08 · Lateral Movement
Lateral Movement Forensics: RDP, PsExec, WMI and WinRM
Map source and destination artifacts for RDP, PsExec, SMB, WMI, WinRM, scheduled tasks and DCOM, then build a cross-host lateral movement graph.
Area 08
Lateral Movement
Intrusions rarely stay on one machine. This area pairs source and destination artifacts for RDP, PsExec, admin shares, WMI, WinRM and remote scheduled tasks, explains the logon types and credential events behind them, and shows how to draw the movement graph across a fleet.
Key sources
- 4624 type 10
- PsExec
- WinRM
Guides in this area
08 · Lateral Movement
Credential Access Forensics: LSASS, DCSync and Kerberoasting
Investigate Windows credential theft: LSASS dumps, SAM and NTDS.dit extraction, DCSync, DPAPI, Kerberoasting and AS-REP roasting, with event IDs and ATT&CK.
08 · Lateral Movement
Remote Access Tool Forensics: AnyDesk, TeamViewer and More
Investigate abused RMM and remote access tools on Windows: install traces, per-tool logs, session IDs and IPs, file transfers and telling attackers from IT.
Artifact cheat sheets
Location by Windows version, what each artifact proves, its timestamps and the tools to parse it.
- RDP connection artifactsRDP forensics cheat sheet: target-side event IDs (4624 type 10, 1149, 21–25, 131) and source-side traces (Terminal Server Client keys, Default.rdp, 1024).
- RDP bitmap cacheRDP bitmap cache cheat sheet: bcache*.bmc and Cache*.bin files on the RDP client, what screen tiles reveal, timestamps, and rebuilding screens with bmc-tools.
- Windows event logs (EVTX)Windows event log cheat sheet: EVTX locations, must-know event IDs for logons, processes, services and log clearing, retention, audit policy and parsing tools.
- Windows ServicesWindows services cheat sheet: Services key values (ImagePath, Start, Type, ServiceDll), 7045 and 4697 install events, PsExec traces and pitfalls.
- Scheduled TasksScheduled tasks cheat sheet: task XML and .job files, TaskCache registry keys, DynamicInfo times, hidden tasks, TaskScheduler and 4698 events.
- Remote access tools (RMM)RMM and remote access tool cheat sheet: AnyDesk, TeamViewer, ScreenConnect and more, their log files, connection IDs, IPs and timestamps, and how to hunt abuse.
- OpenSSH Server and ClientOpenSSH on Windows cheat sheet: sshd event log, sshd_config and host keys, authorized_keys persistence, known_hosts, client traces and reverse tunnels.
- DPAPI and Credential ManagerDPAPI and Credential Manager cheat sheet: master keys, Windows Vault, what secrets they hold, offline decryption requirements and credential-theft traces.
- NTDS.dit and domain controllersNTDS.dit cheat sheet: the Active Directory database, what it proves, theft traces on a DC, and the Kerberos, NTLM and DCSync event IDs investigators need.
- Windows Firewall LogsWindows Firewall cheat sheet: pfirewall.log format and defaults, rule change events 2004-2006, WFP audit 5156/5157, rules in the registry and netsh abuse.