Who Hacked Who? PsExec Forensic Artifacts
Source: YouTube · John Hammond · published Jul 22, 2024 · 20:17
This video demonstrates how digital forensics analysts can identify the source of lateral movement attacks by analyzing artifacts left by PsExec, specifically a .key file that contains the attacker's hostname 0:00-0:42.
Key Takeaways:
• PsExec, commonly used for lateral movement, drops a file in C:\Windows following the naming convention PsExec[SourceHostname][RandomChars].key 12:59-13:48.
• Analysts can detect the installation of the PsExec service by filtering the Windows System logs for Event ID 7045 9:41-10:06.
• Parsing Windows prefetch files with tools like PECMD allows investigators to find references to the .key file, providing high-fidelity evidence of the attack source 15:43-16:31.
Tracking these specific file artifacts helps incident responders definitively link malicious activity to the originating host 18:34-18:59.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
recently I saw this post on Twitter from a good friend Eric capano now let me say Eric is a great guy an absolute wizard in digital forensics instant response all that great blue team Defense work and I'm a big fan so he tweeted out that PS exac one of the tools in the CIS internal Suite oftentimes used for lateral movement in offensive security ethical hacking as well as red teaming penetration testing and actual elicit cyber crime but he noted as a sweet digital forensic artifact on the receiving end the victim or Target computer of a PS exec lateral movement trick a file will quickly get dropped onto the file system and its name contains the host name of the attacking system so this is a good breadcrumb to be able to use to find what machine attacked another who hacked who now if I may …