Deep Lateral Movement & Account Compromise Forensic Report

Through advanced Event Log correlation, we successfully mapped the threat actor's lateral movement path. The attacker originally compromised the user account `rsydow-a` on a pivot host **`172.16.6.18`**. Between January 16 and 17, they used these credentials to establish 85 Network Logons (Logon Type 3) to this machine. On January 17 at 14:43:03 UTC, the attacker escalated their access by launching a remote RDP Session (Logon Type 10) as the service account `wacsvc`, originating from the same pivot host `172.16.6.18`. In this session, they executed their browser history harvesting actions. Additionally, RDP logs show a subsequent ingress on January 23 as `wacsvc`, originating from **`172.16.4.9`**, during which the remote execution toolkit was staged. Finally, the logs capture the DFIR response team's ingress on January 24 at 18:04:57 UTC from `172.16.5.25` under the analyst account `cbarton-a`, which installed the triage utility `F-Response Subject Service` and acquired kernel memory.

• Attacker Subnet Scope Identified: Connections originated from 172.16.6.18 and 172.16.4.9. Security teams must perform a sweep of these two hosts immediately, as they serve as the threat actor's active pivot points.
• No Execution of Lateral Movement Tools locally: Although the attacker staged ph.exe (Process Hacker) and px.exe (PsExec) on January 23, the Prefetch logs confirm they were never executed on this system. The attacker likely planned lateral movement *outbound* but was disrupted by the DFIR team's rapid response on January 24.
• Security Audit Logs Integrity: While the Security event log contains oldest events starting from August 2022, it is fully populated up to January 25, 2023. The apparent "missing" events in previous runs were due to standard API search limits, not log manipulation. The audit log integrity remains intact.