🔍 What

An attacker conducted an RDP brute force from 149.102.244.101 against host Maxton (172.16.17.95), achieving a successful login at 06:35 AM on the letsdefend account. The account is a confirmed local Administrator — the BUILTIN\Administrators entry showing Group used for deny only in whoami /groups reflects the expected UAC split-token state of an admin account’s initial non-elevated shell, not a privilege limitation. The attacker simply launched a separate elevated PowerShell session to execute privileged operations, which is standard behaviour for any local admin over RDP.

Post-compromise activity followed a structured playbook across four phases:

Enumeration: whoami, whoami /groups, ping google.com

Persistence: Created local backdoor account test, added it to Administrators and Remote Desktop Users, reset the built-in Administrator password to Passw0rd!

Defense Evasion: Disabled Windows Defender real-time monitoring and script scanning via Set-MpPreference, disabled the firewall across all profiles via both legacy netsh firewall and netsh AdvFirewall, then navigated to C:\Sysmon\ and reinstalled Sysmon with a replacement config (sysmonconfig-export.xml). The config is 1,201 lines and appears legitimate — intent is uncertain between accidental misfire and deliberate removal of custom detections. MFT timestamp review is recommended to confirm whether the file was pre-staged or dropped during the intrusion.

Log Clearance: Cleared all Windows event logs via Clear-EventLog and wevtutil.exe, including Sysmon, PowerShell Operational, Analytic, and Debug channels. Machine subsequently contained.

🕐 When

📍 Where

• Host: Maxton
• IP: 172.16.17.95
• Primary binary: C:\Windows\system32\wevtutil.exe
• Sysmon config: C:\Sysmon\sysmonconfig-export.xml

👤 Who

• Attacker IP: 149.102.244.101 — confirmed malicious, brute force reports
• Compromised account: letsdefend — confirmed local Administrator
• Backdoor account: test — created post-compromise, added to Administrators and Remote Desktop Users

❓ Why

Confirmed true positive. The attacker ran a password spray against RDP and succeeded on letsdefend, a confirmed local Administrator account. No UAC bypass was required — the attacker used legitimate admin rights to launch an elevated PowerShell session directly. Persistence was layered across backdoor account creation, group membership escalation, and Administrator credential modification. The defense evasion phase was systematic — Defender killed, firewall dropped, Sysmon config replaced, then full log clearance to destroy forensic evidence. The Sysmon reinstall was initially assessed as lab setup scaffolding — a key reminder to apply MFT timestamp analysis to all artefacts within an intrusion window regardless of appearance.

🎯 MITRE ATT&CK

🚨 IOCs

|Type|Value|Notes| |—|—|—| |IP|149.102.244.101|Attacker - confirmed malicious, brute force| |IP|172.16.17.95|Victim host (Maxton)| |Account|letsdefend|Compromised via RDP brute force - local Administrator| |Account|test|Backdoor local user created post-compromise| |Credential|Passw0rd!|Administrator password set by attacker| |Binary|wevtutil.exe|Used to clear Sysmon and PowerShell logs| |File|C:\Sysmon\sysmonconfig-export.xml|Replacement Sysmon config - MFT timestamp review required| 🔬 Analysis Reports https://www.abuseipdb.com/check/149.102.244.101?page=2