Listen to this Post
Introduction:
A reactive SOC analyst watches alerts; an investigation-driven defender reconstructs the full attack chain, understands attacker behavior, and asks why controls failed. This article dissects two real-world SOC L2 interview scenarios: a Pass-the-Hash (PtH) lateral movement that compromised 11 servers after a renamed ProcDump stole NTLM hashes, and a LockBit 3.0 ransomware infection that used a legitimate Windows process (conhost.exe) to encrypt 47,832 files. You will learn how to write effective KQL queries, perform root cause analysis across three dimensions (people, process, technology), and implement mitigations including Credential Guard, EDR behavioral rules, and RDP hardening.
Learning Objectives:
- Reconstruct attack chains using MITRE ATT&CK tactics (T1550.002, T1003.001, T1486, T1059) and differentiate credential dumping from lateral movement
- Write optimized KQL queries for SecurityEvent logs to detect NTLM logon type 3, anomalous lsass.exe access, and mass file rename operations
- Apply a 3-dimension root cause analysis framework (Human/Process/Technology) to prevent ransomware and credential theft in enterprise environments
You Should Know:
- Detecting LSASS Credential Dumping: From Renamed ProcDump to NTLM Hash Theft
Attackers evade EDR by renaming known dumping tools (e.g., `procdump.exe` → svcupdate.exe) and executing from C:\ProgramData\Temp. In the FirstAxis Bank incident, the attacker dumped LSASS at 2:33 PM after admin Aaron Singh logged in with NTLM authentication (Event ID 4624), then waited until 6 PM departure to perform lateral movement.
Step‑by‑step detection and hardening guide:
- Enable Windows Defender Credential Guard (prevents LSASS from storing NTLM hashes in readable format):
– Via Group Policy: `Computer Configuration → Administrative Templates → System → Device Guard → Turn on Virtualization Based Security` → Set to “Enabled with UEFI lock” and select “Credential Guard”
– Verify with PowerShell (Admin): `Get-ComputerInfo -Property “DeviceGuard”`
2. Configure Sysmon to log LSASS access (Event ID 10, ProcessAccess):
– Install Sysmon: `sysmon64.exe -accepteula -i sysmon-config.xml`
– Ensure config includes: `
– Query logs: `Get-WinEvent -FilterHashtable @{LogName=’Microsoft-Windows-Sysmon/Operational’; ID=10} | Where-Object {$_.Message -like “lsass.exe”}`
3. Create custom detection rule in CrowdStrike/Sentinel for renamed ProcDump patterns:
– Monitor process creations (Image contains “procdump” OR `OriginalFileName` contains “procdump” despite renamed binary)
– Alert on `lsass.exe` access by non‑Microsoft processes: `DeviceProcessEvents | where FileName has_any (“procdump”, “svcupdate”) | where ProcessCommandLine contains “lsass”`
4. Linux equivalent (if dumping from Linux‑based EDR agents or cross‑platform):
– Audit `ptrace` calls: `auditctl -a always,exit -S ptrace -k lsass_dump` (though LSASS is Windows‑specific, this applies to Linux credential dumping via `/proc/kcore` or `gdb` on processes like sssd)
- Mitigation commands – Restrict who can access LSASS:
Add protected process light (PPL) for LSASS reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v RunAsPPL /t REG_DWORD /d 1 /f Block non‑Microsoft debuggers from opening LSASS Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" -1ame "MoveImages" -Value 1
2. Pass‑the‑Hash Lateral Movement Analysis with KQL
The attacker used stolen NTLM hashes to authenticate to 11 servers between 11:14 PM and 11:18 PM. A correct KQL query must filter Event ID 4624, LogonType 3 (network logon), NTLM authentication package, and the malicious source IP.
Step‑by‑step KQL query writing and troubleshooting:
- Corrected query from the interview (candidate errors fixed):
SecurityEvent | where EventID == 4624 | where LogonType == 3 | where AuthenticationPackageName == "NTLM" | where SubStatus == "0x0" // Successful logon | where SourceIpAddress == "10.40.12.88" | where TimeGenerated between (datetime(2025-03-07 23:14:00) .. datetime(2025-03-07 23:18:00)) | project ComputerName, TargetUserName, SourceIpAddress, TimeGenerated | sort by TimeGenerated asc
-
Detecting PtH without known source IP – Look for anomalous NTLM logon bursts:
SecurityEvent | where EventID == 4624 and LogonType == 3 and AuthenticationPackageName == "NTLM" | summarize Count = count(), Targets = make_set(ComputerName) by SourceIpAddress, TargetUserName, bin(TimeGenerated, 5m) | where Count > 5 // Lateral movement threshold
-
Enable NTLM logging and disable NTLM where possible (Windows command):
Audit NTLM usage via Group Policy: Computer Config → Windows Settings → Security → Local Policies → Security Options Set "Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers" = Deny all Set "Network security: Restrict NTLM: Audit Incoming NTLM Traffic" = Enable auditing View NTLM events: Event Viewer → Applications and Services → Microsoft → Windows → NTLM → Operational
-
Linux‑side detection of PtH (if cross‑environment with Samba or Winbind):
– Monitor `smbd` logs for NTLM authentication attempts: `grep “ntlm” /var/log/samba/log.smbd`
– Use Zeek (formerly Bro) to detect NTLMv2 hashes in network traffic: `zeek -r capture.pcap ntlm.zeek`
3. Living off the Land (LOLBin) Ransomware: How LockBit 3.0 Used conhost.exe
LockBit 3.0 executed via `conhost.exe` (legitimate Windows Console Host process) to evade EDR. The attacker renamed 47,832 files across 14 shared folders between 04:11 AM and 06:43 AM. EDR failed because conhost.exe is whitelisted, and mass file rename operations were not flagged as suspicious.
Step‑by‑step behavioral detection and containment:
- Detect mass file rename operations using Sysmon Event ID 11 (FileCreate) and 15 (FileCreateStreamHash):
// Microsoft Sentinel query for abnormal file rename rate DeviceFileEvents | where Timestamp between (datetime(2025-02-24 04:00:00) .. datetime(2025-02-24 07:00:00)) | summarize RenameCount = count() by DeviceName, bin(Timestamp, 1m) | where RenameCount > 100 | join kind=inner (DeviceFileEvents | where ActionType == "FileRenamed") on DeviceName
-
Monitor process ancestry – conhost.exe spawned by a suspicious parent (e.g., PowerShell, WMI, or scheduled task):
// KQL for detecting LOLBin ransomware chain DeviceProcessEvents | where FileName == "conhost.exe" | where ParentProcessName has_any ("powershell.exe", "wmic.exe", "schtasks.exe", "rundll32.exe") | project Timestamp, DeviceName, ProcessCommandLine, ParentProcessName, InitiatingProcessAccountName -
Create EDR behavioral rule (example for CrowdStrike Falcon or Microsoft Defender for Endpoint):
– Condition: Process = conhost.exe AND FileRenameCount > 500 per 5 minutes AND FileExtension in (‘.docx’,’.xls’,’.pdf’,’.txt’,’.jpg’)
– Action: Quarantine host, kill process tree, trigger incident response.
- Linux analogous technique – Renaming via `mv` or `rename` in a loop by a system binary (e.g., `bash` or
python):
– Detection command: `auditctl -w /var/log -p wa -k mass_rename` combined with threshold alerting in SIEM.
- Root Cause Analysis (3‑Dimension) Framework for SOC L2
The interview assessment revealed missing analyses: SOC analyst marked medium‑severity alert as “noted in queue, not investigated”; Credential Guard not enabled; stale firewall rule for RDP from internet (port 3389) existed since 2022.
Step‑by‑step RCA template and commands to validate missing controls:
| Dimension | Questions to Answer | Validation Commands / Checks |
|–|–||
| Human / Training | Did analyst understand credential dumping severity? Was alert triaged? | Review SIEM case closure notes. Test analysts with simulated lsass.exe access alerts. |
| Process / Policy | Is LSASS access defined as high severity? Are service account passwords rotated every 90 days? | `net user svc-domainadm /domain` check last password set. Audit SOC SLAs: time to investigate medium alerts. |
| Technology / Control | Is Credential Guard enabled? Are there behavioral rules for renamed ProcDump? | Get-WinEvent -LogName Microsoft-Windows-DeviceGuard; check EDR policy for `TargetImage lsass.exe` rules. |
Linux/Windows commands to gather evidence for each dimension:
Windows: Check Credential Guard status
Confirm-SecureBootUEFI
Get-ComputerInfo -Property "DeviceGuardSecurityServicesConfigured"
Windows: List all service accounts with password age > 90 days
Get-ADUser -Filter {Enabled -eq $true -and ServicePrincipalName -1e "$null"} -Properties PasswordLastSet, Name | Where-Object {($_.PasswordLastSet -lt (Get-Date).AddDays(-90))}
Linux: Check for stale firewall rules allowing RDP (if using iptables/nftables)
iptables -L -1 | grep 3389
nft list ruleset | grep 3389
- KQL Query Optimization for Incident Response: Time Filters and Lateral Movement Summaries
The candidate’s KQL query for lateral movement in the ransomware scenario contained table name errors and missing time filters. A professional query must be efficient and accurate.
Step‑by‑step corrected KQL queries:
- Lateral movement from compromised service account `PFMsvc-backup` (PrimeForge Manufacturing case):
SecurityEvent | where EventID == 4624 | where LogonType == 3 | where Account == "PFMsvc-backup" | where TimeGenerated between (datetime(2025-02-23) .. datetime(2025-02-25 23:59:59)) | project TimeGenerated, Computer, Account, SourceIpAddress, LogonProcessName | summarize TargetSystems = make_set(Computer) by SourceIpAddress, Account
-
Detect RDP brute force prior to initial access (external IP 196.203.44.17):
SecurityEvent | where EventID == 4625 // Failed logon | where LogonType == 10 // RemoteInteractive (RDP) | where SourceIpAddress == "196.203.44.17" | summarize FailedAttempts = count() by bin(TimeGenerated, 1h) | where FailedAttempts > 10
-
RDP Hardening and Service Account Security to Prevent Ransomware
The LockBit infection occurred because service account `PFMsvc-backup` had unchanged password for 3 years, and a firewall rule allowed RDP (port 3389) from the internet.
Step‑by‑step hardening commands:
- Disable RDP from internet at firewall level (Windows Defender Firewall with Advanced Security):
Remove any rule allowing RDP from any remote IP Remove-1etFirewallRule -DisplayName "Remote Desktop - Internet" -ErrorAction SilentlyContinue Add rule allowing RDP only from specific management subnet (e.g., 192.168.100.0/24) New-1etFirewallRule -DisplayName "RDP Restricted" -Direction Inbound -LocalPort 3389 -Protocol TCP -Action Allow -RemoteAddress 192.168.100.0/24
-
Enforce service account password rotation (Group Policy or PowerShell):
Set service account password never expires to false and force change Set-ADUser -Identity "PFMsvc-backup" -PasswordNeverExpires $false Initiate password reset (must be done in a secure manner with vault) $newPass = Read-Host -AsSecureString Set-ADAccountPassword -Identity "PFMsvc-backup" -1ewPassword $newPass -Reset Audit all service accounts with unconstrained delegation Get-ADUser -Filter {TrustedForDelegation -eq $true} -Properties TrustedForDelegation -
Linux equivalent – Restrict SSH and enforce key‑based auth + MFA:
– Edit /etc/ssh/sshd_config: PasswordAuthentication no, PermitRootLogin no, `AllowUsers
– Install `libpam-google-authenticator` for MFA: `apt install libpam-google-authenticator && echo “auth required pam_google_authenticator.so” >> /etc/pam.d/sshd`
What Undercode Say:
- Key Takeaway 1: Timing is an attacker’s greatest ally. In the PtH incident, the attacker waited 8 hours after credential dumping until the admin left the office. SOC teams must prioritize alerts that indicate credential access, even with medium severity, and implement automated checks for after‑hours lateral movement.
- Key Takeaway 2: Living off the Land (LOLBin) techniques like conhost.exe or renamed Procdump bypass signature‑based EDR. Behavioral detection – monitoring process ancestry, file rename rates, and LSASS access patterns – is the only reliable defense. Credential Guard and restricted NTLM policies should be default configurations, not optional.
Analysis: The interview assessment reveals a recurring pattern: SOC analysts understand individual attack steps but fail to connect weak signals across time. The candidate correctly identified ProcDump rename and PtH but missed the policy gap (no escalation for medium alerts) and the technology gap (Credential Guard disabled). Similarly, the LockBit scenario shows that without immutable backups and network segmentation, even perfect detection may come too late. Organizations must shift from “alert response” to “investigation‑driven defense” by integrating MITRE ATT&CK mapping into every L2 analyst’s workflow and automating low‑level queries for common TTPs (T1003, T1550, T1486). The corrected KQL queries above provide immediate actionable content for SIEM tuning.
Prediction:
- -1 Credential dumping will remain the 1 initial access vector for lateral movement because many enterprises still run NTLM and have not enabled Credential Guard. Attackers will continue using renamed legitimate tools (ProcDump, MiniDump, Taskmgr) to evade EDR, leading to more post‑6 PM breaches.
- +1 Behavioral detection rules for mass file operations and LSASS access will become standard in all major EDRs within 12 months, reducing false negatives for LOLBin ransomware. MITRE ATT&CK mappings will be embedded directly into SIEM query builders, lowering the skill barrier for junior analysts.
- -1 Service account password policies remain critically weak – the PrimeForge case (3‑year‑old password) is not an outlier. Until automated rotation and just‑in‑time privileged access become mandatory (e.g., via cyber insurance requirements), attackers will compromise backup and patch management accounts via simple RDP brute force.
- +1 KQL and other SIEM query languages will evolve to include native PtH detection functions, such as `detect_passthehash()` that correlates 4624 logon events with previous 4622 (security principal deletion) or lsass dump events, reducing manual correlation time from hours to seconds.
▶️ Related Video (78% Match):
🎯Let’s Practice For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
IT/Security Reporter URL:
Reported By: Gmfaruk Soc – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
