Tracking Accounts Login and Management

Almost everything and every action in a Windows environment is tied to an account. So, during the incident investigation process, the first effective way to track and investigate an attacker’s activities is to track the compromised accounts’ login and suspicious account management activities. As a SOC analyst, you must be aware of and able to analyze the account login and management event logs provided by Microsoft on the Windows OSs that help you investigate and detect suspicious accounts activities.

The objective of this chapter is to make you aware of the different Windows account types, understand and be able to analyze the event logs of Windows account login activities, such as successful authentications, failure authentications, and admin logins, and track the login session. You will also learn how to track and analyze the account management logs provided by Microsoft, such as new account creation and new members being added...

Account login tracking

If you want to profile specific account behavior or track compromised account activities, Microsoft gives you the ability to track every login attempt that either succeeded or failed by recording event logs for each login attempt. These events include valuable information, such as attempt time, account name, authentication method, and so on. All the authentication logs are logged in the Security log file.

To explain the account login tracking logs, we will divide this section into five subsections:

• Windows accounts
• Tracking successful logins
• Tracking successful administrator logins
• Tracking logon sessions
• Tracking failed logins

Let’s take a look.

Windows accounts

Before digging into the Windows event logs, first, you need to understand that in the Windows environment, every Windows process or activity such as authentication, object access, or running services must be associated with an account. This account could...

Login validation events

Login validation events are the events of the Credential validation results. While logon events such as 4624, 4625, and 4672 are recorded on the workstation that the user tried to log into, the login validation events are logged by the system responsible for authenticating the credentials. So, in the case of domain account authentications, the domain controller serves as the authentication server and logs the login validation events, while in the case of local account authentications, the workstation authenticates the logon credentials using the local SAM database and the logon validation events are recorded in the workstation itself. Such events are valuable for tracking local account authentication attempts in your organization.

Microsoft records logon validation events based on the user authentication protocols used, which could be either NTLM or Kerberos. Let’s take a closer look at each of these in detail.

Login validation Event IDs (NTLM protocol...

Account and group management tracking

Microsoft records several events that allow you to track account and security group management activities such as account creation, account deletion, account disablement, group creation, adding and removing accounts from security groups, and changes made to accounts. Such events allow you to detect and investigate several suspicious account and group management activities, including accounts being created by an attacker to maintain persistence in the environment, accounts being created by unauthorized users, unexpected accounts being added to a privileged security group, unexpected account deletion and changes, and account and group management activities outside of working hours.

For a better explanation of the Windows account and security group management tracking events, we will divide this section into two subsections:

• Tracking account creation, deletion, and change activities
• Tracking creation and account adding to security groups...

Summary

In this chapter, we covered a range of topics related to Windows account management and tracking. We began by discussing the different types of Windows accounts and how to track login activities, including successful and failed logins, as well as admin logins. We also explored how to track account activities during a given logon session and determine session length. Finally, we delved into the topic of account and security group management and learned how to track activities such as creation, deletion, changes, and member additions or removals.

In the next chapter, we will investigate suspicious Windows process executions by utilizing Windows logs and gaining knowledge of the common Windows process characteristics and certain characteristics of suspicious processes.