Introduction to Windows Event Logs

As you know, the most used Operating System (OS) worldwide is Microsoft Windows. Attackers know this, and every day, they develop new malware and techniques to target Microsoft Windows OS platforms. As a SOC analyst, you must understand the provided event logs by Microsoft in Windows environments that help you to investigate and detect cyber breaches.

The objective of this chapter is to understand the provided event types by the Microsoft Windows OS, learn the analysis approach for event logs (either online or offline), and provide you with an overview of the investigation approach for this part of the book.

In this chapter, we will cover the following main topics:

• Windows event types
• Windows event log analysis tools
• The investigative approach for this part of the book

Let’s get started!

Windows event types

Windows event logs are detailed records of most events happening on a system. Those detailed records originated from Microsoft to help system admins to troubleshoot and diagnose system problems. Examples of the events that trigger event logs on the Microsoft OS are successful or failed authentication, system rebooting, and process creation.

By default, since Windows Vista and onward, Microsoft event logs are stored in the C:\Windows\System32\winevt\Logs path; however, this location can be changed by modifying the file registry key that refers to the storage location for Windows logs. This registry key is located under the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\<EventLogName> registry hive. <EventLogName> is a placeholder that represents the name of the Windows event log for which you want to configure the storage location. <EventLogName> can be the application, system, or security log.

The Windows OS generates multiple...

Windows event log analysis tools

There are multiple methods and tools available to analyze Windows event logs. As an SOC analyst, you may think that you will fully rely on your Security Information and Event Management (SIEM) solution to analyze all Windows event logs. However, there may be instances where you need to investigate logs from a Windows machine that does not send logs to your SIEM, or you may be an incident responder looking to collect and analyze Windows event logs without a centralized log management tool (SIEM) in your environment. Therefore, it is important to have a clear understanding of the various tools and methods available to effectively analyze Windows event logs.

If you are analyzing Microsoft event logs from a live machine, you can use the Event Viewer tool, a built-in Microsoft tool used to explore and analyze Windows event logs. To open the Event Viewer tool, you just need to type its name in the Windows search bar. The main view of the tool provides...

The investigative approach for this part of the book

During this part of the book’s chapters, we will use the Mordor security dataset and The Hunting ELK (HELK) SIEM solution to analyze Windows event logs and intrusions and adversaries’ techniques. Mordor security is a dataset of pre-recorded security events generated by simulated adversarial techniques. To explore and learn more about the available datasets, follow this link: https://securitydatasets.com/introduction.html. HELK is an open source SIEM solution, which we will use to ingest and explore Mordor dataset events; for more information about HELK, follow this link: https://github.com/Cyb3rWard0g/HELK.

By using both the Mordor datasets and HELK SIEM solution, we will analyze the possible Windows event logs in order to profile users’ activities, investigating attacker techniques such as execution, persistence, enumeration, defense evasion, and lateral movement techniques.

Although you are not required...

Summary

In this chapter, we introduced the most common and valuable Windows event log files and how to analyze them, either from a live machine or offline by extracting and investigating the logs, using third-party tools. Finally, we provided an overview of this part of the book’s investigative approach and how to install the investigation lab.

In the next chapter, you will learn how to track and investigate Windows account usage and management activities.