Marksman

Scenario

The security team is trialling PersistenceSniper, an open-source IR tool for detecting persistence mechanisms on Windows endpoints. An IR engagement is underway — the task is to combine PersistenceSniper output with manual investigation techniques across Event Logs, Windows Defender, Task Scheduler, and local user management to fully characterise the compromise.

Methodology

Stage 1 — Initial Access: Brute Force Identification

The Security event log is the first stop. Querying for failed logon events (Event ID 4625) immediately reveals the scale of the attack:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} | Measure-Object

Count: 6504

6504 failed logons is unambiguous — this is a sustained brute force campaign, not a fat-finger lockout. The volume and pattern confirms T1110.001 (Brute Force: Password Guessing) as the initial access technique.

Ranking source IPs across the failed logon events surfaces the attacker: 146.70.36.200 from workstation kali — the hostname alone is a dead giveaway. The target account is ECG-Service.

Filtering Event ID 4624 (successful logon) for the same attacker IP identifies the first successful authentication:

• First successful logon: 9/16/2022 10:19:13 AM
• Workstation: kali
• Source IP: 146.70.36.200
• Logon Type: 3 (network)

OSINT on 146.70.36.200 via ipinfo.io returns Germany as the associated country.

Stage 2 — PersistenceSniper Output

With initial access established, PersistenceSniper is run to enumerate persistence mechanisms:

Import-Module PersistenceSniper
Find-AllPersistence | Format-List

Two findings returned:

Finding 1 — Registry Run Key (TightVNC): HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tvncontrol pointing to C:\Program Files\TightVNC\tvnserver.exe. The signature is valid (GLAVSOFT OOO, Russia) and TightVNC is legitimate remote access software present in the lab environment. This is a false positive — rule 1 of security tool usage.

Finding 2 — Image File Execution Options (IFEO): HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe\Debugger set to C:\windows\system32\cmd.exe. This is a classic accessibility feature abuse technique — pressing Win+U at the Windows login screen normally launches Utility Manager (utilman.exe), but with this debugger key set, cmd.exe launches instead as SYSTEM without any authentication required. Classification: T1546.012, Access Gained: System/User.

This is a genuine malicious finding — PersistenceSniper correctly identified it. The TightVNC entry demonstrates why tool output always requires analyst validation.

Stage 3 — Windows Defender Threat Detection

Get-MpThreatDetection | Format-List
Get-MpThreat | Format-List

Defender detected and quarantined a threat. The Windows Defender Operational event log (Event ID 1116) confirms the exact detection timestamp and file origin:

• Detection timestamp: 9/16/2022 11:35 AM
• Threat name: Trojan:Win32/Meterpreter.O
• Affected item: file: \\tsclient\_home_kali_Desktop\KeyboardDriver.dll.exe
• Origin: Network share
• Detection user: EC2AMAZ-UUEMPAU\ECG-Service

The path \\tsclient\ is the RDP client drive redirection mapping — the attacker executed KeyboardDriver.dll.exe directly from the Kali machine’s Desktop over the RDP session rather than copying it to disk first. Defender detected it via real-time protection and suspended execution. The _home_kali_Desktop path confirms the Kali home directory was mapped through the RDP session.

Stage 4 — Defender Exclusion Tampering

Defender quarantined the payload — but the investigation doesn’t end there. Checking Defender exclusions reveals the attacker’s countermove:

The attacker added C:\Users\ECG-Service\Links to Defender’s exclusion list — any file placed in that directory would be invisible to real-time protection. This explains the two-step approach: initial execution from the RDP share (detected), then re-deployment to the excluded folder for persistence.

Stage 5 — Malicious File Recovery and Hashing

The malware was redeployed to the excluded path:

Get-FileHash "C:\Users\ECG-Service\Links\KeyboardDriver.dll.exe" -Algorithm SHA256

C321747522D6E865904EE21B138954BABF324E871B576A406C144B35698EF738

Note: the file appears and disappears depending on lab VM state — the artifact is present in the pre-loaded lab environment but may not survive certain reset conditions.

Stage 6 — Scheduled Task Investigation

PersistenceSniper did not flag a scheduled task — but manual inspection of Task Scheduler surfaces KeyboardDriveConfiguration, created by EC2AMAZ-UUEMPAU\ECG-Service:

The task exists but will never execute. Examining the Triggers tab reveals the critical flaw:

Trigger: One time — At 12:00 AM on 9/16/2022

The trigger fired once in the past and will never fire again. The attacker created a one-time scheduled task rather than a recurring or startup trigger — an operational error that rendered the persistence mechanism completely ineffective. PersistenceSniper missed it because a one-time past trigger doesn’t match persistence patterns it hunts for (Run keys, startup triggers, recurring schedules).

Stage 7 — Attacker-Created Persistence Account

Filtering the Security event log for Event ID 4720 (user account created) after the first ECG-Service logon timestamp surfaces a new account creation:

Account created: LocalAdministrator — created by ECG-Service at 9/16/2022 12:42:31 PM, approximately two hours after initial access.

Get-LocalUser -Name "LocalAdministrator" | Format-List

Get-LocalGroupMember -Group "Administrators"
Get-LocalGroupMember -Group "Remote Desktop Users"
Get-LocalGroupMember -Group "Users"

LocalAdministrator was added to three groups: Administrators, Remote Desktop Users, and Users — full local admin rights plus RDP access, providing a durable backdoor account independent of the compromised ECG-Service account.

Attack Summary

IOCs

MITRE ATT&CK

Defender Takeaways

PersistenceSniper is a starting point, not a conclusion — the tool correctly identified the IFEO abuse and flagged TightVNC as a false positive, but missed the scheduled task entirely because a one-time past trigger doesn’t match its detection patterns. IR tools reduce analyst workload but cannot replace manual validation. Every finding requires verification and every gap requires manual follow-up — PersistenceSniper not flagging something is not evidence of clean persistence.

RDP drive redirection as a delivery vector — executing malware directly from \\tsclient\ means the payload never touches the victim disk during initial execution, bypassing many file-based detection controls. Restricting or disabling RDP drive redirection via Group Policy (Computer Configuration → Administrative Templates → Windows Components → Remote Desktop Services → Do not allow drive redirection) removes this vector entirely.

Defender exclusions as a post-compromise indicator — adding a folder to Defender exclusions is a high-fidelity indicator of attacker activity when done outside of normal IT change management. Monitoring registry writes to HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths via Sysmon Event ID 13 or a SIEM rule provides near-real-time detection of this technique. The exclusion was the attacker’s direct response to the initial quarantine — without it, redeployment would have been blocked.

Attacker-created accounts as durable persistence — LocalAdministrator with Administrators and Remote Desktop Users membership provides full independent access to the system regardless of what happens to ECG-Service. Account creation events (Event ID 4720) and group membership changes (Event ID 4732) should be alerted on in any SIEM, particularly for additions to privileged groups outside of business hours or change windows.

Brute force prevention at the authentication layer — 6504 failed logons against a single account should have triggered an account lockout policy long before success. Account lockout thresholds of 5-10 failures, combined with network-level rate limiting on RDP (port 3389) and MFA, would have prevented initial access entirely regardless of password strength.