Windows Logs and Incident Response
undefined
Windows Logs and Sysmon
Incident Response
Windows Event Logs
•
The logging mechanism built into Windows systems
•
Logs from the operating system
•
Logs from applications on the system
•
Useful for troubleshooting problems
•
Also useful for detecting security issues
•
Errors
•
Warnings
•
Informational messages
Incident Response
2
Major logs
•
Application log
Information about applications
•
System
System component events
Driver issues, hardware issues…
•
Security
Resource use
Logins/logoffs
File access
•
Also will find a lot under Applications and Services Logs
Incident Response
3
Structure of a Windows Event Log
•
Event Viewer
•
Log Name
Application, System,
Security, etc.
•
Event ID
Unique number
corresponding with the
specific log type
•
Log Level
Information, Warning,
Error
•
Message
This will vary quite a bit
based on the content
of the message
CSC-438 Defensive Network Security
4
“Sexy Six” event logs
•
4
6
8
8
/
5
9
2
(
S
e
c
u
r
i
t
y
)
–
N
e
w
P
r
o
c
e
s
s
e
x
e
c
u
t
e
d
Malware or malicious software running, or malicious actor running things
Not every new process is bad!!
Nmap.exe, ssh.exe, psexec.exe, psexecsvc.exe, ping.exe, powershell.exe, etc…
•
4
6
2
4
/
5
2
8
/
5
4
0
(
S
e
c
u
r
i
t
y
)
–
A
c
c
o
u
n
t
l
o
g
g
e
d
i
n
Attacker logged in
But not all logins are attackers!
4
6
2
5
–
F
a
i
l
e
d
l
o
g
o
n
a
t
t
e
m
p
t
•
5
1
4
0
/
5
6
0
(
S
e
c
u
r
i
t
y
)
–
A
s
h
a
r
e
w
a
s
a
c
c
e
s
s
e
d
Accessing another computer
Lateral movement
CSC-438 Defensive Network Security
5
“Sexy Six” event logs
•
5
1
5
6
(
S
e
c
u
r
i
t
y
)
–
W
i
n
d
o
w
s
F
i
r
e
w
a
l
l
N
e
t
w
o
r
k
c
o
n
n
e
c
t
i
o
n
b
y
p
r
o
c
e
s
s
See a process making a connection
Command and control maybe?
•
7
0
4
5
/
6
0
1
(
S
y
s
t
e
m
)
–
N
e
w
S
e
r
v
i
c
e
i
n
s
t
a
l
l
e
d
New services generally should only be installed during patches and new software
installation
Change management procedures – helps anomalies stand out
•
4
6
6
3
/
5
6
7
(
S
e
c
u
r
i
t
y
)
–
F
i
l
e
a
n
d
R
e
g
i
s
t
r
y
a
u
d
i
t
i
n
g
Modifications to the system
Files added
Must enable file auditing
CSC-438 Defensive Network Security
6
Some additional logs
•
4
7
2
0
(
S
e
c
u
r
i
t
y
)
–
A
u
s
e
r
a
c
c
o
u
n
t
w
a
s
c
r
e
a
t
e
d
Attackers could create themselves an account as a backdoor
Should be fairly easy to deconflict with the admin team
•
4
7
3
2
/
4
7
2
8
(
S
e
c
u
r
i
t
y
)
-
A
m
e
m
b
e
r
w
a
s
a
d
d
e
d
t
o
a
g
r
o
u
p
Attackers could add their account to a higher privileged account
Should be fairly easy to deconflict with the admin team
Incident Response
7
Logon Types
•
You’ll find these in logon events
•
Most common…
•
2 – Logon via console
•
3 – Network logon
•
4 – Batch logon
•
5 – Windows service logon
•
10 – Remote interactive logon (RDP)
Incident Response
8
Process Auditing
•
So not everything being audited in 4688 by default…
•
gpedit.msc
•
Computer Configuration -> Windows Settings -> Security Settings -> Advanced
Audit Policy Configuration -> System Audit Policies -> Detailed Tracking
•
Audit Process Creation
CSC-438 Defensive Network Security
9
Enable Command Line Auditing
•
gpedit.msc
•
Computer Configuration -> Administrative Templates -> System -> Audit Process
Creation
•
Include command line in process creation events
Enable
CSC-438 Defensive Network Security
10
Sysmon
•
Monitors and logs system activities to the Windows Event Log
•
Free!
•
A part of the Sysinternals Suite
•
Created by Mark Russinovich
•
Windows service and driver
•
Monitoring + logging only – no analysis
Up to you + another tool to do that
Incident Response
11
Sysmon Event IDs
•
1
–
P
r
o
c
e
s
s
c
r
e
a
t
i
o
n
•
2
–
A process changed a file creation time
•
3
–
N
e
t
w
o
r
k
c
o
n
n
e
c
t
i
o
n
•
4
–
Sysmon service state changed (sysmon was started or stopped)
•
5
–
Process terminated
•
6
–
Driver loaded
•
7
–
Image loaded (module is loaded in a process)
•
11
–
FileCreate
•
12
–
Registry Event (Create and Delete)
Full list here:
https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon
Incident Response
12
Installing Sysmon
•
Default settings…
process images hashed with sha1 and no network monitoring
Will for sure want to modify this
•
Sysmon.exe -accepteula –i
Must install as an admin, since you are installing a service
Incident Response
13
Default Configuration
•
Sysmon.exe –c
•
Gets current configuration
Not a whole lot there…
Incident Response
14
Filtering
•
We can configure Sysmon to
Only show us certain events (include)
Filter out certain events (exclude)
•
Do I care to see every smss.exe event?
Is it malicious?
Probably not…
But make sure you only filter out the OFFICIAL path/executable!
Session Manager Subsystem – it’s normal.
•
XML configuration file
Include events that match…
Exclude events that match…
Incident Response
15
Sample Configuration File
•
Network
Only connections on ports 80 and 443 not from Internet Explorer
•
Drivers
Exclude “Microsoft”
Exclude “windows”
•
No process termination events
Incident Response
16
Filtering doesn’t sound fun…
•
How about a place to start?!?
•
SwiftOnSecurity Sysmon Configuration
https://github.com/SwiftOnSecurity/sysmon-config
•
A good baseline to begin from
•
800+ lines
It’s long
But it’s good
•
Tweak for your own organization
Incident Response
17
Tweaking the Config
•
Logging EVERYTHING will get noisy
Think tons of events on thousands of computers in a large organization
Too much data to deal with
•
Don’t want to exclude things that could be malicious
•
Please – read through the sample config if you start there
Make sure you understand what you’re doing
Make sure you agree with what it’s doing
•
Put it in play and see what happens
Some legitimate process making tons of logs on your network? Exclude it.
Afraid you’re not getting a full enough picture of something? Include it.
Incident Response
18
Windows Processes
•
There are a bunch of default processes that are always running
•
You need to know what’s normal
Experience will help with this
•
Not only normal to all systems, but also normal to your network
Should spotify.exe be running? Do you have policy that should block it?
What normal applications are employees using?
•
SANS Hunt Evil poster
https://digital-forensics.sans.org/media/SANS_Poster_2018_Hunt_Evil_FINAL.pdf
Incident Response
19
Labs – Graylog and Windows Logs
•
Let’s dive in to some data
•
Windows 10 machine forwarded data to Graylog
Sysmon
SwiftOnSecurity config, + all network connections logged
Security event log
•
Start to get familiar with searching and sifting through the available data
•
Intro Lab
•
Compromise Investigation lab
Incident Response
20
The comprehensive guide on Windows event logs, Sysmon, and incident response for effective troubleshooting and security detection. Learn about major logs, structure of Windows event logs, and essential event IDs. Discover insights on the "Sexy Six" event logs highlighting crucial security events and network connections. Delve into additional logs for detecting user account creations, group membership changes, and more.
Uploaded on Mar 02, 2025 | 0 Views
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
You are allowed to download the files provided on this website for personal or commercial use, subject to the condition that they are used lawfully. All files are the property of their respective owners.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.
E N D
Presentation Transcript
Windows Logs and Sysmon Incident Response
Windows Event Logs The logging mechanism built into Windows systems Logs from the operating system Logs from applications on the system Useful for troubleshooting problems Also useful for detecting security issues Errors Incident Response Warnings Informational messages 2
Major logs Application log Information about applications System System component events Driver issues, hardware issues Security Resource use Logins/logoffs File access Incident Response Also will find a lot under Applications and Services Logs 3
Structure of a Windows Event Log Event Viewer Log Name Application, System, Security, etc. Event ID Unique number corresponding with the specific log type CSC-438 Defensive Network Security Log Level Information, Warning, Error Message This will vary quite a bit based on the content of the message 4
Sexy Six event logs 4688/592 (Security) New Process executed Malware or malicious software running, or malicious actor running things Not every new process is bad!! Nmap.exe, ssh.exe, psexec.exe, psexecsvc.exe, ping.exe, powershell.exe, etc 4624/528/540 (Security) Account logged in Attacker logged in But not all logins are attackers! 4625 Failed logon attempt CSC-438 Defensive Network Security 5140/560 (Security) A share was accessed Accessing another computer Lateral movement 5
Sexy Six event logs 5156 (Security) Windows Firewall Network connection by process See a process making a connection Command and control maybe? 7045/601 (System) New Service installed New services generally should only be installed during patches and new software installation Change management procedures helps anomalies stand out CSC-438 Defensive Network Security 4663/567 (Security) File and Registry auditing Modifications to the system Files added Must enable file auditing 6
Some additional logs 4720 (Security) A user account was created Attackers could create themselves an account as a backdoor Should be fairly easy to deconflict with the admin team 4732/4728 (Security) - A member was added to a group Attackers could add their account to a higher privileged account Should be fairly easy to deconflict with the admin team Incident Response 7
Logon Types You ll find these in logon events Most common 2 Logon via console 3 Network logon 4 Batch logon 5 Windows service logon Incident Response 10 Remote interactive logon (RDP) 8
Process Auditing So not everything being audited in 4688 by default gpedit.msc Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Detailed Tracking CSC-438 Defensive Network Security Audit Process Creation 9
Enable Command Line Auditing gpedit.msc Computer Configuration -> Administrative Templates -> System -> Audit Process Creation Include command line in process creation events Enable CSC-438 Defensive Network Security 10
Sysmon Monitors and logs system activities to the Windows Event Log Free! A part of the Sysinternals Suite Created by Mark Russinovich Windows service and driver Incident Response Monitoring + logging only no analysis Up to you + another tool to do that 11
Sysmon Event IDs 1 Process creation 2 A process changed a file creation time 3 Network connection 4 Sysmon service state changed (sysmon was started or stopped) 5 Process terminated 6 Driver loaded 7 Image loaded (module is loaded in a process) Incident Response 11 FileCreate 12 Registry Event (Create and Delete) Full list here: https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon 12
Installing Sysmon Default settings process images hashed with sha1 and no network monitoring Will for sure want to modify this Sysmon.exe -accepteula i Must install as an admin, since you are installing a service Incident Response 13
Default Configuration Sysmon.exe c Gets current configuration Not a whole lot there Incident Response 14
Filtering We can configure Sysmon to Only show us certain events (include) Filter out certain events (exclude) Do I care to see every smss.exe event? Is it malicious? Probably not But make sure you only filter out the OFFICIAL path/executable! Session Manager Subsystem it s normal. XML configuration file Include events that match Exclude events that match Incident Response 15
Sample Configuration File Network Only connections on ports 80 and 443 not from Internet Explorer Drivers Exclude Microsoft Exclude windows No process termination events Incident Response 16
Filtering doesnt sound fun How about a place to start?!? SwiftOnSecurity Sysmon Configuration https://github.com/SwiftOnSecurity/sysmon-config A good baseline to begin from 800+ lines It s long But it s good Incident Response Tweak for your own organization 17
Tweaking the Config Logging EVERYTHING will get noisy Think tons of events on thousands of computers in a large organization Too much data to deal with Don t want to exclude things that could be malicious Please read through the sample config if you start there Make sure you understand what you re doing Make sure you agree with what it s doing Put it in play and see what happens Some legitimate process making tons of logs on your network? Exclude it. Afraid you re not getting a full enough picture of something? Include it. Incident Response 18
Windows Processes There are a bunch of default processes that are always running You need to know what s normal Experience will help with this Not only normal to all systems, but also normal to your network Should spotify.exe be running? Do you have policy that should block it? What normal applications are employees using? SANS Hunt Evil poster https://digital-forensics.sans.org/media/SANS_Poster_2018_Hunt_Evil_FINAL.pdf Incident Response 19
Labs Graylog and Windows Logs Let s dive in to some data Windows 10 machine forwarded data to Graylog Sysmon SwiftOnSecurity config, + all network connections logged Security event log Start to get familiar with searching and sifting through the available data Incident Response Intro Lab Compromise Investigation lab 20
