User Hunt

• http://www.harmj0y.net/blog/penetesting/i-hunt-sysadmins/

• https://www.slideshare.net/harmj0y/i-hunt-sys-admins-20

PS > Find-DomainUserLocation -UserIdentity snovvcrash

Sessions Enum

• http://www.harmj0y.net/blog/powershell/powershell-and-win32-api-access/

• http://www.harmj0y.net/blog/powershell/powerquinsta/

• https://github.com/Leo4j/Invoke-SessionHunter/blob/main/Invoke-SessionHunter.ps1

• https://gist.github.com/GeisericII/6849bc86620c7a764d88502df5187bd0

• https://github.com/p0dalirius/FindUnusualSessions

Derivative Local Admins

• http://www.harmj0y.net/blog/redteaming/local-group-enumeration/

• https://medium.com/@sixdub/derivative-local-admin-cdd09445aac8

• https://wald0.com/?p=14

• http://www.offensiveops.io/tools/bloodhound-working-with-results/

3MB

Pen Testing Active Directory Environments (Varonis).pdf

PDF

Open

Logon Events

• https://github.com/Mr-Un1k0d3r/RedTeamCSharpScripts/blob/5175f64c111ffcc13250e3cf818f05ca46654af5/wmiutility.cs#L194

• https://gist.github.com/awakecoding/5fda938a5fd2d29ebffb31eb023fe51c

• https://github.com/lele8/SharpUserIP

• https://github.com/CICADA8-Research/LogHunter

Search for IPs from where the user of interest logged on to current machine (event 4624):

PS > Get-EventLog Security -InstanceId 4624 | ? {$_.Message.Contains("snovvcrash")} | select -First 10 | fl * | Out-File C:\Windows\Temp\user.dat
Or
Cmd > wmic ntevent where "LogFile='Security' and EventCode=4624 and Message like '%%snovvcrash%%'" get /format:list | findstr /c:"Source Network Address" | sort /unique
$ atexec.py 'wmic ntevent where "LogFile='"'"'Security'"'"' and EventCode=4624 and Message like '"'"'%%snovvcrash%%'"'"'" get /format:list | findstr /c:"Source Network Address" | sort /unique'

chainsaw

• https://github.com/WithSecureLabs/chainsaw

Cmd > chainsaw.exe search -i j.doe C:\Windows\System32\winevt\Logs\Security.evtx --json -o events.json

Connected USB Devices

List USB devices history using reg.py:

$ reg.py -k -no-pass PC01.megacorp.local query -keyName 'HKLM\SYSTEM\CurrentControlSet\Enum\USB'

List USB devices history using PowerShell:

PS > gwmi Win32_USBControllerDevice | %{[wmi]($_.Dependent)} | sort Manufacturer, Description, DeviceID | ft -GroupBy Manufacturer Description, Service, DeviceID

Hunt for connected USB device with a specific VID and PID using wmiquery.py:

$ cat usb.wmi
SELECT DeviceID, Name FROM Win32_USBHub
$ for comp in `cat comps.txt`; do KRB5CCNAME=tickets/"`echo $comp | cut -d'.' -f1`".ccache proxychains4 -q wmiquery.py -k -no-pass $comp -file usb.wmi | tee -a usb.txt; sleep 2; done
$ tail -f usb.txt | grep 'VID_0000&PID_1111'