Executive Summary

This case study outlines the detection, triage, and log correlation process for an unauthorized remote management attack. Using a multi-layered telemetry approach (Wazuh SIEM, Windows Event Logs, and Firewall logs), we traced an attacker's movement from an external brute-force entry to obfuscated PowerShell execution and internal lateral movement.

Detection & Indicators of Compromise (IoCs)

During routine log monitoring, multiple security alerts triggered on the SIEM dashboard indicating anomalous authentication behavior:

  • Source External IP: 2.57.121.25
  • Target Protocol: WinRM (Port 5985) - Windows Remote Management
  • Target Action: Unauthorized remote login attempt and session establishment.

Triage & Investigation Steps

1. Initial Log Correlation

By correlating Windows Event Logs (EVTX) with Wazuh SIEM telemetry, we identified that the external IP successfully authenticated via WinRM.

2. Execution Analysis

Upon establishing the remote session, the attacker spawned wsmprovhost.exe, which immediately triggered an obfuscated Base64-encoded PowerShell command:

  • Technique: Obfuscated PowerShell execution used to bypass basic string-matching security controls.
  • MITRE ATT&CK Mapping:
    • T1021.006 - Remote Services: Windows Remote Management
    • T1059.001 - Command and Scripting Interpreter: PowerShell
    • T1027 - Obfuscated Files or Information

3. Lateral Movement & Enrichment

Further inspection of internal firewall and SMB logs revealed a subsequent connection attempt targeting admin shares on internal host 10.30.15.30.

  • Checking the source threat indicators against threat intelligence feeds (such as VirusTotal) yielded multiple malicious flags, confirming the threat actor's infrastructure.

Remediation & Mitigation Recommendations

  1. Restrict WinRM Access: Limit WinRM listeners (Ports 5985/5986) strictly to internal management subnets via Windows Firewall rules.
  2. PowerShell Logging: Ensure Advanced Script Block Logging (Event ID 4104) is fully enabled across all endpoints to capture de-obfuscated script contents.
  3. Account Lockout Policies: Implement aggressive lockout thresholds for administrative accounts exposed to network services.

Authored by Reycardo Montañez Millan — Aspiring Cyber Threat Monitoring Analyst.
Portfolio: https://reymillanworks-oss.github.io/Reymillanworks101/