Full Report
This blog shows how to catch an adversary moving from machine to machine, how to terminate this movement and how to evict the adversary from your network.
Analysis Summary
# Tool/Technique: Lateral Movement & Adversary Eviction (WinRM/SMB Focus)
## Overview
This technique focuses on how adversaries leverage legitimate Windows administrative features—specifically Windows Remote Management (WinRM) and SMB-based execution—to move laterally across a network. The primary purpose of this investigation is to identify compromised user accounts, terminate their active remote sessions, and evict the attacker by revoking access rights.
## Technical Details
- **Type:** Technique (Lateral Movement & Post-Exploitation)
- **Platform:** Windows / Active Directory
- **Capabilities:** Remote command execution, credential harvesting, internal reconnaissance, and persistence.
- **First Seen:** WinRM has been a native Windows feature since Windows Server 2008.
## MITRE ATT&CK Mapping
- **TA0008 - Lateral Movement**
- **T1021.006 - Remote Services: Windows Remote Management**
- **T1021.002 - Remote Services: SMB/Windows Admin Shares**
- **TA0007 - Discovery**
- **T1033 - System Owner/User Discovery** (e.g., `whoami`)
- **T1087 - Account Discovery**
- **TA0040 - Impact**
- **T1529 - System Shutdown/Reboot** (via remote eviction)
## Functionality
### Core Capabilities
- **Remote Execution:** Utilizing `wsmprovhost.exe` (WinRM) to run PowerShell commands on remote hosts.
- **Session Management:** Creating persistent connections between compromised workstations and high-value servers.
- **Credential Levering:** Using hijacked domain user accounts (e.g., AFairfax, BMason) to perform tasks under the guise of legitimate activity.
### Advanced Features
- **SharpHound Integration:** Running SharpHound (BloodHound ingestor) via SMB shares to map Active Directory attack paths without dropping the executable directly onto the local disk.
- **Living-off-the-Land (LotL):** Using `rdpclip` and `wsmprovhost.exe` to blend in with standard administrative traffic.
## Indicators of Compromise
- **File Names:** `sharphound.exe`, `wsmprovhost.exe` (when spawning unexpected children), `rdpclip.exe`.
- **Behavioral Indicators:**
- `wsmprovhost.exe` spawning discovery tools like `whoami.exe`, `net.exe`, or `ipconfig.exe`.
- PowerShell one-liners executed remotely via WinRM.
- Unexpected SMB connections from standard user workstations to sensitive servers at irregular hours.
- Unusual redirection of executable output to local or remote SMB shares.
## Associated Threat Actors
- **Volt Typhoon** (Known for LotL and living off network appliances).
- General Ransomware Affiliates (For lateral movement and reconnaissance).
## Detection Methods
- **Process Monitoring:** Using PowerShell to audit running processes and their owners:
`Get-Process -IncludeUserName | Select-Object ProcessName, UserName, Path, CommandLine`
- **Behavioral Detection:** Monitoring for `wsmprovhost.exe` spawning child processes that are not typical for administrative workflows.
- **Log Analysis:** Monitoring Windows Event Logs for Event ID 4624 (Successful Logon) and WinRM-specific logs.
## Mitigation Strategies
- **Session Termination:** Using `Disconnect-PSSession` or killing the `wsmprovhost` process associated with specific compromised IDs.
- **Hardening:**
- **Restrict WinRM:** Limit WinRM access to specific administrative "Jump Boxes" using Windows Firewall.
- **Disable Unnecessary Services:** Disable WinRM on workstations where it is not required for business operations.
- **Account Revocation:** Immediately resetting passwords and killing all active Kerberos/NTLM sessions for compromised accounts.
- **Least Privilege:** Ensure standard users do not have permissions to WinRM into sensitive servers.
## Related Tools/Techniques
- **PsExec:** A similar lateral movement tool using SMB.
- **BloodHound/SharpHound:** Used for Active Directory mapping.
- **HTML Smuggling:** Often used as an initial access vector to harvest the credentials used in these lateral movement scenarios.