So now let's go ahead and enable the registry key that will allow us to remotely connect.
Three Windows command line.
OK, so we want this key change the value of hefting and its connections to zero.
Here we go.
It looks like they've actually provided the full command here.
Sweet spot that goes back to our show.
Nice.
Now we need to disable the firewall,
actually, instead of disabling it, let's just poke a hole through it.
So enable party through the firewall a little less noisy during the entire firewall off.
This is not give me what I want.
Let's just go inside the room.
Let's go back here.
We can say that DBP firewall, see that rule, let's name it, party B, enable party being able that
works protocol.
Oh it's going to kill me.
That's a well it looks like I need to copy and paste this,
but have it in here.
Yeah.
Let's take it in here first.
Copy and paste it.
EDV firewall rule name equals party p port protocol equals Tsipi.
The direction is going to be Elbaum.
Local port is three three eight nine and the action is allow.
Let's grab this.
Does that work?
No, I did not.
We're done up.
We need to add the rule because that's the problem.
Trial and error, you know, you just keep trying until you get it.
How was it?
OK, so now that we have our desktop.
Yes, we do.
Our desktop
will allow us to connect.
So we can be like, let's see, let's do our desktop technique and then down here, we'll build it up
to our desktop.
What do we want?
They want to use your name and they go to the server.
These are body server
daizy.
The certificate is a tally.
So I do.
And what the crap is happening here.
Take Connect to quit SSP required by server.
Let's try a different desktop to free already being.
OK, zero X free already be C, our options are
what do we want to do?
Let's be smart about this.
Grep are.
Looks like this is the site for user and then I think there's a flight to scale the window.
Yes, your desktop or smart sizing.
OK, so I should be able to pull this off, slash you body, slash P
and then slash skill or smart sizing can work with, say, invalid hostname.
I wouldn't put it server in italic.
And yes, I do trust certificate.
This is tally.
We get that criticism crap.
What does it say.
There are connected organ failure, I should take the last report out, actually, it was partial.
That's one, two, three, one
oh typos.
Here we go.
In sports, I think is nice because it'll actually it'll scale the window.
So it keeps it allows us to scale it pretty easily to minimize everything else behind us.
Nice clean window.
So here we are in the compromise post.
This is really cool.
So now we are actually logged in.
This box has been completely polland by us and we can sort of explore the logs.
We can look at evidence of attack.
And I think there's actually a sigma rule for GC Potatoe Sigma Rule, GC potatoe.
I'd be on Twitter or some segments just to standardize.
How do I explain it?
It's basically standard rules, kind of like, kind of like the rules, but it's for a simple security
events, information of events, monitoring tool like Splunk.
And so Sigma rules are the industry standard.
This is what people should be using and if they want to detect this kind of thing.
And so here we can see Floriane Roth has a sigma rule that detects juicy potato potato like attacks.
We actually go to this GitHub page and look at the rule and then figure out, you know, how we can
search the logs for this.
You see, it's really pretty straightforward what it's doing.
It's looking Luxor's Windows Security.
You can see it actually even maps it to my attack, which is pretty cool.
Probably escalation credential access, which this will be your next video.
But the product is Windows Security and we're looking for four sixty four events.
Login Type three, the target username should be anonymous.
Log on workstation should be a dash and it should be for the localhost.
Let's go ahead and take a look to see if we can find this.
So if we go to event viewer.
It looks pretty bad.
I want full screen is going to fix itself.
I don't think it is.
OK, so security logs, right?
For 464 events, so we can probably filter the log by clicking current log, by the way, this box is
super, super slow.
So we want to be very, very gentle with it now because we don't want to completely lock it up.
So leave an I.D. We want for six to four
click, OK.
These are the 464 events we could potentially go through these logs and see.
You know what, the logotype type is three.
And the target username and was like on, so if we had a simple setup, we could easily do that.
Of course, this is something you want to see, you know, if you see a new account being created as
it is for 64 years, that's definitely an interesting event that you should look for.
This is an account was successfully logged on, right, but let's look a bit like for a calculation.
It's forty seven twenty.
Right, so if we go back here, we should be able to filter by 47, 20.
Yeah, now we only have a few of these and you shouldn't see a lot of these in your environment.
I'm to be honest.
Here you can see this white collar scroll up a little bit.
This is this RTP windows, very, very lagi vonne money is being created and you can see the time.
So that.
Right.
They were being alerted, the account being created.
It's a being created right here or being alert totally.
What about adding music to the Abigroup Avenues?
Four, seven, three two, a member was added to a security enabled vocal group.
473 to.
We should get even more information.
You see Barney with a member of users there, and then one minute later
she's a member of administrators.
So, yeah, that that again, that is a noisy event.
I know the attack, but you can see how you could pick that up easily in the logs, right?
That's pretty cool.
And by the way, if you want to look at a very good cheat sheet that contains a lot of this and Google
for Hacker who is a hacker hurricaine
malware, archaeology, cheat seats, please.
You can find it this way.
Yeah, this guy's got some awesome whenas if mortgage rates are finding crap like this in your logs.
Yeah.
Here we go.
Windows logging Jegede is the PDF.
You want things gold.
You can see it covers Windows seven three Windows 2000 nineteen for first tells you you know what you
should enable and what configuration stated what tools you can use to gather the logs and then how to.
Actually I'm saying those events to Assim like Splunk and you can see here telling you what you need
to enable DNS logs, you know, is what you configure a group policy.
And then he actually talks about like what you can do to hunt for specific events.
So this is really good.
Here's actually the video right here, four four six nine eight that's watching for a process to start
and call other processes
because a lot of really good stuff in here and give you the event ideas.
That's really the important thing.
This thing right here, little caption and then the event.
So definitely download this and study it and you'll be well on your way.
You can even see the login types right to login type three network net use if you remember back in Sigma
Log and type three.
Right.
So that means that this was let's go back.
This was non interactive, right.
It was purely using the net use command, which is what we used the agency potatoe
back here.
And this is basically using where is it, these necromancy net share net local group that's not use.
Right.
So that is definitely something you would want to see.
So download these from from our archaeology and, you know, start studying them.
And really, that's really it.
I mean, we could continue looking through this computer.
We already kind of know what is on the file system.
Know what, that director is nothing in that I mean, this little letter out holds, but, you know,
you could dig into this.
You can go deeper if you want.
You can, you know, look at the exterior configuration here.
If you wanted to, for example, you can right click.
You can go to Internet, Internet information services.
You could open this up, you know, see poke around how they have everything configured with the application
pools.
And you can see what logging they actually have.
These are all the applications they have set up.
It's like there's a bunch of a bunch of different sites set up here.
All right.
And you can even see, like, the logging levels, like, guess if you logging, maybe the logging is
not adequate if you logs.
I can't get to what's even going to happen, so I don't know what's up with that, you probably need
to be the Iast service in order to look at those logs.
Yes.
So that's the box.
That is everything I have for you
in the next lecture.
We are going to dig into my ear.
I'm going to map everything to the MicroTech framework so you can see all the awesomeness from the miner
perspective.
There's duty data, right, all right.
So I will see you in the next lecture.
All right, bye.