9.3 Initial Access (RDP/SSH), Persistence, Privilege Escalation
Key Takeaways
- Remote Desktop Protocol (RDP) initial access on Windows commonly appears as Security Event 4624 with Logon Type 10 (RemoteInteractive); SSH initial access on Linux appears as sshd Accepted password or publickey lines.
- Persistence is recognized from surviving reboot or logoff: Windows Event 7045 (service installed), scheduled-task creation, Run keys, Linux cron, and SSH authorized_keys changes.
- Privilege escalation is the increase of rights on an already compromised endpoint — local Administrators membership, sudoers changes, or token abuse — not the first packet of a scan.
- Without host authentication, process, and persistence logging, an analyst can see a VPN login and still miss how the endpoint stayed owned after reboot.
- Correlate initial-access logons with the next persistence event on the same account and host; a help-desk RDP session followed by 7045 is a different story from RDP alone.
Initial access over RDP and SSH
SAL1 Endpoint Attacks content focuses on how attackers gain access to endpoints and keep control. Two remote administration channels appear constantly in real SOC queues: Remote Desktop Protocol (RDP) on Windows and Secure Shell (SSH) on Linux and network devices. Both are legitimate tools. Both are initial-access methods when the account, the source network, or the timing is wrong.
RDP recognition. A successful Windows logon is Security Event 4624. The Logon Type field tells you the class of session. Type 10 is RemoteInteractive — the type most associated with RDP (and similar interactive remote desktop paths). Type 2 is a local console. Type 3 is a network logon (shares, many remote management APIs). Type 7 is an unlock. Analysts who treat every 4624 as RDP will drown in file-share noise. Analysts who ignore Type 10 from unusual countries, disabled jump-host ranges, or accounts that never use RDP will miss initial access.
Worked, sanitized Windows snippet:
Time: 2026-09-18T02:14:33Z
EventID: 4624
LogonType: 10
TargetUser: helpdesk.jlee
IpAddress: 198.51.100.88
WorkstationName: -
LogonProcess: User32
Auth: Negotiate
Host: DESKTOP-FINANCE07
Questions that turn this into a case: does helpdesk.jlee RDP to finance workstations at 02:14 UTC? Is 198.51.100.88 a known VPN egress or a consumer ISP? Was there a 4625 failure burst before the 4624 (spray) or a single success (stolen password or brokered session)? Follow-on Event 4627 group membership and 4672 special privileges tell you whether the session already had admin-equivalent rights.
SSH recognition. On Linux, sshd writes to auth.log, secure, or the journal. The line you want is Accepted with the method (password or publickey), the account, the source address, and the port. Failed passwords (Failed password) are reconnaissance or spray. A success from a new key fingerprint after no change ticket is credential or key theft, not "the user learned SSH."
Worked, sanitized syslog:
2026-09-18T02:16:01Z sshd[21904]: Accepted publickey for deploy from 203.0.113.40 port 51122 ssh2: RSA SHA256:aaaaexamplefingerprint
2026-09-18T02:16:02Z systemd-logind: New session 882 of user deploy
Impact of initial access: the adversary now has a process and a home directory on a managed host. Data, lateral movement, and ransomware staging all become possible. Detection depends on whether 4624 Type 10 and sshd Accepted lines are forwarded to the SIEM with source IP preserved. Network firewall "allow 3389/22 from VPN" without account context is not a substitute.
Persistence at recognition level
Persistence is any mechanism that gives the adversary execution after reboot, logoff, or a killed process. SAL1 topics expect you to recognize common techniques, not to build them.
Windows service install is Event 7045 ("A service was installed in the system") in the System log. Fields that matter: service name, image path, service type, and account. A random 16-character name with an image path under \Users\Public\ or \Temp\ after a Type 10 logon is a classic pairing. Scheduled tasks show as Event 4698 (task created) when Task Scheduler auditing is on; also look for schtasks in process-creation logs. Run keys under HKLM\Software\Microsoft\Windows\CurrentVersion\Run and the current-user counterpart cause a program to start at logon. Recognition is a new value, an unsigned binary, or a user-writable path — not a lecture on registry editing.
Linux persistence that analysts actually catch: cron (/etc/cron.*, user crontabs) with wget or interpreter one-liners; systemd user or system units dropped outside the package manager; and SSH keys appended to ~/.ssh/authorized_keys or /root/.ssh/authorized_keys. File-integrity or auditd watches on those paths turn persistence into an alert instead of a surprise at next login.
| Mechanism | Typical artefact | Why it survives | Analyst trap |
|---|---|---|---|
| Windows service | Event 7045, unexpected ImagePath | Starts with the machine | Ignoring 7045 if the name looks "security related" |
| Scheduled task | 4698, schtasks process create | Time or event trigger | Only hunting \Windows\Tasks XML and missing 4698 |
| Run key | New Run/RunOnce value | User logon | Hunting HKLM only and missing HKCU |
| cron | New crontab line, cron.d file | Time trigger | Ignoring user crontabs |
| SSH key | authorized_keys append | Next SSH success | Assuming password auth is the only SSH risk |
Worked chain (same host as the RDP example):
02:14:33Z 4624 Type 10 helpdesk.jlee from 198.51.100.88
02:18:11Z 7045 ServiceName=WinUpdateSvc ImagePath=C:\Users\Public\wu.exe ServiceType=user-mode
02:18:40Z 4698 TaskName=\Microsoft\Windows\WUCheck
Initial access plus two persistence artefacts in four minutes is not a patch cycle. Isolate the host, disable the account, capture the image path, and check whether the same service name exists on other endpoints (a small worm or a copied playbook).
Privilege escalation conceptually
Privilege escalation is increasing rights on a host the adversary already uses. It is not the port scan and it is not the first phishing click. Conceptual Windows paths: adding an account to local Administrators (Event 4732 on the Administrators group when auditing is on); abusing an already-privileged token (token impersonation / theft — you will see unusual processes running as SYSTEM or as another user); and exploiting a local misconfiguration. Conceptual Linux paths: a sudoers change (NOPASSWD for a wide command), a SUID binary that was not in yesterday's inventory, or a user suddenly in the wheel or sudo group.
Recognition, not recipes:
- 4624 Type 10 as a help-desk user, then a 4732 adding that user to Administrators.
sudoin audit logs for/usr/sbin/visudoor unexpectedusermod -aG sudo.- Processes accessing other users' tokens or spawning as SYSTEM without a Windows Update parent.
Impact: persistence planted as SYSTEM or root survives cleanup that only killed a user-level Run key. Data that was ACL-protected becomes readable. Credential theft against Local Security Authority Subsystem Service (LSASS) (next section) usually wants this higher context.
Why logging is the detection backbone
SAL1 endpoint content closes on the importance of activity logging. If 4624 Type 10 is not collected, RDP initial access is a rumor from a firewall allow. If 7045 and 4698 are off, persistence is a hunt through disk after ransomware. If sshd logs are rotated locally and never shipped, a stolen key is invisible. Enable and forward: Windows Security (4624/4625/4672/4732), System 7045, Task Scheduler 4698, process creation (4688 or Sysmon), Linux auth and auditd. Retention must outlast the attacker's dwell time. The next section adds credential theft, Mimikatz-class LSASS access, Sysmon, and auditd as the logging tools named in official SAL1 training content.
A Windows Security log shows Event 4624 with Logon Type 10 from an unusual source address. Which initial-access method does that most directly describe?
Which persistence artefact matches a newly installed Windows service rather than a Run key or a crontab?
Privilege escalation, at the recognition level used in this section, is best described as which of the following?