Executive Summary
This case study outlines the detection, triage, and log correlation process for an unauthorized remote management attack. Using a multi-layered telemetry approach (Wazuh SIEM, Windows Event Logs, and Firewall logs), we traced an attacker's movement from an external brute-force entry to obfuscated PowerShell execution and internal lateral movement.
Detection & Indicators of Compromise (IoCs)
During routine log monitoring, multiple security alerts triggered on the SIEM dashboard indicating anomalous authentication behavior:
-
Source External IP:
2.57.121.25 - Target Protocol: WinRM (Port 5985) - Windows Remote Management
- Target Action: Unauthorized remote login attempt and session establishment.
Triage & Investigation Steps
1. Initial Log Correlation
By correlating Windows Event Logs (EVTX) with Wazuh SIEM telemetry, we identified that the external IP successfully authenticated via WinRM.
2. Execution Analysis
Upon establishing the remote session, the attacker spawned wsmprovhost.exe, which immediately triggered an obfuscated Base64-encoded PowerShell command:
- Technique: Obfuscated PowerShell execution used to bypass basic string-matching security controls.
-
MITRE ATT&CK Mapping:
-
T1021.006- Remote Services: Windows Remote Management -
T1059.001- Command and Scripting Interpreter: PowerShell -
T1027- Obfuscated Files or Information
-
3. Lateral Movement & Enrichment
Further inspection of internal firewall and SMB logs revealed a subsequent connection attempt targeting admin shares on internal host 10.30.15.30.
- Checking the source threat indicators against threat intelligence feeds (such as VirusTotal) yielded multiple malicious flags, confirming the threat actor's infrastructure.
Remediation & Mitigation Recommendations
- Restrict WinRM Access: Limit WinRM listeners (Ports 5985/5986) strictly to internal management subnets via Windows Firewall rules.
- PowerShell Logging: Ensure Advanced Script Block Logging (Event ID 4104) is fully enabled across all endpoints to capture de-obfuscated script contents.
- Account Lockout Policies: Implement aggressive lockout thresholds for administrative accounts exposed to network services.
Authored by Reycardo Montañez Millan — Aspiring Cyber Threat Monitoring Analyst.
Portfolio: https://reymillanworks-oss.github.io/Reymillanworks101/
Top comments (1)
Solid and well-structured SOC case study! Correlating Windows Event Logs with Wazuh telemetry to trace the attacker's trajectory from external WinRM brute-forcing to wsmprovhost.exe spawning obfuscated PowerShell demonstrates exemplary incident response rigor. Mapping each pivot cleanly to MITRE ATT&CK techniques (T1021.006, T1059.001, T1027) makes the investigation both practical and educational.
In your triage environment, did you rely primarily on Script Block Logging (Event ID 4104) to de-obfuscate the Base64 payloads, or did you employ automated sandbox detonation for enrichment?