Introduction

Windows system logs are a core data source for cybersecurity analysis, capturing critical information about system, application, and security events. By integrating the MITRE ATT&CK framework, security practitioners can detect threats, trace attack paths, and build defense strategies. This article introduces common security analysis methods for Windows logs, covers various ATT&CK techniques, lists relevant event IDs, and recommends open-source tools.

1. Overview of Windows Logs

Windows logs primarily include:

  • System Logs: Record events from operating system components, such as service startups or hardware failures.
  • Application Logs: Capture application runtime events, such as errors or warnings.
  • Security Logs: Log security-related events, such as login attempts or permission changes, serving as the focus for threat hunting.
  • Other Logs: Such as PowerShell logs and Sysmon logs, providing fine-grained data.

Logs are stored in %SystemRoot%\System32\winevt\Logs (.evtx format) and can be accessed via Event Viewer or PowerShell (e.g., Get-WinEvent).

2. Common Security Analysis Methods

  1. Log Collection: Enable critical logs (e.g., Audit Logon Events, Sysmon) to ensure detailed recording.
  2. Log Filtering: Filter suspicious events by event ID, timestamp, or user account.
  3. Correlation Analysis: Map events to ATT&CK techniques to build attack timelines.
  4. Threat Detection: Use rules, pattern matching, or behavioral analysis (e.g., Sigma rules) to identify anomalies.
  5. Forensics and Tracing: Reconstruct attack paths using logs to identify initial entry, lateral movement, and target behaviors.

3. ATT&CK Framework and Common Attack Techniques

Based on the ATT&CK framework (v13), the following lists common attack techniques, mapped to Windows log event IDs, with analysis methods.

3.1 Initial Access (T1078 - Valid Accounts)

  • Description: Attackers use legitimate accounts (e.g., weak passwords, stolen credentials) to access systems via RDP, VPN, etc.
  • Related Event IDs:
    • 4624: Successful login (focus on Type 3: Network login, Type 10: RDP).
    • 4625: Failed login (high-frequency failures may indicate brute-force attacks).
    • 4672: Privilege assignment (check for abnormal account privileges).
  • Analysis Methods:
    • Filter 4624 events to check login types and source IPs, identifying unexpected RDP or VPN connections.
    • Analyze 4625 events for high-frequency patterns, combined with timestamps or geolocation to detect brute-force attempts.
    • Use Sysmon Event ID 3 (Network Connection) to verify network activity post-login.
  • Log Sources: Security logs, Sysmon logs.

3.2 Persistence (T1547 - Boot or Logon Autostart Execution)

  • Description: Attackers implant malicious code to execute at system startup or user login, such as via registry Run keys or scheduled tasks.
  • Related Event IDs:
    • 4688: Process creation (detect suspicious calls to schtasks.exe or reg.exe).
    • 7045: New service installation (focus on unusual service names or paths).
    • 4738: User account changes (detect privilege escalation for persistence).
  • Analysis Methods:
    • Check 4688 events for registry modifications (e.g., HKLM\Software\Microsoft\Windows\CurrentVersion\Run).
    • Monitor 7045 events to verify the executable path of new services.
    • Use Sysmon Event ID 13 (Registry Modification) to detect changes to Run keys or scheduled tasks.
  • Log Sources: Security logs, System logs, Sysmon logs.

3.3 Privilege Escalation (T1068 - Exploitation for Privilege Escalation)

  • Description: Attackers exploit vulnerabilities or misconfigurations (e.g., UAC bypass) to elevate privileges.
  • Related Event IDs:
    • 4672: Privilege assignment (focus on high-privilege token assignments).
    • 4688: Process creation (detect privileged command execution, e.g., powershell.exe).
    • 4624: Login (Type 2: Interactive login, focus on token elevation types).
  • Analysis Methods:
    • Check 4672 events for unexpected high-privilege assignments (e.g., Administrator, SYSTEM).
    • Analyze 4688 events for UAC bypass tools (e.g., cmstp.exe) execution.
    • Use Sysmon Event ID 1 (Process Creation) to detect abnormal parent-child process relationships.
  • Log Sources: Security logs, Sysmon logs.

3.4 Credential Access (T1003 - OS Credential Dumping)

  • Description: Attackers steal credentials via memory extraction or SAM database access.
  • Related Event IDs:
    • 4624: Successful login (focus on unusual account logins).
    • 4648: Explicit credential login (potentially related to Pass-the-Hash).
    • 4672: Privilege assignment (abnormal high-privilege account assignments).
  • Analysis Methods:
    • Analyze 4624 events for login Type 3 (Network login) source hosts and times.
    • Monitor 4648 events to check for high-privilege operations (e.g., lsass.exe access) following the event.
    • Use Sysmon Event ID 10 (Process Access) to detect tools like mimikatz accessing lsass.exe.
  • Log Sources: Security logs, Sysmon logs.

3.5 Lateral Movement (T1021 - Remote Services)

  • Description: Attackers move across the network via RDP, SMB, or WMI.
  • Related Event IDs:
    • 4624: Remote login (Type 10: RDP).
    • 4688: Process creation (detect wmic.exe, psexec.exe).
    • 5145: Share object access (focus on SMB shares like Admin$).
  • Analysis Methods:
    • Filter 4624 events to check RDP login source IPs and target hosts.
    • Analyze 4688 events for WMI or PsExec command-line parameters.
    • Use Sysmon Event ID 3 (Network Connection) to detect unusual SMB connections.
  • Log Sources: Security logs, Sysmon logs.

3.6 Defense Evasion (T1562 - Impair Defenses)

  • Description: Attackers disable security software, clear logs, or disguise processes.
  • Related Event IDs:
    • 1102: Security log cleared.
    • 4688: Process creation (e.g., net stop to disable services).
    • 7040: Service state change (services disabled).
  • Analysis Methods:
    • Monitor 1102 events as high-risk behavior.
    • Check 4688 events for commands disabling antivirus software (e.g., net stop Windows Defender).
    • Use Sysmon Event ID 13 (Registry Modification) to detect antivirus configuration changes.
  • Log Sources: Security logs, Sysmon logs.

3.7 Command and Control (T1071 - Application Layer Protocol)

  • Description: Attackers communicate with C2 servers via HTTP, DNS, or other protocols.
  • Related Event IDs:
    • 4688: Process creation (detect network activity from powershell.exe, cmd.exe).
    • 5156: Windows Filtering Platform connection (unusual outbound connections).
  • Analysis Methods:
    • Analyze 4688 events for suspicious URLs or IPs in command-line parameters.
    • Use Sysmon Event ID 3 (Network Connection) to monitor unusual destination addresses.
    • Combine with Zeek or Suricata logs to validate C2 communication patterns.
  • Log Sources: Security logs, Sysmon logs, Network logs.

3.8 Exfiltration (T1041 - Exfiltration Over C2 Channel)

  • Description: Attackers steal data via C2 channels or physical media.
  • Related Event IDs:
    • 4688: Process creation (detect compression tools like rar.exe, 7z.exe).
    • 5156: Windows Filtering Platform connection (unusual large upload traffic).
    • 5145: File share access (detect access to sensitive files).
  • Analysis Methods:
    • Monitor 4688 events for data compression or upload tool execution.
    • Analyze Sysmon Event ID 3 (Network Connection) for unusual high upload traffic.
    • Check 5145 events for SMB access to sensitive files (e.g., *.docx, .pdf).
  • Log Sources: Security logs, Sysmon logs, Network logs.

The following tools support Windows log threat hunting and analysis:

  1. Sysmon:
  2. ELK Stack:
    • Function: Centralized log management with search and visualization capabilities.
    • Configuration: Use Winlogbeat to collect Windows logs and create Kibana dashboards to monitor events like 4624 and 1102.
    • Source: ELK Stack
  3. Sigma:
  4. Chainsaw:
    • Function: Lightweight log analysis focused on Sysmon and Windows event logs.
    • Configuration: Use with Tau-Engine rule sets to detect lateral movement and other behaviors.
    • Source: Chainsaw Repository
  5. Velociraptor:
    • Function: Open-source DFIR tool supporting cross-host log queries.
    • Configuration: Run ATT&CK-mapped queries to trace attack paths.
    • Source: Velociraptor Repository
  6. APT-Hunter:
    • Function: Threat hunting tool designed for Windows logs, detecting APT activities.
    • Configuration: Supports Sigma rules to analyze events like 4624 and 4688.
    • Source: APT-Hunter Repository

5. Analysis Case Study: Detecting Data Exfiltration

Below is a case study for detecting data exfiltration (T1041):

  1. Log Collection: Enable Security logs, Sysmon, and network logs, capturing 4688, 5145, and Sysmon Event ID 3.
  2. Event Filtering:
    • Filter 4688 events for execution of rar.exe or 7z.exe.
    • Check 5145 events for SMB share access to sensitive files (e.g., *.xlsx).
  3. Correlation Analysis:
    • Use Sysmon Event ID 3 to verify if file access is followed by unusual upload traffic.
    • Build a timeline in ELK Stack to correlate 4688 and 5156 events.
  4. Threat Detection:
    • Apply Sigma rules (e.g., win_data_exfiltration) to detect compression tools and abnormal network activity.
    • Use Chainsaw for rapid retrieval of suspicious events.
  5. Forensics and Tracing:
    • Extract command-line parameters from 4688 events to identify compressed target files.
    • Use Velociraptor to query logs across hosts to confirm if data was transferred to other systems.

6. Considerations

  • Log Configuration: Enable PowerShell script block logging, command-line auditing, and Sysmon for enhanced logging.
  • False Positive Management: Reduce false positives by incorporating business context (e.g., user roles, host functions).
  • Performance Optimization: Use ELK or Velociraptor for centralized analysis to avoid local performance bottlenecks.
  • Continuous Updates: Refer to ATT&CK v13 and the latest threat intelligence to update detection rules.

7. Conclusion

Windows logs, combined with the ATT&CK framework, provide robust support for threat hunting. By analyzing techniques like initial access, persistence, and privilege escalation, security teams can effectively detect and respond to attacks. Open-source tools like Sysmon, ELK Stack, and Sigma enhance analysis efficiency. Practitioners are encouraged to continuously learn ATT&CK techniques and log analysis methods to strengthen defenses.

References