Tim Langemo - Windows Event Logging

Tim Langemo (@timlangemo) discussing Windows Event Logging at the ND ISSA (@nd_issa) June 2016 chapter meeting.

Transcript

1. Northern Plains ISSA June 2, 2016 Tim Langemo
2. Events of Interest Collecting Events Analysis and Retention
3. geek Security Analyst, GCIH, GSEC Husband Dad
4. All views expressed are my own. They do not represent the views of my employer. There is not a single right answer ◦ Limitations exist People Politics Money
5. This information is based largely on Server 2008/Windows 7 and later ◦ If using older operating systems: Event IDs will be different Some events are not even captured It is time to revisit your migration plan
6. Events of Interest Collecting Events Analysis and Retention
7. Account Activity (User) ◦ Logons and Logoffs 4624 - Logon 4634 – Logoff 4625 – Failed Logon ◦ Types 2 - Interactive 3 – Network (mapped drives) 10 - RDP
8. Account Activity (Administrative) ◦ 4720 – Creation ◦ 4722 – Enabled ◦ 4723 – User initiated password change ◦ 4724 – Privileged user password change ◦ 4725 – Disabled ◦ 4726 – Deletion ◦ 4740 – Locked Out
9. Group Membership ◦ Local/Global/Universal ◦ 4732/4728/4756 – Member Added ◦ 4733/4729/4757 – Member Removed ◦ If you only watch two groups… Local Admins Domain Admins
10. Hopefully your Anti-Virus solution has centralized administration and alerting ◦ Have you checked to make sure anything alerted on an endpoint phones home? ◦ Varies by vendor SCEP writes to System Log Defender writes to Applications and Services / Microsoft/Windows/Windows Defender Symantec and Trend Micro write to Application Log
11. Service Creation ◦ 7045 – New Windows Service System log Gooogle Update Service registered? ◦ Service Failures Many examples 7022-7024, 7026, 7031, 7032, 7034
12. Process Creation and Termination ◦ Advanced Audit Policy settings to enable 4688 – Process created 4689 – Process terminated ◦ Microsoft is slowly adding more details to the captured data Server 2012R2 added command line info Server 2016 Preview includes SHA1/2 hashes
13. Sysmon ◦ Like Process Creation, but on Steroids ◦ Part of SysInternals suite Writes to Applications and Services Logs/Microsoft/Windows/Sysmon/Operational Process name, ID, parent process, command line, etc. Also terminations, TCP/UDP connections, file modification times, raw disk access Event IDs 1-9 depending on configuration Change default log size!
14. AppLocker ◦ 8002/8005 – Allowed ◦ 8003/8006 – Audit Mode - Would be Blocked ◦ 8004/8007 – Enforcement Mode – Blocked Applications and Services/Microsoft/Windows/AppLocker Software Restriction Policies ◦ 866 – Prevented Execution Application Log
15. Powershell Script Block Logging ◦ Introduced in Powershell 5.0 Dependencies on .NET 4.5 and WMF 5.0 Can generate 1MB/min during activity (legit or otherwise) Expand default log size if you want any value ◦ Records blocks of code passing through Powershell -EncodedCommand de-obfuscation Invoke-Mimikatz, anyone?
16. Enhanced Mitigation Experience Toolkit ◦ Applies various defense mechanisms to selected applications Data Execution Prevention (DEP) Address Space Layout Randomization (ASLR) Certificate Pinning ◦ Writes to Application Log 1 - Warning 2 - Error
17. Events of Interest Collecting Events Analysis and Retention
18. Eventlog To Syslog service ◦ Based on work of Curtis Smith ◦ Seems to be a stale project
19. Snare ◦ Paid ◦ AD capable configuration NxLog ◦ Paid or Community Edition
20. Windows Event Forwarding ◦ Introduced with Server 2008 ◦ Utilizes WinRM and GPO to configure subscriptions Source Initiated (Push) or Collector Initiated (Pull) Events land in ForwardedEvents
22. Events of Interest Collecting Events Analysis and Retention
23. Syslog Server ◦ SolarWinds Kiwi ◦ Syslog-NG ◦ Rsyslog Command Line Kung Fu Grep Awk Sort Native Event Log in Windows ◦ wecutil
24. SIEM ◦ Many Options LogRythm HP ArcSight IBM Qradar Splunk Enterprise OSSIM
25. Security Onion ◦ Developed by Doug Burks ◦ Network Security Monitoring Suite IDS (Snort, Suricata, Bro) Full Packet Capture Syslog OSSEC ◦ Enterprise Log Search Agent (ELSA) Built on top of MySQL Parsing For Windows logs and Sysmon
26. Elasticsearch/Logstash/Kibana (ELK) ◦ Logstash Parsing and normalization ◦ Elasticsearch Storage backend Painless scaling ◦ Kibana Visualization ◦ Plugins Shield (Security) Watcher (Alerting)
30. Your Windows Logs are talking ◦ Are you paying attention? You can do a lot with little capital investment Share your successes
31. Spotting the Adversary with Windows Event Log Monitoring – NSA Ultimatewindowssecurity.com
32. Tim Langemo ◦ tim.langemo@gmail.com ◦ @timlangemo