// Introduction
When analyzing Windows environments, the challenge isn't just gathering data but making sense of it. The interplay between authentication events, process creation, and network connections can reveal patterns indicative of malicious behavior or misconfigurations. Effective correlation of these logs is key.
// Gathering Relevant Logs
To begin this analysis, you'll need to ensure that the necessary auditing is enabled. Here’s a checklist for configuring your system:
- Enable Windows Security Auditing: Ensure that you have the following audit policies enabled:
- Logon events (Audit Logon) - Process creation (Audit Process Creation) - Network connections (Audit Network Policy Server)
- Configure Event Log Retention: Ensure logs are retained long enough to allow for correlation (e.g., increase retention settings in gpedit.msc under _Event Log_ settings).
Once configured, you can extract logs using PowerShell:
Get-WinEvent -LogName Security | Where-Object { $_.Id -eq 4624 -or $_.Id -eq 4688 -or $_.Id -eq 5140 }This command pulls logon events, process creation events, and network share access events, essential for our analysis.
// Event Log Analysis
For effective correlation, focus on key event IDs:
- 4624: Successful logon
- 4688: A new process has been created
- 5140: A network share object was accessed
Example Scenario
Consider a scenario where you suspect lateral movement within your network. You might see a successful logon (4624) from a service account followed closely by a new process creation (4688) which launches a PowerShell script. This script could be a part of a lateral movement attempt. Here’s how you correlate:
1. Identify the User Account: Check the details of the logon event (4624). Note the user and workstation. 2. Check Process Creation: Look for event 4688 for the same user and timestamp. Note the command line used in the process creation. 3. Network Connections: Find event 5140 entries that show whether this process attempted to access network shares, correlating with the account in question.
Log Entry Breakdown
Each event provides specific details:
- 4624:
- Subject: Security ID, Account Name, Domain, Logon ID - Logon Type: Type of logon (e.g., interactive, network, etc.) - Source Network Address: Where the logon request originated
- 4688:
- New Process ID: Unique ID for the new process - New Process Name: Path to the executable - Command Line: Shows how the process was initiated, which can contain suspicious parameters.
- 5140:
- Share Name: The network share being accessed - Client Address: Where the access request came from
Common Pitfalls
Correlating events isn’t without its challenges. Here are common mistakes to avoid:
- Ignoring Time Discrepancies: Always account for clock skew across systems. Refer to Detecting log tampering with clock skew and impossible events for insight into this.
- Overlooking Normal Behavior: Baseline your environment to differentiate between legitimate and suspicious activity.
- Neglecting Historical Data: Correlation without historical context may lead to false positives. Time-based correlation should be a standard practice.
// Advanced Correlation Techniques
For more forensic-grade analysis, consider leveraging SIEM tools for automated log analysis and alerting. With these tools, you can set up rules to flag when a specific user logs on and subsequently executes certain processes or accesses specific network shares.
Example SIEM Rule
{
"rule": {
"if": {
"and": [
{ "event_id": 4624 },
{ "event_id": 4688, "user": "<suspicious_user>" },
{ "event_id": 5140 }
]
},
"then": {
"alert": "Potential lateral movement detected."
}
}
}This JSON rule states that if a logon event is followed by a process creation event from a suspicious user and a network share access event, an alert should trigger.
// Conclusion
The ability to correlate Windows event logs across authentication, process creation, and network activities enhances your visibility into potential security incidents. With the right tools and methodologies, you can not only detect but also understand the context of suspicious activities in your environment.
Take these techniques into a disposable range you own for practical application. Remember, the DaemonCore Academy curriculum is free and provides further training on these topics.