Once Upon a Login
How Logon Sessions Help Defenders See the Bigger Picture
About Me (@jsecurity101)
Consultant @SpecterOps/Defensive Security Researcher
• Detection, Threat Hunting, Compromise Assessments
• Windows Internals, All Things Data, Reverse Engineering
• Open-Source Author/Contributor
• Atomic Test Harnesses
• MSRPC-To-ATT&CK
• Windows APIs To Sysmon-Events
Formerly Sr. Threat Researcher @RedCanary
Host of the Detection: Challenging Paradigms Podcast
Overview
• The “Why”?
• What are logon sessions?
• Defensive Capabilities
• Available Telemetry
• Test-Cases
• PowerShell Script Drop
The “Why”
• Majority of detection and investigation strategies are heavily process
centric
• This leads to A LOT of analysis for the analyst
• Potential “lost” activity
• TIME CONSUMING
Logon Sessions
Logon
Session Authentication Origin Token
Initialization Creation
Logon Sessions
• Session that is created upon a user’s successful logon
• Terminates when the user is logged off
• Referenced via a LogonId value
• LowPart of LUID structure
• If the user that logs in has High IL privileges (administrative privileges)
2 logon sessions are generated. Known as a split token/linked token.
• 1 for Medium IL session
• 1 for High IL session
Split Token Example
Access Tokens
• Securable objects that serve to identify the security context of
processes/threads
• Contain information–
• User SID
• Group Memberships
• Privileges
• Logon ID/Logon Session
• Represented in the kernel via TOKEN structure
• Generated after authentication
• 1 token per logon session
Logon Sessions in Token Structure
Logon Session Generation Process
Defensive Capabilities
• Detections
• Performing JOINs on actions performed in the same logon session
• <example>
• Investigation
• More scoped approach
• Alert goes off (LogonID is exposed)
• LogonID query to pull all actions performed with that logon session
• Investigate
Note: There are some gaps within some vendors on which logs expose
LogonId fields*
Available Telemetry Today
• Window Security Events
• High Volume
• Sysmon
• Only ProcessCreation events
• Microsoft Defender for Endpoint
• 48(+) different ActionTypes contain LogonId data
• Other EDR vendors
Microsoft Defender for Endpoint
MDE NewCredential Limitation
Practical Examples (Credential Dumping)
Practical Examples (Privilege Escilation)
A process was injected with potentially malicious code
Practical Examples (Privilege Escilation)
A process was injected with potentially malicious code
Practical Examples (Lateral Movement)
Ongoing hands-on-keyboard attacker activity detected (Cobalt Strike)
WinRM
Practical Examples (Lateral Movement)
Ongoing hands-on-keyboard attacker activity detected (Cobalt Strike)
Practical Examples (Lateral Movement)
Ongoing hands-on-keyboard attacker activity detected (Cobalt Strike)
Practical Examples (Lateral Movement)
Suspicious process executed PowerShell command
Practical Examples (Lateral Movement)
Detection
Investigation Script
Conclusion
• Goal is to provide an initial targeted approach
• Logon Session Centric Analysis is not meant to replace previous
analysis methodologies
• Other processes will still need to be used due to limitations in today’s
telemetry
• Really powerful with multiple data sources – Security Events + EDR!!
Resources
• Windows Internals Book Part 1, Chapter 7
• Microsoft Authentication/Logon Documentations
• LogonProcesses.ps1 -
https://gist.github.com/jsecurity101/12e75415b35a5d220d13674e9e
d43373
Q/A
