-: New accounts. 2 2
In this lesson, we're going to talk more about new accounts 3 3
because new accounts are an area that attackers use 4 4
to be able to give themselves more persistence. 5 5
By creating rogue accounts, 6 6
this allows an adversary to maintain access to your systems 7 7
once they've broken in, 8 8
and so they are a dead giveaway 9 9
as an indicator of compromise 10 10
that you have been had and somebody's in your network. 11 11
For example, as an attacker gains access to your system, 12 12
one of the first things they will do 13 13
is try to create additional accounts on that system. 14 14
This way, they know they will be able to maintain access 15 15
because they'll have multiple user accounts 16 16
or even administrator accounts 17 17
with those usernames and passwords 18 18
that they can use for further attacks. 19 19
So one of the things you need to do 20 20
is check if any accounts have been created. 21 21
This means you should be checking for account creation, 22 22
and all account creation 23 23
should be subject to a monitored change control process 24 24
to mitigate the creation of rogue accounts. 25 25
And that way, 26 26
even if an attacker 27 27
does create one of these rogue accounts, 28 28
it'll be quickly caught and identified. 29 29
Now, there are lots of different tools to help you do this. 30 30
These are known as account and session management tools. 31 31
For example, you could use local users and groups. 32 32
This is a Windows tool 33 33
that's used for the management of local accounts 34 34
on a system. 35 35
So if you're dealing 36 36
with a standard Windows 10 desktop computer, 37 37
you can go into the local users and accounts 38 38
and look through all of the accounts or groups 39 39
on that system. 40 40
If you see any that you don't recognize, 41 41
that could be an indication 42 42
that an attacker has gotten into that system 43 43
and created a new account. 44 44
Another tool you can use 45 45
is the active directory users and computers tool. 46 46
This is a Windows tool 47 47
that's used for the management of accounts 48 48
on a domain controller known as a DC. 49 49
This in Windows is known as active directory. 50 50
So if you go into it, 51 51
it looks a lot like the other tool we just talked about 52 52
with local users and groups, 53 53
except this works across the entire domain. 54 54
In here, in my sample, 55 55
I only have 19 objects or 19 accounts, 56 56
but in a real domain with an enterprise group, 57 57
you may have hundreds or thousands 58 58
or even hundreds of thousands of users, 59 59
and so identifying new accounts 60 60
are going to be much more challenging 61 61
than on a system like this where there's only 19. 62 62
That being said, 63 63
it is still important for you to have some method 64 64
to control account creation, 65 65
and some form of monitoring over time 66 66
to look at all the new accounts that have been created 67 67
and whether or not they were authorized. 68 68
Additionally, I want you to remember 69 69
that accounts can still be created using the command line. 70 70
You don't have to use these graphical tools. 71 71
You can be using things like net commands 72 72
or the Windows Management Interface Command-Line, 73 73
known as WMIC, 74 74
or even PowerShell. 75 75
All of these are ways you can create accounts as well 76 76
on a Windows system. 77 77
Now, on Linux, there's a couple of tools 78 78
for session management there too, 79 79
such as who, w and rwho. 80 80
All of these are Linux tools for session management 81 81
Who is the first one we're going to talk about. 82 82
Who is a Linux command that shows what users are logged in 83 83
and what terminal teletypes or TTYs they have active 84 84
for each running process, 85 85
and what date or time they logged in. 86 86
This is really useful 87 87
as you're going through and doing your adversary hunting. 88 88
W is going to display the same basic information as who, 89 89
but it's also going to return the remote host, 90 90
if that's being used, 91 91
how long the account has been idle, 92 92
the name of the process the account is actively running, 93 93
the execution time of each process, 94 94
and more information like that. 95 95
Finally, we have rwho, 96 96
which displays the same basic information as who, 97 97
but it runs on a client server architecture. 98 98
So it gives you even more details, 99 99
especially if you're using 100 100
more of an enterprise environment. 101 101
All three of these commands, who, w and rwho, 102 102
are useful as you're trying to track down malicious users 103 103
on your systems. 104 104
The next command I want to talk about is lastlog. 105 105
Now, last log will retrieve the log-on history 106 106
from the slash var slash log slash lastlog file, 107 107
and it will display the account name, the TTY, 108 108
the remote host, and the last time the user was logged in. 109 109
Here you can see an example of lastlog on the screen. 110 110
When you type in lastlog, 111 111
you're going to get all the usernames, 112 112
the ports that they're using, 113 113
what IP address they're using, 114 114
and the latest login. 115 115
So you can see here that the root user 116 116
connected on port one from 10 dot 48 dot one dot seven, 117 117
and the last connection was on July 7th. 118 118
Another command we might use is what's known as faillog. 119 119
This is a Linux command 120 120
that displays only the authentication failures. 121 121
This is really helpful 122 122
if you're trying to identify somebody 123 123
who has been using password guessing 124 124
as they're trying to guess additional user accounts 125 125
or administrative accounts on your systems. 126 126
So if you use faillog, 127 127
it looks something like this. 128 128
Notice here I'm looking for all the failures 129 129
for a particular user, 130 130
in this case, Bruce. 131 131
And you can see here, there were no failures, 132 132
and we haven't reached the maximum limit yet. 133 133
Now, in addition to doing it this way, 134 134
you can do it the way I showed you in a previous lesson. 135 135
You can go through and grep your authentication log 136 136
and look for terms like failed or failure. 137 137
And again, this is a much more accurate way of doing it, 138 138
and a much easier way of doing it 139 139
across all of your systems 140 140
by being able to run scripts 141 141
using this type of a grep command. 142 142
Either way you want to do it is okay, 143 143
but you should be aware 144 144
that there are multiple ways to accomplish any goal. 145 145
And as you get better at doing this in the real world, 146 146
you're going to find the ways that work best for you 147 147
as part of your own tactical processes.