Endpoint and Host Defense
This domain tests host-level visibility: which Windows, Linux and EDR artefacts record an action, what each event ID means, and how parent-child process lineage turns a single alert into a confirmed intrusion.
Windows telemetry that matters
- 4624 successful logon with Logon Type 2 interactive, 3 network, 5 service, 10 RDP. 4625 failure, with substatus 0xC000006A for bad password and 0xC0000064 for no such user. 4648 explicit credential use. 4672 special privileges assigned.
- 4688 process creation, but the command line is only recorded if audit policy enables it.
- 4104 PowerShell script block logging. 7045 service installed. 4698 scheduled task created. 4720 account created. 1102 audit log cleared. 4768/4769 Kerberos TGT and service ticket requests.
- Sysmon: 1 process create with hashes and parent, 3 network connect, 7 image load, 8 CreateRemoteThread, 10 ProcessAccess, 11 FileCreate, 12/13/14 registry, 22 DNS query. Sysmon is not installed by default; absence of Sysmon events is not absence of activity.
- Linux: /var/log/auth.log or /var/log/secure for sshd accept and fail, auditd execve rules, systemd journal, cron entries, /etc/passwd modification times, LD_PRELOAD abuse.
- Persistence hotspots: Run and RunOnce keys, services, scheduled tasks, WMI event subscriptions, startup folders, DLL search order.
- LOLBins: certutil, mshta, rundll32, regsvr32, wmic, powershell -enc.
Worked example
Sysmon Event 10 records SourceImage C:\Users\bob\Downloads\updater.exe opening TargetImage C:\Windows\System32\lsass.exe with GrantedAccess 0x1010. Normal processes rarely touch LSASS, and 0x1010 includes PROCESS_VM_READ, the classic credential-dumping access. Correlate outward: Event 1 shows updater.exe created by winword.exe, meaning a malicious document launched it; Event 11 shows a .dmp file in %TEMP%; 4688 shows rundll32 executing afterwards. The chain converts one ambiguous alert into a confirmed credential-theft case.
Traps that cost marks
Relying on 4688 without command-line auditing enabled; confusing 4624 Type 3 with Type 10; assuming Sysmon is present; ignoring parent-child lineage; treating a single 4625 as an attack; missing 1102 log clearing as evidence of defence evasion.
Key points
- 4624 Type 3 is network, Type 10 is RDP; 4625 substatus names the failure reason.
- 4688 needs command-line audit policy to be useful.
- Sysmon 10 access to lsass.exe with read rights indicates credential dumping.
- Parent-child process lineage is the strongest single triage signal.
- 1102 and 7045 mark log clearing and service-based persistence.