I'm cleaning up after an incident where a few servers were hacked. A new IDS has been put in place, the firewall has been upgraded, the services used in the attack are being replaced with more secure alternatives, and everything that doesn't need to be exposed is now behind a VPN, so at this point my focus is on determining what was going on while these servers were hacked. This is interesting to me and I wonder if any of you have seen something like it.
The hack started with RDP brute force and created a second account and then spread over RDP as far as it could using the same credentials and whatever it could dump from the first server. Then, for a period of several months, the hackers connected a few times a day over RDP for anywhere from a few seconds to a few minutes on both of those accounts. To try to figure out what might have been going on, I've:
- Run sleuthkit against the drives
- Written a tool to sequence the file timeline against all useful event logs and group those by remote session intervals and also run other profiling on the sessions
- Reviewed the users on the box
- Scanned the box
- Looked at all services listening on any port
- Manually gone through the files
I haven't set something up to listen for odd traffic to or from these boxes since we've taken them offline and I'm working with them as disconnected VMs.
Apart from some signs one of the boxes might have been temporarily used to stage a social engineering attack, I haven't seen any activity of note during the entire time the boxes are actively hacked. I don't imagine a higher form of access is taking place since the RDP connections were so active, and based on the firewall and services that were still working, the only form of backdoor I can think of actually working without detection would be a reverse shell, and if that existed, I'm not sure why RDP would be so active.
It turns out that one of the servers hacked by the hacked server had also been hacked the same way several months prior (by IPs from the same region), and that exhibited the same sort of usage: daily short RDP connections from the same set of sources after the source rotation from the brute force attacks had finished, but nothing odd on the box itself.
I suppose the continued connections could be just validation of current account credentials and access levels, but I'd have to imagine more would have been going on that I'm not seeing in the logs or file audits. Does anyone have any related experiences they'd like to share lessons learned from?
Edit: As requested by @pacifist, here are the logs I have reviewed:
- Sleuthkit file timeline
- Microsoft-Windows-RemoteApp and Desktop Connections/Admin
- Microsoft-Windows-RemoteApp and Desktop Connection Management/Admin
- Microsoft-Windows-RemoteApp and Desktop Connection Management/Operational
- Application log
- Security log
- Setup log
- System log
- IIS logs
- Firewall logs
- CAPI2 and BITS logs
- Powershell log
I've reviewed every other log file in the event viewer, but most didn't give any more information than what was already in the above or were disabled. However, the log retention policies weren't set properly until just recently, so there are definitely gaps between the log files.