Joey Victorino

Windows intrusion artifacts: a working reference.

The event IDs, registry locations, and host artifacts I reach for during a hypervisor-ransomware intrusion in a Microsoft estate, in collection order. Compiled from the Akira walkthrough; every line is checkable against vendor documentation.

Read the walkthrough

Identity plane · domain controllers

Security 4624 / 4625 DC Security logLogons and failures. Type 3 (network) and 10 (RDP); type 3 onto hypervisor management from a non-DC source is a priority pivot.
Security 4776 DC Security logNTLM credential validation. Off-hours clusters are worth the pull.
Security 4768 / 4769 DC Security logKerberos TGT/TGS issuance. Bursts for service accounts that never request HTTP or CIFS tickets at 02:00.
Security 4662 + replication GUIDs DC Security logDCSync. Access mask 0x100 with properties 1131f6aa… (DS-Replication-Get-Changes) or 1131f6ad… (Get-Changes-All) and a subject that is not a DC computer account. Correlate to the 4624 sharing the Logon ID for a source address.
Security 4720 / 4728 / 4732 DC Security logNew accounts; additions to Domain Admins or Enterprise Admins.
System 7045 · Security 4698 DC / member logsNew service installed; new scheduled task.
Security 5136 DC Security logDirectory object modification.
Security 1102 DC Security logSecurity log cleared. Treat that DC as hostile until proven otherwise.
NTDS IFM ntdsutilactivate instance ntds → ifm → create full — or a VSS copy of ntds.dit plus SYSTEM. Never a live-volume file copy.

Defender / sensor state

Registry: …\Windows Advanced Threat Protection\Status HKLM\SOFTWARE\MicrosoftOnboardingState = 1, SenseIsRunning = 1, OrgId matches the tenant. The authoritative onboarding check; Get-MpComputerStatus reports the AV engine, not the sensor.
SENSE/Operational 5 Applications and Services LogsSensor cannot reach the service. After containment cuts the internet, this is the allow-list own-goal: wrapper fine, portal empty.
SENSE/Operational 6 / 10 / 25 / 27 Applications and Services LogsNot onboarded, no parameters / failed to persist onboarding / failed health-status reset / failed to enable EDR mode.
Application log, source WDATPOnboarding: 15 / 35 / 40 Application logOnboarding script results: SENSE failed to start / status registry value missing / status not 1. A different log than SENSE/Operational; routinely confused with it.
Defender/Operational 5001 / 5007 / 5010 / 5012 Applications and Services LogsReal-time protection disabled / configuration changed (exclusions written) / scanning disabled. 5007 plus Tamper Protection off is a triage candidate, not policy drift.
Defender/Operational 1121 / 1123 / 1124 Applications and Services LogsASR block; controlled-folder-access block/audit. 1123/1124 around a hanging file save usually means a missing path exclusion, not residual malware.
catroot2 rebuild cryptsvcSilent sensor-install failure with exit code 0: net stop cryptsvc · ren catroot2 catroot2.old · net start cryptsvc, then re-onboard. catroot2, not catroot.

Anti-forensics · Safe Mode · BYOVD

Kernel-General 12 System logBootMode value distinguishes a safe-mode start from normal boot.
Defender/Operational 3002, error 0x8007043C Applications and Services LogsERROR_NOT_SAFEBOOT_SERVICE — Defender declining to start in Safe Mode. Detection without remediation in that window is consistent, not contradictory.
System 7036 System logSense, WinDefend, WdNisSvc stopping.
SafeBoot\Network service keys HKLM\SYSTEM\CurrentControlSet\ControlA service registered here survives a forced Safe Mode boot. Operator persistence artifact.
rwdrv.sys + hlpdrv.sys service installs Service registry / DeviceRegistryEventsBYOVD pair in current Akira tradecraft: ThrottleStop’s driver for kernel execution, then a helper writing DisableAntiSpyware via silent regedit.exe. Registry and service-install events outlive the deleted files; the write is evidence even where the policy is deprecated.
Precursor process hunting DeviceProcessEvents (14d)vssadmin/wmic/wbadmin/bcdedit/fsutil/wevtutil/ntdsutil with shadow-delete, recovery-off, USN-delete, log-clear, or IFM arguments; rclone/WinSCP/FileZilla/MEGA and renamed scanners via ProcessVersionInfoCompanyName.

Hypervisor · ESXi · SAN

/var/log and /scratch/log Every ESXi hostvmkernel, hostd, shell, auth — pulled before any rebuild. The only record of how the operator lived on the host.
authorized_keys ESXiRogue SSH keys.
esxcli software vib list ESXi shellUnexpected VIBs.
/etc/rc.local.d/local.sh ESXiBoot persistence.
SSH / ESXi shell state Host configEnabled when policy says disabled is itself a finding.
Encrypted VMFS datastores SANSnapshot, do not delete. SAN controller logs alongside.

Recovery discipline

KRBTGT double reset ADTwice, with a proper interval, to close the golden-ticket window. Rotate every privileged secret including hypervisor and backup credentials.
Backup age vs dwell time A clean backup date is an assumption until dwell is established. Replaying an image that contains the intruder is not recovery.
Egress before rebuild Firewall / proxy / DeviceNetworkEventsOutbound bytes for the two weeks before impact answer the question the regulator asks and restore-from-tape cannot: did data leave.

Corrections welcome and credited: joey@victori.no. If you are in the middle of the incident this page describes, this is the work I do.