title: Lateral Movement Indicator ConDrv
id: 29d31aee-30f4-4006-85a9-a4a02d65306c
status: stable
description: This event was observed on the target host during lateral movement. The process name within the event contains the process spawned post compromise. Account Name within the event contains the compromised user account name. This event should to be correlated with 4624 and 4688 for further intrusion context.
author: Janantha Marasinghe
date: 2021/04/27
references:
    - https://jpcertcc.github.io/ToolAnalysisResultSheet/details/wmiexec-vbs.htm
    - https://www.fireeye.com/blog/threat-research/2017/08/monitoring-windows-console-activity-part-one.html
tags:
    - attack.lateral_movement
    - attack.execution
    - attack.t1021  
    - attack.t1059
logsource:
    product: windows
    service: security
    definition: 
detection:
    selection:
          EventID: 4674
          ObjectServer: 'Security'
          ObjectType: 'File'
          ObjectName: '\Device\ConDrv'
    condition: selection
falsepositives:
    - Penetration tests where lateral movement has occurred. This event will be created on the target host.
level: high
