> For the complete documentation index, see [llms.txt](https://ppn.snovvcra.sh/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ppn.snovvcra.sh/pentest/infrastructure/ad/user-hunt.md).
# User Hunt
*
*
```
PS > Find-DomainUserLocation -UserIdentity snovvcrash
```
## Sessions Enum
*
*
*
*
*
## Derivative Local Admins
*
*
*
*
{% file src="/files/Btm0k3XllKKyfi6USqcy" %}
## Logon Events
*
*
*
*
{% embed url="" %}
Search for IPs from where the user of interest logged on to current machine (event [4624](https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4624)):
```
PS > Get-EventLog Security -InstanceId 4624 | ? {$_.Message.Contains("snovvcrash")} | select -First 10 | fl * | Out-File C:\Windows\Temp\user.dat
Or
Cmd > wmic ntevent where "LogFile='Security' and EventCode=4624 and Message like '%%snovvcrash%%'" get /format:list | findstr /c:"Source Network Address" | sort /unique
$ atexec.py 'wmic ntevent where "LogFile='"'"'Security'"'"' and EventCode=4624 and Message like '"'"'%%snovvcrash%%'"'"'" get /format:list | findstr /c:"Source Network Address" | sort /unique'
```
### chainsaw
*
```
Cmd > chainsaw.exe search -i j.doe C:\Windows\System32\winevt\Logs\Security.evtx --json -o events.json
```
## Connected USB Devices
List USB devices history using [reg.py](https://github.com/fortra/impacket/blob/master/examples/reg.py):
```
$ reg.py -k -no-pass PC01.megacorp.local query -keyName 'HKLM\SYSTEM\CurrentControlSet\Enum\USB'
```
List USB devices history using [PowerShell](https://gist.github.com/thebentern/07d9c682176654cfe0c1):
```
PS > gwmi Win32_USBControllerDevice | %{[wmi]($_.Dependent)} | sort Manufacturer, Description, DeviceID | ft -GroupBy Manufacturer Description, Service, DeviceID
```
Hunt for connected USB device with a specific `VID` and `PID` using [wmiquery.py](https://github.com/fortra/impacket/blob/master/examples/wmiquery.py):
```
$ cat usb.wmi
SELECT DeviceID, Name FROM Win32_USBHub
$ for comp in `cat comps.txt`; do KRB5CCNAME=tickets/"`echo $comp | cut -d'.' -f1`".ccache proxychains4 -q wmiquery.py -k -no-pass $comp -file usb.wmi | tee -a usb.txt; sleep 2; done
$ tail -f usb.txt | grep 'VID_0000&PID_1111'
```