Mastering Windows Network Forensics and Investigation

Chapter 14: Other Audit Events

Chapter Topics:

• Logging of Modifications to Groups, Accounts, Policies

• Object Access Logs

Changes to Accounts (Win XP)

• Event ID 624 records account creation

• Event ID 642 records changes to existing accounts

• Event ID 626 shows accounts being activated

Changes to Accounts(Win Vista +)

• Event ID 4720records account creation

• Event ID 4738 records changes to existing accounts

• Event ID 4722 shows accounts being activated

Changes to Accounts(Win XP)

• New Account Name is account being modified

• Caller User Name is account causing action

Changes to Accounts(Win Vista +)

• New Account: Account Name is account being modified

• Subject: Security ID is account causing action

Changes to Accounts

Changes to Accounts

Changes to Groups

• Changes to group membership are common ways to increase an attacker’s privilege level

• These events generate logs with the Event ID based on the type of group

Changes to Groups

Vista +Event ID

Win XP/2003 Event ID

Action Indicated

4728 632 Member added to global security group

4729 633 Member removed from global security group

4732 636 Member added to local security group

4733 637 Member removed from local security group

4746 650 Member added to local distribution group

4747 651 Member removed from local distribution group

4751/4761 655 Member added to global distribution group

4752 656 Member removed from global distribution group

4756 660 Member added to universal security group

4757 661 Member removed from universal security group

N/A 665 Member added to universal distribution group

4762 666 Member removed from universal distribution group

Changes to Groups(Win XP)

• The account that is impacted (added or removed from a group) is called the Member ID

• Group that is changed is called the Target Account Name

• The account that initiated the change is called the Caller User Name

Changes to Groups(Win Vista +)

• The account that is impacted (added or removed from a group) is called the Member: Security ID

• Group is the group that is changed

• The account that initiated the change is called the Account Name

Changes to Groups

Changes to Audit Policy

• Event ID 612 shows the end result of a change in audit policy

Changes to Audit Policy

• Event ID 4719 shows the end result of a change in audit policy

Object Access

• Objects include files, folders, printers, etc.

• Auditing must be configured for each object

• The object handle can be used to correlate related events in the event log

Object Access(Win XP)

• Event ID 560 records opening of handles

• Event ID 562 records closing of handles

• Event ID 567 shows which access permissions were actually used

Object Access(Win Vista+)

• Event ID 4656 records opening of handles

• Event ID 4658 records closing of handles

• Event ID 4657 shows which access permissions were actually used

Object Access

Object Access

Object Access

Object Access

Object Access

Object Access

Object Access

Object Access