Windows Event Logs
In this TryHackMe room, we will explore Windows Event Logs. Event Logs record events taking place in the execution of a system to provide an audit trail that can be used to understand the activity of the system and to diagnose problems.
Before we jump into the lab, lets get a quick overview of core windows processes and Sysinternal tools.
Sysinternals
Windows Processes
-
Shows fie version number, timestamp information, and digital signature details (including certificate chains)
Also has an option to check VirusTotal
Use: Check for unsigned files in C:\Windows\System32
If there are any results, an investigation is necessary.
-
Every file has at least one data stream ($DATA). Windows Explorer does not display alternate data streams (ADS) to the user. PowerShell can!
Malware writers use ADS to hide data in an endpoint.
Use: When you download a file from the internet, there are identifiers written in ADS to identify that it was downloaded via internet
streams C:\Users\<Username>\Desktop\SysinternalsSuite.zip - accepteula
Return: :Zone.Identifier:$DATA [number]
Use: Finding streams inside file
streams C:\Users\Administrator\Desktop -accepteula
Output: :ads.txt:$DATA 26
Input: notepad C:\Users\Administrator\Desktop\file.txt:ads.txt
Output: Notepad with streams
-
Allows you to delete one or more files and/or directories or to cleanse the free space on a logical disk
(Implemented the Department of Defense clearing and sanitizing protocol)
Used by adversaries [MITRE Technique T1485] (Data Destruction)
-
Shows detailed listings of all TCP and UDP endpoints on you system
More convenient than Netstat
-
Shows what programs are configured to run during system bootup or login
(Good tool to search for many malicious entries created to establish Persistence)
-
Monitors an application for CPU spikes
Generates crash dumps during a spike
-
Top Window: Show list of activity running processes
Bottom Window: Depends on the mode (Handle & DLL)
Verifies Signatures
Colors:
Purple: Indication that files may be packed
Red: Process is exiting
Green: Process was freshly spawned
Light Blue: Processes are ran by the same account that started Process Explorer
Dark Blue: Process is selected
Pink: Process is a service
Dark Grey: Process that is suspended
-
(ProcMon)
Shows real-tine file system, registry, and process/thread activity
When launched, ProcMon will capture thousands of events occurring within the operating system.
-
Telnet-replacement that allows for the execution of processes on other systems without having to install software
Used by adversaries
MITRE Technique T1570, T1021.002, T1569, S0029
-
System Monitor
Driver that remains resident across system reboots to monitor and log system activity into the Windows event log
Provides detailed information about process creations, network connections, and changes to file creation time
-
Uses the native Windows NT API to access and display information on the NT object manager’s name space
-
Displays relevant information about a Windows computer on the desktop’s background
-
Takes a egstry path and makes Regedit open to that past
Accepts root keys in standard and abbreviated form
-
Scans he file you pass it for UNICODE (or ASCII) strings of a default length of 3 or more characters
Use: strings .\file.exe | findstr hi
Output:
Hi my name is
My name is Hi
name Hi is my
etc.
-
Runs only in Kernel mode.
Is a system thread. (Have all attributes of regular user-mode threads but only run in kernel-mode and execute code in system space)
PID: 4
Image Path: N/A
Parent Process: <None>
User Account: Local System
Start Time: Boot
-
Session Manager Subsystem (Windows Session Manager)
Responsible for creating new sessions
First user-mode process started by the kernel
Responsible for creating environment variables, virtual memory paging files, and starts winlogon.exe
Includes win32k.sys (kernel mode), winsrv.dll (user mode), and csrss.exe (user mode)
Starts csrss.exe and and wininit.exe in Session 0
Starts another csrss.exe and winlogon.exe in Session 1
Image Path: %SystemRoot%\System32\smss.exe
Parent Process: System
Number of Instances: One master instance and child instance per session
User Account: Local System
Start Time: Boot
-
Client Server Runtime Process
User-mode side of the Windows Subsystem
If terminated, system will fail
Responsible for the Windows32 console window and process thread creation and deletion
Loads many dls including (csrsv.dll, bassrv.dll, and winserv.dll)
Responsible for making the Windows API available to other processes
Responsible for handling the Windows shutdown process and mapping drive letters
Session 0
Image Path: %SystemRoot%\System32\csrss.exe
Parent Process: Created by smss.exe
Number of Instances: Two or more
User Account: Local System
Start Time: Boot/Start times for additional instances occur when new sessions are created
-
Windows Initialization Process
Responsible for launching service.exe, lsass.exe, and lsaiso.exe in Session 0
Critical windows process
Image Path: %SystemRoot%\System32\wininit.ex
Parent Process: Created by smss.exe
Number of Instances: One
User Account: Local System
Start Time: Boot
-
Service Control Manager
Handles system services
Loading services
Interacting with services
Ending service
Maintains a database that can be quired using sc.exe
When a user logs in, the process sets the value of the Last Known Good Configuration to the same as the CurrentControlSet
Parent to svchost.exe, spoolsv.exe, msmpeng.exe, and dllhost.exe
Image Path: %SystemRoot%\System32\services.exe
Parent Process: winit.exe
Number of Instances: One
User Account: Local System
Start Time: Boot
-
Service Host
Responsible for hosting and managing Windws services
-k is how a genuine svchost.exe is called
Target for malicious actors
Image Path: %SystemRoot%\System32\svchost.exe
Parent Process: services.exe
Number of Instances: Multiple
User Account: Varies (SYSTEM, Network Services, Local Service, sometimes logged in user)
Start Time: Boot/Other instances can be started
-
Local Security Authority Subsystem Service
Responsible for enforcing the security policy on system
Verifies user logons, handles password changes, creates across tokens
Writes to the Windows Security Log
Also a common target. Used to dump credentials or hide in plain sight.
Image Path: %SystemRoot%\System32\lsass.exe
Parent Process: wininit.exe
Number of Instances: One
User Account: Local System
Start Time: Boot
-
Windows Logon
Responsible for handling the Secure Attention Sequence (ALT+CTRL+DEL)
Responsible or loading user profile
Image Path: %SystemRoot%\System32\winlogon.exe
Parent Process: smss.exe (usually exits)
Number of Instances: One or more
User Account: Local System
Start Time: Boot/Start times for additional instances occur when new sessions are created (RD or switching logons)
-
Windows Explorer
Gives the user access to their folders and files
Provides functionality for Start Menu, Taskbar & more
Image Path: %SystemRoot%\explorer.exe
Parent Process: userinit.exe (usually exits)
Number of Instances: One or more
User Account: Logged in user(s)
Start Time: User logon session begins
Event Viewer
Event logs are crucial for troubleshooting computer incidents. They will assist in understanding the situation and how to remediate the incident.
The logs files typically ride in C:\Windows\System32\winevt\Logs
Let’s go over the specific elements that form event logs.
-
Event associated with Operating System segments (anything related to the device)
Examples:
Hardware Changes
Device Drives
System Changes
Anything related to the device
-
Event connected to logon and logoff activities
-
Events related to applications installed on a system
Examples:
Application erors
Events
Warnings
-
Records Active Directory (AD) changes and activities
-
Events associated with Windows Servers during the sharing of Group Policies and logon scripts to domain controllers
-
Records domain events
-
Logs applications that require custom data storage. This allows applications to control log size and attach other paraments for security purposes
You can access event logs by using Event Viewer, Wevtutil.exe, or Get-WinEvent
Lab Questions:
What is the Event ID for the earliest recorded event?
Filter on Event ID 4104. What was the 2nd command executed in the PowerShell session?
What is the Task Category for Event ID 4104?
Analyze the Windows PowerShell log. What is the Task Category for Event ID 800?
What is the Event ID for the earliest recorded event?
To find this event, we need to sort the Date and Time. The easiest way that I found was to click “View” —> “Group By” —> “Date and Time” in the Actions Bar.
This process will then sort all the times by date and then group them together based on their dates. Go ahead and select the first event, then we’ll be able to see the EventID under the box.
The answer is 40961
Filter on Event ID 4104. What was the 2nd command executed in the PowerShell session?
First use the filter to look for any event with an ID of 4104:
After using the filter, this should be your output:
Click on the second event and inside of “General” you’ll see the command whoami
What is the Task Category for Event ID 4104?
The “Task Category” can be seen under the “General“ box.
The answer is Execute a Remote Command
Analyze the Windows PowerShell log. What is the Task Category for Event ID 800?
You will find the Windows PowerShell log using the “Event Viewer (Local)” box. Go to “Applications and Services Logs” —> “Windows PowerShell”
The first log that opens has an EventID of 800. Look under the “General” box to find the “Task Category”.
The answer is Pipeline Execution Details
wevtutil.exe
wevtutil.exe enables you to retrieve information about event logs and publishers. It also assists in installing/uninstalling event manifests, running queries, and exporting, archiving, and clearing logs
Lab Questions:
How many log names are in the machine?
What event files would be read when using the query-events command?
What option would you use to provide a path to a log file?
What is the VALUE for /q?
The questions below are based on this command: wevtutil qe Application /c:3 /rd:true /f:text
What is the /rd option for?
What is the /c option for?
How many log names are in the machine?
To answer this, we need to figure out which command to use. (use wevtutil.exe /? if you don’t know commands). Because we’re counting, we want to list all the log names. Therefore we want to use el for enum-logs. In PowerShell we’re going to type “wevtutil.exe el” to generate all the log names.
There are too many logs to count, so let’s use the Measure-Object command to make it more simple: wevtutil.exe el | Measure-Object
There are a total of 1071 log names.
What event files would be read when using the query-events command?
The answer is Event log, Log file, Structured query
What option would you use to provide a path to a log file?
To answer this question, we need to find the command to use. Because we’re looking for a particular log file, we’d want to query for it. Therefore, we are going to use the qe (query-events) command.
Type in wevtutil.exe qe /? to show pf all the commands.
/lf:true is the answer
What is the VALUE for /q?
Use the previous questions command and look through the options. Find where “/{q | query}:VALUE” is and then read the description.
The answer is XPATH Query
What is the log name?
The questions below are based on this command: wevtutil qe Application /c:3 /rd:true /f:text
Put the command into PowerShell
The answer is Application
What is the /rd option for?
Type in wevtutil.exe qe /? to show all of the commands.
The answer is Event Read Direction
What is the /c option for?
The answer is Maximum number of events to read
Get-WinEvent
Get-WinEvent gets events from event logs and event tracing log files on local and remote computers. It provides information on event logs and event log providers.
Lab Questions:
Execute the command from Example 1 (as is). What are the names of the logs related to OpenSSH?
Execute the command from Example 8. Instead of the string *Policy* search for *PowerShell*. What is the name of the 3rd log provider?
Execute the command from Example 9. Use Microsoft-Windows-PowerShell as the log provider. How many event ids are displayed for this event provider?
How do you specify the number of events to display?
When using the FilterHashtable parameter and filtering by level, what is the value for Informational?
