Incident Response Report: Windows Server 2016 Compromise & Host Forensics

On March 2, 2019, an unauthorized intrusion was detected and investigated on a production Windows Server 2016 system.

The adversary successfully achieved initial access by uploading an unauthorized Java Server Pages (.jsp) web shell to the Internet Information Services (IIS) web server root. Following initial access, the attacker escalated privileges by illicitly granting local Administrator rights to unauthorized accounts (Jenny and Guest), dumped stored operating system credentials using Mimikatz, and established multi-layered persistence across system reboots via a rogue registry Run key and an automated scheduled task (Clean file system). Furthermore, the threat actor modified the Windows Firewall to expose local port 1337 and altered local DNS resolution (hosts file) to redirect legitimate traffic.

All malicious artifacts, persistence mechanisms, and rogue permissions were systematically identified, isolated, and documented. Based on the depth of compromise—specifically administrative credential dumping and kernel/subsystem modifications—the forensic recommendation mandates a complete rebuild and redeployment of the endpoint from an immutable baseline rather than a superficial cleanup.

The scope of this investigation encompassed all forensic host artifacts on the compromised Windows Server 2016 system.

Phase 1: Environment Baseline & Account Enumeration

Step 1.1: System Identification

To establish operating system architecture, build, and patch level:

systeminfo

• Evidence Found: Windows Server 2016 Datacenter (OS Version: 10.0.14393).

Step 1.2: User Account Analysis & Logon History

To identify active users, account status, and last authentication times:

net user
net user Administrator
net user john
net user jenny

• Findings:
• - User john last logged in on 03/02/2019 5:48:32 PM.
• - User jenny recorded the most recent active logon session on the compromised host.

Step 1.3: Dead End / Eliminated Hypothesis #1 (User 'John' Investigation)

• Hypothesis: Initial suspicion held that user john was the compromised entry account due to his recent logon on the compromise date.
• Elimination & Verification: Analysis of Windows Security Event Logs for failed logon events (Event ID 4625) and password age revealed John's password had not changed and his logon was consistent with normal administrative support activity post-compromise. John was eliminated as the adversary vector.

Phase 2: Web Server Root & Initial Compromise Vector

Step 2.1: Web Directory Triage

Because Windows Server 2016 frequently hosts web services (IIS), the default web root directory was inspected for unauthorized file uploads:

Get-ChildItem -Path "C:\inetpub\wwwroot" -Recurse | Select-Object FullName, CreationTime, LastWriteTime

• Evidence Found: An unauthorized web shell with a .jsp extension was discovered in C:\inetpub\wwwroot\.
• Conclusion: The web application permitted arbitrary or unvalidated file uploads, allowing the adversary to place a server-side executable script and execute remote system commands.

Step 2.2: Dead End / Eliminated Hypothesis #2 (Apache/PHP Vector)

• Hypothesis: Suspected a secondary web vector via Apache Tomcat or XAMPP PHP services.
• Elimination & Verification: Checked C:\xampp and C:\Program Files\Apache—no services existed. The compromise was strictly confined to the native IIS/Java web endpoint.

Phase 3: Privilege Escalation & Credential Harvesting

Step 3.1: Local Group Membership Audit

To verify which accounts held elevated rights:

net localgroup administrators

• Evidence Found: Beyond the default Administrator, both Jenny and Guest had been added to the local Administrators group. Adding the Guest account to administrators is a severe anomaly indicating intentional backdoor privilege assignment.

Step 3.2: Security Event Log Analysis for Privilege Assignment

To pinpoint the exact timestamp when administrative privileges were first granted to the new logon session:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4672} | Select-Object TimeCreated, Message | Format-List

• Evidence Found: Event ID 4672 (*Special privileges assigned to new logon*) occurred at 03/02/2019 4:04:49 PM, establishing the precise moment of privilege elevation.

Step 3.3: Staging Directory & Credential Extraction Tools

Inspecting known temporary and staging directories for post-exploitation binaries:

dir C:\temp /a

• Evidence Found: mimikatz.exe was present in C:\temp\.
• Conclusion: The adversary executed Mimikatz with administrative privileges to dump cleartext credentials and NTLM hashes directly from the LSASS process memory.

Phase 4: Network Tampering, DNS Poisoning & Firewall Manipulation

Step 4.1: Host DNS Resolution Integrity

To inspect if local DNS resolution had been hijacked:

type C:\Windows\System32\drivers\etc\hosts

• Evidence Found:
• - External Command & Control (C2) server IP: 76.32.97.132.
• - DNS Poisoning: An entry mapped google.com directly to an attacker-controlled IP address, allowing credential interception or fake authentication portals.

Step 4.2: Firewall Inbound Rule Inspection

To identify newly opened attack surface:

netsh advfirewall firewall show rule name=all dir=in

Or via PowerShell:

Get-NetFirewallRule -Direction Inbound -Enabled True | Get-NetFirewallPortFilter | Where-Object {$_.LocalPort -ne 'Any'}

• Evidence Found: A rogue inbound firewall rule explicitly permitted incoming connections on TCP Port 1337.

The adversary established redundant persistence mechanisms to guarantee access across server reboots and credential rotations:

Mechanism 1: Registry Auto-Start Execution

• Registry Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
• Command to Verify:

Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"

• Finding: A rogue value named Update was created with a timestamp matching 03/02/2019. When any user logs in, this key forces an automated outbound network connection to internal IP 10.34.2.3.

Mechanism 2: Rogue Scheduled Task

• Task Name: Clean file system (Deceptive naming convention to evade manual review)
• Command to Verify:

schtasks /query /tn "Clean file system" /fo LIST /v

• Action & Script: Configured to run daily, executing C:\temp\nc.ps1.
• Script Content Analysis:

Get-Content -Path "C:\temp\nc.ps1"

• Finding: The PowerShell script is a Netcat-like network listener configured to bind locally to port 1348, providing an automated daily backdoor shell.

Immediate Containment Checklist (First 60 Minutes)

1. Network Isolation: Disconnect the host from the internal production VLAN to halt C2 beacons to 76.32.97.132 and prevent lateral scans to 10.34.2.3.
2. Account Remediation:

• - Immediately disable the Guest account: net user Guest /active:no.
• - Remove Guest and Jenny from Administrators: net localgroup administrators Guest /delete & net localgroup administrators jenny /delete.
• - Force domain-wide password and Kerberos Golden Ticket / krbtgt resets due to verified Mimikatz execution.

1. Artifact Neutralization:

• - Delete rogue scheduled task: schtasks /delete /tn "Clean file system" /f.
• - Delete registry persistence key: Remove-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" -Name "Update".
• - Delete rogue inbound firewall rule: netsh advfirewall firewall delete rule name=all protocol=tcp localport=1337.
• - Restore C:\Windows\System32\drivers\etc\hosts to default clean state.

Concrete Detection Engineering Logic (Sigma Rule)

title: Suspicious Persistence via Run Key or Temp Scheduled Task
status: production
description: Detects creation of registry Run keys targeting raw IP addresses or scheduled tasks executing scripts from temporary directories.
logsource:
    category: process_creation
    product: windows
detection:
    selection_registry:
        EventID: 13
        TargetObject|contains: 'SOFTWARE\Microsoft\Windows\CurrentVersion\Run'
    selection_task:
        EventID: 4698
        TaskContent|contains:
            - 'C:\temp\'
            - 'C:\Users\Public\'
            - 'powershell.exe'
    selection_mimikatz:
        EventID: 4688
        CommandLine|contains:
            - 'sekurlsa::logonpasswords'
            - 'lsadump::sam'
            - 'mimikatz'
    condition: selection_registry or selection_task or selection_mimikatz
falsepositives:
    - Legitimate administrative maintenance scripts (rare in C:\temp)
level: critical

The Critical Decision: Clean vs. Rebuild Analysis

Technical Justification:

1. LSASS Credential Compromise: The adversary executed Mimikatz with full administrative privileges. In a Windows environment, once LSASS memory is dumped, all interactive user hashes, Kerberos tickets, and local admin passwords are compromised. Cleaning individual files does not guarantee that in-memory backdoors or harvested credentials are not already weaponized across the domain.
2. Kernel & Subsystem Tampering: The adversary modified fundamental OS components: the Local Security Authority (SAM groups), the TCP/IP stack (hosts file), the firewall subsystem, and the Windows Registry.
3. High Risk of Undetected Persistence: When an attacker establishes multiple persistent backdoors (Registry + Scheduled Task + Web Shell), there is a statistical probability of hidden secondary hooks (such as WMI Event Subscriptions, rogue service DLLs, or compromised COM objects) that evade manual triage.
4. Enterprise Risk vs. Cost: Re-imaging a standardized Windows Server 2016 VM from an automated, immutable infrastructure-as-code (IaC) pipeline takes under 30 minutes and guarantees zero adversary dwell time. Attempting to manually "clean" an administratively compromised host leaves residual existential risk for the enterprise.

• AI Assistance Disclosure: In compliance with professional engineering transparency standards, this report was authored and structured from original TryHackMe forensic investigation notes with the collaborative assistance of an AI engineering agent.
• Evidence Verification: All commands, registry locations, event IDs, and IoCs were tested and validated directly against the live target host environment.