Sysinternals глазами SOC

Summary

Andrey Gunkin of Kaspersky Lab explains how attackers and defenders use Microsoft Sysinternals utilities and how SOC teams can identify their activity. The talk focuses on traces these tools leave on Windows hosts and domain controllers.

Sysinternals and Sysmon

• Sysinternals began as a set of Windows utilities created primarily by Mark Russinovich. Microsoft acquired the tools in 2006. The suite is free and includes roughly 70 utilities.
• Many tools are portable and can run without a separate installation. Attackers may use them because they are legitimate, Microsoft-signed tools.
• Sysmon supplements standard Windows event logging. It can record process and registry activity and calculate hashes such as MD5, SHA-1, SHA-256, and IMPHASH. Its XML configuration controls which events are collected and filtered.
• File metadata—especially the company and product fields—can help identify a Sysinternals executable even if it has been renamed. Sysmon image-load events can also provide signature information.
• On first run, many Sysinternals tools display a license prompt. The talk describes the -accepteula option and the registry values used to remember acceptance, which can themselves be monitored.
• Sysmon can generate substantial event volume and, in some environments, increase CPU load. The speaker recommends tuning its configuration; disabling process-hash calculation may reduce overhead. He also notes that Sysmon is not the sensor used by Kaspersky’s MDR service.

Tools and Possible Detection Signals

• AD Explorer: Browses Active Directory and can save snapshots for later comparison or offline analysis. Snapshots may be detected through command-line arguments, file-creation events, registry records of the snapshot path and time, and LDAP activity. Snapshot files have a recognizable signature that can be searched for with YARA. AD Explorer data can also be exported for use with BloodHound.
• AD Restore: Finds and restores deleted directory objects that remain recoverable. Restoration activity can generate domain-controller event 4662; detection rules should account for legitimate system accounts.
• PsTools: Several utilities work remotely by using administrative shares, creating a service on the remote host, and communicating through named pipes. These behaviors can leave useful host-side traces:
  • PsExec runs commands remotely; service names, files, and named pipes can help identify its use.
  • PsFile lists or closes remote file sessions.
  • PsGetSid, PsInfo, PsList, PsLoggedOn, PsKill, PsSuspend, and PsShutdown retrieve remote information or control processes and systems. Depending on the utility, indicators may include remote services, named pipes, or remote-registry activity.
  • PsSuspend can pause a process without generating the same process-termination signal as killing it.
• ProcDump and Strings: The talk discusses dumping process memory and searching extracted strings for sensitive data, including tokens. Process creation and dump-file creation can provide detection opportunities.
• AccessChk and AccessEnum: These tools help identify weak permissions on services, files, directories, or registry locations. Embedded file metadata may reveal the tool even when its filename is disguised.
• MoveFile/PendMoves: These tools can schedule a file move or deletion for reboot. Relevant registry changes and access events may expose this activity.
• SDelete: Securely overwrites file data before deletion. The speaker shows an example of malware invoking it and describes monitoring its command-line use and related Sysinternals registry activity.

Practical Guidance and Discussion

The presentation is a defensive analysis and detection guide, illustrated with examples, rather than a conventional product review. The speaker recommends correlating multiple signals instead of relying only on filenames. These signals can include process and file events, registry auditing, remote service and pipe activity, LDAP requests, and domain-controller events.

Legitimate administrator use of these tools can create false positives, so organizations should define authorized accounts and tune alerts accordingly.

During the Q&A, the speaker discusses detecting AD Explorer through LDAP behavior, using Sysmon event data to identify disguised files, and the value of distinctive PsTools service or pipe names. He notes that some PsTools require access to administrative shares and that some use the remote registry. Antivirus products may block particular actions, such as process dumping, even if they do not remove the utility itself.

Main Speaker and Sources

• Main speaker: Andrey Gunkin, Kaspersky Lab. He previously worked in its MDR SOC and, at the time of the talk, in targeted-attack research.
• Other sources: Audience members contributed questions during the Q&A.