Field Notes: Reconstructing an Attacker’s Workflow

What it is

A dfir.ch Field Note on PowerShell scripts an attacker left on disk during an incident. The scripts form a post-compromise toolkit: a file-based command runner, a credential-phishing prompt, AD computer enumeration with WMI access testing, and SMB share discovery. The author says parts of the runner overlap with Microsoft's analysis of the TerminalFix campaign, a ClickFix variant that deploys a reverse tunnel. The page does not say when or whether each script was run.

How it works

Command runner. A while ($true) loop polls the LastWriteTime of %TEMP%\watchFile.txt once a second. When it changes, the whole file goes to iex, and stdout and stderr are redirected to %TEMP%\outputFile.txt.

Credential prompt. The script calls $host.UI.PromptForCredential('Windows Security', ...) for one fixed account, then converts the SecureString back with $cred.GetNetworkCredential().Password.

flowchart TD
    A[Prompt for credentials] --> B{Username matches target?}
    B -- no --> A
    B -- yes --> C{Hidden powershell.exe starts with -Credential?}
    C -- no --> D[Log password in cleartext] --> A
    C -- yes --> E[Prompt ends]

Entering valid credentials for another account does not end the prompt. The recovered log held entries like FAILED - Invalid password for: dfir\malmoeb | Password: dfir.ch, plus CANCELLED lines when the user dismissed the prompt.

AD recon. A DirectorySearcher with filter (&(sAMAccountType=805306369)) returns computer accounts with a populated dnshostname. A runspace pool of up to 30 workers then runs Get-WmiObject Win32_OperatingSystem -ComputerName against each host. Hosts that answer are printed as "Local admin access on N computers".

SMB discovery. The script takes computers from AD, or falls back to local IPv4 info and generates /24 ranges. It tests TCP/445 with BeginConnect and a 500 ms wait, then calls NetShareEnum() from netapi32.dll. It tries Get-ChildItem on each share, reads the volume size with GetDiskFreeSpaceEx(), and classifies rights from the ACL as Read, Read+Write, Modify or FullControl.

What to do

Hunt for behaviour fragments in PowerShell Script Block Logging (Event ID 4104) and Module Logging (4103):

• PromptForCredential
• GetNetworkCredential().Password
• DirectoryServices.DirectorySearcher
• sAMAccountType=805306369
• Get-WmiObject Win32_OperatingSystem -ComputerName
• Net.Sockets.TcpClient
• BeginConnect
• NetShareEnum
• GetDiskFreeSpaceEx

Each string is legitimate alone. Combinations are the signal, especially from an unusual user context or during an incident window.

Use Event ID 4688, Sysmon Event ID 1 or EDR data to look for suspicious PowerShell and odd parent-child chains. In network telemetry, look for one PowerShell process reaching many hosts on TCP/445 or making remote WMI/DCOM calls.

If a credential log like the one above is recovered, treat every password in it as compromised, whether or not later attacker activity is visible.

Caveats

• A successful Start-Process -Credential shows only that Windows accepted the credentials for that process creation. It does not prove they work against other systems or network resources.
• The "local admin access" label is misleading. A successful remote WMI query shows the current context can query that host. Delegated WMI permissions can produce the same result, and it does not prove remote command execution.
• Computer objects from AD may be stale, so not every returned system is live.
• The ACL-based rights classification is not a true effective-permissions calculation, because SMB access combines share and NTFS permissions.
• SizeGB is the size of the underlying volume, not the share. Shares on one volume show identical values.