Windows logs and Sysmon

Where the logs are

• .evtx files in C:\Windows\System32\winevt\Logs\.
• Main ones: Security, System, Application, then Microsoft-Windows-Sysmon/Operational and Microsoft-Windows-PowerShell/Operational.
• Many useful events require the matching audit policy to be enabled (advanced auditing).

Event IDs to know

IDs, logon types and Sysmon events are gathered in a cheat sheet you can study with the revision mode.

Sysmon

Sysmon greatly increases visibility. It is configured through an XML file; the public configurations by SwiftOnSecurity or Olaf Hartong are good starting points.

The events to remember (1, 3, 10, 11, 22…) are in the Event IDs cheat sheet.

What should catch your eye

• A burst of 4625 on one account or from one IP: brute force or password spraying.
• Unusual parent: winword.exe or excel.exe launching powershell.exe or cmd.exe.
• Encoded PowerShell (-enc), downloads from the Internet, obfuscated content in 4104.
• Access to lsass.exe (Sysmon 10) by a process that has no business there.
• New service, new scheduled task or Run key: possible persistence.
• Many 4769 requests with RC4 encryption: a possible attack on service accounts.
• Event 1102: someone is covering their tracks.

Querying logs with PowerShell

# The last 20 failed logons
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} -MaxEvents 20
# Processes created in the last hour (Sysmon)
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Sysmon/Operational'; Id=1; StartTime=(Get-Date).AddHours(-1)}
# Read an exported .evtx file
Get-WinEvent -Path .\Security.evtx | Where-Object Id -eq 4624