How to Evict an Attacker from Active Directory After Detection

Summary

Using a fictional Active Directory scenario, the article shows how to investigate WinRM, Impacket WMIexec and RDP activity, then evict attackers by securing accounts and ending sessions while accounting for the risk of tipping them off.

Key points

The fictional scenario uses suspicious processes and account activity to investigate possible attacker access to a Windows server.
WinRM activity can be investigated through logs or server-side session details; disabling the compromised Active Directory account terminates access.
Impacket WMIexec activity may leave process and ADMIN$ redirection traces. The guidance recommends changing the compromised password twice, disabling the account, and removing administrator privileges.
RDP investigations can use session telemetry and logs, including the connecting username and source IP; defenders can sign out the user and then secure the account.
Domain-wide session tools can help identify other accounts and machines where an adversary may be active.
Before disrupting an attacker, investigate initial access and persistence where possible: intervention may prompt them to cover their tracks or cause damage.
The article recommends coordinating immediate containment with log review and post-incident security improvements.

Article Details

Defense Focus: Detect and evict adversaries using compromised accounts for WinRM, WMIexec, or RDP access, while investigating initial access and persistence before disrupting the attacker when feasible.
Detection Methods: Review process and command-line activity, including unexpected whoami or net time execution and output redirection to ADMIN$ or a local SMB share.
Use Elastic telemetry to identify wsmprovhost.exe spawning commands and to inspect RDP session activity, including the source domain.
Inspect active PowerShell remoting sessions and their user and session duration.
Query RDP logs for remote sign-in times, usernames, and source IP addresses.
Review Windows endpoint prefetch data and enumerate domain-wide user sessions and remote PowerShell sessions.
Data Sources: Elastic-collected process and session logs
Process and command-line data
PowerShell remoting session information
RDP logs, including username and source IP address
Windows endpoint prefetch data
Active Directory domain-wide user-session information
Rule Types: Elastic process-activity detections
PowerShell one-liners for process and remoting-session inspection
RDP log queries
Platforms: Elastic
Active Directory
Windows
Defensive Actions: Before disrupting the adversary when circumstances allow, investigate initial access and identify and remove persistence mechanisms; intervene immediately if the adversary reaches key machines or begins destructive activity.
Disable compromised accounts to terminate or prevent further remote access.
For suspected WMIexec access, rotate the compromised password twice, disable the account, and remove it from the administrators group.
Force the compromised RDP user to sign out, then change the password or disable the account.
Review other accounts and machines for active sessions across the domain.
Coordinate post-incident IT and security changes to reduce the risk of re-compromise.