🟦
LSWSec-Defensive
  • LSWSec - Defensive Security Notes
  • General
    • Tool List
  • Threat Intelligence
    • Introduction
    • Threat Actors and APTs
    • Operational Threat Intelligence
    • Tactical Threat Intelligence
    • Strategic Threat Intelligence
    • Malware and Global Campaigns
  • Phishing
    • Introduction
    • Investigating a Phishing Email
    • Analysing
    • Defensive Action
    • Reactive Measures
    • Report Writing
  • Digital Forensics
    • Introduction
    • Digital Evidence and Handling
    • Memory, Pagefile and Hibernation file
    • Digital Evidence Collection
    • Windows Investigation
    • Linux Investigations
    • Volatility
    • Autopsy
    • Windows Commands
      • Network Discovery
      • DHCP
      • DNS
  • SIEM
    • Introduction
    • Logging
    • Correlation
  • Incident Response
    • Introduction
    • Preperation
    • Detection & Analysis
    • Containment, Eradication and Recovery
    • reporting
    • MITRE Att&ck
  • Event Viewer
    • event Summary
    • Event ID: 4648
    • Event ID: 4776
    • Event ID: 4673
    • Event ID: 4625
Powered by GitBook
On this page
  • What is logging?
  • Syslog
  • Windows event Logs
  • Other Logs
  • Aggregation
  1. SIEM

Logging

PreviousIntroductionNextCorrelation

Last updated 1 year ago

What is logging?

  • Detailed lists of application information, system performance statistics and user activity

  • Can be useful to keep track of computer use, network activity, security issues and error reports

Syslog

  • Actions generate events which are logged on many devices

  • Impractical to review these locally

  • Available on unix and linux

  • Can be used on windows

  • Uses UDP 514 by default TCP 514 can be used for more reliability

  • Some more secure standards require TCP 6514 is used

  • Made up for 3 components: priority value, header and message.

Priority value

  • Derived from facility code and severity level

  • Use (facility code * 8 ) + Severity Value = PRI

Header

  • Contains information like timestamps, hostnames, application names, message IDs.

Message

  • Each message can either be plane text or machine readable

  • First label is function/facility. For example, mail servers usually use the mail facility.

  • Second label specifies the severity level.

  • The action is then specified which is usually a file in /var/log.

Windows event Logs

  • Binary files with the .evtx extension

  • Stored locally in the windows directory of an operating system.

  • %WinDir%\system32\Config*.evt

  • %WinDir%\system32\WinEVT\Logs*.evtx

  • Keep a detailed log of the majority of events

  • Registered events include: Application, System, Security, Directory service, DNS and File Replication.

Security Event logs

  • Information about events which relate to the Windows Security Audit Policies

  • Account logon events

  • Account Management

  • Privilege use

  • Account Management

  • Resource Usage

Sysmon

  • Windows system service and device driver.

  • Monitor and log system activity

  • Logs process creation with fill command line for both current and parent processes

  • Includes session GUID

  • Logs loading of drivers and DLLs with their signatures and hashes

  • Optionally logs network connections.

  • Detects changes in file creation time.

  • Rule filtering to include or exclude certain events

Installing Sysmon

Download sysmon, go to directory and run sysmon -i

Other Logs

  • Azure is usually monitored through Azure monitor and Log Analytic Workspace.

  • Can automatically acquire logs from lots of devices

  • Azure can be connected to lots of different siem platforms

  • Uses kusto query language (KQL)

  • Osquery is a universal and open source project developed by facebook

  • Its an open source project

  • Uses sql to explore data

  • Creates one agent for multiple OS

Aggregation

  • Process of collecting logs, parsing them, extracting structured data then putting them in a format that's easy to understand

  • Syslog - standard logging protocol, syslog server can be set up which receives logs from multiple sources

  • Event Streaming - Protocols like SNMP, Netflow adn IPFIX allow network devices to provide standard information about their operations.

  • Log Collectors - software agents which run on network devices which capture logs parse it and send it to a centralized aggregator.

  • Direct access - log aggregators that can directly access devices

  • Structured data - usually logs for Apache, IIS, Windows events, cisco logs and some other manufacturers. They have clearly defined fields/

  • Unstructured data - usually from custom built applications. Most likely the majority of data being sent to siem

https://www.youtube.com/watch?v=9qsP5h033Qk&t=491s
Windows Security Event Logs: my own cheatsheetAndrea Fortuna