Detect Data from Local System in CrowdStrike LogScale
Adversaries may search local system sources, such as file systems, configuration files, local databases, and process memory to find files of interest and sensitive data prior to Exfiltration. Adversaries commonly target credential stores (Windows DPAPI, browser databases, SSH keys), corporate documents (Office files, PDFs), and system databases (Active Directory NTDS.dit, SAM hive) using command interpreters, native OS utilities like esentutl.exe and robocopy.exe, or custom malware. Observed threat actors include Kimsuky (document theft), HAFNIUM (data collection post-exploitation), LAPSUS$ (credential and file theft for extortion), and malware families such as QakBot (esentutl for browser credential extraction) and BADNEWS (recursive crawl for Office/PDF files).
MITRE ATT&CK
- Tactic
- Collection
- Technique
- T1005 Data from Local System
- Canonical reference
- https://attack.mitre.org/techniques/T1005/
LogScale Detection Query
#event_simpleName = ProcessRollup2
| ImageFileName = /(?i)(esentutl|cmd|powershell|pwsh|wscript|cscript|mshta|robocopy|xcopy|where|findstr|find)\.exe$/
| CommandLine = /(?i)(ntds|\.dit|login[\s_]?data|cookies|web[\s_]?data|id_rsa|id_ed25519|id_ecdsa|\.ssh[\/\\]|microsoft.credentials|microsoft.protect|\.kdbx|filezilla|recentservers|winscp\.ini|\.pst|\.ost|dir\s\/s|get-childitem.*recurse|gci.*recurse|compress-archive|\.pdf|\.docx|\.xlsx|\.pptx|\.pfx|\.pem|\.key)/
| NOT ParentBaseFileName = /(?i)(MsMpEng|svchost|services|BackupAgent|OneDriveSetup)\.exe$/
| case {
ImageFileName = /(?i)esentutl\.exe$/ AND CommandLine = /(?i)(ntds|\.dit|login.data|cookies|\/vss)/ |
SignalReason := "ESE Database Extraction (esentutl)" ;
ImageFileName = /(?i)(powershell|pwsh)\.exe$/ AND CommandLine = /(?i)(get-childitem.*recurse|gci.*recurse|gci.*-r\s|dir\s\/s|tree\s\/f|compress-archive)/ AND CommandLine = /(?i)(\.pdf|\.docx|\.xlsx|\.pptx|\.pfx|\.pem|\.key|\.kdbx|\.pst)/ |
SignalReason := "PowerShell Recursive File Enumeration for Sensitive Extensions" ;
ImageFileName = /(?i)(robocopy|xcopy)\.exe$/ AND CommandLine = /(?i)(\.ssh|credential|protect|ntds|\.kdbx|filezilla)/ |
SignalReason := "Bulk Copy Tool Targeting Sensitive Paths" ;
ImageFileName = /(?i)(cmd|powershell|pwsh|wscript|cscript|mshta)\.exe$/ AND CommandLine = /(?i)(\.ssh|id_rsa|credentials|protect|login.data|ntds\.dit|\.kdbx|filezilla|\.pst|\.ost)/ |
SignalReason := "CLI Access to Sensitive Credential Path" ;
ImageFileName = /(?i)(where|findstr|find)\.exe$/ |
SignalReason := "Search Utility Locating Sensitive File Extensions" ;
* | SignalReason := "T1005 Process Indicator"
}
| table([ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName, ParentCommandLine, SignalReason], limit=2000)
| sort(field=@timestamp, order=desc)
// Supplemental query: File access via Falcon WriteFile/ReadFile events
// Run separately to detect direct credential store file access
#event_simpleName = /^(WriteFile|PeFileWritten|SuspiciousFileWritten)$/
| TargetFileName = /(?i)(\\Microsoft\\Credentials\\|\\Microsoft\\Protect\\|\.ssh[\/\\](id_rsa|id_ed25519|id_ecdsa)|Google\\Chrome.*Login Data|Microsoft\\Edge.*Login Data|Mozilla\\Firefox.*logins\.json|Mozilla\\Firefox.*key4\.db|System32\\config\\(SAM|SYSTEM|SECURITY)|NTDS\\ntds\.dit|\.kdbx$|FileZilla.*recentservers\.xml|WinSCP\.ini)/
| NOT ImageFileName = /(?i)(svchost|MsMpEng|SearchIndexer|OneDrive|msedge|chrome|firefox)\.exe$/
| case {
TargetFileName = /(?i)(\\Credentials\\|\\Protect\\)/ |
SignalReason := "Windows DPAPI Credential Store File Access" ;
TargetFileName = /(?i)\.ssh[\/\\](id_rsa|id_ed25519|id_ecdsa)/ |
SignalReason := "SSH Private Key File Access" ;
TargetFileName = /(?i)(Chrome|Edge).*Login Data/ |
SignalReason := "Browser Credential Database Access" ;
TargetFileName = /(?i)Firefox.*(logins\.json|key4\.db)/ |
SignalReason := "Firefox Credential Store Access" ;
TargetFileName = /(?i)System32\\config\\(SAM|SYSTEM|SECURITY)/ |
SignalReason := "Windows Registry Hive File Access" ;
TargetFileName = /(?i)(NTDS\\ntds\.dit|\.kdbx$)/ |
SignalReason := "AD Database or KeePass Vault Access" ;
* | SignalReason := "Sensitive Credential File Access"
}
| table([ComputerName, UserName, ImageFileName, TargetFileName, SignalReason], limit=2000)
| sort(field=@timestamp, order=desc)Two complementary CrowdStrike LogScale (Falcon) queries. Query 1 targets ProcessRollup2 events: filters for process names associated with T1005 collection (esentutl, shell/script interpreters, robocopy/xcopy, where/findstr), then requires command line content matching sensitive credential paths, document extensions, or enumeration patterns. Uses case expression to classify each hit into a signal reason. Query 2 targets Falcon WriteFile/PeFileWritten/SuspiciousFileWritten events to detect direct file access to DPAPI credential stores, SSH keys, browser DBs, Windows registry hives, NTDS.dit, KeePass vaults, and FTP credential files. Both queries exclude known-good browser and system processes and sort descending by timestamp. Run each query independently in the Falcon LogScale investigation console or as separate saved searches.
Data Sources
Required Tables
False Positives & Tuning
- CrowdStrike Falcon sensor itself (CSFalconService, CSFalconContainer) may access credential and registry paths during telemetry collection — the sensor process is typically excluded by EDR policy but may surface if exclusion lists are not maintained
- Enterprise software deployment tools (SCCM, Intune Management Extension, Chef/Puppet agents) executing PowerShell scripts for software inventory or compliance checks may match the bulk enumeration pattern — correlate with software deployment schedules and management agent parent process names
- Developer CI/CD pipeline agents running on Windows build servers executing PowerShell scripts that traverse source trees containing key material (e.g., embedded test certificates, .pem fixtures) will match the recursive enumeration with sensitive extension branch — filter by build server hostname asset tag or pipeline service account
Other platforms for T1005
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1 Recursive Document Collection via PowerShell
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Get-ChildItem', '-Recurse', and file extension patterns. Sysmon Event ID 11: FileCreate for df00tech-filelist.csv in %TEMP%. PowerShell ScriptBlock Log Event ID 4104 showing the full collection script. File access events (if SACL auditing enabled, Security Event ID 4663) for each document accessed during enumeration.
- Test 2 Browser Credential Database Extraction via esentutl
Expected signal: Sysmon Event ID 1: Process Create for esentutl.exe with CommandLine containing '/y', 'Login Data', '/d', and '/o' flags. Sysmon Event ID 11: FileCreate for df00tech-logindata.db in %TEMP%. Security Event ID 4688 (if command line auditing enabled) capturing the full esentutl command. File access event on the Chrome Login Data file path.
- Test 3 SSH Private Key Collection
Expected signal: Sysmon Event ID 1: Process Create for cmd.exe with CommandLine containing '.ssh' and 'copy' and 'id_rsa'. Sysmon Event ID 11: FileCreate for both the test key file in .ssh and the copied file in %TEMP%. DeviceFileEvents (MDE): FileCreated action on .ssh directory path with id_rsa in filename, initiating process cmd.exe. Security Event ID 4663 on the .ssh directory if SACL auditing is enabled.
- Test 4 Windows DPAPI Credential Store Enumeration
Expected signal: Sysmon Event ID 1: Process Create for cmd.exe with CommandLine containing 'dir /s /b' and 'Microsoft\Credentials'. Security Event ID 4688 (if command line auditing enabled). If SACL auditing is configured on the Credentials directory, Security Event ID 4663 for directory access. DeviceProcessEvents (MDE) will capture the command with full path context.
References (5)
- https://attack.mitre.org/techniques/T1005/
- https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1005/T1005.md
- https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon
- https://www.microsoft.com/en-us/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
Response Playbook
Triage
- Identify the initiating process and user account — is this a known backup agent, IT tool, or service account? Cross-reference against the CMDB and change management system for approved activity.
- Examine the full command line if process-based: what paths are being enumerated, what extensions targeted, and is output being redirected to a staging location (e.g., 'dir /s /b > C:\Users\Public\files.txt')?
- For esentutl.exe alerts: determine the target database. esentutl targeting 'Login Data' (browser credentials) or 'ntds.dit' (AD database) is high-severity; targeting benign .db files less so. Check for VSS snapshot interaction (/vss flag).
- Check for staging artifacts: look for zip archives, newly created directories in temp/public paths (C:\Users\Public, C:\Temp, C:\Windows\Temp), or files with names inconsistent with normal operations created near the alert time.
- Correlate with network events: did the same process or a subsequent process make outbound connections within 30 minutes? Run DeviceNetworkEvents for the same device and AccountName in the alert window.
- Review the parent process chain — was the collection tool spawned by a suspicious parent (Office application, script host, service account outside change window)? Parent context often reveals the initial access vector.
- Check for Volume Shadow Copy creation (vssadmin.exe or wmic shadowcopy) in the 30 minutes preceding the alert — adversaries often use VSS to access locked files like ntds.dit and SAM.
Containment
- If active exfiltration is suspected or confirmed: isolate the endpoint immediately using EDR network isolation or emergency VLAN placement. Preserve isolation until forensics is complete.
- If credential stores were accessed (DPAPI Credentials, browser Login Data, .ssh/id_rsa, KeePass .kdbx): assume all stored credentials on that system are compromised. Initiate credential reset for the affected user and any service accounts accessible from that host.
- If NTDS.dit or SAM/SYSTEM hive files were accessed or copied: escalate to Tier 3 immediately — treat as a domain-wide credential compromise. Initiate krbtgt double-reset and review for Golden Ticket activity.
- If SSH keys were accessed: rotate all SSH key pairs that were readable from the compromised user's .ssh directory. Audit authorized_keys files on target systems for unauthorized additions.
- Block outbound transfers from the isolated host by verifying the network isolation policy is active. Check DNS logs for any data exfiltration over DNS that occurred before isolation.
- If data was staged locally (archive files in public or temp paths): preserve those files as forensic evidence before any cleanup — they may reveal the full scope of what was collected.
Evidence Collection
- Process tree and command lines: collect full Sysmon Event ID 1 logs (or Security Event ID 4688 with command line auditing) for the 2-hour window around the alert, filtered to the alerting user and suspicious processes.
- File creation and access events: Sysmon Event ID 11 (FileCreate) and Event ID 23 (FileDelete/moved) for the alerting host, looking for staging archives or collected file aggregations.
- Network connection events: Sysmon Event ID 3 (NetworkConnect) from the alerting process or account, particularly any outbound to non-corporate IPs — correlate timestamps with file collection activity.
- VSS-related activity: check for vssadmin.exe or wmic commands creating or listing shadow copies (Sysmon EventID 1, Security Event ID 4688) in the hours preceding the alert.
- PowerShell Script Block Logs (Event ID 4104 from Microsoft-Windows-PowerShell/Operational): if PowerShell was used, these logs capture full deobfuscated script content and will show file enumeration logic.
- Prefetch files on the endpoint: C:\Windows\Prefetch\ESENTUTL.EXE-*.pf, ROBOCOPY.EXE-*.pf, etc. — record execution timestamps and referenced file paths from prefetch metadata.
- Filesystem timeline: acquire MFT (Master File Table) for targeted drives using tools like Velociraptor or FTK Imager to identify files accessed or created in bulk during the collection window.
- Registry and memory artifacts: if credential theft is suspected, run volatility or an EDR memory scan on the lsass.exe process to detect in-memory credential access that may accompany file-based collection.
Escalation Criteria
- !Any access to ntds.dit (Active Directory database) or SAM/SYSTEM/SECURITY registry hive files — even an attempted read indicates possible domain-level credential exposure and requires immediate Tier 3 escalation.
- !esentutl.exe observed accessing browser Login Data databases with subsequent outbound network connections from any process on the same host within the collection window.
- !SSH private key files accessed by a process other than the user's SSH client — particularly if followed by new SSH authentication events on other systems.
- !Bulk file collection (>50 files in a single enumeration command) combined with archive creation in a world-writable path (C:\Users\Public, C:\Temp) — strong indicator of pre-exfiltration staging.
- !The collecting process was spawned by a parent associated with initial access tradecraft: Office applications, browser processes, script hosts launching esentutl or PowerShell collection commands.
- !Multiple sensitive path types accessed within a single session (e.g., .ssh keys AND browser credentials AND DPAPI stores) — breadth of collection indicates systematic adversary behavior rather than accidental access.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Prefetch directory: C:\Windows\Prefetch\ESENTUTL.EXE-*.pf, ROBOCOPY.EXE-*.pf, WHERE.EXE-*.pf — records execution timestamps and referenced file paths - >
Shell history: %APPDATA%\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt — PowerShell command history including file enumeration commands - >
Sysmon Event ID 1 logs: full command lines for process creation events, preserving exact enumeration syntax used by the adversary - >
Sysmon Event ID 11 logs: file creation events revealing staging directories and archive filenames created during collection - >
Volume Shadow Copies: if adversary used VSS-based access, shadow copy metadata persists even after the copy is deleted — check vssadmin list shadows - >
MFT (Master File Table): MACB timestamps (Modified, Accessed, Changed, Born) for targeted files reveal whether access timestamps match claimed activity window - >
Windows Event Log — Security Event ID 4663 (Object Access): if SACL auditing was configured on sensitive directories, provides a per-file record of access with process and account details - >
Browser history and download records: adversary reconnaissance tools may be downloaded and launched from browser context — check %LOCALAPPDATA%\Google\Chrome\User Data\Default\History (SQLite) - >
Recycle Bin artifacts ($I files in C:\$Recycle.Bin): collection scripts or tools may have been deleted post-use, leaving recoverable metadata - >
Windows Error Reporting: C:\ProgramData\Microsoft\Windows\WER\ReportQueue — esentutl failures or crashes may leave WER reports with command line context
Tuning Guidance
The primary source of false positives is backup software — Veeam, Acronis, Windows Server Backup, and similar tools legitimately access ntds.dit, registry hives, and credential paths via VSS. Build a suppression list of backup agent binary names and their associated service accounts, and exclude these combinations rather than the file paths alone. For PowerShell-based enumeration, tune by requiring both a recursive collection pattern AND a sensitive extension in the same command line — this substantially reduces false positives from developer scripts that enumerate directories but target benign file types. For esentutl.exe alerts, the presence of 'ntds', '.dit', or 'Login Data' in the command line is strongly anomalous outside of backup contexts; treat these as high confidence unless the initiating process is a documented backup agent. For file-access detections (DeviceFileEvents), note that browser processes (chrome.exe, msedge.exe, firefox.exe) legitimately access their own Login Data files — exclude these initiating processes but do NOT exclude the Login Data path itself, as access by any other process is suspicious. Consider enabling Windows SACL-based file auditing (Security Event ID 4663) on the C:\Windows\System32\config and NTDS directories for maximum fidelity credential access detection, accepting the volume overhead in exchange for per-file granularity.
Hunting Queries
Hunt for bulk or repeated usage of data collection utilities across the environment. High execution counts from a single user or spread across multiple devices may indicate scripted collection campaigns. Focuses on native tools commonly abused for T1005 that are less commonly seen in high volumes under normal operations.
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("robocopy.exe", "xcopy.exe", "copy", "esentutl.exe", "where.exe", "findstr.exe")
| summarize
ExecutionCount = count(),
UniqueDevices = dcount(DeviceName),
Commands = make_set(ProcessCommandLine, 20),
FirstSeen = min(Timestamp),
LastSeen = max(Timestamp)
by AccountName, FileName
| where ExecutionCount > 5 or UniqueDevices > 2
| sort by ExecutionCount descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(Image="*\\robocopy.exe" OR Image="*\\xcopy.exe" OR Image="*\\esentutl.exe" OR Image="*\\where.exe" OR Image="*\\findstr.exe")
| stats count as ExecutionCount, dc(host) as UniqueDevices, values(CommandLine) as Commands, earliest(_time) as FirstSeen, latest(_time) as LastSeen by User, Image
| where ExecutionCount > 5 OR UniqueDevices > 2
| sort - ExecutionCountHunt for archive files created in world-writable or temporary paths by unexpected processes — a strong indicator of pre-exfiltration staging. Adversaries collecting data from the local system frequently compress files before transmission. This query specifically targets staging locations used by threat actors and excludes known archive application binaries.
DeviceFileEvents
| where Timestamp > ago(7d)
| where ActionType in~ ("FileCreated", "FileRenamed")
| where FileName endswith ".zip" or FileName endswith ".7z" or FileName endswith ".rar" or FileName endswith ".tar" or FileName endswith ".gz"
| where FolderPath has_any ("\\Users\\Public\\", "\\Windows\\Temp\\", "\\Temp\\", "\\AppData\\Local\\Temp\\", "\\ProgramData\\")
| where InitiatingProcessFileName !in~ ("7zG.exe", "winrar.exe", "WinZip64.exe", "OneDrive.exe", "Backup")
| summarize
ArchiveCount = count(),
UniqueDevices = dcount(DeviceName),
ArchiveNames = make_set(FileName, 10),
Paths = make_set(FolderPath, 10)
by InitiatingProcessFileName, InitiatingProcessAccountName
| where ArchiveCount > 2
| sort by ArchiveCount descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
(TargetFilename="*.zip" OR TargetFilename="*.7z" OR TargetFilename="*.rar" OR TargetFilename="*.tar" OR TargetFilename="*.gz")
(TargetFilename="*\\Users\\Public\\*" OR TargetFilename="*\\Windows\\Temp\\*" OR TargetFilename="*\\AppData\\Local\\Temp\\*" OR TargetFilename="*\\ProgramData\\*")
NOT (Image="*\\7zG.exe" OR Image="*\\winrar.exe" OR Image="*\\WinZip64.exe" OR Image="*\\OneDrive.exe")
| stats count as ArchiveCount, dc(host) as UniqueDevices, values(TargetFilename) as ArchiveNames by Image, User
| where ArchiveCount > 2
| sort - ArchiveCountHunt for the VSS-then-esentutl attack chain used to extract locked files like ntds.dit, SAM, and SYSTEM hives. Adversaries must first create a Volume Shadow Copy to access files locked by the OS, then use esentutl or robocopy to read from the shadow volume. Both actions occurring on the same host within 60 minutes is a high-fidelity indicator of credential database theft.
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("powershell.exe", "pwsh.exe", "cmd.exe")
| where ProcessCommandLine has_any ("vssadmin", "wmic", "shadowcopy")
and ProcessCommandLine has_any ("create", "list")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName
| join kind=leftouter (
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName =~ "esentutl.exe" and ProcessCommandLine has_any ("ntds", ".dit", "SAM", "SYSTEM", "SECURITY")
| project DeviceName, EsentutlTime=Timestamp, EsentutlCmd=ProcessCommandLine
) on DeviceName
| where isnotempty(EsentutlTime) and abs(datetime_diff('minute', Timestamp, EsentutlTime)) < 60
| sort by Timestamp descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval is_vss=if(match(lower(CommandLine), "(vssadmin|shadowcopy|wmic.*shadow)") AND match(lower(CommandLine), "(create|list)"), 1, 0)
| eval is_esentutl=if(match(lower(Image), "esentutl\.exe") AND match(lower(CommandLine), "(ntds|\.dit|sam|system|security)"), 1, 0)
| where is_vss=1 OR is_esentutl=1
| eval sig=if(is_vss=1, "VSS_Create", "ESE_Extract")
| stats values(CommandLine) as Commands, values(sig) as Signals, dc(sig) as SigTypes, earliest(_time) as First, latest(_time) as Last by host, User
| where SigTypes > 1
| eval TimeWindowMinutes=round((Last-First)/60, 0)
| where TimeWindowMinutes < 60
| sort - SigTypesAtomic Red Team Tests
Simulates adversary use of PowerShell to recursively enumerate and collect Office documents and PDFs from a user's home directory, mirroring behavior observed in Kimsuky and BADNEWS campaigns. The collected file list is written to a staging location in the temp directory. This test does not exfiltrate data — it only creates the enumeration artifact.
Command
powershell.exe -NoProfile -Command "Get-ChildItem -Path $env:USERPROFILE -Recurse -Include '*.pdf','*.docx','*.xlsx','*.pptx','*.doc','*.xls' -ErrorAction SilentlyContinue | Select-Object FullName, Length, LastWriteTime | Export-Csv -Path $env:TEMP\df00tech-filelist.csv -NoTypeInformation"Cleanup
Remove-Item $env:TEMP\df00tech-filelist.csv -ErrorAction SilentlyContinueExpected Telemetry
Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Get-ChildItem', '-Recurse', and file extension patterns. Sysmon Event ID 11: FileCreate for df00tech-filelist.csv in %TEMP%. PowerShell ScriptBlock Log Event ID 4104 showing the full collection script. File access events (if SACL auditing enabled, Security Event ID 4663) for each document accessed during enumeration.
Expected Detection
KQL: matches is_bulk_enum signal — PowerShell with Get-ChildItem -Recurse targeting sensitive extensions. SPL: is_bulk_enum=1, SuspicionScore >= 1. The CSV output file creation in TEMP may also trigger staging detection if further hunting queries are active.
Simulates the QakBot and LAPSUS$ technique of using esentutl.exe to copy the locked Chromium-based browser credential database (Login Data) to a readable location. Chrome's Login Data is an SQLite file locked by the browser process; esentutl /y performs a low-level copy bypassing the file lock. This test copies to a temp path without decrypting the credentials.
Command
cmd.exe /c esentutl.exe /y "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data" /d "%TEMP%\df00tech-logindata.db" /oCleanup
del %TEMP%\df00tech-logindata.db 2>nulExpected Telemetry
Sysmon Event ID 1: Process Create for esentutl.exe with CommandLine containing '/y', 'Login Data', '/d', and '/o' flags. Sysmon Event ID 11: FileCreate for df00tech-logindata.db in %TEMP%. Security Event ID 4688 (if command line auditing enabled) capturing the full esentutl command. File access event on the Chrome Login Data file path.
Expected Detection
KQL and SPL: matches is_esentutl=1 on 'Login Data' keyword. SignalReason='ESE Database Extraction (browser creds or NTDS)'. High confidence trigger — esentutl accessing Login Data outside of backup contexts is anomalous. SuspicionScore >= 1 in SPL.
Simulates adversary access to SSH private keys stored in the user's .ssh directory, as observed in Troll Stealer malware. Creates a test SSH key file and then copies it to a staging location to simulate collection. The test uses cmd.exe copy to avoid PowerShell detection, matching tradecraft that uses basic native commands for file access.
Command
cmd.exe /c "mkdir %USERPROFILE%\.ssh 2>nul && echo -----BEGIN OPENSSH PRIVATE KEY----- > %USERPROFILE%\.ssh\id_rsa_test && echo [TEST CONTENT - NOT A REAL KEY] >> %USERPROFILE%\.ssh\id_rsa_test && echo -----END OPENSSH PRIVATE KEY----- >> %USERPROFILE%\.ssh\id_rsa_test && copy %USERPROFILE%\.ssh\id_rsa_test %TEMP%\df00tech-id_rsa.bak"Cleanup
del %USERPROFILE%\.ssh\id_rsa_test 2>nul & del %TEMP%\df00tech-id_rsa.bak 2>nulExpected Telemetry
Sysmon Event ID 1: Process Create for cmd.exe with CommandLine containing '.ssh' and 'copy' and 'id_rsa'. Sysmon Event ID 11: FileCreate for both the test key file in .ssh and the copied file in %TEMP%. DeviceFileEvents (MDE): FileCreated action on .ssh directory path with id_rsa in filename, initiating process cmd.exe. Security Event ID 4663 on the .ssh directory if SACL auditing is enabled.
Expected Detection
KQL ProcessCollection branch: cmd.exe with '.ssh' in CommandLine triggers is_sensitive_path_cli. KQL FileAccessCollection branch: FolderPath has '.ssh' and FileName contains 'id_rsa' triggers SignalReason='SSH Private Key Access'. SPL: is_sensitive_path_cli=1, SuspicionScore >= 1. File event detections fire on EventCode=11 matching .ssh path pattern.
Simulates adversary enumeration of Windows DPAPI credential stores in %APPDATA%\Microsoft\Credentials, a technique used by credential-harvesting malware to locate encrypted credential blobs for offline decryption or DPAPI decryption using the user's master key. This test only lists the files without decrypting them.
Command
cmd.exe /c dir /s /b "%APPDATA%\Microsoft\Credentials" && dir /s /b "%LOCALAPPDATA%\Microsoft\Credentials"Expected Telemetry
Sysmon Event ID 1: Process Create for cmd.exe with CommandLine containing 'dir /s /b' and 'Microsoft\Credentials'. Security Event ID 4688 (if command line auditing enabled). If SACL auditing is configured on the Credentials directory, Security Event ID 4663 for directory access. DeviceProcessEvents (MDE) will capture the command with full path context.
Expected Detection
KQL ProcessCollection: cmd.exe with '\Microsoft\Credentials\' in ProcessCommandLine matches SensitivePathKeywords, SignalReason='Windows DPAPI Credential Store Access'. SPL: is_sensitive_path_cli=1 on 'credentials\\' pattern match, SuspicionScore >= 1. This test demonstrates that even basic dir commands against DPAPI paths generate actionable telemetry.