Windows Event Log Analysis

Configuring logging on Windows systems, and aggregating those logs into a SIEM, is a critical step toward ensuring that your environment is able to support effective incident response using Incident response tools.

Events can be logged in the Security, System and Application event logs. 

Log Name	Event Log where the event is stored. Useful when processing numerous logs pulled from the same system.
Source	The service, Microsoft component or application that generated the event.
Event ID	A code assigned to each type of audited activity.
Level	The severity assigned to the event in question.
User	The user account involved in triggering the activity or the user context that the source was running as when it logged the event.
OpCode	Assigned by the source generating the log.
Logged	The local system date and time when the event was logged.
Task Category	Assigned by the source generating the log.
Keywords	Assigned by the source and used to group or sort events.
Computer	The computer on which the event was logged. This is useful when examining logs collected from multiple systems, but should not be considered to be the device that caused an event (remote workstation).
Description	A text block where additional information specific to the event being logged is recorded.

 

Types of Windows Event Log Analysis – Guide

•     Account Management Events
•     Account Logon and Logon Events
•     Common Event ID 4768 result codes
•     Logon event type code descriptions
•     Common logon failure status codes
•     Access to Shared Objects
•     Scheduled Task Logging
•     Object Access Auditing
•     Audit Policy Changes
•     Auditing Windows Services
•     Wireless LAN Auditing
•     Process Tracking
•     Additional Program Execution Logging
•     Auditing PowerShell Use

Go thru the complete incident response guide with the following link.

Links:

• Windows Event Log Analysis - Complete Incident Response Guide
• Microsoft Threat Protection Audit
  

Velociraptor for DFIR

Velociraptor - Endpoint visibility and collection tool

Velociraptor is a tool for collecting host based state information using The Velociraptor Query Language (VQL) queries. It is an advanced digital forensic and incident response tool that enhances your visibility into your endpoints.

Today, I just see the demo from Carlos Cajigas's on Rapid DFIR Tooling in SANS community night event. It is amazing !!

There is a blog spot from FIRST.org where it shows how Velociraptor vs. PrintNightmare (2021).

Links:

• Velociraptor at GitHub
  
• Velociraptor Documentation
  

BruteShark - A Network Analysis Tool

BruteShark is a Network Forensic Analysis Tool (NFAT) that performs deep processing and inspection of network traffic (mainly PCAP files). It includes: password extracting, building a network map, reconstruct TCP sessions, extract hashes of encrypted passwords and even convert them to a Hashcat format in order to perform an offline Brute Force attack.

The main goal of the project is to provide solution to security researchers and network administrators with the task of network traffic analysis while they try to identify weaknesses that can be used by a potential attacker to gain access to critical points on the network.

What it can do

• Extracting and encoding usernames and passwords (HTTP, FTP, Telnet, IMAP, SMTP...)
• Extract authentication hashes and crack them using Hashcat (Kerberos, NTLM, CRAM-MD5, HTTP-Digest...)
• Build a visual network diagram (Network nodes & users)
• Reconstruct all TCP Sessions

Download

• Windows - download Windows Installer (64 Bit).
• Linux - download BruteSharkCli.zip and run BruteSharkCli.exe using MONO:

$ wget https://github.com/odedshimon/BruteShark/releases/latest/download/BruteSharkCli.zip
$ unzip BruteSharkCli.zip
$ mono BruteSharkCli/BruteSharkCli.exe

Links:

• https://github.com/odedshimon/BruteShark/
• https://hakin9.org/brute-shark-a-network-analysis-tool/
  

When Patching is not Sufficient

No doubt that patching is part of our priority list. But patching isn't sufficient in some cases, such as the ProxyLogon case.

Microsoft claims that 92% of Exchange servers have applied the mitigations against the critical flaw. However, it is critical to investigate Exchange servers in detail while patching. A pre-patch compromise is very likely.

Here're the 2 tools to help detect the IOC and you can cross check with your SIEM.

1. CHIRP IOC Detection Tool (CISA)
2. Microsoft Defender
   

Links:

• https://www.zdnet.com/article/microsoft-92-of-vulnerable-exchange-servers-are-now-patched-mitigated/

Free Computer Forensic Tools

This is a handy list for forensic and IR work. Any update of the list will be announced on twitter.com/jonathankrause

Currently the list is divided into the following categories:

• Disk Tools
• Email Analysis
• General
• File & Data Analysis
• Data Analysis Suite
• File Viewers
• Internet History Analysis
• Registry Analysis
• Web Application Analysis

The full list can be obtains at http://forensiccontrol.com/fcresources.php

Secure Erase

This summarize the article from Craig Wright. He is a Director with Information Defense in Australia.

In the article, Erasing drives should be quick and easy, he shows us a way to perform secure erase. Also he stated a few FUD on data recovering like:

• X-Ray machines and scanners will erase a drive;
• SEM or AFM (electron microscopy will do) could be used to recover data;
• Government or NSA can read your wiped drives;

The simplest manner to wipe hard disk is using the the firmware Secure Erase command on an ATA, SATA, PATA, etc drives. A full erase using SE takes 30 min to 1 hour to complete. Basically it is quick. It is non-recoverable. It saves all the BS. It removes the need for the FUD that still surrounds us.

Here's the steps to wipe a drive using hdparm utility:

1. Login as root.
2. Ensure the drive isn't security frozen (result shows "not frozen"): hdparm -I /dev/sda
3. Issue command by set user password, Security =Maximum (Master Password = Blank): hdparm --user-master u --security-set-pass Eins /dev/sda
4. Issue command to confirm the process with the the word "enabled" in the output: hdparm -I /dev/sda
5. Issue the AT SE command: hdparm --user-master u --security-erase Eins /dev/sda
6. Issue command to ensure output verification return "not enabled": hdparm -I /dev/sda

References:

• http://sourceforge.net/projects/hdparm/
• http://cmrr.ucsd.edu/people/Hughes/SecureErase.shtml
• https://ata.wiki.kernel.org/index.php/ATA_Secure_Erase

Mandiant: Forensic and Incident Response Tools

Below is the list of tools that I used to perform forensic and incident response. All are available at Mandiant free software.

1. MANDIANT IOCe is a free editor for Indicators of Compromise (IOCs). 
2. Memoryze - A free memory forensics software designed to help incident responders find evil within live memory.
3. MIR Lite-CDT - A command line utility based on technology from MANDIANT's Intelligent Response enterprise product.
4. Audit Viewer - An open source tool that allows users to examine the results of Memoryze's analysis.
5. Highlighter - Designed to help network analysts rapidly review log and other structured text files.
6. Red Curtain - A software for incident responders that helps find and analyze unknown malware.
7. Web Historian - Assists users in reviewing websites that are stored in the history files of the most commonly used browsers.

Sagan – Real-time System & Event Log (syslog) Monitoring System

Screenshot of Sagan

Softwink announces the release of Sagan, the ultimate in Syslog monitoring. Sagan can alert you when events are occurring in your syslogs that need your attention right away, in real time!


Sagan is a multi-threaded, real time system- and event-log monitoring system, but with a twist. Sagan uses a “Snort” like rule set for detecting “bad things” happening on your network and/or computer systems. If Sagan detects a “bad thing” happening, that event can be stored to a Snort database (MySQL/PostgreSQL) and Sagan will correlate the event with your Snort Intrusion Detection/Intrusion Prevention (IDS/IPS) system. Sagan is meant to be used in a ‘centralized’ logging environment, but will work fine as part of a standalone Host IDS system for workstations.

Sagan is fast: Sagan is written in C and is a multi-threaded application. Sagan is threaded to prevent blocking Input/Output (I/O). For example, data processing doesn’t stop when an SQL query is needed. It is also meant to be as efficient as possible in terms of memory and CPU usage.

Sagan uses a “Snort” like rule set: If you’re a user of “Snort” and understand Snort rule sets, then you already understand Sagan rule sets. Essentially, Sagan is compatible with Snort rule management utilities, like “oinkmaster” for example.

Sagan can log to Snort databases: Sagan will operate as a separate “sensor” ID to a Snort database. This means that your IDS/IPS events from Snort will remain separate from your Sagan (syslog/event log) events. Since Sagan can utilize Snort databases, using Snort front-ends like BASE and Snorby will not only work with your IDS/IPS event, but also with your syslog events as well!

Sagan output formats: You don’t have to be a Snort user to use Sagan. Sagan supports multiple output formats, such as a standard output file log format (similar to Snort), e-mailing of alerts (via libesmtp), Logzilla support and externally based programs that you can develop using the language you prefer (Perl/Python/C/etc).

Sagan is actively developed: Softwink, Inc. actively develops and maintains the Sagan source code and rule sets. Softwink, Inc. uses Sagan to monitor security related log events on a 24/7 basis.

Features:

• Sagan is meant to be easy to install. The traditional, “./configure && make && make install” works for many installations depending on the functionality needed and configuration.
• Thresholding of alerts. Uses the same format as Snort in the Sagan rule set.
• Attempts to pull TCP/IP addresses, port information, and protocol of rule set that was triggered. This leads to better correlation.
• Can be used to monitor just about any type of device or system (Routers, firewalls, managed switches, IDS/IPS systems, Unix/Linux systems, Windows event logs, wireless access points & much more).
• Works ‘out of the box’ with Snort front ends like BASE, Snorby, proprietary consoles, various Snort based reporting systems.
• Sagan is ‘open source’ and released under the GNU/GPL version 2 license.

Reference:

• more info & download

Forensic on Microsoft Office Document Metadata

This is a post about performing metadata forensics on office documents using some tools: wmd.pl, SSView, BIFFView.

As a forensic practitioner, you shouldn't have miss the Deeply Embedded Metadata at CmdLab.