---
description: Network Forensics Lab Discuss PsExec Tool
---

# PsExec Hunt Blue Team Lab

## 1-First Of all We When we start our investigation we must Know what is the first key we look for we are investigate for PsExec Which is used SMB protocol so we look for the SMB protocol and here we go&#x20;

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FGO1QiMJSLD9Tx1bRJw3j%2FScreenshot%202024-08-23%20170311.png?alt=media&#x26;token=c3a5d511-0fdc-4cf8-97ea-94de417534e4" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2F9I2Cz0rQjV4i22H3oVln%2Fimage.png?alt=media&#x26;token=b5fcb270-4c4e-4342-983b-9a214fb29c33" alt=""><figcaption><p><br><br></p></figcaption></figure>

## 2-To Determine To the Targeted Host-Name I Follow The TCP Stream of the  Psexec traffic and we can determine it and that\`s it&#x20;

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2F1bVJerZc3svt3tSyhVyX%2FScreenshot%202024-08-23%20175153.png?alt=media&#x26;token=92bbddf8-089c-4004-807a-84d772246874" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FlhmEEzqHKCfO5GClBCzy%2Fimage.png?alt=media&#x26;token=b0a1013b-1e92-4397-bd99-b31b0af00ce7" alt=""><figcaption></figcaption></figure>

## 3-In The Packet i looking for the username and i found it in the session id&#x20;

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FKFj3pv5LhZKPAkIBjOQU%2FScreenshot%202024-08-23%20180030.png?alt=media&#x26;token=25646ca5-8504-4c43-83d3-3c57d41d4d0e" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FwMbUswuec2RsWVNKzzWn%2Fimage.png?alt=media&#x26;token=81acf2f7-afad-4b40-948a-59a318aec5d3" alt=""><figcaption></figcaption></figure>

## 4-I think it is the easiest question it is the name of the file wich is we start analysis with it by the way&#x20;

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FYQaEyZ7tMI00w6z37RIg%2FScreenshot%202024-08-23%20180505.png?alt=media&#x26;token=e655112d-dccf-4595-ae63-8dd28941965a" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2Fz00f6MwYd5COWRhSUrP7%2Fimage.png?alt=media&#x26;token=f95a0492-c369-443b-bb1a-2be530e65c57" alt=""><figcaption></figcaption></figure>

## 5-I Detect it easily from the Tree Id

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FHFIt7Dm1G00gh3nXtT7O%2FScreenshot%202024-08-23%20180746.png?alt=media&#x26;token=c44f9904-c794-494c-ad1b-4bffe6821c4d" alt=""><figcaption></figcaption></figure>

&#x20;&#x20;

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FQvO5fChNKsIqZBEqw3zZ%2Fimage.png?alt=media&#x26;token=1b648181-b27d-49b0-8e51-316504b13074" alt=""><figcaption></figcaption></figure>

## 6-Let Investigate again in the same filter it\`s here&#x20;

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FQvBjLNhOhWaaMpFiWt9Y%2FScreenshot%202024-08-23%20181202.png?alt=media&#x26;token=a6041b6d-3ecd-4756-9410-02af214a01e5" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2F6QLVndOsNpDP2bbtz1AY%2Fimage.png?alt=media&#x26;token=ace1dd5f-cce7-4b6c-bfd5-5216fe5e3958" alt=""><figcaption></figcaption></figure>

## 8-Ok here we must Remember a small note that PSexec used LLMNR  protocol so i put filter to retrieve the dns query and ezy (:

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FPL5PlJBT8jscQNQrCvPK%2FScreenshot%202024-08-23%20181749.png?alt=media&#x26;token=955ba11a-add3-4c1e-8544-263b77477af5" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FFhjQVYoB0wc86y9Nuxi0%2Fimage.png?alt=media&#x26;token=d108a4e6-c864-469f-8069-db9c9a9d0980" alt=""><figcaption></figcaption></figure>

> Thank you For Reading .
