1 1 00:00:00,660 --> 00:00:01,923 New accounts. 2 2 00:00:02,910 --> 00:00:06,330 In this lesson, we're going to talk more about new accounts 3 3 00:00:06,330 --> 00:00:09,600 because new accounts are an area that attackers use 4 4 00:00:09,600 --> 00:00:12,270 to be able to give themselves more persistence. 5 5 00:00:12,270 --> 00:00:13,890 By creating rogue accounts, 6 6 00:00:13,890 --> 00:00:17,580 this allows an adversary to maintain access to your systems 7 7 00:00:17,580 --> 00:00:18,960 once they've broken in, 8 8 00:00:18,960 --> 00:00:20,539 and so they are a dead giveaway 9 9 00:00:20,539 --> 00:00:22,383 as an indicator of compromise 10 10 00:00:22,383 --> 00:00:26,190 that you have been had and somebody's in your network. 11 11 00:00:26,190 --> 00:00:29,670 For example, as an attacker gains access to your system, 12 12 00:00:29,670 --> 00:00:31,170 one of the first things they will do 13 13 00:00:31,170 --> 00:00:34,710 is try to create additional accounts on that system. 14 14 00:00:34,710 --> 00:00:37,620 This way, they know they will be able to maintain access 15 15 00:00:37,620 --> 00:00:39,690 because they'll have multiple user accounts 16 16 00:00:39,690 --> 00:00:41,490 or even administrator accounts 17 17 00:00:41,490 --> 00:00:43,230 with those usernames and passwords 18 18 00:00:43,230 --> 00:00:45,630 that they can use for further attacks. 19 19 00:00:45,630 --> 00:00:47,190 So one of the things you need to do 20 20 00:00:47,190 --> 00:00:50,160 is check if any accounts have been created. 21 21 00:00:50,160 --> 00:00:52,530 This means you should be checking for account creation, 22 22 00:00:52,530 --> 00:00:54,000 and all account creation 23 23 00:00:54,000 --> 00:00:57,360 should be subject to a monitored change control process 24 24 00:00:57,360 --> 00:01:00,180 to mitigate the creation of rogue accounts. 25 25 00:01:00,180 --> 00:01:01,013 And that way, 26 26 00:01:01,013 --> 00:01:01,846 even if an attacker 27 27 00:01:01,846 --> 00:01:03,570 does create one of these rogue accounts, 28 28 00:01:03,570 --> 00:01:06,660 it'll be quickly caught and identified. 29 29 00:01:06,660 --> 00:01:09,660 Now, there are lots of different tools to help you do this. 30 30 00:01:09,660 --> 00:01:12,960 These are known as account and session management tools. 31 31 00:01:12,960 --> 00:01:16,590 For example, you could use local users and groups. 32 32 00:01:16,590 --> 00:01:18,000 This is a Windows tool 33 33 00:01:18,000 --> 00:01:20,190 that's used for the management of local accounts 34 34 00:01:20,190 --> 00:01:21,270 on a system. 35 35 00:01:21,270 --> 00:01:22,103 So if you're dealing 36 36 00:01:22,103 --> 00:01:24,480 with a standard Windows 10 desktop computer, 37 37 00:01:24,480 --> 00:01:27,000 you can go into the local users and accounts 38 38 00:01:27,000 --> 00:01:29,310 and look through all of the accounts or groups 39 39 00:01:29,310 --> 00:01:30,600 on that system. 40 40 00:01:30,600 --> 00:01:32,610 If you see any that you don't recognize, 41 41 00:01:32,610 --> 00:01:33,656 that could be an indication 42 42 00:01:33,656 --> 00:01:35,820 that an attacker has gotten into that system 43 43 00:01:35,820 --> 00:01:37,770 and created a new account. 44 44 00:01:37,770 --> 00:01:39,000 Another tool you can use 45 45 00:01:39,000 --> 00:01:42,210 is the active directory users and computers tool. 46 46 00:01:42,210 --> 00:01:43,500 This is a Windows tool 47 47 00:01:43,500 --> 00:01:45,270 that's used for the management of accounts 48 48 00:01:45,270 --> 00:01:48,390 on a domain controller known as a DC. 49 49 00:01:48,390 --> 00:01:51,180 This in Windows is known as active directory. 50 50 00:01:51,180 --> 00:01:52,350 So if you go into it, 51 51 00:01:52,350 --> 00:01:54,750 it looks a lot like the other tool we just talked about 52 52 00:01:54,750 --> 00:01:56,370 with local users and groups, 53 53 00:01:56,370 --> 00:01:59,370 except this works across the entire domain. 54 54 00:01:59,370 --> 00:02:01,110 In here, in my sample, 55 55 00:02:01,110 --> 00:02:04,260 I only have 19 objects or 19 accounts, 56 56 00:02:04,260 --> 00:02:06,840 but in a real domain with an enterprise group, 57 57 00:02:06,840 --> 00:02:08,910 you may have hundreds or thousands 58 58 00:02:08,910 --> 00:02:11,340 or even hundreds of thousands of users, 59 59 00:02:11,340 --> 00:02:12,893 and so identifying new accounts 60 60 00:02:12,893 --> 00:02:15,330 are going to be much more challenging 61 61 00:02:15,330 --> 00:02:18,300 than on a system like this where there's only 19. 62 62 00:02:18,300 --> 00:02:19,230 That being said, 63 63 00:02:19,230 --> 00:02:21,600 it is still important for you to have some method 64 64 00:02:21,600 --> 00:02:23,400 to control account creation, 65 65 00:02:23,400 --> 00:02:25,860 and some form of monitoring over time 66 66 00:02:25,860 --> 00:02:28,290 to look at all the new accounts that have been created 67 67 00:02:28,290 --> 00:02:30,870 and whether or not they were authorized. 68 68 00:02:30,870 --> 00:02:32,250 Additionally, I want you to remember 69 69 00:02:32,250 --> 00:02:35,160 that accounts can still be created using the command line. 70 70 00:02:35,160 --> 00:02:37,380 You don't have to use these graphical tools. 71 71 00:02:37,380 --> 00:02:39,660 You can be using things like net commands 72 72 00:02:39,660 --> 00:02:42,180 or the Windows Management Interface Command-Line, 73 73 00:02:42,180 --> 00:02:43,860 known as WMIC, 74 74 00:02:43,860 --> 00:02:45,450 or even PowerShell. 75 75 00:02:45,450 --> 00:02:47,970 All of these are ways you can create accounts as well 76 76 00:02:47,970 --> 00:02:49,560 on a Windows system. 77 77 00:02:49,560 --> 00:02:51,450 Now, on Linux, there's a couple of tools 78 78 00:02:51,450 --> 00:02:53,130 for session management there too, 79 79 00:02:53,130 --> 00:02:56,130 such as who, w and rwho. 80 80 00:02:56,130 --> 00:02:59,268 All of these are Linux tools for session management 81 81 00:02:59,268 --> 00:03:01,800 Who is the first one we're going to talk about. 82 82 00:03:01,800 --> 00:03:05,730 Who is a Linux command that shows what users are logged in 83 83 00:03:05,730 --> 00:03:09,587 and what terminal teletypes or TTYs they have active 84 84 00:03:09,587 --> 00:03:11,460 for each running process, 85 85 00:03:11,460 --> 00:03:14,190 and what date or time they logged in. 86 86 00:03:14,190 --> 00:03:15,240 This is really useful 87 87 00:03:15,240 --> 00:03:18,510 as you're going through and doing your adversary hunting. 88 88 00:03:18,510 --> 00:03:21,870 W is going to display the same basic information as who, 89 89 00:03:21,870 --> 00:03:24,390 but it's also going to return the remote host, 90 90 00:03:24,390 --> 00:03:25,650 if that's being used, 91 91 00:03:25,650 --> 00:03:27,360 how long the account has been idle, 92 92 00:03:27,360 --> 00:03:29,880 the name of the process the account is actively running, 93 93 00:03:29,880 --> 00:03:31,860 the execution time of each process, 94 94 00:03:31,860 --> 00:03:34,080 and more information like that. 95 95 00:03:34,080 --> 00:03:35,670 Finally, we have rwho, 96 96 00:03:35,670 --> 00:03:38,250 which displays the same basic information as who, 97 97 00:03:38,250 --> 00:03:41,130 but it runs on a client server architecture. 98 98 00:03:41,130 --> 00:03:42,870 So it gives you even more details, 99 99 00:03:42,870 --> 00:03:44,040 especially if you're using 100 100 00:03:44,040 --> 00:03:46,350 more of an enterprise environment. 101 101 00:03:46,350 --> 00:03:49,650 All three of these commands, who, w and rwho, 102 102 00:03:49,650 --> 00:03:52,290 are useful as you're trying to track down malicious users 103 103 00:03:52,290 --> 00:03:54,030 on your systems. 104 104 00:03:54,030 --> 00:03:56,940 The next command I want to talk about is lastlog. 105 105 00:03:56,940 --> 00:03:59,610 Now, last log will retrieve the log-on history 106 106 00:03:59,610 --> 00:04:03,660 from the slash var slash log slash lastlog file, 107 107 00:04:03,660 --> 00:04:06,360 and it will display the account name, the TTY, 108 108 00:04:06,360 --> 00:04:10,380 the remote host, and the last time the user was logged in. 109 109 00:04:10,380 --> 00:04:13,500 Here you can see an example of lastlog on the screen. 110 110 00:04:13,500 --> 00:04:15,120 When you type in lastlog, 111 111 00:04:15,120 --> 00:04:16,830 you're going to get all the usernames, 112 112 00:04:16,830 --> 00:04:18,150 the ports that they're using, 113 113 00:04:18,150 --> 00:04:19,800 what IP address they're using, 114 114 00:04:19,800 --> 00:04:21,540 and the latest login. 115 115 00:04:21,540 --> 00:04:23,790 So you can see here that the root user 116 116 00:04:23,790 --> 00:04:28,500 connected on port one from 10 dot 48 dot one dot seven, 117 117 00:04:28,500 --> 00:04:31,560 and the last connection was on July 7th. 118 118 00:04:31,560 --> 00:04:35,070 Another command we might use is what's known as faillog. 119 119 00:04:35,070 --> 00:04:36,210 This is a Linux command 120 120 00:04:36,210 --> 00:04:39,090 that displays only the authentication failures. 121 121 00:04:39,090 --> 00:04:40,110 This is really helpful 122 122 00:04:40,110 --> 00:04:41,370 if you're trying to identify somebody 123 123 00:04:41,370 --> 00:04:43,170 who has been using password guessing 124 124 00:04:43,170 --> 00:04:45,180 as they're trying to guess additional user accounts 125 125 00:04:45,180 --> 00:04:47,760 or administrative accounts on your systems. 126 126 00:04:47,760 --> 00:04:48,990 So if you use faillog, 127 127 00:04:48,990 --> 00:04:51,030 it looks something like this. 128 128 00:04:51,030 --> 00:04:53,280 Notice here I'm looking for all the failures 129 129 00:04:53,280 --> 00:04:54,480 for a particular user, 130 130 00:04:54,480 --> 00:04:56,070 in this case, Bruce. 131 131 00:04:56,070 --> 00:04:58,200 And you can see here, there were no failures, 132 132 00:04:58,200 --> 00:05:00,570 and we haven't reached the maximum limit yet. 133 133 00:05:00,570 --> 00:05:02,280 Now, in addition to doing it this way, 134 134 00:05:02,280 --> 00:05:05,160 you can do it the way I showed you in a previous lesson. 135 135 00:05:05,160 --> 00:05:08,160 You can go through and grep your authentication log 136 136 00:05:08,160 --> 00:05:10,770 and look for terms like failed or failure. 137 137 00:05:10,770 --> 00:05:13,920 And again, this is a much more accurate way of doing it, 138 138 00:05:13,920 --> 00:05:15,403 and a much easier way of doing it 139 139 00:05:15,403 --> 00:05:17,288 across all of your systems 140 140 00:05:17,288 --> 00:05:18,990 by being able to run scripts 141 141 00:05:18,990 --> 00:05:21,150 using this type of a grep command. 142 142 00:05:21,150 --> 00:05:23,460 Either way you want to do it is okay, 143 143 00:05:23,460 --> 00:05:24,360 but you should be aware 144 144 00:05:24,360 --> 00:05:26,820 that there are multiple ways to accomplish any goal. 145 145 00:05:26,820 --> 00:05:29,520 And as you get better at doing this in the real world, 146 146 00:05:29,520 --> 00:05:31,470 you're going to find the ways that work best for you 147 147 00:05:31,470 --> 00:05:33,783 as part of your own tactical processes.