SlideShare a Scribd company logo

Windows logging workshop - BSides Austin 2014

Michael Gough, profile picture
Michael Gough

This document provides an overview of a workshop on Windows logging. The workshop aims to teach attendees how to use Windows logging to detect attacks like the Target data breach. It discusses enabling and configuring Windows logging, collecting logs using commands, and analyzing logs with Splunk. The presentation covers malware behavior, Windows logging components, enabling auditing of important events in security and system logs, and installing the Splunk Universal Forwarder to send logs to Splunk Storm for analysis.

Technology
Related topics:
Incident Response
1 of 102
Downloaded 96 times
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
Windows Logging Workshop You could have and SHOULD have caught the Target Breach! Michael Gough – Founder MalwareArchaeology.com
Why are we here • Someone got P0wned • Windows SUCKS by default • The Target breach came after we planned on doing this… but it SO helps to understand why we need to do this. • To show you how to catch APT type attacks
Avecto Study – Admin = P0wnage
When and from Where? Jan 2011 Feb 2011 Mar 2011 Apr 2011 May 2011 June 2011 July 2011 123 45 6 7 1234567 89 1011 12 1 8 2 9 3456789101112 10111213141516171819202122 13 2324252627 13 28293031323334 14 3536 15 37383940414243444546 16 47 17 4849 18 19 20 2122 23 24 25 26 272829 30 Hackers Company Contractor 505152 31 3233 34 35 36 3738 39 40 41 4243 4445464748 49 50 53 515253 54555657585960 14 545556575859 61 60616263 6263 646566676869707172737475767778 64 7980 System Recovered Successful Logons – Jan 4, 2011 to July 6, 2011 Typical Windows system on the internet with port 3389 open – Password brute forced/guessed HackerHurricane.com
The Malware Management Framework • This presentation, and many more we do is because we all need to start practicing Malware Management. • Analyze the information in Malware reports wherever you can find it • Use this Intel to feed into your security tools • Use this Intel to feed into your logging solution and learn what to log for. www.MalwareManagement.org
Malware Management Understand what the latest malware is doing • Files being used • Location of files • Registry Keys • URL’s being used • IP’s being used • Behavior details, processes, traffic, etc. • Understand basically what the malware is doing
Project-Hook & Dexter CC Malware
Agent.BTZ
Windows logging workshop - BSides Austin 2014
BlackPoS - Symantec
How cute, they tried • Hey X-Force… You have a tool called BigFix
Agent.BTZ – F-Secure
Urburos – G-Data
Prevention has failed, or will • Like I always say “We will give up the endpoint”, who cares how it/they got in. It’s all about Detection and Response these days. • So let’s take a look at what they did and what kind of noise they made • First and foremost, BlackPoS/Kaptoxa/Dexter is NOT a sophisticated malware. We need to understand that just because it stole Credit Card numbers, it is not NSA/Govt grade malware
You could catch CryptoLocker
You can catch Malwarians
Windows Logging
Four Sections • Enable – You have to turn it because Microsoft didn’t do it for you • Configure – You have to configure it as there are options and Microsoft didn’t do it for you • Gather – Collect log info via the command line • Harvest – Now we’re talking… Splunk baby, though you can use any log management or SIEM solution
Where to get things • Map a drive to: – 172.20.99.96DATA – Username: BSides – Password: Austin • Copy these directories to your computer: – Cheat Sheet – Scripts – Agent – Logs
• 1. If you did not sign up for the BSides Austin Conference, you will not be allowed to attend – Sorry, but this is how we pay for the room, strictly enforced - sorry. • 2. You will need some type of Windows 7, Server 2008 or later Windows OS. • 3. You will need to alter the Local Security Policy and Advanced Auditing of your Windows OS. So if it is a work issued laptop under Group Policy restrictions, ask your IT folks if they can remove them the day prior to the training. If not.. Read #4 • 4. If you are paranoid and do not want to alter your laptop settings then these are other options you can do. You are on your own for this step, no help will be provided. • a. Dual Boot into a throw away Win 7/Server 2008/Server 2012 image All changes can be easily undone. • b. Use VMWare of Virtual Box to build a VM and use that • c. Create an Amazon AWS Account and use their FREE Windows Server 2008/2012 option and RDP into that system • d. Of course you can use your regular system, we won’t break anything, you can uninstall the agent and reverse the settings that we will tweak. So take screen shots of what the settings are or use AuditPol to capture them before we tweak them. This step we will do in class.
• 5. We will be doing command line gathering as well and showing you tips and tricks as many do not have a Log Management solution. We will talk about other agents and Logging options. • 6. If you have a MAC or Linux system – See #4 If you have a MAC or Linux system – See #4 Sign up for a Splunk Storm account (www.SplunkStorm.com). This is a FREE Cloud service from Splunk that we will be able to send your log data to so you can see how to use a real log management solution over the command line options we will do in class. I will be demonstrating what you can find in your logs using Splunk to make it easier to understand. Again, you can delete the Log data in Splunk Storm after the training, so no need to be paranoid on what your log data will contain. • 7. Install the Splunk Universal Forwarder – Get your Splunk Storm Account 1st! you need a key. Use verions 5.x (splunkforwarder-5.0.X-163460-x64-release.msi) NOT the latest version 6.x. Splunk Storm has instructions on how to do this or wait for the class. We will walk through the agent install early on. You can find the Agent at: • a. http://www.splunk.com/page/previous_releases • b. How to install the agent - http://docs.splunk.com/Documentation/Storm/Storm/User/Setupauniversalforwa rderonWindows
Splunk Storm • You need an account to Harvest logs. • Splunk Storm will be our SIM/SIEM/LMS • If you don’t want to send your logs to the Cloud… then you will watch or go home early • www.SplunkStorm.com
Let’s get the agent collecting • Agent install – Launch the installer • Pay attention to the server – This is for the Instructor, yours will vary – udp.h7vj-kx2k.data.splunkstorm.com – Port 48784 • In about 15 mins you should see some data • We will check back.
Let’s get into it • The Goal… What do I want you to learn? • To Catch BlackPoS, Kaptoxa or Dexter – Stuxnet, Duqu, Flamer, WinNTI too • Yes, yes you can • It is/was NOT sophisticated malware like they would like you to believe, I have seen better
We need a Picture of a Network Network Diagrams from McAfee and Brian Krebs Patient 0 Where they jump from
What did they do? • BlackPos/Kaptoxa & Dexter – Used the Run Key to launch malware (older version) – Modifies other Reg keys – Drops a .DLL in the system32 folder – Uses Logs to record CC data (.log, .tmp, .dll) – Connects outbound to the Internet – Connects from one machine to another • Obviously in memory components, but we can’t Log that, or can we?
BlackPoS / Kaptoxa • Connects from Patient 0 to the PoS System – Share via Port 445 • Login with some account (Best1_user) – Network login Type 3 • Executed commands to infect – Cmd.exe, Net.exe, psexec, psexecsvc • And the malware – Bladelogic.exe’ or ‘POSWDS.EXE’
BlackPoS / Kaptoxa • Drops files – Msxml.dll – actually not a .DLL (CC Log file) – in C:windowssystem32, with the malware • Logs – C:windowssystem32Winxml.dll • Collected Credit Card Logs – FTP.exe – C:WindowsTwain_32 – Twain_32.dll • In the end, this is a lot of noise and we can detect and respond to this information
US-CERT has the answer • US-CERT – TA14-002A • Anyone think this is a good solution?
In Summary • Malware is noisy • We can detect it • Logs can hold all types of information – It’s NOT just for Forensics anymore • All we have to do is: – Enable the Logs – Configure the Logs – Gather the Logs – Harvest the Logs
LOGGING OVERVIEW
Logging Overview Log Management consists of these components 1. A system with logs 2. A Log agent 3. A Log collector 4. A Log Management solution 1. Manual, Syslog 2. Application 3. SIEM
Local Logging • Turn it on, disks are no where near full • Systems are capable of a lot more than you think. • It’s FUD to think you can’t enable local logging • CPU’s are fast enough now • If you are limited in space, use Syslog to send off the system (network devices, etc.) • Syslog is a de-facto standard built into most everything. Use it
Logging Agents *NIX • syslog-ng • rsyslog • RELP • OSSEC • Splunk
Logging Agents Windows • Syslog of course • rsyslog server • uberAgent for Splunk • Snare • Splunk Universal Forwarder • NTsyslog • nxlog • syslog-ng for Windows • OSSEC • https://code.google.com/p/eventlog-to-syslog/ • PowerShell scripts
• Ready for something BRAND SPANKING new?
Introducing the… Windows Logging Service WLS
Log Management Solutions • Way too many to cover • But you know I love (Pssst – Look around) • And we will get to play with it ! • FREE!!!!!
Get out your Cheat Sheets
ENABLE
Prepare • Disk space !!!! Lots of it – Indexing will be your best friend – Meaning collect ONLY what you need, toss the rest • Most likely you have big enough disks locally – Collect as much as you can – Windows will roll a Security log in 2 hours or less, minutes if you log Windows Firewall • So where are the Windows Logs? – C:WindowsSystem32winevtLogs MalwareArchaeology.com
Enable
Let’s change some settings • Open Event Viewer and follow along • Open up the Local Security
DNS & DHCP
Enable
CONFIGURE
Did I say Windows SUCKS by default? • Legacy Audit Settings
Windows logging workshop - BSides Austin 2014
Windows logging workshop - BSides Austin 2014
Windows logging workshop - BSides Austin 2014
Windows logging workshop - BSides Austin 2014
AuditPol • I have a script for you… • DataScripts – Set_Audit_Pol.cmd • Open it up and take a look • Adjust as necessary
File Auditing
File Auditing • Lets set some File Auditing • Explorer… • PowerShell command line • Some Windows utilities
Registry Auditing
Registry Auditing • Lets set some Registry Auditing • RegEdt32… • PowerShell command line • Some Windows utilities
Like to read? • Lacks the details we are now discussing
Legacy Windows (XP, 2003) Audit Policy Security Setting Audit account logon events Success, Failure Audit account management Success, Failure Audit directory service access Failure Audit logon events Success , Failure Audit object access Failure Audit policy change Success Audit privilege use Failure Audit process tracking No auditing Audit system events Success DISA STIG Auditing Policies Recommendation for Legacy Systems (XP, 2003 and earlier) Me thinks this is missing something… DISA STIG Auditing Policies Recommendation for Legacy Systems (XP, 2003 and earlier)
Powershell • It’s nice to know Powershell executed, but we REALLY want to see what was executed • Again, Windows SUCKS by default • Details on setting PowerShell Preference variables – http://technet.microsoft.com/en-us/library/hh847796.aspx • Run this command on each computer – $LogCommandHealthEvent = $true – $LogCommandLifecycleEvent = $true • Splunk - Inputs.conf – # Windows platform specific input processor – [WinEventLog://Windows PowerShell] – disabled = 0
Powershell Command Line Command Line basics for auditing • https://chapters.theiia.org/lansing/Documents/Command%20Line%20Bas ics%20for%20IT%20Auditors.pdf How to Gather logs with Powershell • http://blogs.technet.com/b/heyscriptingguy/archive/2011/01/24/use- powershell-cmdlet-to-filter-event-log-for-easy-parsing.aspx File System Security PowerShell Module 2.0 http://gallery.technet.microsoft.com/scriptcenter/1abd77a5-9c0b-4a2b-acef- 90dbb2b84e85. Get-Item C:Windows | Add-Audit -Account "NT AuthorityEveryone" -AccessRights Delete -AppliesTo ThisFolderSubfoldersAndFiles http://gallery.technet.microsoft.com/scriptcenter/1abd77a5-9c0b-4a2b-acef- 90dbb2b84e85 The old iCacls or subinacls used to do it in Win XP and earlier…
Windows 8.1 • It’s nice to know cmd.exe executed, but we REALLY want to see what was executed. It would be better if we could see what was executed with svchost.exe! • Again, Windows SUCKS by default, even Windows 8.1 – I do think this is the K3wlest feature in Windows 8.1 • Set GPO – Administrative TemplatesSystemAudit Process Creation – "Include command line in process creation events“ – http://technet.microsoft.com/en-us/library/dn535776.aspx • Registry Key – SoftwareMicrosoftWindowsCurrentVersionPoliciesSystemAuditProcessCreati onIncludeCmdLine_Enabled to DWORD - 1
Windows 8.1 CMD line details!
GATHER
Windows Event Utility WEvtUtil.exe – Command line tool to view logs. • Help - WEvtUtil /? /c:<count> Return a specified count of event log entries. If omitted, you’ll get everything. /c:5 /rd:<True|False> Reverse Direction. By default entries are returned oldest first. When set to True you’ll get newest entries first. /rd:true /f:<Text|XML|RenderedXML> The default output format is XML. Set this to Text; easier to read output. /f:text /r:<computername> Specify the name of a remote computer. /r:server01 /u:<username> The user account to connect to the remote system /u:Best1_usr /p:<password> The user account password to connect to the remote system /p:BreachMe
Let’s take a look
Let’s Play
Let’s Look at Event Viewer • Filter Current Log • Use XML tab to feed your command line
Windows Event Utility • You can use the Event Log “Filter Current Log” to build a query and by viewing the XML copy and paste into the command line or save the XML results and execute at the command line. • wevtutil qe Login_query.txt /sq:true /c:50 • Using WEvtUtil – http://www.petri.co.il/command-line-event-log.htm
What to monitor for 1. Administrator/Root/Guest login attempts 2. C$ logins workstations 3. C$ logins servers 4. Net.exe use, Net1.exe 5. Cscript.exe, PSExec.exe 6. IPConfig, NetStat 7. Database alerts 8. Disabled Acct login attempts 9. DNS Names surfing out from servers not in known list 10. FTP from servers and workstations HackerHurricane.com 11. Group membership changes 12. Certain share accessed 13. Systems without logging agents of various kinds 14. OWA logins 15. RDP logins 16. Services installed servers, workstations noisy 17. Success logins for certain accounts 18. Suspicious files being executed 19. VPN logins 20. Unknown processes
Go Ahead and execute these on your system • Open a command prompt and execute the following: – Net view – IPConfig – You have already connected to the Server share – RDP to the server – Add a user to your system – Change a user membership – Execute some utilities you have
DHCP • Lab • Look at a Sample DHCP Log • What you are looking for: ID Date Message IP System Name MAC 10,02/17/14,10:53:24,Assign,10.1.2.3,US6575496-7001.domain.us.boo.hack.com,A44E31118A40,,538664179,0,,,
DHCP Logs
DNS • DNS - Internal Source IP to Domain/IP - Last hour • DNS - Known Bad IP's - ALL TIME DNS - RegEx IP and Record - Last Hour • DNS - SRV - Names not resolving • DNS - WS - Systems where hostname does not match Computer Name - Last 30 days
DNS Logs • Lab • Look at Sample DNS Log – Wht can you find ?
DNS Logs
IIS • IIS - 2003 - Details of connections - Last day • IIS - 2003 - POST Attempts (BAD) - Last 7 days • IIS - 2008 & Later - Details of connections - Last day • IIS - 2008 & Later - POST attempts (BAD) - All Time • IIS - 2008 & Later - POST attempts (BAD) - Last 7 days • IIS - DFSrvWeb2 Timer_ Errors - All Time • IIS - ERRORS - DFSrvWeb2 Timer_ Errors - All Time • IIS - ERRORS - Internal system - URL Not Found - Last 24 hours • IIS - HACKING - Count of Dest_URL by Country (400 series errors) - Last 30 days • IIS - HACKING - External IP - BadRequest & Forbidden (400 series errors) - Last 24 hours • IIS - HACKING - External IP trying for PAGE NOT FOUND (400 series errors) - Last 24 hours • IIS - Service Pages being called (All .SVC) - All Time • IIS - W3SVCxxxxxxxx - Odd Requests - Last 30 days
IIS Logs • Lab • Look at a Sample IIS Log
IIS Logs – w00t w00t
IIS Logs
IIS Logs – China Calling
HARVEST
• Time for some Splunkage • Let’s see what you can find • First let’s look at a populated Splunk setup • Open your Splunk Storm console
Populate your Splunk • Use the Cheat Sheet • Look for some things • Do things to populate it • You can do this after the Workshop, it is your Splunk Storm account
Log Clear, Tasks, Drivers, OS Version
Processes, Installer, Windows Update, Windows Time, Application Errros
Accounts, Audit Policy, AppLocker
Services
New Files Added, Logon Type
Windows Firewall, Email/VPN
System Integrity, Registry
Incident Response & IT • IR - DNS - Filtered Internal Source IP to Domain/IP - BY USER IP - Last hour • IR - List of INBOUND and OUTBOUND connections from/to a system Last 24 hours • IR - List of INBOUND connections from the INTERNET to a system - Last 24 hours • IR - List of INBOUND connections to a system - Last 24 hours • IR - List of OUTBOUND to the Internet connections from/to a system Last 24 hours • IR - Processes - What process is calling what program - Last 15 mins • IR - SRV - XYZ - User Modified Files on FileServerX > 1000 DELETES in an hour • IR - SRV - XYZ - User Modified Files on FileServerX > 1000 Write/Adds in an hour • IR - SRV - XYZ - User Modified Files on FileServerX > 1000 Write/Adds in an hour - LONG LIST • IR - WHO is doing WHAT on a system • IT - User Logon & Email Activity Report - Specify Period • IT - User Processes Activity Report - Specify Period
Where did they go?
Event - Spreadsheet 93
Monitor Accounts • Account - Attempt to change Account Password - Last 24 hours • Account - Domain Connection issue - Last 24 hours • Account - Failed Guest and Administrator Logins - Last 24 hours • Account - Local Group changed - Last 30 days • Account - Logon Type by Count - Last 24 hours • Account - Logon by Type 8 - CLEAR TEXT Login - Last 24 hours • Account - Logon by Type 10 - RDP Login - Last 24 hours • Account - Logon by Type - Last 15 mins • Account - SRV - Successful Logins of NON-User Accounts - Last hour • Account - User Account Attempted Password Change - Last 7 days • Account - User Account DELETED - Last 7 days • Account - User Account ENABLED - Last 7 days • Account - User Account Locked Out - Last 24 hours • Account - User Account Password changed - Last 7 days • Account - User Account UNLOCKED - Last 7 days • Account - User Account password reset - last 7 days • Account - User Account was DISABLED - Last 30 days • Account - User failed to logon - Last 24 hours • Account - User locked out of domain - Last 24 hours • Account - User successfully logged on - Last hour • Account - User successfully logged on - NOT Exchange - Last hour • Account - User successfully logged on Exchange - Last hour • Account - WS/SRV - Account failed to logon - Last 24 hours • Account - WS/SRV - Account login with explicit credentials - Last 24 hours • Account - WS/SRV - User added to group - Last 24 hours
Lots more • Application Crash - Application Error - Last 24 hours • Application Crash - Windows Error Reporting - Last hour • Audit Policy - SRV - Audit Policy changed - Last 24 hours • Audit Policy - WS - Audit Policy changed - Last 7 days • Client - DC Issue with distant clients contacting a DC - Last 24 hours • Commands - Registry related commands executed - Last hour • Commands - SRV - CScript.exe executed - By Count - Last 30 days • Commands - SRV - Net.exe Net1.exe used - By COUNT - Last 24 hours • Commands - SRV - Net.exe Net1.exe used - Last 24 hours • Commands - SRV - Schtasks and AT executed - Last 30 day • Commands - Suspicious commands being executed - Last 24 hours • Commands - WS - CScript.exe executed - By Count - Last 30 days • Commands - WS - Net.exe Net1.exe used - Last 24 hours • Commands - WS - Schtasks and AT executed - Last 30 day • DNS - Internal Source IP to Domain/IP - Last hour • DNS - Known Bad IP's - ALL TIME DNS - RegEx IP and Record - Last Hour • DNS - SRV - Names not resolving • DNS - WS - Systems where hostname does not match Computer Name - Last 30 days • Driver - Issue with driver - last 24 hours
And more • Exchange - Mail Server having issues • Exchange - Successful Webmail Logon Count by IP • Exchange - Successful Webmail logins • Exchange - Failed Email delivery - Last hour • Exchange - Failed Mobile device email login > 10 last hour • Exchange - Failed OWA login last hour • Exchange - Failed Email delivery - Last hour • Exchange - Failed Mobile device email login > 10 last 24 hours • Exchange - Failed Mobile device email login > 10 last hour • Exchange - Failed OWA login last 24 hours • Exchange - Failed OWA login last hour • Executables - SRV - New File dropped in monitored locations - Last 30 days • Executables - WS - New File dropped in monitored locations - Last 30 days • GPO - Group Policy Failed - Last 7 days
Yet more • Kerberos - List of Kerberos tickets - Last 24 hours • Logs - SRV - Cleared - Last 7 days • Logs - SRV - Logs low on events - Last 24 hours • Logs - WS - Cleared - Last 7 days • Logs - WS - Logs low on events - Last 24 hours • SRV - Files Modified on ServerX - Last 4 hours • NTFS - NTFS Error - Last 7 days • OS Version - SRV - What OS, SP, CPU type - Last 30 days • OS Version - WS - What OS, SP, CPU type - Last 30 days • Firewall - Threats - Last Hour • Firewall - Traffic - Last Hour • Printing - Printer Failed - Last 30 days • Privileged Object - SRV - Last 24 hours • Privileged Object - WS - Last 24 hours • Processes - SRV - New Process being launched - Last 60 mins • Processes - WS - New Process being launched - Last 60 mins
Product, Registry & SNMP • Product - SRV - Installation Started - Last Day • Product - SRV - Installation Status All - Last Day • Product - SRV - Installation Status OTHER - Last 30 Days • Product - SRV - Windows Installer Status - Last Day • Product - SRV - Windows Update - Last 24 hours • Product - WS - Installation Started - Last Day • Product - WS - Installation Status All - Last Day • Product - WS - Installation Status OTHER - Last 30 Days • Product - WS - Windows Installer Status - Last Day • Product - WS - Windows Update - Last 24 hours • Registry - Key Changed - Last 24 hours • Registry - Key value Add, Change, Delete - Last 24 hours • Registry - Run & RunOnce Key value Add, Change, Delete - Last 24 hours • SNMP - SNMP Service Config updated - Last 7 days
Services & Shares • Service - SRV - Issues with startup or failure - Last 24 hours • Service - SRV - New SERVICE Installed - Last Hour • Service - SRV - SERVICE state changed 'to disabled' - Last 24 hours • Service - SRV - Service Failed to Start - last 7 days • Service - State - Startup or Failure - Last 24 hours • Service - WS - Issues with startup or failure - Last 24 hours • Service - WS - New SERVICE Installed - Last Hour • Service - WS - SERVICE state changed 'to disabled' - Last 24 hours • Service - WS - Service Failed to Start - last 7 days • Shares - WS - C$ Share being accessed - Last 24 hours • Shares - WS - C$ or Admin$ Share accessed - Last 24 hours
And Finally • System Integrity - SRV - File Hash are not valid - Last 24 hours • System Integrity - WS - File Hash are not valid - Last 24 hours • Tasks - New Task Scheduled - Last Hour • Tasks - Task Scheduled Created, Changed or Deleted - Last Hour • Time - SRV - Time Service sync details - Last 24 hours • Time - SRV - When a system rebooted - last 24 hours • Time - WS - Time Service sync details - Last 24 hours • Time - WS - When a system rebooted - last 24 hours • USB - Status of USB drives used - Last 7 days • VPN - FAILED logins Last Hour VPN - Successful logins Last Hour • WinRM - SRV - WinRM Service status - Last 30 days • WinRM - WS - WinRM Service status - Last 30 days
Resources • Our Website – www.MalwareArchaeology.com • The Handout – Windows Logging Cheat Sheet
Questions? • You can find us at: • Michael@MalwareArchaeology.com • @HackerHurricane • www.MalwareArchaeology.com • Yes – We do consulting ;-)

More Related Content

PDF
Ask a Malware Archaeologist
Michael Gough
 
PDF
Info sec is not daunting v1.0
Michael Gough
 
PDF
Logs, Logs, Logs - What you need to know to catch a thief
Michael Gough
 
PDF
Proper logging can catch breaches like retail PoS
Michael Gough
 
PDF
Finding attacks with these 6 events
Michael Gough
 
PDF
Logging for Hackers - What you need to know to catch them
Michael Gough
 
PDF
Secure Yourself, Practice what we preach - BSides Austin 2015
Michael Gough
 
PDF
Deeplook into apt and how to detect and defend v1.0
Michael Gough
 
Ask a Malware Archaeologist
Michael Gough
 
Info sec is not daunting v1.0
Michael Gough
 
Logs, Logs, Logs - What you need to know to catch a thief
Michael Gough
 
Proper logging can catch breaches like retail PoS
Michael Gough
 
Finding attacks with these 6 events
Michael Gough
 
Logging for Hackers - What you need to know to catch them
Michael Gough
 
Secure Yourself, Practice what we preach - BSides Austin 2015
Michael Gough
 
Deeplook into apt and how to detect and defend v1.0
Michael Gough
 

What's hot (20)

PDF
Commodity malware means YOU
Michael Gough
 
PDF
Logging for Hackers v1.0
Michael Gough
 
PDF
Windows logging cheat sheet
Michael Gough
 
PDF
Windows Registry Auditing Cheat Sheet ver Oct 2016 - MalwareArchaeology
Michael Gough
 
PDF
RMISC logging for hackers
Michael Gough
 
PDF
MW_Arch Fastest_way_to_hunt_on_Windows_v1.01
Michael Gough
 
PDF
Windows splunk logging cheat sheet Oct 2016 - MalwareArchaeology.com
Michael Gough
 
PDF
Detecting WMI Exploitation v1.1
Michael Gough
 
PDF
You need a PROcess to catch running processes and their modules_v2.0
Michael Gough
 
PDF
Windows IR made easier and faster v1.0
Michael Gough
 
PDF
Sandbox vs manual malware analysis v1.1
Michael Gough
 
PDF
Logging for hackers SAINTCON
Michael Gough
 
PDF
Mw arch mac_tips and tricks v1.0
Michael Gough
 
PDF
Malware Management - HouSecCon 2014
Michael Gough
 
PDF
InnoTech 2017_Defend_Against_Ransomware 3.0
Michael Gough
 
PDF
What can you do about ransomware
Michael Gough
 
PDF
BSidesOK_You_CAN_detect_PowerShell_attacks_v1.1
Michael Gough
 
PDF
Windows Incident Response is hard, but doesn't have to be
Michael Gough
 
PDF
Windows Logging Cheat Sheet ver Jan 2016 - MalwareArchaeology
Michael Gough
 
PDF
The top 10 windows logs event id's used v1.0
Michael Gough
 
Commodity malware means YOU
Michael Gough
 
Logging for Hackers v1.0
Michael Gough
 
Windows logging cheat sheet
Michael Gough
 
Windows Registry Auditing Cheat Sheet ver Oct 2016 - MalwareArchaeology
Michael Gough
 
RMISC logging for hackers
Michael Gough
 
MW_Arch Fastest_way_to_hunt_on_Windows_v1.01
Michael Gough
 
Windows splunk logging cheat sheet Oct 2016 - MalwareArchaeology.com
Michael Gough
 
Detecting WMI Exploitation v1.1
Michael Gough
 
You need a PROcess to catch running processes and their modules_v2.0
Michael Gough
 
Windows IR made easier and faster v1.0
Michael Gough
 
Sandbox vs manual malware analysis v1.1
Michael Gough
 
Logging for hackers SAINTCON
Michael Gough
 
Mw arch mac_tips and tricks v1.0
Michael Gough
 
Malware Management - HouSecCon 2014
Michael Gough
 
InnoTech 2017_Defend_Against_Ransomware 3.0
Michael Gough
 
What can you do about ransomware
Michael Gough
 
BSidesOK_You_CAN_detect_PowerShell_attacks_v1.1
Michael Gough
 
Windows Incident Response is hard, but doesn't have to be
Michael Gough
 
Windows Logging Cheat Sheet ver Jan 2016 - MalwareArchaeology
Michael Gough
 
The top 10 windows logs event id's used v1.0
Michael Gough
 
Ad

Similar to Windows logging workshop - BSides Austin 2014 (20)

PDF
Proper logging can catch breaches like retail PoS
Michael Gough
 
PDF
Can_We_Really_Detect_These_So_Called_Sophisticated_Attacks?
Michael Gough
 
PDF
PHDays 2018 Threat Hunting Hands-On Lab
Teymur Kheirkhabarov
 
PPTX
Threat Hunting with Splunk
Splunk
 
PPTX
Threat Hunting with Splunk
Splunk
 
PPTX
Threat Hunting with Splunk
Splunk
 
PPT
Intrusion Discovery on Windows
dkaya
 
PDF
JAKU Botnet Analysis
Napier University
 
PPTX
Power of logs: practices for network security
Information Technology Society Nepal
 
PPT
Logs for Incident Response and Forensics: Key Issues for GOVCERT.NL 2008
guestc0c304
 
PPT
Logs for Incident Response and Forensics: Key Issues for GOVCERT.NL 2008
Anton Chuvakin
 
PDF
My InfoSec journey led me to create my own IR tools, how, and why you should too
Michael Gough
 
PDF
Sophisticated Attacks - Can We Really Detect Them _v1.2.pdf
Michael Gough
 
PPTX
Adversary tactics config mgmt-&amp;-logs-oh-my
Jesse Moore
 
PPT
FIRST 2006 Full-day Tutorial on Logs for Incident Response
Anton Chuvakin
 
PDF
BSidesPGH 2019
BrianGardiner12
 
PPTX
Federal Compliance with Splunk on Hetergeneous Networks (Splunk User Conferen...
Daniel O'Donnell
 
PPT
Best practises for log management
Brian Honan
 
PPTX
Splunk Enterprise for Information Security (Hands-On)
Splunk
 
PPTX
Splunk Enterpise for Information Security Hands-On
Splunk
 
Proper logging can catch breaches like retail PoS
Michael Gough
 
Can_We_Really_Detect_These_So_Called_Sophisticated_Attacks?
Michael Gough
 
PHDays 2018 Threat Hunting Hands-On Lab
Teymur Kheirkhabarov
 
Threat Hunting with Splunk
Splunk
 
Threat Hunting with Splunk
Splunk
 
Threat Hunting with Splunk
Splunk
 
Intrusion Discovery on Windows
dkaya
 
JAKU Botnet Analysis
Napier University
 
Power of logs: practices for network security
Information Technology Society Nepal
 
Logs for Incident Response and Forensics: Key Issues for GOVCERT.NL 2008
guestc0c304
 
Logs for Incident Response and Forensics: Key Issues for GOVCERT.NL 2008
Anton Chuvakin
 
My InfoSec journey led me to create my own IR tools, how, and why you should too
Michael Gough
 
Sophisticated Attacks - Can We Really Detect Them _v1.2.pdf
Michael Gough
 
Adversary tactics config mgmt-&amp;-logs-oh-my
Jesse Moore
 
FIRST 2006 Full-day Tutorial on Logs for Incident Response
Anton Chuvakin
 
BSidesPGH 2019
BrianGardiner12
 
Federal Compliance with Splunk on Hetergeneous Networks (Splunk User Conferen...
Daniel O'Donnell
 
Best practises for log management
Brian Honan
 
Splunk Enterprise for Information Security (Hands-On)
Splunk
 
Splunk Enterpise for Information Security Hands-On
Splunk
 
Ad

More from Michael Gough (13)

PDF
Hacking a backup power solution(s) for your home, Tornado tested!
Michael Gough
 
PPTX
Incident Response Fails
Michael Gough
 
PDF
When Security Tools Fail You
Michael Gough
 
PDF
Introducing ArTHIR - ATT&CK Remote Threat Hunting Incident Response Windows tool
Michael Gough
 
PDF
MITRE AttACK framework it is time you took notice_v1.0
Michael Gough
 
PDF
You can detect PowerShell attacks
Michael Gough
 
PDF
Cred stealing emails bsides austin_2018 v1.0
Michael Gough
 
PDF
EDR, ETDR, Next Gen AV is all the rage, so why am I ENRAGED?
Michael Gough
 
PDF
Email keeps getting us pwned - Avoiding Ransomware and malware
Michael Gough
 
PDF
Email keeps getting us pwned v1.1
Michael Gough
 
PDF
DIR ISF - Email keeps getting us pwned v1.1
Michael Gough
 
PDF
Email keeps getting us pwned v1.0
Michael Gough
 
PDF
Sandbox vs manual analysis v2.1
Michael Gough
 
Hacking a backup power solution(s) for your home, Tornado tested!
Michael Gough
 
Incident Response Fails
Michael Gough
 
When Security Tools Fail You
Michael Gough
 
Introducing ArTHIR - ATT&CK Remote Threat Hunting Incident Response Windows tool
Michael Gough
 
MITRE AttACK framework it is time you took notice_v1.0
Michael Gough
 
You can detect PowerShell attacks
Michael Gough
 
Cred stealing emails bsides austin_2018 v1.0
Michael Gough
 
EDR, ETDR, Next Gen AV is all the rage, so why am I ENRAGED?
Michael Gough
 
Email keeps getting us pwned - Avoiding Ransomware and malware
Michael Gough
 
Email keeps getting us pwned v1.1
Michael Gough
 
DIR ISF - Email keeps getting us pwned v1.1
Michael Gough
 
Email keeps getting us pwned v1.0
Michael Gough
 
Sandbox vs manual analysis v2.1
Michael Gough
 

Recently uploaded (20)

PDF
Mushroom cultivation and it's methods.pdf
mailmeonrishi
 
PDF
Profit Center Accounting in SAP S/4HANA, S4F28 Col11
Libreria ERP
 
PDF
ENT215_Completing-a-large-scale-migration-and-modernization-with-AWS.pdf
ssuser28425f
 
PDF
Approach and Philosophy of On baking technology
30anthuong17
 
PDF
Assigned Numbers - 2025 - Bluetooth® Document
Bloombase
 
PDF
gpt5_lecture_notes_comprehensive_20250812015547.pdf
Chinchu40
 
PPTX
A Presentation on Artificial Intelligence
memembruh336
 
PDF
Hybrid model detection and classification of lung cancer
IAESIJAI
 
PPTX
TLE Review Electricity (Electricity).pptx
JayPolicarpio2
 
PPTX
KOM of Painting work and Equipment Insulation REV00 update 25-dec.pptx
muhammadmuneebnaeem7
 
PDF
NewMind AI Weekly Chronicles - August'25-Week II
NewMind AI
 
PDF
project resource management chapter-09.pdf
ssuser00e6e21
 
PPTX
Digital-Transformation-Roadmap-for-Companies.pptx
David Malick Dieng
 
PPTX
Group 1 Presentation -Planning and Decision Making .pptx
MatthewLewis227954
 
PPTX
Tartificialntelligence_presentation.pptx
ry7r52mzb4
 
PDF
Unlocking AI with Model Context Protocol (MCP)
Brian McKeiver
 
PDF
Transform Your ITIL® 4 & ITSM Strategy with AI in 2025.pdf
PDCA Consulting
 
PDF
Zenith AI: Advanced Artificial Intelligence
Biz Preneurs
 
PDF
Enhancing emotion recognition model for a student engagement use case through...
IAESIJAI
 
PDF
A novel scalable deep ensemble learning framework for big data classification...
IAESIJAI
 
Mushroom cultivation and it's methods.pdf
mailmeonrishi
 
Profit Center Accounting in SAP S/4HANA, S4F28 Col11
Libreria ERP
 
ENT215_Completing-a-large-scale-migration-and-modernization-with-AWS.pdf
ssuser28425f
 
Approach and Philosophy of On baking technology
30anthuong17
 
Assigned Numbers - 2025 - Bluetooth® Document
Bloombase
 
gpt5_lecture_notes_comprehensive_20250812015547.pdf
Chinchu40
 
A Presentation on Artificial Intelligence
memembruh336
 
Hybrid model detection and classification of lung cancer
IAESIJAI
 
TLE Review Electricity (Electricity).pptx
JayPolicarpio2
 
KOM of Painting work and Equipment Insulation REV00 update 25-dec.pptx
muhammadmuneebnaeem7
 
NewMind AI Weekly Chronicles - August'25-Week II
NewMind AI
 
project resource management chapter-09.pdf
ssuser00e6e21
 
Digital-Transformation-Roadmap-for-Companies.pptx
David Malick Dieng
 
Group 1 Presentation -Planning and Decision Making .pptx
MatthewLewis227954
 
Tartificialntelligence_presentation.pptx
ry7r52mzb4
 
Unlocking AI with Model Context Protocol (MCP)
Brian McKeiver
 
Transform Your ITIL® 4 & ITSM Strategy with AI in 2025.pdf
PDCA Consulting
 
Zenith AI: Advanced Artificial Intelligence
Biz Preneurs
 
Enhancing emotion recognition model for a student engagement use case through...
IAESIJAI
 
A novel scalable deep ensemble learning framework for big data classification...
IAESIJAI
 

Windows logging workshop - BSides Austin 2014

  • 1. Windows Logging Workshop You could have and SHOULD have caught the Target Breach! Michael Gough – Founder MalwareArchaeology.com
  • 2. Why are we here • Someone got P0wned • Windows SUCKS by default • The Target breach came after we planned on doing this… but it SO helps to understand why we need to do this. • To show you how to catch APT type attacks
  • 3. Avecto Study – Admin = P0wnage
  • 4. When and from Where? Jan 2011 Feb 2011 Mar 2011 Apr 2011 May 2011 June 2011 July 2011 123 45 6 7 1234567 89 1011 12 1 8 2 9 3456789101112 10111213141516171819202122 13 2324252627 13 28293031323334 14 3536 15 37383940414243444546 16 47 17 4849 18 19 20 2122 23 24 25 26 272829 30 Hackers Company Contractor 505152 31 3233 34 35 36 3738 39 40 41 4243 4445464748 49 50 53 515253 54555657585960 14 545556575859 61 60616263 6263 646566676869707172737475767778 64 7980 System Recovered Successful Logons – Jan 4, 2011 to July 6, 2011 Typical Windows system on the internet with port 3389 open – Password brute forced/guessed HackerHurricane.com
  • 5. The Malware Management Framework • This presentation, and many more we do is because we all need to start practicing Malware Management. • Analyze the information in Malware reports wherever you can find it • Use this Intel to feed into your security tools • Use this Intel to feed into your logging solution and learn what to log for. www.MalwareManagement.org
  • 6. Malware Management Understand what the latest malware is doing • Files being used • Location of files • Registry Keys • URL’s being used • IP’s being used • Behavior details, processes, traffic, etc. • Understand basically what the malware is doing
  • 11. How cute, they tried • Hey X-Force… You have a tool called BigFix
  • 14. Prevention has failed, or will • Like I always say “We will give up the endpoint”, who cares how it/they got in. It’s all about Detection and Response these days. • So let’s take a look at what they did and what kind of noise they made • First and foremost, BlackPoS/Kaptoxa/Dexter is NOT a sophisticated malware. We need to understand that just because it stole Credit Card numbers, it is not NSA/Govt grade malware
  • 15. You could catch CryptoLocker
  • 16. You can catch Malwarians
  • 18. Four Sections • Enable – You have to turn it because Microsoft didn’t do it for you • Configure – You have to configure it as there are options and Microsoft didn’t do it for you • Gather – Collect log info via the command line • Harvest – Now we’re talking… Splunk baby, though you can use any log management or SIEM solution
  • 19. Where to get things • Map a drive to: – 172.20.99.96DATA – Username: BSides – Password: Austin • Copy these directories to your computer: – Cheat Sheet – Scripts – Agent – Logs
  • 20. • 1. If you did not sign up for the BSides Austin Conference, you will not be allowed to attend – Sorry, but this is how we pay for the room, strictly enforced - sorry. • 2. You will need some type of Windows 7, Server 2008 or later Windows OS. • 3. You will need to alter the Local Security Policy and Advanced Auditing of your Windows OS. So if it is a work issued laptop under Group Policy restrictions, ask your IT folks if they can remove them the day prior to the training. If not.. Read #4 • 4. If you are paranoid and do not want to alter your laptop settings then these are other options you can do. You are on your own for this step, no help will be provided. • a. Dual Boot into a throw away Win 7/Server 2008/Server 2012 image All changes can be easily undone. • b. Use VMWare of Virtual Box to build a VM and use that • c. Create an Amazon AWS Account and use their FREE Windows Server 2008/2012 option and RDP into that system • d. Of course you can use your regular system, we won’t break anything, you can uninstall the agent and reverse the settings that we will tweak. So take screen shots of what the settings are or use AuditPol to capture them before we tweak them. This step we will do in class.
  • 21. • 5. We will be doing command line gathering as well and showing you tips and tricks as many do not have a Log Management solution. We will talk about other agents and Logging options. • 6. If you have a MAC or Linux system – See #4 If you have a MAC or Linux system – See #4 Sign up for a Splunk Storm account (www.SplunkStorm.com). This is a FREE Cloud service from Splunk that we will be able to send your log data to so you can see how to use a real log management solution over the command line options we will do in class. I will be demonstrating what you can find in your logs using Splunk to make it easier to understand. Again, you can delete the Log data in Splunk Storm after the training, so no need to be paranoid on what your log data will contain. • 7. Install the Splunk Universal Forwarder – Get your Splunk Storm Account 1st! you need a key. Use verions 5.x (splunkforwarder-5.0.X-163460-x64-release.msi) NOT the latest version 6.x. Splunk Storm has instructions on how to do this or wait for the class. We will walk through the agent install early on. You can find the Agent at: • a. http://www.splunk.com/page/previous_releases • b. How to install the agent - http://docs.splunk.com/Documentation/Storm/Storm/User/Setupauniversalforwa rderonWindows
  • 22. Splunk Storm • You need an account to Harvest logs. • Splunk Storm will be our SIM/SIEM/LMS • If you don’t want to send your logs to the Cloud… then you will watch or go home early • www.SplunkStorm.com
  • 23. Let’s get the agent collecting • Agent install – Launch the installer • Pay attention to the server – This is for the Instructor, yours will vary – udp.h7vj-kx2k.data.splunkstorm.com – Port 48784 • In about 15 mins you should see some data • We will check back.
  • 24. Let’s get into it • The Goal… What do I want you to learn? • To Catch BlackPoS, Kaptoxa or Dexter – Stuxnet, Duqu, Flamer, WinNTI too • Yes, yes you can • It is/was NOT sophisticated malware like they would like you to believe, I have seen better
  • 25. We need a Picture of a Network Network Diagrams from McAfee and Brian Krebs Patient 0 Where they jump from
  • 26. What did they do? • BlackPos/Kaptoxa & Dexter – Used the Run Key to launch malware (older version) – Modifies other Reg keys – Drops a .DLL in the system32 folder – Uses Logs to record CC data (.log, .tmp, .dll) – Connects outbound to the Internet – Connects from one machine to another • Obviously in memory components, but we can’t Log that, or can we?
  • 27. BlackPoS / Kaptoxa • Connects from Patient 0 to the PoS System – Share via Port 445 • Login with some account (Best1_user) – Network login Type 3 • Executed commands to infect – Cmd.exe, Net.exe, psexec, psexecsvc • And the malware – Bladelogic.exe’ or ‘POSWDS.EXE’
  • 28. BlackPoS / Kaptoxa • Drops files – Msxml.dll – actually not a .DLL (CC Log file) – in C:windowssystem32, with the malware • Logs – C:windowssystem32Winxml.dll • Collected Credit Card Logs – FTP.exe – C:WindowsTwain_32 – Twain_32.dll • In the end, this is a lot of noise and we can detect and respond to this information
  • 29. US-CERT has the answer • US-CERT – TA14-002A • Anyone think this is a good solution?
  • 30. In Summary • Malware is noisy • We can detect it • Logs can hold all types of information – It’s NOT just for Forensics anymore • All we have to do is: – Enable the Logs – Configure the Logs – Gather the Logs – Harvest the Logs
  • 32. Logging Overview Log Management consists of these components 1. A system with logs 2. A Log agent 3. A Log collector 4. A Log Management solution 1. Manual, Syslog 2. Application 3. SIEM
  • 33. Local Logging • Turn it on, disks are no where near full • Systems are capable of a lot more than you think. • It’s FUD to think you can’t enable local logging • CPU’s are fast enough now • If you are limited in space, use Syslog to send off the system (network devices, etc.) • Syslog is a de-facto standard built into most everything. Use it
  • 34. Logging Agents *NIX • syslog-ng • rsyslog • RELP • OSSEC • Splunk
  • 35. Logging Agents Windows • Syslog of course • rsyslog server • uberAgent for Splunk • Snare • Splunk Universal Forwarder • NTsyslog • nxlog • syslog-ng for Windows • OSSEC • https://code.google.com/p/eventlog-to-syslog/ • PowerShell scripts
  • 36. • Ready for something BRAND SPANKING new?
  • 38. Log Management Solutions • Way too many to cover • But you know I love (Pssst – Look around) • And we will get to play with it ! • FREE!!!!!
  • 39. Get out your Cheat Sheets
  • 41. Prepare • Disk space !!!! Lots of it – Indexing will be your best friend – Meaning collect ONLY what you need, toss the rest • Most likely you have big enough disks locally – Collect as much as you can – Windows will roll a Security log in 2 hours or less, minutes if you log Windows Firewall • So where are the Windows Logs? – C:WindowsSystem32winevtLogs MalwareArchaeology.com
  • 43. Let’s change some settings • Open Event Viewer and follow along • Open up the Local Security
  • 47. Did I say Windows SUCKS by default? • Legacy Audit Settings
  • 52. AuditPol • I have a script for you… • DataScripts – Set_Audit_Pol.cmd • Open it up and take a look • Adjust as necessary
  • 54. File Auditing • Lets set some File Auditing • Explorer… • PowerShell command line • Some Windows utilities
  • 56. Registry Auditing • Lets set some Registry Auditing • RegEdt32… • PowerShell command line • Some Windows utilities
  • 57. Like to read? • Lacks the details we are now discussing
  • 58. Legacy Windows (XP, 2003) Audit Policy Security Setting Audit account logon events Success, Failure Audit account management Success, Failure Audit directory service access Failure Audit logon events Success , Failure Audit object access Failure Audit policy change Success Audit privilege use Failure Audit process tracking No auditing Audit system events Success DISA STIG Auditing Policies Recommendation for Legacy Systems (XP, 2003 and earlier) Me thinks this is missing something… DISA STIG Auditing Policies Recommendation for Legacy Systems (XP, 2003 and earlier)
  • 59. Powershell • It’s nice to know Powershell executed, but we REALLY want to see what was executed • Again, Windows SUCKS by default • Details on setting PowerShell Preference variables – http://technet.microsoft.com/en-us/library/hh847796.aspx • Run this command on each computer – $LogCommandHealthEvent = $true – $LogCommandLifecycleEvent = $true • Splunk - Inputs.conf – # Windows platform specific input processor – [WinEventLog://Windows PowerShell] – disabled = 0
  • 60. Powershell Command Line Command Line basics for auditing • https://chapters.theiia.org/lansing/Documents/Command%20Line%20Bas ics%20for%20IT%20Auditors.pdf How to Gather logs with Powershell • http://blogs.technet.com/b/heyscriptingguy/archive/2011/01/24/use- powershell-cmdlet-to-filter-event-log-for-easy-parsing.aspx File System Security PowerShell Module 2.0 http://gallery.technet.microsoft.com/scriptcenter/1abd77a5-9c0b-4a2b-acef- 90dbb2b84e85. Get-Item C:Windows | Add-Audit -Account "NT AuthorityEveryone" -AccessRights Delete -AppliesTo ThisFolderSubfoldersAndFiles http://gallery.technet.microsoft.com/scriptcenter/1abd77a5-9c0b-4a2b-acef- 90dbb2b84e85 The old iCacls or subinacls used to do it in Win XP and earlier…
  • 61. Windows 8.1 • It’s nice to know cmd.exe executed, but we REALLY want to see what was executed. It would be better if we could see what was executed with svchost.exe! • Again, Windows SUCKS by default, even Windows 8.1 – I do think this is the K3wlest feature in Windows 8.1 • Set GPO – Administrative TemplatesSystemAudit Process Creation – "Include command line in process creation events“ – http://technet.microsoft.com/en-us/library/dn535776.aspx • Registry Key – SoftwareMicrosoftWindowsCurrentVersionPoliciesSystemAuditProcessCreati onIncludeCmdLine_Enabled to DWORD - 1
  • 62. Windows 8.1 CMD line details!
  • 64. Windows Event Utility WEvtUtil.exe – Command line tool to view logs. • Help - WEvtUtil /? /c:<count> Return a specified count of event log entries. If omitted, you’ll get everything. /c:5 /rd:<True|False> Reverse Direction. By default entries are returned oldest first. When set to True you’ll get newest entries first. /rd:true /f:<Text|XML|RenderedXML> The default output format is XML. Set this to Text; easier to read output. /f:text /r:<computername> Specify the name of a remote computer. /r:server01 /u:<username> The user account to connect to the remote system /u:Best1_usr /p:<password> The user account password to connect to the remote system /p:BreachMe
  • 67. Let’s Look at Event Viewer • Filter Current Log • Use XML tab to feed your command line
  • 68. Windows Event Utility • You can use the Event Log “Filter Current Log” to build a query and by viewing the XML copy and paste into the command line or save the XML results and execute at the command line. • wevtutil qe Login_query.txt /sq:true /c:50 • Using WEvtUtil – http://www.petri.co.il/command-line-event-log.htm
  • 69. What to monitor for 1. Administrator/Root/Guest login attempts 2. C$ logins workstations 3. C$ logins servers 4. Net.exe use, Net1.exe 5. Cscript.exe, PSExec.exe 6. IPConfig, NetStat 7. Database alerts 8. Disabled Acct login attempts 9. DNS Names surfing out from servers not in known list 10. FTP from servers and workstations HackerHurricane.com 11. Group membership changes 12. Certain share accessed 13. Systems without logging agents of various kinds 14. OWA logins 15. RDP logins 16. Services installed servers, workstations noisy 17. Success logins for certain accounts 18. Suspicious files being executed 19. VPN logins 20. Unknown processes
  • 70. Go Ahead and execute these on your system • Open a command prompt and execute the following: – Net view – IPConfig – You have already connected to the Server share – RDP to the server – Add a user to your system – Change a user membership – Execute some utilities you have
  • 71. DHCP • Lab • Look at a Sample DHCP Log • What you are looking for: ID Date Message IP System Name MAC 10,02/17/14,10:53:24,Assign,10.1.2.3,US6575496-7001.domain.us.boo.hack.com,A44E31118A40,,538664179,0,,,
  • 73. DNS • DNS - Internal Source IP to Domain/IP - Last hour • DNS - Known Bad IP's - ALL TIME DNS - RegEx IP and Record - Last Hour • DNS - SRV - Names not resolving • DNS - WS - Systems where hostname does not match Computer Name - Last 30 days
  • 74. DNS Logs • Lab • Look at Sample DNS Log – Wht can you find ?
  • 76. IIS • IIS - 2003 - Details of connections - Last day • IIS - 2003 - POST Attempts (BAD) - Last 7 days • IIS - 2008 & Later - Details of connections - Last day • IIS - 2008 & Later - POST attempts (BAD) - All Time • IIS - 2008 & Later - POST attempts (BAD) - Last 7 days • IIS - DFSrvWeb2 Timer_ Errors - All Time • IIS - ERRORS - DFSrvWeb2 Timer_ Errors - All Time • IIS - ERRORS - Internal system - URL Not Found - Last 24 hours • IIS - HACKING - Count of Dest_URL by Country (400 series errors) - Last 30 days • IIS - HACKING - External IP - BadRequest & Forbidden (400 series errors) - Last 24 hours • IIS - HACKING - External IP trying for PAGE NOT FOUND (400 series errors) - Last 24 hours • IIS - Service Pages being called (All .SVC) - All Time • IIS - W3SVCxxxxxxxx - Odd Requests - Last 30 days
  • 77. IIS Logs • Lab • Look at a Sample IIS Log
  • 78. IIS Logs – w00t w00t
  • 80. IIS Logs – China Calling
  • 82. • Time for some Splunkage • Let’s see what you can find • First let’s look at a populated Splunk setup • Open your Splunk Storm console
  • 83. Populate your Splunk • Use the Cheat Sheet • Look for some things • Do things to populate it • You can do this after the Workshop, it is your Splunk Storm account
  • 84. Log Clear, Tasks, Drivers, OS Version
  • 85. Processes, Installer, Windows Update, Windows Time, Application Errros
  • 88. New Files Added, Logon Type
  • 91. Incident Response & IT • IR - DNS - Filtered Internal Source IP to Domain/IP - BY USER IP - Last hour • IR - List of INBOUND and OUTBOUND connections from/to a system Last 24 hours • IR - List of INBOUND connections from the INTERNET to a system - Last 24 hours • IR - List of INBOUND connections to a system - Last 24 hours • IR - List of OUTBOUND to the Internet connections from/to a system Last 24 hours • IR - Processes - What process is calling what program - Last 15 mins • IR - SRV - XYZ - User Modified Files on FileServerX > 1000 DELETES in an hour • IR - SRV - XYZ - User Modified Files on FileServerX > 1000 Write/Adds in an hour • IR - SRV - XYZ - User Modified Files on FileServerX > 1000 Write/Adds in an hour - LONG LIST • IR - WHO is doing WHAT on a system • IT - User Logon & Email Activity Report - Specify Period • IT - User Processes Activity Report - Specify Period
  • 94. Monitor Accounts • Account - Attempt to change Account Password - Last 24 hours • Account - Domain Connection issue - Last 24 hours • Account - Failed Guest and Administrator Logins - Last 24 hours • Account - Local Group changed - Last 30 days • Account - Logon Type by Count - Last 24 hours • Account - Logon by Type 8 - CLEAR TEXT Login - Last 24 hours • Account - Logon by Type 10 - RDP Login - Last 24 hours • Account - Logon by Type - Last 15 mins • Account - SRV - Successful Logins of NON-User Accounts - Last hour • Account - User Account Attempted Password Change - Last 7 days • Account - User Account DELETED - Last 7 days • Account - User Account ENABLED - Last 7 days • Account - User Account Locked Out - Last 24 hours • Account - User Account Password changed - Last 7 days • Account - User Account UNLOCKED - Last 7 days • Account - User Account password reset - last 7 days • Account - User Account was DISABLED - Last 30 days • Account - User failed to logon - Last 24 hours • Account - User locked out of domain - Last 24 hours • Account - User successfully logged on - Last hour • Account - User successfully logged on - NOT Exchange - Last hour • Account - User successfully logged on Exchange - Last hour • Account - WS/SRV - Account failed to logon - Last 24 hours • Account - WS/SRV - Account login with explicit credentials - Last 24 hours • Account - WS/SRV - User added to group - Last 24 hours
  • 95. Lots more • Application Crash - Application Error - Last 24 hours • Application Crash - Windows Error Reporting - Last hour • Audit Policy - SRV - Audit Policy changed - Last 24 hours • Audit Policy - WS - Audit Policy changed - Last 7 days • Client - DC Issue with distant clients contacting a DC - Last 24 hours • Commands - Registry related commands executed - Last hour • Commands - SRV - CScript.exe executed - By Count - Last 30 days • Commands - SRV - Net.exe Net1.exe used - By COUNT - Last 24 hours • Commands - SRV - Net.exe Net1.exe used - Last 24 hours • Commands - SRV - Schtasks and AT executed - Last 30 day • Commands - Suspicious commands being executed - Last 24 hours • Commands - WS - CScript.exe executed - By Count - Last 30 days • Commands - WS - Net.exe Net1.exe used - Last 24 hours • Commands - WS - Schtasks and AT executed - Last 30 day • DNS - Internal Source IP to Domain/IP - Last hour • DNS - Known Bad IP's - ALL TIME DNS - RegEx IP and Record - Last Hour • DNS - SRV - Names not resolving • DNS - WS - Systems where hostname does not match Computer Name - Last 30 days • Driver - Issue with driver - last 24 hours
  • 96. And more • Exchange - Mail Server having issues • Exchange - Successful Webmail Logon Count by IP • Exchange - Successful Webmail logins • Exchange - Failed Email delivery - Last hour • Exchange - Failed Mobile device email login > 10 last hour • Exchange - Failed OWA login last hour • Exchange - Failed Email delivery - Last hour • Exchange - Failed Mobile device email login > 10 last 24 hours • Exchange - Failed Mobile device email login > 10 last hour • Exchange - Failed OWA login last 24 hours • Exchange - Failed OWA login last hour • Executables - SRV - New File dropped in monitored locations - Last 30 days • Executables - WS - New File dropped in monitored locations - Last 30 days • GPO - Group Policy Failed - Last 7 days
  • 97. Yet more • Kerberos - List of Kerberos tickets - Last 24 hours • Logs - SRV - Cleared - Last 7 days • Logs - SRV - Logs low on events - Last 24 hours • Logs - WS - Cleared - Last 7 days • Logs - WS - Logs low on events - Last 24 hours • SRV - Files Modified on ServerX - Last 4 hours • NTFS - NTFS Error - Last 7 days • OS Version - SRV - What OS, SP, CPU type - Last 30 days • OS Version - WS - What OS, SP, CPU type - Last 30 days • Firewall - Threats - Last Hour • Firewall - Traffic - Last Hour • Printing - Printer Failed - Last 30 days • Privileged Object - SRV - Last 24 hours • Privileged Object - WS - Last 24 hours • Processes - SRV - New Process being launched - Last 60 mins • Processes - WS - New Process being launched - Last 60 mins
  • 98. Product, Registry & SNMP • Product - SRV - Installation Started - Last Day • Product - SRV - Installation Status All - Last Day • Product - SRV - Installation Status OTHER - Last 30 Days • Product - SRV - Windows Installer Status - Last Day • Product - SRV - Windows Update - Last 24 hours • Product - WS - Installation Started - Last Day • Product - WS - Installation Status All - Last Day • Product - WS - Installation Status OTHER - Last 30 Days • Product - WS - Windows Installer Status - Last Day • Product - WS - Windows Update - Last 24 hours • Registry - Key Changed - Last 24 hours • Registry - Key value Add, Change, Delete - Last 24 hours • Registry - Run & RunOnce Key value Add, Change, Delete - Last 24 hours • SNMP - SNMP Service Config updated - Last 7 days
  • 99. Services & Shares • Service - SRV - Issues with startup or failure - Last 24 hours • Service - SRV - New SERVICE Installed - Last Hour • Service - SRV - SERVICE state changed 'to disabled' - Last 24 hours • Service - SRV - Service Failed to Start - last 7 days • Service - State - Startup or Failure - Last 24 hours • Service - WS - Issues with startup or failure - Last 24 hours • Service - WS - New SERVICE Installed - Last Hour • Service - WS - SERVICE state changed 'to disabled' - Last 24 hours • Service - WS - Service Failed to Start - last 7 days • Shares - WS - C$ Share being accessed - Last 24 hours • Shares - WS - C$ or Admin$ Share accessed - Last 24 hours
  • 100. And Finally • System Integrity - SRV - File Hash are not valid - Last 24 hours • System Integrity - WS - File Hash are not valid - Last 24 hours • Tasks - New Task Scheduled - Last Hour • Tasks - Task Scheduled Created, Changed or Deleted - Last Hour • Time - SRV - Time Service sync details - Last 24 hours • Time - SRV - When a system rebooted - last 24 hours • Time - WS - Time Service sync details - Last 24 hours • Time - WS - When a system rebooted - last 24 hours • USB - Status of USB drives used - Last 7 days • VPN - FAILED logins Last Hour VPN - Successful logins Last Hour • WinRM - SRV - WinRM Service status - Last 30 days • WinRM - WS - WinRM Service status - Last 30 days
  • 101. Resources • Our Website – www.MalwareArchaeology.com • The Handout – Windows Logging Cheat Sheet
  • 102. Questions? • You can find us at: • Michael@MalwareArchaeology.com • @HackerHurricane • www.MalwareArchaeology.com • Yes – We do consulting ;-)