What is windows event log?
Windows event log is a record of a computer's alerts and notifications such as errors, warning and other information.
There are a lot of System Information and Event Management (SIEM) tools out there that collects and analyzes logs and monitors for security threats, these softwares offers many advance and somewhat features.
In this article, we are going to explore windows event viewer to perform a simple security analysis and create a simple custom view for monitoring.
We are going to use the following event ID 4672 - Special privileges assigned to new logon.
This event lets you know whenever an account assigned any "administrator equivalent" user rights logs on. There are reasons why we need to monitor for such event, we usually give our employees a standard user rights and hackers can perform privilege escalation (e.i. Metaspoit’s meterpreter script getsystem that will use a number of different techniques to attempt to gain SYSTEM level privileges).
Sample list of event IDs:
ID | Message |
4672 | Special privileges assigned to new logon. |
4673 | A privileged service was called. |
4674 | An operation was attempted on a privileged object. |
5140 | A network share object was accessed. |
5142 | A network share object was added. |
5145 | A network share object was checked to see whether the client can be granted desired access. |
A list of event IDs can be found here:
To do this, click on start button, search for event viewer, right-click on event viewer and run it as an administrator then you will see a window as shown below.
We are going to filter the result to only show special privilege logon. Follow the steps below.
Now you can analyze whether this special logon associated with time if it was authorized.
Next, we are going to create a custom view to monitor special logon.
Here we are naming it as Custom Special Logon.
Now we can click on this tab every time we want to check for special logons.
There are a lot of configuration options available, make a custom view that suits your need.
Now that you have a basic event analyzing skill, think of this situation. A malware infects a computer in your network that can leverage its privilege and can map a network and performs a copy maybe of itself.
You may want to investigate a series of event IDs to include 5140 and 4672, refer to the table I created above.
Security tools such as metasploit framework has its meterpreter a command called clearev which clears the event log. This capability is not new to elite hackers which can craft their own custom tools. A cleared event log should ring your loudest bell available.
For more info and references:
A very well-developed post with step by step guidance on event viewer. The way you explained each point with necessary details and maintained good balance between theory and practice is really commendable.I want to learn Network penetration testing please let me know if you have anyresources.
ReplyDelete