account Information > Logon GUID: Session ID of the logon
  • Network Information > Client Port: Source port number of the ticket request (high port)
5 Security 4672 Special Logon Privileges assigned to a new logon.
  • Privileges: Assigned privileges (SeSecurityPrivilege, SeBackupPrivilege, SeRestorePrivilege, SeTakeOwnershipPrivilege, SeDebugPrivilege, SeSystemEnvironmentPrivilege, SeLoadDriverPrivilege, SeImpersonatePrivilege, SeEnableDelegationPrivilege)
  • Subject > Security ID/Account Name/Account Domain: SID/Account name/Domain of the user who executed the tool
  • Subject > Logon ID: Session ID of the user who executed the process
Security 4624 Logon An account was successfully logged on.
  • Process Information > Process ID: Process ID (hexadecimal)
  • Subject > Security ID/Account Name/Account Domain: SID/Account name/Domain of the user who executed the tool
  • New Logon > Logon ID/Logon GUID: Session ID of the user who was logged on
  • Detailed Authentication Information > Package Name (NTLM only): NTLM version
  • Detailed Authentication Information > Logon Process: Process used for logon (Kerberos)
  • Network Information > Source Port: Source port number (high port)
  • New Logon > Security ID/Account Name/Account Domain: SID/Account name/Domain of the user who was logged on
  • Logon Type: Logon path, method, etc. (3=Network)
  • Network Information > Workstation Name: Name of the host that requested the logon
  • Detailed Authentication Information > Key Length: Length of the key used for the authentication (0)
  • Process Information > Process Name: Path to the executable file
  • Detailed Authentication Information > Authentication Package: Authentication package used (Kerberos)
  • Network Information > Source Network Address: IP address that requested the logon (source host IP address)
  • Subject > Logon ID: Session ID of the user who executed the authentication
6 Security 5145 Detailed File Share A network share object was checked to see whether the client can be granted the desired access.
  • Network Information > Source Port: Source port number (high port)
  • Network Information > Object Type: Type of the created object (File)
  • Shared Information > Share Path: Path to the share (\??\C:\Windows\SYSVOL\sysvol)
  • Access Request Information > Access: Requested privileges (including SYNCHRONIZE, ReadData or ListDirectory, and ReadAttributes)
  • Shared Information > Share Name: Share name (\\*\SYSVOL)
  • Subject > Security ID/Account Name/Account Domain: SID/Account name/Domain of the user who executed the tool
  • Shared Information > Relative Target Name: Relative target name from the share path (\)
  • Network Information > Source Address: Source IP address (source host IP address)
  • Subject > Logon ID: Session ID of the user who executed the process
Security 5145 Detailed File Share A network share object was checked to see whether the client can be granted the desired access.
  • Network Information > Source Port: Source port number (high port)
  • Network Information > Object Type: Type of the created object (File)
  • Shared Information > Share Path: Path to the share (\??\C:\Windows\SYSVOL\sysvol)
  • Access Request Information > Access: Requested privileges (including ReadAttributes)
  • Shared Information > Share Name: Share name (\\*\SYSVOL)
  • Subject > Security ID/Account Name/Account Domain: SID/Account name/Domain of the user who executed the tool
  • Shared Information > Relative Target Name: Relative target name from the share path ([Domain Name]\Policies\[GUID]\MACHINE\Microsoft\Windows NT\SecEdit\GptTmpl.inf)
  • Network Information > Source Address: Source IP address (source host IP address)
  • Subject > Logon ID: Session ID of the user who executed the process
Security 5145 Detailed File Share A network share object was checked to see whether the client can be granted the desired access.
  • Network Information > Source Port: Source port number (high port)
  • Network Information > Object Type: Type of the created object (File)
  • Shared Information > Share Path: Path to the share (\??\C:\Windows\SYSVOL\sysvol)
  • Access Request Information > Access: Requested privileges (including ReadAttributes)
  • Shared Information > Share Name: Share name (\\*\SYSVOL)
  • Subject > Security ID/Account Name/Account Domain: SID/Account name/Domain of the user who executed the tool
  • Shared Information > Relative Target Name: Relative target name from the share path ([Domain Name]\Policies\[GUID]\MACHINE\Microsoft\Windows NT\SecEdit\Registry.pol)
  • Network Information > Source Address: Source IP address (source host IP address)
  • Subject > Logon ID: Session ID of the user who executed the process
Security 5145 Detailed File Share A network share object was checked to see whether the client can be granted the desired access.
  • Network Information > Source Port: Source port number (high port)
  • Network Information > Object Type: Type of the created object (File)
  • Shared Information > Share Path: Path to the share (\??\C:\Windows\SYSVOL\sysvol)
  • Access Request Information > Access: Requested privileges (including ReadAttributes)
  • Shared Information > Share Name: Share name (\\*\SYSVOL)
  • Subject > Security ID/Account Name/Account Domain: SID/Account name/Domain of the user who executed the tool
  • Shared Information > Relative Target Name: Relative target name from the share path ([Domain Name]\Policies\[GUID]\GPT.INI)
  • Network Information > Source Address: Source IP address (source host IP address)
  • Subject > Logon ID: Session ID of the user who executed the process
Security 5145 Detailed File Share A network share object was checked to see whether the client can be granted the desired access.
  • Network Information > Source Port: Source port number (high port)
  • Network Information > Object Type: Type of the created object (File)
  • Shared Information > Share Path: Path to the share (\??\C:\Windows\SYSVOL\sysvol)
  • Access Request Information > Access: Requested privileges (including ReadAttributes)
  • Shared Information > Share Name: Share name (\\*\SYSVOL)
  • Subject > Security ID/Account Name/Account Domain: SID/Account name/Domain of the user who executed the tool
  • Shared Information > Relative Target Name: Relative target name from the share path ([Domain Name]\Policies\[GUID]\Machine\Preferences\Groups\Groups.xml)
  • Network Information > Source Address: Source IP address (source host IP address)
  • Subject > Logon ID: Session ID of the user who executed the process
Security 5145 Detailed File Share A network share object was checked to see whether the client can be granted the desired access.
  • Network Information > Source Port: Source port number (high port)
  • Network Information > Object Type: Type of the created object (File)
  • Shared Information > Share Path: Path to the share (\??\C:\Windows\SYSVOL\sysvol)
  • Access Request Information > Access: Requested privileges (including SYNCHRONIZE, ReadData or ListDirectory, and ReadAttributes)
  • Shared Information > Share Name: Share name (\\*\SYSVOL)
  • Subject > Security ID/Account Name/Account Domain: SID/Account name/Domain of the user who executed the tool
  • Shared Information > Relative Target Name: Relative target name from the share path ([Domain Name]\scripts)
  • Network Information > Source Address: Source IP address (source host IP address)
  • Subject > Logon ID: Session ID of the user who executed the process

- Packet Capture

# Process Source Host Source Port Number Destination Host Destination Port Number Protocol/Application
1 Negotiate Protocol Request [Source Host] [High Port] [Destination Host] 445 SMB2
Negotiate Protocol Response [Destination Host] 445 [Source Host] [High Port] SMB2
2 Session Setup Request [Source Host] [High Port] [Destination Host] 445 SMB2
Session Setup Response [Destination Host] 445 [Source Host] [High Port] SMB2
3 Tree Connect Request Tree: \\[NetBIOS Name at Destination]\sysvol [Source Host] [High Port] [Destination Host] 445 SMB2
Tree Connect Response [Destination Host] 445 [Source Host] [High Port] SMB2
4 Ioctl Request FSCTL_VALIDATE_NEGOTIATE_INFO [Source Host] [High Port] [Destination Host] 445 SMB2
Ioctl Response FSCTL_VALIDATE_NEGOTIATE_INFO [Destination Host] 445 [Source Host] [High Port] SMB2
5 Ioctl Request FSCTL_QUERY_NETWORK_INTERFACE_INFO [Source Host] [High Port] [Destination Host] 445 SMB2
Create Request File: [Domain Name]\Policies\{[GUID]}\gpt.ini [Destination Host] 445 [Source Host] [High Port] SMB2
6 Ioctl Response FSCTL_QUERY_NETWORK_INTERFACE_INFO [Source Host] [High Port] [Destination Host] 445 SMB2
Create Response File: [Domain Name]\Policies\{[GUID]}\gpt.ini [Destination Host] 445 [Source Host] [High Port] SMB2
7 GetInfo Request FILE_INFO/SMB2_FILE_NETWORK_OPEN_INFO File: [Domain Name]\Policies\{[GUID]}\gpt.ini [Source Host] [High Port] [Destination Host] 445 SMB2
GetInfo Response [Destination Host] 445 [Source Host] [High Port] SMB2
8 Read Request Len:[Length] Off:0 File: [Domain Name]\Policies\{[GUID]}\gpt.ini [Source Host] [High Port] [Destination Host] 445 SMB2
Read Response [Destination Host] 445 [Source Host] [High Port] SMB2
9 Create Request File: [Domain Name]\Policies\{[GUID]}\Machine [Source Host] [High Port] [Destination Host] 445 SMB2
Create Response File: [Domain Name]\Policies\{[GUID]}\Machine [Destination Host] 445 [Source Host] [High Port] SMB2
10 GetInfo Request FILE_INFO/SMB2_FILE_NETWORK_OPEN_INFO File: [Domain Name]\Policies\{[GUID]}\Machine [Source Host] [High Port] [Destination Host] 445 SMB2
GetInfo Response [Destination Host] 445 [Source Host] [High Port] SMB2
11 Find Request File: [Domain Name]\Policies\{[GUID]}\Machine SMB2_FIND_ID_BOTH_DIRECTORY_INFO Pattern: *;Find Request File: [Domain Name]\Policies\{[GUID]}\Machine SMB2_FIND_ID_BOTH_DIRECTORY_INFO Pattern: * [Source Host] [High Port] [Destination Host] 445 SMB2
Find Response SMB2_FIND_ID_BOTH_DIRECTORY_INFO Pattern: *;Find Response, Error: STATUS_NO_MORE_FILES SMB2_FIND_ID_BOTH_DIRECTORY_INFO Pattern: * [Destination Host] 445 [Source Host] [High Port] SMB2
12 Create Request File: [Domain Name]\Policies\{[GUID]}\Machine\Microsoft [Source Host] [High Port] [Destination Host] 445 SMB2
Create Response File: [Domain Name]\Policies\{[GUID]}\Machine\Microsoft [Destination Host] 445 [Source Host] [High Port] SMB2
13 GetInfo Request FILE_INFO/SMB2_FILE_NETWORK_OPEN_INFO File: [Domain Name]\Policies\{[GUID]}\Machine\Microsoft [Source Host] [High Port] [Destination Host] 445 SMB2
GetInfo Response [Destination Host] 445 [Source Host] [High Port] SMB2
14 Find Request File: [Domain Name]\Policies\{[GUID]}\Machine\Microsoft SMB2_FIND_ID_BOTH_DIRECTORY_INFO Pattern: *;Find Request File: [Domain Name]\Policies\{[GUID]}\Machine\Microsoft SMB2_FIND_ID_BOTH_DIRECTORY_INFO Pattern: * [Source Host] [High Port] [Destination Host] 445 SMB2
Find Response SMB2_FIND_ID_BOTH_DIRECTORY_INFO Pattern: *;Find Response, Error: STATUS_NO_MORE_FILES SMB2_FIND_ID_BOTH_DIRECTORY_INFO Pattern: * [Destination Host] 445 [Source Host] [High Port] SMB2
15 Create Request File: [Domain Name]\Policies\{[GUID]}\Machine\Microsoft\Windows NT [Source Host] [High Port] [Destination Host] 445 SMB2
Create Response File: [Domain Name]\Policies\{[GUID]}\Machine\Microsoft\Windows NT [Destination Host] 445 [Source Host] [High Port] SMB2
16 GetInfo Request FILE_INFO/SMB2_FILE_NETWORK_OPEN_INFO File: [Domain Name]\Policies\{[GUID]}\Machine\Microsoft\Windows NT [Source Host] [High Port] [Destination Host] 445 SMB2
GetInfo Response [Destination Host] 445 [Source Host] [High Port] SMB2
17 Find Request File: [Domain Name]\Policies\{[GUID]}\Machine\Microsoft\Windows NT SMB2_FIND_ID_BOTH_DIRECTORY_INFO Pattern: *;Find Request File: [Domain Name]\Policies\{[GUID]}\Machine\Microsoft\Windows NT SMB2_FIND_ID_BOTH_DIRECTORY_INFO Pattern: * [Source Host] [High Port] [Destination Host] 445 SMB2
Find Response SMB2_FIND_ID_BOTH_DIRECTORY_INFO Pattern: *;Find Response, Error: STATUS_NO_MORE_FILES SMB2_FIND_ID_BOTH_DIRECTORY_INFO Pattern: * [Destination Host] 445 [Source Host] [High Port] SMB2
18 Create Request File: [Domain Name]\Policies\{[GUID]}\Machine\Microsoft\Windows NT\SecEdit [Source Host] [High Port] [Destination Host] 445 SMB2
Create Response File: [Domain Name]\Policies\{[GUID]}\Machine\Microsoft\Windows NT\SecEdit [Destination Host] 445 [Source Host] [High Port] SMB2
19 GetInfo Request FILE_INFO/SMB2_FILE_NETWORK_OPEN_INFO File: [Domain Name]\Policies\{[GUID]}\Machine\Microsoft\Windows NT\SecEdit [Source Host] [High Port] [Destination Host] 445 SMB2
GetInfo Response [Destination Host] 445 [Source Host] [High Port] SMB2
20 Find Request File: [Domain Name]\Policies\{[GUID]}\Machine\Microsoft\Windows NT\SecEdit SMB2_FIND_ID_BOTH_DIRECTORY_INFO Pattern: *;Find Request File: [Domain Name]\Policies\{[GUID]}\Machine\Microsoft\Windows NT\SecEdit SMB2_FIND_ID_BOTH_DIRECTORY_INFO Pattern: * [Source Host] [High Port] [Destination Host] 445 SMB2
Find Response SMB2_FIND_ID_BOTH_DIRECTORY_INFO Pattern: *;Find Response, Error: STATUS_NO_MORE_FILES SMB2_FIND_ID_BOTH_DIRECTORY_INFO Pattern: * [Destination Host] 445 [Source Host] [High Port] SMB2
21 Create Request File: [Domain Name]\Policies\{[GUID]}\Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf [Source Host] [High Port] [Destination Host] 445 SMB2
Create Response File: [Domain Name]\Policies\{[GUID]}\Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf [Destination Host] 445 [Source Host] [High Port] SMB2
22 GetInfo Request FILE_INFO/SMB2_FILE_NETWORK_OPEN_INFO File: [Domain Name]\Policies\{[GUID]}\Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf [Source Host] [High Port] [Destination Host] 445 SMB2
GetInfo Response [Destination Host] 445 [Source Host] [High Port] SMB2
23 GetInfo Request FILE_INFO/SMB2_FILE_EA_INFO File: [Domain Name]\Policies\{[GUID]}\Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf;GetInfo Request FILE_INFO/SMB2_FILE_STREAM_INFO File: [Domain Name]\Policies\{[GUID]}\Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf;GetInfo Request SEC_INFO/SMB2_SEC_INFO_00 File: [Domain Name]\Policies\{[GUID]}\Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf [Source Host] [High Port] [Destination Host] 445 SMB2
GetInfo Response;GetInfo Response;GetInfo Response [Destination Host] 445 [Source Host] [High Port] SMB2
24 GetInfo Request FILE_INFO/SMB2_FILE_STREAM_INFO File: [Domain Name]\Policies\{[GUID]}\Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf [Source Host] [High Port] [Destination Host] 445 SMB2
GetInfo Response [Destination Host] 445 [Source Host] [High Port] SMB2
25 GetInfo Request FILE_INFO/SMB2_FILE_EA_INFO File: [Domain Name]\Policies\{[GUID]}\Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf [Source Host] [High Port] [Destination Host] 445 SMB2
GetInfo Response [Destination Host] 445 [Source Host] [High Port] SMB2
26 GetInfo Request FS_INFO/FileFsVolumeInformation File: [Domain Name]\Policies\{[GUID]}\Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf;GetInfo Request FS_INFO/FileFsAttributeInformation File: [Domain Name]\Policies\{[GUID]}\Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf [Source Host] [High Port] [Destination Host] 445 SMB2
GetInfo Response;GetInfo Response [Destination Host] 445 [Source Host] [High Port] SMB2
27 GetInfo Request SEC_INFO/SMB2_SEC_INFO_00 File: [Domain Name]\Policies\{[GUID]}\Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf [Source Host] [High Port] [Destination Host] 445 SMB2
GetInfo Response [Destination Host] 445 [Source Host] [High Port] SMB2
28 Read Request Len:1098 Off:0 File: [Domain Name]\Policies\{[GUID]}\Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf [Source Host] [High Port] [Destination Host] 445 SMB2
Read Response [Destination Host] 445 [Source Host] [High Port] SMB2
29 Create Request File: [Domain Name]\Policies\{[GUID]}\Machine\Registry.pol [Source Host] [High Port] [Destination Host] 445 SMB2
Create Response File: [Domain Name]\Policies\{[GUID]}\Machine\Registry.pol [Destination Host] 445 [Source Host] [High Port] SMB2
30 GetInfo Request FILE_INFO/SMB2_FILE_NETWORK_OPEN_INFO File: [Domain Name]\Policies\{[GUID]}\Machine\Registry.pol [Source Host] [High Port] [Destination Host] 445 SMB2
GetInfo Response [Destination Host] 445 [Source Host] [High Port] SMB2
31 GetInfo Request FILE_INFO/SMB2_FILE_EA_INFO File: [Domain Name]\Policies\{[GUID]}\Machine\Registry.pol;GetInfo Request FILE_INFO/SMB2_FILE_STREAM_INFO File: [Domain Name]\Policies\{[GUID]}\Machine\Registry.pol;GetInfo Request SEC_INFO/SMB2_SEC_INFO_00 File: [Domain Name]\Policies\{[GUID]}\Machine\Registry.pol [Source Host] [High Port] [Destination Host] 445 SMB2
GetInfo Response;GetInfo Response;GetInfo Response [Destination Host] 445 [Source Host] [High Port] SMB2
32 GetInfo Request FILE_INFO/SMB2_FILE_STREAM_INFO File: [Domain Name]\Policies\{[GUID]}\Machine\Registry.pol [Source Host] [High Port] [Destination Host] 445 SMB2
GetInfo Response [Destination Host] 445 [Source Host] [High Port] SMB2
33 GetInfo Request FILE_INFO/SMB2_FILE_EA_INFO File: [Domain Name]\Policies\{[GUID]}\Machine\Registry.pol [Source Host] [High Port] [Destination Host] 445 SMB2
GetInfo Response [Destination Host] 445 [Source Host] [High Port] SMB2
34 GetInfo Request SEC_INFO/SMB2_SEC_INFO_00 File: [Domain Name]\Policies\{[GUID]}\Machine\Registry.pol [Source Host] [High Port] [Destination Host] 445 SMB2
GetInfo Response [Destination Host] 445 [Source Host] [High Port] SMB2
35 Read Request Len:2790 Off:0 File: [Domain Name]\Policies\{[GUID]}\Machine\Registry.pol [Source Host] [High Port] [Destination Host] 445 SMB2
Read Response [Destination Host] 445 [Source Host] [High Port] SMB2
36 GetInfo Request FILE_INFO/SMB2_FILE_EA_INFO File: [Domain Name]\Policies\{[GUID]}\gpt.ini;GetInfo Request FILE_INFO/SMB2_FILE_STREAM_INFO File: [Domain Name]\Policies\{[GUID]}\gpt.ini;GetInfo Request SEC_INFO/SMB2_SEC_INFO_00 File: [Domain Name]\Policies\{[GUID]}\gpt.ini [Source Host] [High Port] [Destination Host] 445 SMB2
GetInfo Response;GetInfo Response;GetInfo Response [Destination Host] 445 [Source Host] [High Port] SMB2
37 GetInfo Request FILE_INFO/SMB2_FILE_STREAM_INFO File: [Domain Name]\Policies\{[GUID]}\gpt.ini [Source Host] [High Port] [Destination Host] 445 SMB2
GetInfo Response [Destination Host] 445 [Source Host] [High Port] SMB2
38 GetInfo Request FILE_INFO/SMB2_FILE_EA_INFO File: [Domain Name]\Policies\{[GUID]}\gpt.ini [Source Host] [High Port] [Destination Host] 445 SMB2
GetInfo Response [Destination Host] 445 [Source Host] [High Port] SMB2
39 GetInfo Request SEC_INFO/SMB2_SEC_INFO_00 File: [Domain Name]\Policies\{[GUID]}\gpt.ini [Source Host] [High Port] [Destination Host] 445 SMB2
GetInfo Response [Destination Host] 445 [Source Host] [High Port] SMB2
40 Close Request File: [Domain Name]\Policies\{[GUID]}\Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf [Source Host] [High Port] [Destination Host] 445 SMB2
Close Response [Destination Host] 445 [Source Host] [High Port] SMB2
41 Close Request File: [Domain Name]\Policies\{[GUID]}\Machine\Registry.pol [Source Host] [High Port] [Destination Host] 445 SMB2
Close Response [Destination Host] 445 [Source Host] [High Port] SMB2
42 Close Request File: [Domain Name]\Policies\{[GUID]}\gpt.ini [Source Host] [High Port] [Destination Host] 445 SMB2
Close Response [Destination Host] 445 [Source Host] [High Port] SMB2
43 Session Setup Request [Source Host] [High Port] [Destination Host] 445 SMB2
Session Setup Response [Destination Host] 445 [Source Host] [High Port] SMB2
Tree Connect Request Tree: \\[NetBIOS Name at Destination Host]\IPC$ [Source Host] [High Port] [Destination Host] 445 SMB2
Tree Connect Response [Destination Host] 445 [Source Host] [High Port] SMB2
Ioctl Request FSCTL_DFS_GET_REFERRALS, File: [Source Host] [High Port] [Destination Host] 445 SMB2
Ioctl Response FSCTL_DFS_GET_REFERRALS [Destination Host] 445 [Source Host] [High Port] SMB2
Tree Disconnect Request [Source Host] [High Port] [Destination Host] 445 SMB2
Tree Disconnect Response [Destination Host] 445 [Source Host] [High Port] SMB2
Session Logoff Request [Source Host] [High Port] [Destination Host] 445 SMB2
Session Logoff Response [Destination Host] 445 [Source Host] [High Port] SMB2
44 Close Request File: [Domain Name]\Policies\{[GUID]}\Machine\Microsoft\Windows NT\SecEdit [Source Host] [High Port] [Destination Host] 445 SMB2
Close Response [Destination Host] 445 [Source Host] [High Port] SMB2
45 Close Request File: [Domain Name]\Policies\{[GUID]}\Machine\Microsoft\Windows NT [Source Host] [High Port] [Destination Host] 445 SMB2
Close Response [Destination Host] 445 [Source Host] [High Port] SMB2
46 Close Request File: [Domain Name]\Policies\{[GUID]}\Machine\Microsoft [Source Host] [High Port] [Destination Host] 445 SMB2
Close Response [Destination Host] 445 [Source Host] [High Port] SMB2
47 Close Request File: [Domain Name]\Policies\{[GUID]}\Machine [Source Host] [High Port] [Destination Host] 445 SMB2
Close Response [Destination Host] 445 [Source Host] [High Port] SMB2
48 Tree Disconnect Request [Source Host] [High Port] [Destination Host] 445 SMB2
Tree Disconnect Response [Destination Host] 445 [Source Host] [High Port] SMB2
49 Session Logoff Request [Source Host] [High Port] [Destination Host] 445 SMB2
Session Logoff Response [Destination Host] 445 [Source Host] [High Port] SMB2