Ctrlk
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Events Ripper

How to process Windows event logs from E01 using Events Ripper

Download and unzip Events Ripper

https://github.com/keydet89/Events-Ripper

This took about 5 minutes to process all the events logs from our original image (mounted as G: using AIM). The result is a ~200MB text file.

Trawling through 948,134 lines in a text file isn't the most efficient use of time. Events Ripper also includes erip.exe to parse/identify specific events and provide some kind of context to the data. From the GitHub repo;

After we run erip, the resultant refined file is ~560KB with 7,134 lines.

Locating relevant entries

Given the nature of our incident, Events Ripper allows us to quickly identify relevant artefacts. Let's look at RDP activity and failed/successful account authentication.

Add these to our accounts of interest, and IPs of interest.

We can see that network type 3 (network based login) has a significant quantity of events. We can also see IP addresses associated with those logins. Further, 36.133.110.87 also appears in the list again. Update our running list of IPs.

Type 10 logins (remote interactive - RDP).

Source host machine (kali).

More logins from the same remote IP addresses.

Based on the following artefacts/entries, we should be able to refine our initial assessment to activity from the source IP addresses, focusing on the 4 user accounts (if they all exist), around 5th February 2024 ~23:02 Z/UTC.

Running tally of indicators

Accounts:

  • admin

  • root

  • user

  • administrator

Hostnames:

  • WIN-NI8FBK23SLO

  • kali 👀

IPs:

  • 185.229.66.183 (failed login source, type 10 login source)

  • 36.133.110.87 (failed login source, successful login source)

  • 31.220.85.162 (successful login source)

  • 195.21.1.97 (type 3 and 10 logins)

LogoWhat is "Events Ripper"?windowsir.blogspot.com
PreviousPlasoNextEZ tools

Last updated