Contents

1. Introduction
2. Approach
3. Findings Summary
4. Cobalt Strike remote-exec winrm
5. Sysmon Events
6. Findings
7. Conclusion
8. Detection Rule Example
9. Cobalt Strike remote-exec wmi
10. Sysmon Events
11. Findings
12. Conclusion
13. Detection Rule Example
14. Cobalt Strike remote-exec psexec
15. Sysmon Events
16. Findings
17. Conclusion
18. Detection Rule Example
19. Part 1 - Conclusion

Introduction

Although it was not originally designed for this use, Cobalt Strike has become one of the most frequently used tools for lateral movements and it is not uncommon to observe traces of its use during digital forensic.

This article aims to analyze the different Cobalt Strike commands to find evidence that the tools could drop behind him. Several blogs have already explained how to detect Cobalt Strike, but for this analysis we choose to let the Windows log levels by default without activating special "Windows Audit Policies" and we used post-compromising tools to extract artifacts.

In this first part, we will focus on the Cobalt Strike built-in remote-exec command and its different methods of remote code execution:

• remote-exec winrm
• remote-exec wmi
• remote-exec psexec

A second blogpost will focus on the persistent Cobalt Strike session using Beacon and the built-in jump commands with different methods such as "psexec64", "winrm64" or "psexec_psh".

Approach

The aim here is to provide basic information on what kinds of logs and other artefacts could be generated from Cobalt Strike on a default Windows 10 host. To get a better context and understanding, we enabled Sysmon on the victim Workstation, so that we get a based line to compare with.

The tests have been done with Cobalt Strike version 4.4 with the default configuration without any kind of customization. It'is important to note that Cobalt Strike allow users to change various settings (pipes names, service name, default temporary process, etc.) to customize its footprint. Depending on Cobalt Strike settings used by the attackers, the events generated may be slightly different and detection rule may fail.

Each command has been executed twice to avoid false positive. This short analysis can be later on used as a reference to build rules to detect Cobalt Strike movements during a forensics incident response (without Sysmon or Audit Policies).

The Lab is composed of the following elements:

• Windows 10 workstations with Sysmon installed;
• Windows Server 2016 Domain Controller.

The different steps and tools used to extract and analyze the artifacts post compromise are:

1. Run DFIR_ORC to extract artifacts on the Windows 10 machine
2. Run log2timeline/plaso combined with Logstash on the extracted data to build a clear timeline
3. Analyze data using Splunk

By using DFIR_Orc and Plaso, we were able to process the most important artifacts:

• Event log (*.evtx), including PowerShell command history;
• Prefetch files;
• USNjrnl;
• MFT;
• User and System hives (userassist, appcompatcache, etc.).

Findings Summary

A summary of the most important findings (excluding Sysmon events) is available on the timeline below:

Cobalt Strike remote-exec winrm

The Cobalt Strike remote-exec winrm command allows the user to execute a command using WinRM on the remote host without creating a persistent session with a Beacon. For this example, the executed command is ipconfig.

Sysmon Events

As explained earlier, System Monitor (Sysmon) was installed on the Windows 10 workstation to have reference events on which to base our analyses. We therefore first reviewed the events recorded by Sysmon to get a based line to compare with extracted artifacts. The Sysmon events below has been filtered to the most useful.

Event ID 1 - Process Creation

The process creation event provides extended information about a newly created process. The full command line provides context on the process execution. The ProcessGUID field is a unique value for this process across a domain to make event correlation easier.

The process chain created by the remote-exec winrm commands on the victim workstation is svchost.exe -> wsmprovhost.exe -> ipconfig.exe.

Event ID 3 - Network Connection Detected

The network connection event logs TCP/UDP connections on the machine. Each connection is linked to a process through the ProcessId and ProcessGUID fields. The event also contains the source and destination host names IP addresses, port numbers and IPv6 status.

The execution of the remote-exec winrm commands leads to the creation of 3 network connections made to the victim workstation on the port 5985. The ports 5985 (HTTP) and 5986 (HTTPS) are the default TCP ports used by WinRM:

Event ID 7 - Image Loaded

The image loaded event logs when a module is loaded in a specific process. It indicates the process in which the module is loaded, hashes and signature information.

Without Sysmon installed on the victim workstation, it is hard to get the same information from other artifacts. Nevertheless, and this will be discussed later in the article, MFT provides similar evidence and this is why we have chosen to include these events.

Event ID 11 - File created

File create operations are logged when a file is created or overwritten. This event is useful for monitoring autostart locations, like the Startup folder, as well as temporary and download directories, which are common places malware drops during initial infection.

On the disk, two PowerShell scripts, generated by Microsoft, are created (__PSScriptPolicyTest_<random_number>.ps1) to test against AppLocker. If the test file executes, then it assumed that AppLocker is disabled. Two Prefetch files for ipconfig, and wsmprovhost.exe binaries are also created, as well as a log file.

Findings

Now that we have seen the events and other artifacts generated by the execution of the remote-exec winrm commands, let's dwell on the evidence present natively on a Windows 10 system out of the box.

Winevtx - Microsoft-Windows-Security-Auditing

Without the audit policies enabled, there are not much events generated. However, in both tests, Windows recorded 5 successful logons (event ID 4624) with the logon type '3' (Network) from the compromised account "CORP.LOCAL\alice". If correlated, this behavior may help during the investigation to support a hypothesis.

Winevtx - Microsoft Windows WinRM

When executed, a successful remote WinRM connection will log an event ID 91 (Creating WSMan shell on servers) within the WinRM event log on the targeted host. Another good indicator to detect WinRM lateral movements is the event ID 6 on the source host:

Winevtx - Microsoft Windows Powershell

Cobalt Strike WinRM cmdlets run over PowerShell script, so the PowerShell events ID 600, 400 and 403 are recorded and display the hosted application (C:\Windows\system32\wsmprovhost.exe -Embedding).

Prefetch

Prefetch files allow to recover the process chain created and find out that wsrmprovhost has executed the ipconfig programs.

USN journal

As with Sysmon which showed the creation of Prefetch files (event ID 11 - File Create), the USN journal gives a good overview of what’s happened, from the wsmprovhost.exe execution to the final commands (ipconfig) and the PowerShell execution.

MFT

As we saw earlier with Sysmon (event ID 7 - Image Loaded), in that case the MFT can be used to get information on the image loaded by the wsmprovhost.exe program. Indeed, the collection of evidence having been carried out very shortly after the execution, the DLLs accessed by the wsmprovhost.exe program have not (yet) been accessed by other programs, and the timestamps present in the MFT coincide with the binary access.

Conclusion

Reliable artifacts can lead us to the conclusion that WinRM has been used to execute remote commands using Cobalt Strike on the victim workstation:

• A PowerShell execution (Microsoft Windows Powershell, event ID 600, 400, 403) host by the application C:\Windows\system32\wsmprovhost.exe -Embedding;
• A WinRM connection received (Microsoft Windows WinRM, event ID 91);
• Execution traces of the \Windows\SysWOW64\wsmprovhost.exe binary, visible in the MFT, the USN journal or even the Prefetch files.

These events can be accompanied by network authentication as we have seen with the logon type 3 of the user "CORP\alice", as well as other events related to actions performed using WinRM. In our case, the execution of the ipconfig.exe command generated openings of TCP connections as well as the creation/modifications of the Prefetch files.

Detection Rule Example

Splunk queries

To make the detection rule query, for each span time of 15 seconds, we can:

• Search for the events ID 91 and event ID 400 where the PowerShell host application name contains the strings wsmprovhost.exe.
• Count distinctly the number of event ID (this avoid to trigger the rule if two events with the same "eid" occur).

host="*" index="*" parser=winevtx eid=91 OR (eid=400 AND  host_application="*wsmprovhost.exe*")
| bin span=15s _time
| eventstats distinct_count(eid) as dis_count by _time
| where dis_count==2
| table _time eid report_desc dis_count

Both tests are displayed successfully by this requests:

| _time    | report_desc                                                                                                                                                                            | dis_count |
| 14:24:00 | **[evtx/powershell/400]** the PowerShell engine state hosted by application 'C:\Windows\system32\wsmprovhost.exe -Embedding' with command line ''is changed from 'None' to 'Available'. | 2         |
| 14:24:00 | **[evtx/winrm/91]** Creating WSMan shell on server with ResourceURI: 'http://schemas.microsoft.com/powershell/Microsoft.PowerShell'                                                        | 2         |
| 14:26:00 | **[evtx/powershell/400]** the PowerShell engine state hosted by application 'C:\Windows\system32\wsmprovhost.exe -Embedding' with command line ''is changed from 'None' to 'Available'. | 2         |
| 14:26:00 | **[evtx/winrm/91]** Creating WSMan shell on server with ResourceURI: 'http://schemas.microsoft.com/powershell/Microsoft.PowerShell'                                                        | 2         |

Another way to do it, is by using the Splunk transaction command. This command allow to find transaction that meet various constraints. In our example, the first event transaction must contains the event ID 91, the last event must contains the event ID 400 and the events in the transaction must span less than 5 seconds.

host="*" index="*" sourcetype="lexhunt_json" eid=91 OR (eid=400 AND  host_application="*wsmprovhost.exe*")
| transaction parser startswith=eid=91 endswith=eid=400 maxspan=5s
| table _time report_desc duration
| sort _time

| _time        | report_desc                                                                                                                                                                                                                                                                                                                      | duration |
| ----         | -----                                                                                                                                                                                                                                                                                                                            | ------   |
| 14:24:02.586 | **[evtx/winrm/91]** Creating WSMan shell on server with ResourceURI: 'http://schemas.microsoft.com/powershell/Microsoft.PowerShell'.  **[evtx/powershell/400]** the PowerShell engine state hosted by application 'C:\\Windows\\system32\\wsmprovhost.exe -Embedding' with command line ''is changed from 'None' to 'Available'. | 2.663    |
| 14:26:02.828 | **[evtx/winrm/91]** Creating WSMan shell on server with ResourceURI: 'http://schemas.microsoft.com/powershell/Microsoft.PowerShell'.  **[evtx/powershell/400]** the PowerShell engine state hosted by application 'C:\\Windows\\system32\\wsmprovhost.exe -Embedding' with command line ''is changed from 'None' to 'Available'. | 1.234    |

Sigma rules

A Sigma rule already exists for this event (sigma/posh_pc_remote_powershell_session.yml at master · SigmaHQ/sigma).

sigma-cli >>> sigma convert -t splunk -p sysmon ../sigma/rules/windows/powershell/powershell_classic/posh_pc_remote_powershell_session.yml
Parsing Sigma rules  [####################################]  100%
HostName="ServerRemoteHost" HostApplication="*wsmprovhost.exe*"

Cobalt Strike remote-exec wmi

The Cobalt Strike remote-exec wmi command allows the user to execute a command using WMI on the remote host without creating a persistent session with a Beacon. For this test, the command executed is calc.exe.

Sysmon Events

Just like in the case above, we start by observing what Sysmon logs so that we can later compare with extracted artifacts. The Sysmon events below have been filtered to the most useful.

Event ID 1 - Process Create

The process creation event provides extended information about a newly created process. The full command line provides context on the process execution. The ProcessGUID field is a unique value for this process across a domain to make event correlation easier.

The process chain created by the remote-exec wmi commands is WmiPrvSE.exe -> <cmd>. In both of our tests, the program OpenWith.exe is also triggered a moment after by the parent process svchost.exe.

Event ID 3 - Network Connection Detected

The network connection event logs TCP/UDP connections on the machine. Each connection is linked to a process through the ProcessId and ProcessGUID fields. The event also contains the source and destination host names IP addresses, port numbers and IPv6 status.

By default, WMI uses a randomly selected dynamic port range for TCP between 49152 and 65535.

Event ID 11 - File Create

File create operations are logged when a file is created or overwritten. This event is useful for monitoring autostart locations, like the Startup folder, as well as temporary and download directories, which are common places malware drops during initial infection.

The only interesting files created on the file system are the Preftech files.

Findings

Winevtx - Microsoft-Windows-Security-Auditing

Without the audit policies enabled, there are not much events generated. However, in both tests, Windows recorded 4 short connections (event ID 4624) with the logon type '3' (Network) from the compromised account "CORP.LOCAL\alice". If correlated, this behavior may help during the investigation to support a hypothesis.

Winevtx - DCOM

Because WMI uses DCOM to handle remote calls, related events may be generated. In our case we get an error about the permission for the COM server with CLSID {3480A401-BDE9-4407-BC02-798A866AC051} (ShellServiceHostBrokerProvider). This error may be specific to the labs, even if the configuration is almost by default.

Prefetch files, USNjrnl and MFT

The Prefetch, USNjrnl and MFT artifacts shows that the calc.exe and openwith.exe programs have been executed.

Conclusion

This is probably the hardest Cobalt Strike command to detect because not many events are generated. The most accurate artifacts to know that the command remote-exec wmi has been executed are:

• The openwith.exe observable among Prefetch files;
• Many short successful logons (Microsoft Windows Security Auditing, event ID 4624) with logon type '3' (Network);
• Some DCOM events, such as warnings (DCOM, event ID 10016).

Detection Rule Example

Splunk queries

To make the detection rule query, for each span time of 10 seconds, we can:

• Search 1 event where the Prefetch executable name is openwith.exe
• Search 4 logon connection (with logon type 3).

We cannot reuse the previous query because Prefetch events has no field "eid". The first attempt was this query:

host="*" index="*" (parser=prefetch AND executable="OPENWITH.EXE") OR (parser=winevtx AND eid=4624 AND logon_type=3)
| bin span=10s _time
| eventstats count by _time
| where count>=5
| table _time parser report_desc count
| sort _time

But it generates multiple false positives because 5 events with eid 4624 may occur in 10 seconds without the needed Prefetch events:

| _time    | parser   | report_desc                                                                                                                                                                                                      | count |
| 14:26:00 | winevtx  | **[evtx/sec/4624]** user 'CORP.LOCAL\alice' (S-1-5-21-1155457554-2149841727-2293290625-1108) successfully logon (type=3) from '-' ('-') (logon_id=0x00000000004ae65c) with '-'                                       | 5     |
| 14:26:00 | winevtx  | **[evtx/sec/4624]** user 'CORP.LOCAL\alice' (S-1-5-21-1155457554-2149841727-2293290625-1108) successfully logon (type=3) from '-' ('-') (logon_id=0x00000000004ae638) with '-'                                       | 5     |
| 14:26:00 | winevtx  | **[evtx/sec/4624]** user 'CORP.LOCAL\alice' (S-1-5-21-1155457554-2149841727-2293290625-1108) successfully logon (type=3) from '-' ('-') (logon_id=0x00000000004ad37e) with '-'                                       | 5     |
| 14:26:00 | winevtx  | **[evtx/sec/4624]** user 'CORP.LOCAL\alice' (S-1-5-21-1155457554-2149841727-2293290625-1108) successfully logon (type=3) from '-' ('-') (logon_id=0x00000000004acafc) with '-'                                       | 5     |
| 14:26:00 | winevtx  | **[evtx/sec/4624]** user 'CORP.LOCAL\alice' (S-1-5-21-1155457554-2149841727-2293290625-1108) successfully logon (type=3) from '-' ('-') (logon_id=0x00000000004abf4b) with '-'                                       | 5     |
| 14:28:00 | prefetch | **[prefetch]** Prefetch [OPENWITH.EXE] was executed - run count 3 path hints: \WINDOWS\SYSTEM32\OPENWITH.EXE hash: 0x5C93E816 volume: 1 [serial number: 0x228095FD  device path: \VOLUME{01d80e8a80662822-228095fd}] | 5     |
| 14:28:00 | winevtx  | **[evtx/sec/4624]** user 'CORP\alice' (S-1-5-21-1155457554-2149841727-2293290625-1108) successfully logon (type=3) from '192.168.56.119' ('DC01') (logon_id=0x00000000004d8bb6) with '-'                             | 5     |
| 14:28:00 | winevtx  | **[evtx/sec/4624]** user 'CORP.LOCAL\alice' (S-1-5-21-1155457554-2149841727-2293290625-1108) successfully logon (type=3) from '192.168.56.119' ('-') (logon_id=0x00000000004d89bb) with '-'                          | 5     |
| 14:28:00 | winevtx  | **[evtx/sec/4624]** user 'CORP.LOCAL\alice' (S-1-5-21-1155457554-2149841727-2293290625-1108) successfully logon (type=3) from '192.168.56.119' ('-') (logon_id=0x00000000004d8957) with '-'                          | 5     |
| 14:28:00 | winevtx  | **[evtx/sec/4624]** user 'CORP.LOCAL\alice' (S-1-5-21-1155457554-2149841727-2293290625-1108) successfully logon (type=3) from '192.168.56.119' ('-') (logon_id=0x00000000004d811f) with '-'                          | 5     |

So, we need to count distinctly by parser as well:

host="*" index="*" (parser=prefetch AND executable="OPENWITH.EXE") OR (parser=winevtx AND eid=4624 AND logon_type=3)
| bin span=10s _time
| eventstats count by _time
| eventstats distinct_count(parser) as parser_dis_count by _time
| where parser_dis_count > 1 AND count >= 4
| table _time parser report_desc count parser_dis_count
| sort _time

The results:

| _time    | parser   | report_desc                                                                                                                                                                                                      | count | parser_dis_count |
| 14:28:00 | prefetch | **[prefetch]** Prefetch [OPENWITH.EXE] was executed - run count 3 path hints: \WINDOWS\SYSTEM32\OPENWITH.EXE hash: 0x5C93E816 volume: 1 [serial number: 0x228095FD  device path: \VOLUME{01d80e8a80662822-228095fd}] | 5     | 2                |
| 14:28:00 | winevtx  | **[evtx/sec/4624]** user 'CORP\alice' (S-1-5-21-1155457554-2149841727-2293290625-1108) successfully logon (type=3) from '192.168.56.119' ('DC01') (logon_id=0x00000000004d8bb6) with '-'                             | 5     | 2                |
| 14:28:00 | winevtx  | **[evtx/sec/4624]** user 'CORP.LOCAL\alice' (S-1-5-21-1155457554-2149841727-2293290625-1108) successfully logon (type=3) from '192.168.56.119' ('-') (logon_id=0x00000000004d89bb) with '-'                          | 5     | 2                |
| 14:28:00 | winevtx  | **[evtx/sec/4624]** user 'CORP.LOCAL\alice' (S-1-5-21-1155457554-2149841727-2293290625-1108) successfully logon (type=3) from '192.168.56.119' ('-') (logon_id=0x00000000004d8957) with '-'                          | 5     | 2                |
| 14:28:00 | winevtx  | **[evtx/sec/4624]** user 'CORP.LOCAL\alice' (S-1-5-21-1155457554-2149841727-2293290625-1108) successfully logon (type=3) from '192.168.56.119' ('-') (logon_id=0x00000000004d811f) with '-'                          | 5     | 2                |
| 14:30:00 | prefetch | **[prefetch]** Prefetch [OPENWITH.EXE] was executed - run count 3 path hints: \WINDOWS\SYSTEM32\OPENWITH.EXE hash: 0x5C93E816 volume: 1 [serial number: 0x228095FD  device path: \VOLUME{01d80e8a80662822-228095fd}] | 5     | 2                |
| 14:30:00 | winevtx  | **[evtx/sec/4624]** user 'CORP\alice' (S-1-5-21-1155457554-2149841727-2293290625-1108) successfully logon (type=3) from '192.168.56.119' ('DC01') (logon_id=0x0000000000598fa4) with '-'                             | 5     | 2                |
| 14:30:00 | winevtx  | **[evtx/sec/4624]** user 'CORP.LOCAL\alice' (S-1-5-21-1155457554-2149841727-2293290625-1108) successfully logon (type=3) from '192.168.56.119' ('-') (logon_id=0x0000000000598ee4) with '-'                          | 5     | 2                |
| 14:30:00 | winevtx  | **[evtx/sec/4624]** user 'CORP.LOCAL\alice' (S-1-5-21-1155457554-2149841727-2293290625-1108) successfully logon (type=3) from '192.168.56.119' ('-') (logon_id=0x0000000000598ed0) with '-'                          | 5     | 2                |
| 14:30:00 | winevtx  | **[evtx/sec/4624]** user 'CORP.LOCAL\alice' (S-1-5-21-1155457554-2149841727-2293290625-1108) successfully logon (type=3) from '192.168.56.119' ('-') (logon_id=0x0000000000598e96) with '-'                          | 5     | 2                |

Other rules can be created by adding the DCOM events.

Cobalt Strike remote-exec psexec

The Cobalt Strike remote-exec psexec command allows the user to execute a command using PsExec on the remote host without creating a persistent session with a Beacon. It creates and start a service remotely with random Service Name¹ and then passed on command as Service File Name. For this test, the command executed is notepad.exe.

Sysmon Events

One last time, as in the two previous cases, the Sysmon events are recorded in order to serve as elements of comparison with the other artifacts collected on the workstation. The Sysmon events below has been filtered to the most useful.

Event ID 1 - Process Creation

The process creation event provides extended information about a newly created process. The full command line provides context on the process execution. The ProcessGUID field is a unique value for this process across a domain to make event correlation easier.

Cobalt Strike creates a service to run the arbitrary command with the SYSTEM rights so the process chain is services.exe -> notepad.exe.

Event ID 3 - Network Connection Detected

The network connection event logs TCP/UDP connections on the machine. Each connection is linked to a process through the ProcessId and ProcessGUID fields. The event also contains the source and destination host names IP addresses, port numbers and IPv6 status.

Two connections are recorded, one to the TCP port 135 and the second to a random TCP port.

Event ID 11 - File Create

File create operations are logged when a file is created or overwritten. This event is useful for monitoring autostart locations, like the Startup folder, as well as temporary and download directories, which are common places malware drops during initial infection.

Because the process services.exe is already running, only one Prefetch file is generated.

Event ID 13 - Registry Value Set

Registry key and value create and delete operations map to this event type.

Cobalt Strike creates a service to run the arbitrary command, so a registry key with a random name is created under HKLM\System\CurrentControlSet\Services\d8041e9 by the Services.exe process and the ImagePath is set to the arbitrary commands to execute.

Findings

Winevtx - Microsoft Windows Security Auditing

Without the audit policies enabled, there are not much events generated. Only one successful logons (event ID 4624) is recorded, with the logon type '3' (Network) from the compromised account "CORP.LOCAL\alice". If correlate, this behavior may help during the investigation to support an hypothesis.

Winevtx - Service Control Manager

In that particular case, the most useful Windows logs generated is the event ID 7045 (a service randomly named was installed by user 'LocalSystem'). In this case, we choose to run notpad.exe, but it would be interesting to monitor services.exe child process for malicious behavior like spawning system shells using cmd.exe and powershell.exe or some discovery behavior like whoami.exe, systeminfo.exe, net.exe, etc.

Prefetch and USNjrnl

The Prefetch files shows only the binary called by services.exe, and the only activity recorded by the USN journal is access to the Prefetch file.

Conclusion

The use of remote-exec psexec causes the installation of a randomly named service on the targeted host, which is particularly visible in the logs of the Service Control Manager: the 7045 event records the creation of the service as well as the name of the child process which is executed. Other artifacts may be correlated with the creation of this service, in particular the creation of Prefetch files associated with the child process, or the successful logon (event ID 4624) of the account used to create the malicious service.

Detection Rule Example

Splunk queries

In a forensics context, a simple query enumerating the services installed (Service Control Manager, event ID 7045) should be enough, the randomness of the service name and the child process visually identifying illegitimate services. However, you can also add to the query the successful logons (event ID 4624):

host="*" index="*" (parser=winevtx AND eid=7045) OR (parser=winevtx AND eid=4624 AND logon_type=3)
| bin span=1m _time
| eventstats distinct_count(eid) as dis_count by _time
| where dis_count==2
| table _time eid report_desc dis_count
| sort _time

| _time    | eid  | report_desc                                                                                                                                                                             | dis_count |
| 14:32:00 | 7045 | **[evtx/sys/scm/7045]** service 'd8041e9' (notepad.exe) was installed by user 'LocalSystem' (type: user mode service, start: demand start)                                                  | 2         |
| 14:32:00 | 4624 | **[evtx/sec/4624]** user 'CORP.LOCAL\alice' (S-1-5-21-1155457554-2149841727-2293290625-1108) successfully logon (type=3) from '192.168.56.119' ('-') (logon_id=0x00000000005eda88) with '-' | 2         |

Or you can select only the events where the service name is only 7 characters long:

host="*" index="blog" sourcetype="lexhunt_json" eid=7045
| eval service_name_len=len(service_name)
| where service_name_len==7
| table _time service_name
| sort _time

| _time        | service_name |
| 14:32:05.920 | d8041e9      |
| 14:34:07.311 | 8f0c55c      |

Part 1 - Conclusion

The hardest Cobalt Strike command to detect is probably the remote-exec wmi because it does not create a service like remote-exec psexec or use PowerShell like remote-exec winrm. We can notice that each remote-exec commands generated a specific number of successful logons to the victim (event id 4624). As a reminder, remote-exec commands can be triggered detecting the following behavior:

• remote-exec winrm
• A PowerShell execution (Microsoft Windows Powershell, event ID 600, 400, 403) host by the application C:\Windows\system32\wsmprovhost.exe -Embedding;
• A WinRM connection received (Microsoft Windows WinRM, event ID 91);
• Execution traces of the \Windows\SysWOW64\wsmprovhost.exe binary, visible in the MFT, the USN journal or even the Prefetch files;
• Many successful logons (Microsoft Windows Security Auditing, event ID 4624) with logon type '3' (Network).
• remote-exec wmi
• The openwith.exe observable among Prefetch files;
• Many short successful logons (Microsoft Windows Security Auditing, event ID 4624) with logon type '3' (Network);
• Some DCOM events, such as warnings (DCOM, event ID 10016).
• remote-exec psexec
• The installation of a randomly named service (Service Control Manager, event ID 7045) running suspicious binaries;
• One successful logon (Microsoft Windows Security Auditing, event ID 4624) with logon type '3' (Network).

To detect lateral movements more efficiently, we advise installing Sysmon with a custom configuration and/or to activate more audit policies.

References:

• Detecting CONTI Cobalt Strike Lateral Movement Techniques - Part 1 - CYB3RSN0RLAX
• Tool Analysis Result Sheet
• SigmaHQ/sigma: Generic Signature Format for SIEM Systems
• SigmaHQ/sigma-cli: The Sigma command line interface based on pySigma
• Detecting Lateral Movement via WinRM Using KQL - In.Security - Cyber Security Technical Services & Training
• Sysmon - Windows Sysinternals | Microsoft Docs