What is windows event log?
Windows event log is a record of a computer's alerts and
notifications such as errors, warning and other information.
There are a lot of System Information and Event Management (SIEM) tools
out there that collects and analyzes logs and monitors for security threats,
these softwares offers many advance and somewhat features.
In this article, we are going to explore windows event viewer to
perform a simple security analysis and create a simple custom view for
monitoring.
We are going to use the following event ID 4672 - Special
privileges assigned to new logon.
This event lets you know whenever an account assigned any
"administrator equivalent" user rights logs on. There are reasons why
we need to monitor for such event, we usually give our employees a standard user
rights and hackers can perform privilege escalation (e.i. Metaspoit’s
meterpreter script getsystem that will use a number of different techniques to
attempt to gain SYSTEM level privileges).
Sample list of event IDs:
ID
|
Message
|
4672
|
Special privileges assigned to new logon.
|
4673
|
A privileged service was called.
|
4674
|
An operation was attempted on a privileged object.
|
5140
|
A network share object was accessed.
|
5142
|
A network share object was added.
|
5145
|
A network share object was checked to see
whether the client can be granted desired access.
|
A list of event IDs can be found here:
To do this, click on start button, search for event viewer, right-click
on event viewer and run it as an administrator then you will see a window as
shown below.
We are going to filter the result to only show special privilege logon.
Follow the steps below.
Now you can analyze whether this special logon associated with time if
it was authorized.
Next, we are going to create a custom view to monitor special logon.
Here we are naming it as Custom Special Logon.
Now we can click on this tab every time we want to check for special
logons.
There are a lot of configuration options available, make a custom view
that suits your need.
Now that you have a basic event analyzing skill, think of this
situation. A malware infects a computer in your network that can leverage its privilege
and can map a network and performs a copy maybe of itself.
You may want to investigate a series of event IDs to include 5140 and 4672, refer to the table I created above.
Security tools such as metasploit framework has its meterpreter a
command called clearev which clears the event log. This capability is not new to
elite hackers which can craft their own custom tools. A cleared event log
should ring your loudest bell available.
For more info and references:
Comments
Post a Comment