# Windows Event Logs & Finding Evil

### Windows Event Logs

**Windows Event Logging Basics**

`Windows Event Logs` are an intrinsic part of the Windows Operating System, storing logs from different components of the system including the system itself, applications running on it, ETW providers, services, and others.

Windows event logging offers comprehensive logging capabilities for application errors, security events, and diagnostic information. As cybersecurity professionals, we leverage these logs extensively for analysis and intrusion detection.

The logs are categorized into different event logs, such as “Application”, “System”, “Security” and others, to organize events based on their source or purpose.

Event logs can be be accessed using the `Event Viewer` application or programmatically using APIs such as the Windows Event Log API.

Accessing the `Windows Event Viewer` as an administrative user allows us to explore the various logs available.

![Windows search for 'Event Viewer' showing options: Open, Run as administrator, Open file location, Pin to Start, Pin to taskbar.](https://academy.hackthebox.com/storage/modules/216/image42.png align="center")

![Windows Logs showing Application, Security, Setup, System, and Forwarded Events with event counts and sizes.](https://academy.hackthebox.com/storage/modules/216/image1.png align="center")

The default Windows event logs consist of `Application, Security, Setup, System`, and `Fowarded Events`. While the first four logs cover application errors, security events, system setup activities, and general system information, the “Forwarded Events” section is unique, showcasing event log data forwarded from other machines. This central logging feature proves valuable for system administrators who desire a consolidated new. In our current analysis, we focus on event logs from a single machine.

It should be noted, that the Windows Event Viewer has the ability to open and display previously saved `.evtx` files, which can be then found in the “Saved Logs” section.

![Event Viewer displaying DLLHijack logs with details of Sysmon events, including registry value changes and process information.](https://academy.hackthebox.com/storage/modules/216/image89.png align="center")

**The Anatomy of an Event Log**

When examining `Application` logs, we encounter two distinct levels of events: `information` and `error`.

![Icons for Information and Error with counts.](https://academy.hackthebox.com/storage/modules/216/image2.png align="center")

Information events provide general usage details about the application, such as its start or stop events. Conversely, error events highlight specific errors and often offer detailed insights into the encountered issues.

![Event Viewer error for SideBySide, Event ID 35, detailing activation context generation failure for Visual Studio with processor architecture mismatch.](https://academy.hackthebox.com/storage/modules/216/image3.png align="center")

Each entry in the Windows Event Log is an “Event” and contains the following primary components:

1. `Log Name`: The name of the event log (e.g., Application, System, Security, etc.).
    
2. `Source`: The software that logged the event.
    
3. `Event ID`: A unique identifier for the event.
    
4. `Task Category`: This often contains a value or name that can help us understand the purpose or use of the event.
    
5. `Level`: The severity of the event (Information, Warning, Error, Critical, and Verbose).
    
6. `Keywords`: Keywords are flags that allow us to categorize events in ways byond the other classification options. These are generally broad categories, such as “Audit Success” or “Audit Failure” int the Security log.
    
7. `User`: The user account that was logged on when the event occurred.
    
8. `OpCode`: This field can identify the specific operation that the event reports.
    
9. `Logged`: The date and time when the event was logged.
    
10. `Computer`: The name of the computer the event occurred.
    
11. `XML Data`: All the above information is also included in an XML format along with additional event data.
    

The `Keywords` field is particularly useful when filtering event logs for specific types of events. It can significantly enhance the precision of search queries by allowing us to specify events of interest, thus making log management more efficient and effective.

Taking a closer look at the event log above, we observe several crucial elements. The `Event ID` in the top left corner serves as a unique identifier, which can be further researched on Microsoft’s website to gather additional information. The “SideBySide” label next to the event ID represents the event source. Below, we find the general error description, often containing rich details. By clicking on the details, we can further analyze the event’s impact using XML or a well-formatted view.

![Event Viewer details for SideBySide, Event ID 35, showing provider, version, level, and creation time.](https://academy.hackthebox.com/storage/modules/216/image4.png align="center")

Additionally, we can extract supplementary information from the event log, such as the process ID where the error occurred, enabling precise analysis.

![Event Viewer details showing SystemTime, EventRecordID 1773, ProcessID 636, ThreadID 0, on computer ARASHPARSA2BB9.](https://academy.hackthebox.com/storage/modules/216/image5.png align="center")

Switching our focus to security logs, let’s consider event ID 4624, a commonly occurring event (detailed at [https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4624](https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4624)).

![Event Viewer log for Event 4624, Microsoft Windows security auditing, showing successful account logon with Security ID SYSTEM, Account Name ARASHPARSA2BB9$, and Logon Type 5.](https://academy.hackthebox.com/storage/modules/216/image6.png align="left")

According to Microsoft’s documentation, this event signifies the creation of a logon session on the destination machine, originating from the accessed computer where the session was established. Within this log, we find crucial details, including the “Logon ID”, which allows us to correlate this logon with other events sharing the same “Logon ID”. Another important details the “Logon Type”, indicating the type of logon. In this case, it specifies a Service logon type, suggesting that “SYSTEM” initiated a new service. However, further investigation is required to determine the specific service involved, utilizing correlation techniques with additional data like the “Logon ID”.

**Leveraging Custom XML Queries**

To streamline our analysis, we can create custom XML queries to identify related events using the “Logon ID” as a starting point. By navigating to “Filter Current Log” —> “XML” —> “Edit Query Manually,” we gain access to a custom XML query language that enables more granular log searches.

![Event Viewer filter setup with XML query for Security log, filtering by SubjectLogonId 0x3E7.](https://academy.hackthebox.com/storage/modules/216/image7.png align="center")

In the example query, we focus on events containing the “SubjectLogonId” field with a value of “0×3E7”. The selection of this value stems from the need to correlate events associated with a specific “Logon ID” and understand the relevant details within those events.

![Event 4624 details: SubjectUserName ARASHPARSA2BB9$, SubjectDomainName WORKGROUP, TargetUserName SYSTEM, LogonType 5, LogonProcessName Advapi.](https://academy.hackthebox.com/storage/modules/216/image8.png align="center")

It is worth noting that if assistance is required in crafting the query, automatic filters can be enabled, allowing exploration of their impact on the XML representation. For further guidance, Microsoft offers informative articles on advanced XML filtering in the Windows Event Viewer.

By constructing such queries, we can narrow down our focus to the account responsible for initiating the service and eliminate unnecessary details. This approach helps unveil a clearer picture of recent logon activities associated with the specified Logon ID. However, even with this refinement, the amount of data remains significant.

Delving into the log details progressively reveals a narrative. For instance, the analysis begins with [Event ID 4907](https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4907), which signifies audit policy change.

![Event Viewer showing Event 4907, Microsoft Windows security auditing, with audit policy change details for account ARASHPARSA2BB9$, object path, and logon ID 0x3E7.](https://academy.hackthebox.com/storage/modules/216/image9.png align="center")

With the event description, we find valuable insights, such as “This event generates when the SACL of an object (for example, a registry key or file) was changed.”

In case unfamiliar with SACL, referring to the provided link (https://docs.microsoft.com/en-us/windows/win32/secauthz/access-control-lists) sheds light on access control lists (ACLs). The “S” in SACL denotes a system access control list, which enables administrators to log access attempts to secure objects. Each Access Control Entry (ACE) within a SACL specifies the types of access attempts by a designated trustee that trigger record generation in the security event log. ACEs in a SACL can generate audit records upon failed, successful, or both types of access attempts. For more information about SACLs, see Audit Generation and SACL Access Right.”

Based on this information, it becomes apparent that the permissions of a file were altered to modify the logging or auditing of access attempts. Further exploration of the event details reveals additional intriguing aspects.

![Event 4907 details: SubjectUserName ARASHPARSA2BB9$, SubjectDomainName WORKGROUP, ObjectType File, ObjectName path, ProcessName SetupHost.exe.](https://academy.hackthebox.com/storage/modules/216/image10.png align="center")

For example, the process responsible for the change is identified as “SetupHost.exe”, indicating a potential setup process (although it’s worth noting that malware can sometimes masquerade under legitimate names). The object name impacted appears to be the “bootmanager”, and we can examine the new and old security descriptor can be accomplished through references such as the article ACE Strings and Understanding SDDL Syntax.

From the observed events, we can infer that a setup process occurred, involving the creation of a new file and the initial configuration of security permissions for auditing purposes. Subsequently, we encounter the logon event, followed by a “special logon” event.

![Event IDs 4624 Logon and 4672 Special Logon.](https://academy.hackthebox.com/storage/modules/216/image11.png align="center")

Analyzing the special logon event, we gain insights into token permissions granted to the user upon a successful logon.

![Event 4672, Microsoft Windows security auditing, showing SYSTEM account with special privileges like SeAssignPrimaryTokenPrivilege and SeDebugPrivilege.](https://academy.hackthebox.com/storage/modules/216/image12.png align="center")

A comprehensive list of privileges can be found in the documentation on privilege constants. For instance, the “SeDebugPrivilege” privilege indicates that the user possesses the ability to temper with memory that does not belong to them.

**Useful Windows Event Logs**

Find below an indicative (non-exhaustive) list of useful Windows event logs.

1. Windows System Logs
    
    * Event ID 1074 `(System Shutdown/Restart)`: This event log indicates when and why the system was shut down or restarted. By monitoring these events, you can determine if there are unexpected shutdowns or restarts, potentially revealing malicious activity such as malware inflection or unauthorized user access.
        
    * Event ID 6005 `(The Event log service was started)`: This event log marks the time when the Event Log Service was started. This is an important record, as it can signify a system boot-up, providing point for investigating system performance or potential security incidents around the period. It can also be used to detect unauthorized system reboots.
        
    * Event ID 6006 `(The Event log service was stopped)`: This event log signifies the moment when the Event Log Service was stopped. It is typically seen when the system is shutting down. Abnormal or unexpected occurrences of this event could point to intentional service disruption for covering illicit activities.
        
    * Event ID 6013 `(Windows uptime)`: This event occurs once a day and shows the uptime of system in seconds. A shorter then expected uptime could mean the system has been rebooted, which could signify a potential intrusion or unauthorized activities on the system.
        
    * Event ID 7040 `(Service status change)`: This event indicates a change in service startup type, which could be from manual to automatic or vice versa. If a crucial service’s startup type is changed, it could be a sign of system tampering.
        
2. **Windows Security Logs**
    
    * Event ID 1102 `(The audit log was cleared)`: Clearing the audit log is often a sign of an attempt to remove evidence of an intrusion or malicious activity.
        
    * Event ID 1106 `(Antivirus malware detection)`: This event is particularly important because it logs when Defender detects a malware. A surge in these events could indicate a targeted attack or wide spread malware infection.
        
    * Event ID 1108 `(Antivirus remediation activity has started)`: This event signifies that Defender has begun the process of removing or quarantining detected malware. It’s important to monitor these events to ensure that remediation activities are successful.
        
    * Event ID 1119 `(Antivirus remediation activity has succeeded)`: This event signifies that the remediation process for detected malware has been successful. Regular monitoring of these events will help ensure that identified threats are effectively neutralized.
        
    * [Event ID 1120](https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide) `(Antivirus remediation activity has failed)`: This event is the counterpart to 1119 and indicates that remediation process has failed. These events should be closely monitored and addressed immediately to ensure threats are effectively neutralized.