Windows Server Hack Investigation Guide: Forensic Analysis Steps

Initial Compromise Assessment

Discovering a hacked Windows Server demands systematic forensic analysis. Start by verifying system details: our compromised machine runs Windows Server 2016, confirmed via system properties. Immediate red flags included unexpected PowerShell windows popping up and Temporary_Mim.exe processes—clear indicators of unauthorized access.

Establishing User Activity Timeline

1. Last Logon Identification: Use net user [username] in PowerShell to check account activity. For the "John" account, results showed a last logon in 2019, suggesting stale credentials.
2. Event Viewer Analysis: Filter Security logs for Event ID 4624 (successful logons). The attacker used the "Administrator" account, with timestamps revealing the initial breach period.
3. Privilege Escalation Detection: Search for Event ID 4672 (special privileges assigned) around the compromise timeframe. The earliest event occurred at 4:49 PM on March 2, 2019, indicating privilege escalation.

Malicious Artifact Investigation

Scheduled Task Forensics

Malicious tasks often hide in Task Scheduler. Key findings:

• Malicious Task Name: Clean File System (disabled post-compromise)
• Task Action: Executed C:\TMP\NC.ps1 daily at 4:55 PM
• Script Analysis: The PowerShell script (NC.ps1) listened locally on port 1348 and relayed data to attacker-controlled infrastructure.

Attacker Tool Identification

The presence of Mim.exe (Mimikatz) in temporary folders confirmed credential theft. Mimikatz dumped passwords like "MySecretPass," stored in C:\TMP\mim_out.txt.

Network Compromise Indicators

Command & Control (C2) Infrastructure

1. DNS Poisoning Evidence: Check C:\Windows\System32\drivers\etc\hosts for unauthorized entries. The attacker mapped google.com to 192.168.3.78—a fake C2 server.
2. Firewall Rule Manipulation: Review Inbound Rules in Windows Firewall. An anomalous rule named "Allow Outside Connection for Development" permitted external access on port 1337.
3. Startup Connections: Reboot the server and note the first IP connection (e.g., 10.34.23.1) via command prompt during initialization.

Critical Forensic Checklist

Apply these steps immediately after detecting a breach:

1. Account Audit: Run netplwiz to list administrative users (e.g., Administrator, Jenny, Guest).
2. Task Scheduler Review: Identify tasks with "Startup" triggers or hidden actions.
3. Event Log Triangulation: Cross-reference Event IDs 4624 (logons), 4672 (privileges), and 1149 (RDP connections).
4. File System Sweep: Scan TMP folders for .ps1, .exe, or unexpected text files.
5. Network Configuration Check: Inspect hosts file and firewall rules for tampering.

Advanced Investigation Tools

• WiFi History View: Reconstruct network connections (requires internet access).
• Sysinternals Suite: Analyze processes and autoruns for persistence mechanisms.
• ELK Stack: Centralize logs for timeline-based attack reconstruction.

Pro Tip: Always capture memory dumps before rebooting—use Windows Sysinternals RAMMap to preserve volatile evidence attackers might delete.

Lessons from a Failed Investigation

The investigator spent 7+ hours struggling with four critical mistakes:

1. Overlooking the hosts file for C2 IPs
2. Misinterpreting date formats in event logs (MM/DD vs. DD/MM)
3. Ignoring disabled scheduled tasks
4. Not analyzing PowerShell script parameters (e.g., -L1348 for ports)

"Which step would challenge you most? Share your forensic hurdles in the comments!"

Final Thoughts

Windows Server forensic investigations require meticulous attention to authentication logs, scheduled tasks, and network configurations. By combining native tools like Event Viewer and PowerShell with systematic artifact analysis, you can trace attacker actions—even without commercial software. Remember: reboot strategically, document timestamps rigorously, and always verify "disabled" items in Task Scheduler.