SherbyNet - /page/wikibook/entry.mu

Micron Document

<!DOCTYPE html>

<title>Windows Security Log</title>

</head>

Windows Security Log

</h1>

</header>

<div id="mw-content-text" class="mw-body-content mw-content-ltr" lang="en" dir="ltr"><div class="mw-content-ltr mw-parser-output" lang="en" dir="ltr">The Security Log, in <a href="Microsoft_Windows" title="Microsoft Windows">Microsoft Windows</a>, is a log that contains records of login/logout activity or other security-related events specified by the system's audit policy. Auditing allows administrators to configure Windows to record operating system activity in the Security Log. The Security Log is one of three logs viewable under <a href="Event_Viewer" title="Event Viewer">Event Viewer</a>. <a href="Local_Security_Authority_Subsystem_Service" title="Local Security Authority Subsystem Service">Local Security Authority Subsystem Service</a> writes events to the log. The Security Log is one of the primary tools used by Administrators to detect and investigate attempted and successful unauthorized activity and to troubleshoot problems; Microsoft describes it as "Your Best and Last Defense".<a href="#cite_note-1">[1]</a> The log and the audit policies that govern it are also favorite targets of <a href="White_hat_(computer_security)" title="White hat (computer security)">hackers</a> and rogue <a href="System_administrator" title="System administrator">system administrators</a> seeking to cover their tracks before and after committing unauthorized activity.<a href="#cite_note-2">[2]</a>

<div class="mw-heading mw-heading2"><h2 id="Types_of_data_logged">Types of data logged</h2></div>

If the audit policy is set to record logins, a successful login results in the user's user name and computer name being logged as well as the user name they are logging into.<a href="#cite_note-3">[3]</a> Depending on the version of Windows and the method of login, the <a href="IP_address" title="IP address">IP address</a> may or may not be recorded. Windows 2000 Web Server, for instance, does not log IP addresses for successful logins, but Windows Server 2003 includes this capability.<a href="#cite_note-4">[4]</a> The categories of events that can be logged are:<a href="#cite_note-Audit_Policy_Categories-5">[5]</a>

<ul><li><a href="Login_session" title="Login session">Account logon events</a></li>

<li>Account management</li>

<li><a href="Directory_service" title="Directory service">Directory service</a> access</li>

<li><a href="Login" title="Login">Logon events</a></li>

<li><a href="Object_Manager_(Windows)" class="mw-redirect" title="Object Manager (Windows)">Object access</a></li>

<li><a href="Group_Policy" title="Group Policy">Policy change</a></li>

<li>Privilege use</li>

<li><a href="Process_(computing)" title="Process (computing)">Process tracking</a></li>

<li>System events</li></ul>

The sheer number of loggable events means that security log analysis can be a time-consuming task.<a href="#cite_note-6">[6]</a> Third-party utilities have been developed to help identify suspicious trends. It is also possible to filter the log using customized criteria.

<div class="mw-heading mw-heading2"><h2 id="Attacks_and_countermeasures">Attacks and countermeasures</h2></div>

Administrators are allowed to view and clear the log (there is no way to separate the rights to view and clear the log).<a href="#cite_note-7">[7]</a> In addition, an Administrator can use <a href="Winzapper" title="Winzapper">Winzapper</a> to delete specific events from the log. For this reason, once the Administrator account has been compromised, the event history as contained in the Security Log is unreliable.<a href="#cite_note-Winzapper-8">[8]</a> A defense against this is to set up a remote log server with all services shut off, allowing only console access.<a href="#cite_note-9">[9]</a>

As the log approaches its maximum size, it can either overwrite old events or stop logging new events. This makes it susceptible to attacks in which an intruder can flood the log by generating a large number of new events. A partial defense against this is to increase the maximum log size so that a greater number of events will be required to flood the log. It is possible to set the log to not overwrite old events, but as Chris Benton notes, "the only problem is that NT has a really bad habit of crashing when its logs become full".<a href="#cite_note-Benton-10">[10]</a>

Randy Franklin Smith's Ultimate Windows Security points out that given the ability of administrators to manipulate the Security Log to cover unauthorized activity, separation of duty between operations and security-monitoring IT staff, combined with frequent backups of the log to a server accessible only to the latter, can improve security.<a href="#cite_note-11">[11]</a>

Another way to defeat the Security Log would be for a user to log in as Administrator and change the auditing policies to stop logging the unauthorized activity he intends to carry out. The policy change itself could be logged, depending on the "audit policy change" setting, but this event could be deleted from the log using Winzapper; and from that point onward, the activity would not generate a trail in the Security Log.<a href="#cite_note-Auditing_Policy-12">[12]</a>

Microsoft notes, "It is possible to detect attempts to elude a security monitoring solution with such techniques, but it is challenging to do so because many of the same events that can occur during an attempt to cover the tracks of intrusive activity are events that occur regularly on any typical business network".<a href="#cite_note-13">[13]</a>

As Benton points out, one way of preventing successful attacks is <a href="Security_through_obscurity" title="Security through obscurity">security through obscurity</a>. Keeping the IT department's security systems and practices confidential helps prevent users from formulating ways to cover their tracks. If users are aware that the log is copied over to the remote log server at :00 of every hour, for instance, they may take measures to defeat that system by attacking at :10 and then deleting the relevant log events before the top of the next hour.<a href="#cite_note-Benton-10">[10]</a>

Log manipulation is not needed for all attacks. Simply being aware of how the Security Log works can be enough to take precautions against detection. For instance, a user wanting to log into a fellow employee's account on a corporate network might wait until after hours to gain unobserved <a href="Physical_access" title="Physical access">physical access</a> to the computer in their cubicle; surreptitiously use a <a href="Hardware_keylogger" title="Hardware keylogger">hardware keylogger</a> to obtain their password; and later log into that user's account through <a href="Terminal_Services" class="mw-redirect" title="Terminal Services">Terminal Services</a> from a <a href="Hotspot_(Wi-Fi)" class="mw-redirect" title="Hotspot (Wi-Fi)">Wi-Fi hotspot</a> whose IP address cannot be traced back to the intruder.

After the log is cleared through Event Viewer, one log entry is immediately created in the freshly cleared log noting the time it was cleared and the admin who cleared it. This information can be a starting point in the investigation of the suspicious activity.

In addition to the Windows Security Log, administrators can check the <a href="Internet_Connection_Firewall" class="mw-redirect" title="Internet Connection Firewall">Internet Connection Firewall</a> security log for clues.

<div class="mw-heading mw-heading2"><h2 id="Writing_false_events_to_the_log">Writing false events to the log</h2></div>

It is theoretically possible to write false events to the log. Microsoft notes, "To be able to write to the Security log, SeAuditPrivilege is required. By default, only Local System and Network Service accounts have such privilege".<a href="#cite_note-14">[14]</a> Microsoft Windows Internals states, "Processes that call audit system services . . . must have the SeAuditPrivilege privilege to successfully generate an audit record".<a href="#cite_note-15">[15]</a> The Winzapper FAQ notes that it is "possible to add your own 'made up' event records to the log" but this feature was not added because it was considered "too nasty," a reference to the fact that someone with Administrator access could use such functionality to shift the blame for unauthorized activity to an innocent party.<a href="#cite_note-Winzapper-8">[8]</a> Server 2003 added some API calls so that applications could register with the security event logs and write security audit entries. Specifically, the AuthzInstallSecurityEventSource function installs the specified source as a security event source.<a href="#cite_note-16">[16]</a>

<div class="mw-heading mw-heading2"><h2 id="Admissibility_in_court">Admissibility in court</h2></div>

The EventTracker newsletter states that "The possibility of tampering is not enough to cause the logs to be inadmissible, there must be specific evidence of tampering in order for the logs to be considered inadmissible".<a href="#cite_note-17">[17]</a>

<ul><li><a href="Common_Log_Format" title="Common Log Format">Common Log Format</a></li>

<li><a href="Log_management" title="Log management">Log management</a></li>

<li><a href="Syslog" title="Syslog">Syslog</a></li></ul>

<div class="mw-heading mw-heading2"><h2 id="References">References</h2></div>

/* start https://en.wikipedia.org/ */

.mw-parser-output .reflist{margin-bottom:0.5em;list-style-type:decimal}@media screen{.mw-parser-output .reflist{font-size:90%}}.mw-parser-output .reflist .references{font-size:100%;margin-bottom:0;list-style-type:inherit}.mw-parser-output .reflist-columns-2{column-width:30em}.mw-parser-output .reflist-columns-3{column-width:25em}.mw-parser-output .reflist-columns{margin-top:0.3em}.mw-parser-output .reflist-columns ol{margin-top:0}.mw-parser-output .reflist-columns li{page-break-inside:avoid;break-inside:avoid-column}.mw-parser-output .reflist-upper-alpha{list-style-type:upper-alpha}.mw-parser-output .reflist-upper-roman{list-style-type:upper-roman}.mw-parser-output .reflist-lower-alpha{list-style-type:lower-alpha}.mw-parser-output .reflist-lower-greek{list-style-type:lower-greek}.mw-parser-output .reflist-lower-roman{list-style-type:lower-roman}

/* end https://en.wikipedia.org/ */

</style><div class="reflist">

<li id="cite_note-1"><a href="#cite_ref-1">^</a> <a rel="nofollow" class="external text" href="http://www.microsoft.com/technet/archive/winntas/maintain/security/ntsecuri.mspx?mfr=true">The NT Security Log - Your Best and Last Defense</a>, Randy Franklin Smith

</li>

<li id="cite_note-2"><a href="#cite_ref-2">^</a> <a rel="nofollow" class="external text" href="http://www.windowsitpro.com/Windows/Article/ArticleID/8785/8785.html">Protecting the NT Security Log</a>, Randy Franklin Smith, Windows IT Pro, July 2000.

</li>

<li id="cite_note-3"><a href="#cite_ref-3">^</a> <a rel="nofollow" class="external text" href="https://technet.microsoft.com/en-us/library/Bb742436.aspx">Tracking Logon and Logoff Activity in Windows 2000</a>, Microsoft.

</li>

<li id="cite_note-4"><a href="#cite_ref-4">^</a> <a rel="nofollow" class="external text" href="http://www.windowsitpro.com/Windows/Article/ArticleID/40022/40022.html">Capturing IP Addresses for Web Server Logon Events</a>, Randy Franklin Smith, Windows IT Pro, October 2003.

</li>

<li id="cite_note-Audit_Policy_Categories-5"><a href="#cite_ref-Audit_Policy_Categories_5-0">^</a> <a rel="nofollow" class="external text" href="https://www.ultimatewindowssecurity.com/securitylog/book/page.aspx?spid=chapter2">Auditing Policy Categories</a>, UltimateWindowsSecurity.com.

</li>

<li id="cite_note-6"><a href="#cite_ref-6">^</a> <a rel="nofollow" class="external text" href="http://www.infosecwriters.com/text_resources/pdf/top5-log-analysis-mistakes.pdf">“Five Mistakes of Security Log Analysis”</a>, Anton Chuvakin, Ph.D., GCIA, GCIH.

</li>

<li id="cite_note-7"><a href="#cite_ref-7">^</a> <a rel="nofollow" class="external text" href="http://www.windowsitpro.com/WindowsSecurity/Article/ArticleID/42811/42811.html">Access Denied: Letting Users View Security Logs</a>, Randy Franklin Smith, July 2004 -- intermittently broken link as of 2007-9-27.

</li>

<li id="cite_note-Winzapper-8">^ <a href="#cite_ref-Winzapper_8-0">a</a> <a href="#cite_ref-Winzapper_8-1">b</a> <a rel="nofollow" class="external text" href="http://www.ntsecurity.nu/toolbox/winzapper/">Winzapper FAQ</a>, NTSecurity.

</li>

<li id="cite_note-9"><a href="#cite_ref-9">^</a> <a rel="nofollow" class="external text" href="https://www.loggly.com/ultimate-guide/centralizing-windows-logs">Ultimate Guide to Logging</a>, loggly.com

</li>

<li id="cite_note-Benton-10">^ <a href="#cite_ref-Benton_10-0">a</a> <a href="#cite_ref-Benton_10-1">b</a> <a rel="nofollow" class="external text" href="http://nsi.arcert.gov.ar/webs/textos/ntaudit.pdf">Auditing Windows NT</a> <a rel="nofollow" class="external text" href="https://web.archive.org/web/20120208113606/http://nsi.arcert.gov.ar/webs/textos/ntaudit.pdf">Archived</a> 2012-02-08 at the <a href="Wayback_Machine" title="Wayback Machine">Wayback Machine</a>, Chris Benton.

</li>

<li id="cite_note-11"><a href="#cite_ref-11">^</a> <a rel="nofollow" class="external text" href="http://www.ultimatewindowssecurity.com/ebookChapter2.html">Ultimate Windows Security</a>, Randy Franklin Smith. <a rel="nofollow" class="external text" href="https://web.archive.org/web/20220314030345/https://www.ultimatewindowssecurity.com/ebookChapter2.html">Archived</a> 2022-03-14 at the <a href="Wayback_Machine" title="Wayback Machine">Wayback Machine</a>

</li>

<li id="cite_note-Auditing_Policy-12"><a href="#cite_ref-Auditing_Policy_12-0">^</a> <a rel="nofollow" class="external text" href="http://technet2.microsoft.com/windowsserver/en/library/962f5863-15df-4271-9ae0-4b0412e297491033.mspx?mfr=true">Auditing Policy</a>, Microsoft. <a rel="nofollow" class="external text" href="https://web.archive.org/web/20071227084909/http://technet2.microsoft.com/WindowsServer/en/library/962f5863-15df-4271-9ae0-4b0412e297491033.mspx?mfr=true">Archived</a> 2007-12-27 at the <a href="Wayback_Machine" title="Wayback Machine">Wayback Machine</a>

</li>

<li id="cite_note-13"><a href="#cite_ref-13">^</a> <a rel="nofollow" class="external text" href="http://www.microsoft.com/technet/security/midsizebusiness/topics/serversecurity/attackdetection.mspx">Security Monitoring and Attack Detection</a>, Microsoft, Aug. 29, 2006.

</li>

<li id="cite_note-14"><a href="#cite_ref-14">^</a> <a rel="nofollow" class="external text" href="http://msdn2.microsoft.com/en-us/library/ms731669.aspx">Auditing Security Events</a>, Microsoft.

</li>

<li id="cite_note-15"><a href="#cite_ref-15">^</a> <a rel="nofollow" class="external text" href="http://book.itzero.com/read/microsoft/0507/microsoft.press.microsoft.windows.internals.fourth.edition.dec.2004.internal.fixed.ebook-ddu_html/0735619174/ch08lev1sec4.html">Microsoft Windows Internals</a>, Microsoft.

</li>

<li id="cite_note-16"><a href="#cite_ref-16">^</a> <a rel="nofollow" class="external text" href="https://learn.microsoft.com/en-us/windows/win32/api/authz/nf-authz-authzinstallsecurityeventsource">AuthzInstallSecurityEventSource Function</a>, Microsoft.

</li>

<li id="cite_note-17"><a href="#cite_ref-17">^</a> <a rel="nofollow" class="external text" href="http://www.eventlogmanager.com/subpass/newsletter/april06.htm">EventTracker Newsletter</a>, April 2006, Will your log files stand up in court? Authentication vs. logon events? <a rel="nofollow" class="external text" href="https://web.archive.org/web/20070621191038/http://www.eventlogmanager.com/subpass/newsletter/april06.htm">Archived</a> 2007-06-21 at the <a href="Wayback_Machine" title="Wayback Machine">Wayback Machine</a>

</li>

</ol></div></div>

<div class="mw-heading mw-heading2"><h2 id="External_links">External links</h2></div>

<ul><li><a rel="nofollow" class="external text" href="http://support.microsoft.com/kb/947226">Description of security events in Windows Vista and in Windows Server 2008</a></li>

<li><a rel="nofollow" class="external text" href="http://www.microsoft.com/downloads/details.aspx?FamilyID=82e6d48f-e843-40ed-8b10-b3b716f6b51b">Description of security events in Windows Vista and in Windows Server 2008 (XLS)</a></li></ul></div><div><div class="zim-footer">

This article is issued from <a class="external text" title="Last edited on 2023-11-16" href="https://en.wikipedia.org/wiki/?title=Windows_Security_Log&oldid=1185418121">Wikipedia</a>. The text is available under <a class="external text" href="https://creativecommons.org/licenses/by-sa/4.0/deed.en">Creative Commons Attribution-Share Alike 4.0</a> unless otherwise noted. Additional terms may apply for the media files.

</div>

</div></div>

</div>

</main>

</div>

</body></html>