Tracing attacks with Windows event logs
You read logons, process starts and lateral movement in Security, System, PowerShell and Sysmon logs, and sweep EVTX files against Sigma rules with Chainsaw and Hayabusa.
Level 301 · 19 lessons · 15 practice labs
Lessons
EVTX basics
- EVTX files: channels, event IDs and the XML structure
- Parsing EVTX on Linux with evtx_dump and EvtxECmd
- Audit policy: which events get logged and which do not
- Short task: list the 10 most frequent event IDs in a log
Logons and accounts
- 4624 and 4625: logon types and source address
- 4768, 4769 and 4776: Kerberos and NTLM authentication traces
- Account creation, group membership and privilege changes
- RDP and lateral movement: 4778, 1149 and TerminalServices logs
- Short task: map the machines one account jumped to
Processes and scripts
- 4688 and command-line logging
- Sysmon events: process, network, file creation and registry
- PowerShell script block and module logging (4104)
- New service (7045) and scheduled task (4698) events
- Log clearing (1102, 104) and quietly stopped logging
- Short task: decode an encoded PowerShell command and explain what it did
Hunting at speed
- Sigma rules: a shared detection language for logs
- Sweeping EVTX with Sigma rules using Chainsaw
- A timeline from event logs with Hayabusa
- Capstone: trace the path of a domain compromise through event logs
Practice labs
- The ten most frequent event ids: Parse an EVTX file and count the ten most frequent event ids.
- Parse EVTX to CSV: Convert the Security log to CSV with evtx_dump or EvtxECmd and map one event's XML fields.
- Blind spots in the audit policy: Work out which audit settings are off from the event types that never appear in the log.
- Separate the logon types: Count 4624 events by logon type and separate network and remote desktop logons.
- Account creation and group addition: Show the newly created account and the moment it joined the administrators group with the relevant events.
- Kerberos and NTLM authentication traces: From 4768, 4769 and 4776 events derive which services an account requested tickets for and where it fell back to NTLM.
- List the RDP sessions: List the remote desktop sessions with source addresses from the TerminalServices logs.
- Map the machines an account hopped to: Combine three machines' logs to draw in what order an account moved where.
- New service and scheduled task events: Find the remotely created service and task from 7045 and 4698 events and match them to the logon event.
- Extract command lines from 4688: List the command lines with parent processes from process creation events.
- Decode an encoded PowerShell command: Decode the Base64 command in a 4104 script block and explain what it does in two sentences.
- Build a process-to-network chain with Sysmon: Link Sysmon process, network and file creation events by process id into one chain.
- Find the log clearing event: Search for 1102 and 104 events and report who cleared the log and when.
- A Sigma scan with Chainsaw: Scan an EVTX folder with Sigma rules and validate the five most important matches.
- Trace the path of a domain compromise: With a Hayabusa timeline and raw events, report the path from first logon to administrator rights in the Saklıvadi Üniversitesi lab domain.
About this course
You read logons, process starts and lateral movement in Security, System, PowerShell and Sysmon logs, and sweep EVTX files against Sigma rules with Chainsaw and Hayabusa.
What you will learn
- EVTX basics
- Logons and accounts
- Processes and scripts
- Hunting at speed
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run on your own Kali Linux desktop in the browser, with the tools ready in their windowed interfaces. Nothing to install; a computer screen is recommended.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.