Windows intrusion artifacts: a working reference.
The event IDs, registry locations, and host artifacts I reach for during a hypervisor-ransomware intrusion in a Microsoft estate, in collection order. Compiled from the Akira walkthrough; every line is checkable against vendor documentation.
Identity plane · domain controllers
Security 4624 / 4625
DC Security logLogons and failures. Type 3 (network) and 10 (RDP); type 3 onto hypervisor management from a non-DC source is a priority pivot.
Security 4776
DC Security logNTLM credential validation. Off-hours clusters are worth the pull.
Security 4768 / 4769
DC Security logKerberos TGT/TGS issuance. Bursts for service accounts that never request HTTP or CIFS tickets at 02:00.
Security 4662 + replication GUIDs
DC Security logDCSync. Access mask 0x100 with properties 1131f6aa… (DS-Replication-Get-Changes) or 1131f6ad… (Get-Changes-All) and a subject that is not a DC computer account. Correlate to the 4624 sharing the Logon ID for a source address.
Security 4720 / 4728 / 4732
DC Security logNew accounts; additions to Domain Admins or Enterprise Admins.
System 7045 · Security 4698
DC / member logsNew service installed; new scheduled task.
Security 5136
DC Security logDirectory object modification.
Security 1102
DC Security logSecurity log cleared. Treat that DC as hostile until proven otherwise.
NTDS IFM
ntdsutil
activate instance ntds → ifm → create full — or a VSS copy of ntds.dit plus SYSTEM. Never a live-volume file copy.
Defender / sensor state
Registry: …\Windows Advanced Threat Protection\Status
HKLM\SOFTWARE\MicrosoftOnboardingState = 1, SenseIsRunning = 1, OrgId matches the tenant. The authoritative onboarding check; Get-MpComputerStatus reports the AV engine, not the sensor.
SENSE/Operational 5
Applications and Services LogsSensor cannot reach the service. After containment cuts the internet, this is the allow-list own-goal: wrapper fine, portal empty.
SENSE/Operational 6 / 10 / 25 / 27
Applications and Services LogsNot onboarded, no parameters / failed to persist onboarding / failed health-status reset / failed to enable EDR mode.
Application log, source WDATPOnboarding: 15 / 35 / 40
Application logOnboarding script results: SENSE failed to start / status registry value missing / status not 1. A different log than SENSE/Operational; routinely confused with it.
Defender/Operational 5001 / 5007 / 5010 / 5012
Applications and Services LogsReal-time protection disabled / configuration changed (exclusions written) / scanning disabled. 5007 plus Tamper Protection off is a triage candidate, not policy drift.
Defender/Operational 1121 / 1123 / 1124
Applications and Services LogsASR block; controlled-folder-access block/audit. 1123/1124 around a hanging file save usually means a missing path exclusion, not residual malware.
catroot2 rebuild
cryptsvcSilent sensor-install failure with exit code 0:
net stop cryptsvc · ren catroot2 catroot2.old · net start cryptsvc, then re-onboard. catroot2, not catroot.
Anti-forensics · Safe Mode · BYOVD
Kernel-General 12
System logBootMode value distinguishes a safe-mode start from normal boot.
Defender/Operational 3002, error 0x8007043C
Applications and Services LogsERROR_NOT_SAFEBOOT_SERVICE — Defender declining to start in Safe Mode. Detection without remediation in that window is consistent, not contradictory.
System 7036
System logSense, WinDefend, WdNisSvc stopping.
SafeBoot\Network service keys
HKLM\SYSTEM\CurrentControlSet\ControlA service registered here survives a forced Safe Mode boot. Operator persistence artifact.
rwdrv.sys + hlpdrv.sys service installs
Service registry / DeviceRegistryEventsBYOVD pair in current Akira tradecraft: ThrottleStop’s driver for kernel execution, then a helper writing DisableAntiSpyware via silent regedit.exe. Registry and service-install events outlive the deleted files; the write is evidence even where the policy is deprecated.
Precursor process hunting
DeviceProcessEvents (14d)vssadmin/wmic/wbadmin/bcdedit/fsutil/wevtutil/ntdsutil with shadow-delete, recovery-off, USN-delete, log-clear, or IFM arguments; rclone/WinSCP/FileZilla/MEGA and renamed scanners via ProcessVersionInfoCompanyName.
Hypervisor · ESXi · SAN
/var/log and /scratch/log
Every ESXi hostvmkernel, hostd, shell, auth — pulled before any rebuild. The only record of how the operator lived on the host.
authorized_keys
ESXiRogue SSH keys.
esxcli software vib list
ESXi shellUnexpected VIBs.
/etc/rc.local.d/local.sh
ESXiBoot persistence.
SSH / ESXi shell state
Host configEnabled when policy says disabled is itself a finding.
Encrypted VMFS datastores
SANSnapshot, do not delete. SAN controller logs alongside.
Recovery discipline
KRBTGT double reset
ADTwice, with a proper interval, to close the golden-ticket window. Rotate every privileged secret including hypervisor and backup credentials.
Backup age vs dwell time
—A clean backup date is an assumption until dwell is established. Replaying an image that contains the intruder is not recovery.
Egress before rebuild
Firewall / proxy / DeviceNetworkEventsOutbound bytes for the two weeks before impact answer the question the regulator asks and restore-from-tape cannot: did data leave.
Corrections welcome and credited: joey@victori.no. If you are in the middle of the incident this page describes, this is the work I do.