Published case study
Windows intrusion investigation
An end-to-end reconstruction of a brute-force RDP compromise using Windows Security Event Logs and Sysmon telemetry.
Executive summary
Two Windows event-log files were analyzed to trace an intrusion from initial access through post-exploitation. Authentication records, Logon IDs, SIDs, process activity, file creation, and network connections were correlated to determine what happened and which activity required escalation.
Attack chain reconstructed
| Stage | Finding |
|---|---|
| Initial access | Fourteen failed logons from 10.10.53.248 in approximately four seconds, followed by a successful RDP session. |
| Compromise | Successful Administrator logon recorded by Event ID 4624, Logon Type 10, with Logon ID 0x183c36d. |
| Backdoor account | The attacker session created the local account svc_sysrestore, recorded by Event ID 4720. |
| Privilege change | The new account was added to Backup Operators and Remote Desktop Users using activity recorded by Event ID 4732. |
| Malware delivery | Sysmon process and alternate-data-stream telemetry identified ckjg.exe downloaded through Chrome. |
| Persistence | The malware created a shortcut in the Startup folder, enabling execution after login. |
| Command & control | Sysmon network telemetry showed a connection to 193.46.217.4:7777, associated with hkfasfsafg.click. |
| Post-exploitation | PowerShell history showed system reconnaissance and additional attacker activity. |
Methodology
- Filtered Event ID
4625to identify the failed-logon pattern, then pivoted to4624to identify the successful RDP session. - Used the compromised session’s Logon ID to correlate account creation and group-membership changes.
- Reviewed Sysmon Events
1,11, and15to trace execution, persistence, and download origin. - Analyzed Sysmon Event
3for suspicious outbound network activity. - Reviewed PowerShell history to establish post-exploitation behavior.
Analyst conclusion
The evidence supports escalation as a confirmed compromise. Recommended actions include isolating the endpoint, disabling the affected accounts, blocking identified infrastructure, collecting volatile evidence, and reviewing adjacent systems for reuse of the compromised credentials.