Check Your Systems For This Suspicious Activity
- Chris Yarbrough
- May 22, 2024
- 3 min read
Updated: Jun 20, 2024
Analyzing event logs is a critical step in identifying potential indicators of compromise (IoCs). Certain event IDs could be a sign of malicious activity or security breaches, making them essential for security teams to monitor. Here are some top Windows event IDs that could indicate compromise, along with best practices for investigating them.
Key Event IDs to Monitor
1. Event ID 4624 - Successful Logon
What it is: This event indicates a successful logon to a system. While this can be a normal occurrence, monitoring for unusual or unexpected logon attempts is important.
How to Investigate it:
Check the logon type to differentiate between interactive logons (user physically present) and network logons.
Look for logons at odd hours or from unusual locations.
Correlate with other events to determine if the logon is part of a larger pattern of suspicious activity.
2. Event ID 4625 - Failed Logon
What it is: This event is logged when a logon attempt fails. Multiple failed logons could indicate a brute force attack.
How to Investigate it:
Track the number of failed logon attempts in a short period.
Identify the source IP addresses and check for known malicious IPs.
Determine if the failed attempts are targeting a specific user account.
3. Event ID 4648 - Logon Attempt Using Explicit Credentials
What it is: This event is generated when a logon attempt is made using explicit credentials, often seen in pass-the-hash or pass-the-ticket attacks.
How to Investigate it:
Identify the process that initiated the logon attempt.
Look for patterns in the usage of explicit credentials.
Verify the legitimacy of the credentials being used.
4. Event ID 4670 - Permissions on an Object Were Changed
What it is: This event indicates a change in permissions on a file, folder, registry key, or other objects.
How to Investigate it:
Determine what object had its permissions changed and why.
Identify the user who made the change and whether it was authorized.
Correlate with other events to see if this is part of a privilege escalation attempt.
5. Event ID 4688 - A New Process Has Been Created
What it is: This event logs the creation of a new process, useful for detecting suspicious or unauthorized software execution.
How to Investigate it:
Identify the parent process that created the new process.
Check the executable's path and hash it to see if it matches known malware.
Monitor for unexpected or unauthorized software running on the system.
6. Event ID 4776 - The Domain Controller Attempted to Validate the Credentials for an Account
What it is: This event is logged on domain controllers and shows credential validation attempts. Multiple invalid attempts could indicate a brute force attack on user accounts.
How to Investigate it:
Track the frequency of validation attempts.
Identify the source of the attempts and if they originate from unexpected locations.
Correlate with account lockout events to identify targeted accounts.
7. Event ID 5140 - A Network Share Object Was Accessed
What it is: This event occurs when a network share is accessed, which could indicate lateral movement within a network.
How to Investigate it:
Monitor which shares are accessed and by whom.
Look for access attempts to sensitive or unusual shares.
Correlate with other access events to detect patterns of unauthorized access.
Some Best Practices for Investigating Event IDs
Establish a Baseline
Understand what normal activity looks like within your environment. This helps in identifying anomalies that could indicate a compromise.
Correlate Events
Investigate events in the context of other logs and events. Correlating data points can provide a clearer picture of potential malicious activity.
Automate Monitoring
Use Security Information and Event Management (SIEM) systems to automate the collection, correlation, and alerting of suspicious events.
Regular Audits
Regularly review and audit logs to ensure monitoring configurations are effective and to identify any overlooked events.
Enable Logging & Retain Logs
Ensure that logging is enabled for all critical systems and that logs are retained for an adequate period for analysis.
Conclusion
Monitoring specific Windows event IDs is crucial for detecting potential indicators of compromise. By understanding what each event ID represents and following best practices for investigation, security teams can effectively identify and respond to threats, ensuring the protection of their organization's assets.
What are your experiences with monitoring Windows event logs? Share your insights and strategies in the comments below!
1 bình luận