Windows Event Log Analysis for Advanced Threat Detection başlıklı kaynağın profesyonel teknik özetidir. Aşağıda belgenin ana başlık ve içerik yapısı Türkçe açıklamalarla sunulmuştur.
Executive Summary 3 Understanding Windows Event Log Architecture 3 Event Log Fundamentals 3 Critical Security Event IDs for Threat Detection 4 Authentication and Logon Events 4 Privilege Escalation Indicators 6 Advanced Threat Detection Patterns 6 Lateral Movement Detection 6 Persistence Mechanism Detection 9 Event Log Correlation and Timeline Analysis 12 Building Attack Timelines 12 Cross-System Correlation 15 Automated Threat Hunting with Event Logs 18 Machine Learning-Based Anomaly Detection 18 Event Log Forensics and Incident Response 22 Evidence Collection and Preservation 22 Chain of Cus...
tody Documentation 25 Performance Optimization and Scalability 28 High-Performance Event Log Querying 28 Security Information and Event Management (SIEM) Integration 31 Log Forwarding and Centralization 31 SIEM Rule Development 32 Compliance and Regulatory Requirements 34 Event Log Retention Policies 34 Audit Configuration Scripts 34 Best Practices and Recommendations 36 Security Event Log Monitoring Checklist 36 Log Volume Estimation and Sizing 37 Performance Tuning Recommendations 37 Related Articles and Resources 39 Executive Summary Windows Event Logs serve as the digital forensic backbone...
of enterprise security operations, capturing every system activity, authentication attempt, and security-relevant action across Windows infrastructure. Mastering event log analysis transforms raw data into actionable threat intelligence, enabling security teams to detect sophisticated attacks, investigate incidents, and maintain regulatory compliance. This comprehensive guide explores advanced Windows Event Log analysis techniques, from understanding the underlying architecture to implementing automated threat detection systems. We'll cover critical security event IDs, correlation strategies,...
and practical investigation workflows that security professionals need to identify and respond to modern cyber threats effectively. Understanding Windows Event Log Architecture Event Log Fundamentals Windows Event Logs operate through a sophisticated architecture that captures system, application, and security activities across the enterprise: Core Event Log Categories Windows maintains several critical log categories: Log Category Primary Purpose Default Location Key Securi ty Event s Security Authenticatio n, authorization , audit events %SystemRoot%\System32\Winevt\Log s\Security.evtx 4624...
, 4625, 4648, 4672 System System component events, driver issues %SystemRoot%\System32\Winevt\Log s\System.evtx 7045, 7040, 1074 Application Application-s pecific events %SystemRoot%\System32\Winevt\Log s\Application.evtx 1000, 1001, 1002 PowerShell/Opera tional PowerShell command execution Microsoft-Windows-PowerShell%4Op erational.evtx 4103, 4104, 4105 Sysmon Detailed system activity monitoring Microsoft-Windows-Sysmon%4Operat ional.evtx 1, 3, 7, 10, 11 Windows Defender Antimalware activities Microsoft-Windows-Windows Defender%4Operational.evtx 1116, 1117, 5001 Critical Security Event IDs fo...
r Threat Detection Authentication and Logon Events Understanding authentication patterns is crucial for detecting unauthorized access: powershell # PowerShell script to analyze authentication events function Analyze-AuthenticationEvents { param( [string]$ComputerName = $env:COMPUTERNAME, [int]$Hours = 24 ) $StartTime = (Get-Date).AddHours(-$Hours) # Critical authentication event IDs $AuthEventIDs = @{ 4624 = "Successful Logon" 4625 = "Failed Logon" 4634 = "Logoff" 4648 = "Explicit Credential Logon" 4672 = "Special Privileges Assigned" 4768 = "Kerberos TGT Request" 4769 = "Kerberos Service Tick...
et Request" 4771 = "Kerberos Pre-authentication Failed" 4776 = "NTLM Authentication" } $Results = @() foreach ($EventID in $AuthEventIDs.Keys) { $Events = Get-WinEvent -FilterHashtable @{ LogName = 'Security' ID = $EventID StartTime = $StartTime } -ComputerName $ComputerName -ErrorAction SilentlyContinue if ($Events) { $EventAnalysis = $Events | Group-Object -Property { $_.Properties[5].Value # Account Name } | Select-Object @{ Name = 'EventType' Expression = {$AuthEventIDs[$EventID]} }, @{ Name = 'Account' Expression = {$_.Name} }, Count | Sort-Object Count -Descending $Results += $EventAnaly...
sis } } return $Results | Format-Table -AutoSize } # Example usage Analyze-AuthenticationEvents -Hours 48 Privilege Escalation Indicators Key events indicating potential privilege escalation: Event ID Description Security Significance Investigation Priority 4672 Special privileges assigned to new logon Administrative access granted Critical 4673 Privileged service called Sensitive privilege use High 4674 Operation attempted on privileged object Potential privilege abuse High 4688 New process created (with token elevation) Process creation with elevated privileges Medium 4703 Token right adjust...
ed User rights modification High 4728 Member added to security-enabled global group Group membership changes Critical 4732 Member added to security-enabled local group Local admin additions Critical 4756 Member added to security-enabled universal group Domain-wide privilege changes Critical Advanced Threat Detection Patterns Lateral Movement Detection Identifying lateral movement requires correlating multiple event sources: powershell # Advanced lateral movement detection script function Detect-LateralMovement { [CmdletBinding()] param( [DateTime]$StartTime = (Get-Date).AddHours(-24), [string[...
]]$Computers = @($env:COMPUTERNAME) ) $LateralMovementIndicators = @{ # Network logons from unusual sources NetworkLogons = @{ EventID = 4624 LogonType = 3 # Network logon } # Explicit credential usage ExplicitCredentials = @{ EventID = 4648 } # Remote Desktop connections RDPConnections = @{ EventID = @(4624, 4778, 4779) LogonType = 10 # RemoteInteractive } # Service installations (PsExec-like behavior) ServiceInstallations = @{ EventID = 7045 LogName = 'System' } # WMI Activity WMIActivity = @{ EventID = 5857 LogName = 'Microsoft-Windows-WMI-Activity/Operational' } # PowerShell Remoting PSRem...
oting = @{ EventID = @(4103, 4104) LogName = 'Microsoft-Windows-PowerShell/Operational' } } $DetectedMovements = @() foreach ($Computer in $Computers) { Write-Host "Analyzing $Computer for lateral movement..." -ForegroundColor Cyan # Check for network logons with suspicious patterns $NetworkLogons = Get-WinEvent -FilterHashtable @{ LogName = 'Security' ID = 4624 StartTime = $StartTime } -ComputerName $Computer -ErrorAction SilentlyContinue | Where-Object { $_.Properties[8].Value -eq 3 -and # Network logon $_.Properties[5].Value -notlike "*$" -and # Not computer account $_.Properties[18].Value ...
-ne '-' -and # Has source IP $_.Properties[18].Value -notmatch '^(127\.|::1)' # Not localhost } if ($NetworkLogons) { $DetectedMovements += [PSCustomObject]@{ Computer = $Computer Type = "Network Logon" Count = $NetworkLogons.Count UniqueAccounts = ($NetworkLogons | ForEach-Object {$_.Properties[5].Value} | Select-Object -Unique).Count SourceIPs = $NetworkLogons | ForEach-Object {$_.Properties[18].Value} | Select-Object -Unique } } # Check for service installations $ServiceInstalls = Get-WinEvent -FilterHashtable @{ LogName = 'System' ID = 7045 StartTime = $StartTime } -ComputerName $Computer ...
Belge toplam 15 paragraf içermektedir; tam metin /root/pdf klasöründeki kaynak dosyasında mevcuttur.