adam's notes

Windows Logging for SOC

Anatomy of a Log Entry

  • Windows logs are stored in binary format inside C:\Windows\System32\winevt\Logs
  • Every evtx file corresponds to a specific log category

Reading Event Logs

Event Viewer is a built in tool to view and manage log events.

  1. Log Sources
    • Every EVTX file corresponds to a single item on the left panel
  2. Log List: Each row you see is a single event that contains a few properties you can sort by:
    • Keywords
      • For some events, indicates if the action was successful or not
    • Date and Time
      • The timestamp when the event occurred (system time, not UTC)
    • Event ID
      • A unique number for the event name (e.g. a failed login is always 4625)
  3. Log Details
    • The actual content of the log, in a plaintext or XML format (“Details” tab)
  4. Filters Menu
    • Use the “Filter Current Log” and “Find” buttons to filter the logs

Security Log: Authentication

  • Two most important security logs:
    • EventID 4624 (Successful Logon)
      • detects suspicious RDP/network logins and identify the attack starting point
      • logged on the machine
      • limitation:
        • very noise, can see hundreds per minute
    • EventID 4625 (Failed Logon)
      • detect brute force, password spraying, or vulnerability scanning
      • logged on the machine
      • limitation:
        • inconsistent
        • logs have lots of caveats that may trick you into the wrong understanding of the event

Structure of 4624

  • Can cover most L1/L2 cases with a few core fields:
// Ignore this misleading section. Use "New Logon" instead!
Subject:
	Security ID:       SYSTEM
	Account Name:      THM-PC$  
	Acount Domain:     WORKGROUP
	Logon ID:          0x3E7
	
Logon Information:
	Logon Type:        10   <- This is the login method (10=RDP, 3=Network)
	[...]
	
// This is the actual logged in user
New Logon:
	Security ID:       THM-PC\Administrator
	Account Name:      Administrator
	Account Domain:    THM-PC
	Logon ID:          0x5D6AC
	
// Source IP can be trusted. Hostname is not reliable
Network Information:
	Workstation Name:        THM-PC
	Source Network Address:  10.12.99.54
	[...]

Usage of 4624/4625

Security Log: User Management

  • Common Event IDs:
Event IDDescriptionMalicious Usage
4720 / 4722 / 4738A user account was created / enabled / changedAttackers might create a backdoor account or even enable an old one to avoid detection
4725 / 4726A user account was
disabled / deleted		In some advanced cases, threat actors may disable privileged SOC accounts to slow down their actions
4723 / 4724A user changed their password / User’s password was resetGiven enough permissions, threat actors might reset the password and then access the required user
4732 / 4733A user was added to / removed from a security groupAttackers often add their backdoor accounts to privileged groups like “Administrators”

Structure of User Management Events

  • All user management events have a similar structure and can be split into three parts:
    1. who did the action (Subject)
    2. who was the target (Object)
    3. and which exact changes were made (Details)
  1. Subject
    • The account doing the action
    • Note the Logon ID field - you can use it to correlate this event with the preceding 4624 login event
  2. Object
    • This can be named differently depending on an event ID (e.g. New Account or Member), but it always means the same - the target of the action
  3. Details
    • A target group for 4732 and 4733 events, or new user’s attributes like full name or password expiration settings for the 4720 event

Usage of User Management Events

Hunt for Backdoored Users

  1. Open Security logs and filter for 4720 / 4732 event IDs
  2. Manually review every event; your red flags are:
    • No one from your IT department can confirm the action
    • Changes were made during non-working hours or on weekends
    • The subject user’s name is unknown or unexpected to you
      (e.g. “adm.old.2008” creating new Windows users)
    • The target user’s name does not follow a usual naming pattern
      (e.g. “backup” instead of “thm_svc_backup”)
  3. If you confirmed that the action was malicious, find out the login details:
    • Copy the Logon ID field from your 4720 / 4732 event
    • Find the corresponding login event with the same Logon ID
    • Refer to the workbooks from the previous task for further analysis

Sysmon: Process Monitoring

Two ways to enable process monitoring on Windows:

Event CodePurposeLimitations
4688
(Security Log: Process Creation)		Log an event every time a new process is launched, including its command line and parent process detailsDisabled by default, you need to enable it by following the official documentation
1
(Sysmon: Process Creation)		Replace 4688 event code and provide more advanced fields like process hash and its signatureSysmon is an external tool not installed by default. Check out the Sysmon official page

Sysmon Event ID 1

  • event ID 1 has a lot of different fields, the most important of which can be grouped as:
    • Process Info: Context of the launched process, including its PID, path (image), and command line
    • Parent Info: Context of the parent process
      • very useful to build a process tree or an attack chain
    • Binary Info: Process hash, signature, and PE metadata
    • User Context: A user running the process and, most importantly, Logon ID - same as in the Security logs

Sysmon: Files and Network

Event IDSecurity Log AlternativeEvent Purpose
11 / 13
(File Create / Registry Value Set)		4656 for file changes and 4657 for registry changes, both disabled by defaultDetect files dropped by malware or its changes to the registry (e.g. for persistence)
3 / 22
(Network Connection / DNS Query)		No direct alternative, requires additional firewall and DNS configurationDetect traffic from untrusted processes or to known malicious destinations

Structure of Sysmon Events

Sysmon 3: Network Connection
 
[Process Info]
ProcessId: 1922
Image: C:\Program Files\Program\program.exe
 
[User Info]
User: THM-PC\sarah.miller
 
[Network Info]
Protocl: tcp
SourceIp: x.x.x.x
SourcePort: 50558
DestinationIp: x.x.x.x
DestinationPort: 443
  • The first to sections have the same structure across events
  • The last has the event specific information
    • e.g., Network Connects, DNS query, File creation, Registry value set, etc.
  • use the ProcessId field to find the corresponding event ID 1 (process creation) to get full context

Usage of Sysmon Events

PowerShell: Logging Commands

  • Powershell history file
    • plain text file
    • automatically created by PowerShell
    • records every command entered
    • updated immediately when you press enter to submit a command
C:\Users\<USER>\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt
  • very useful for tracking malicious actions like system discovery or malware download
  • created for every user
    • may see five files if there are five active system users
  • survives system reboots unless manually deleted
  • saves all PowerShell commands entered for all time
  • does not log command outputs
  • does not show script content

Reference

Windows Logging for SOC. (2023). TryHackMe. https://tryhackme.com/room/windowsloggingforsoc

Graph View

Backlinks