Spotting the Adversary with Windows Event Log Monitoring

Figure 8: Enabling WinRM listeners
Figure 9: WinRM listener's IP Filter Options
Within the Allow automatic configurations of listeners dialog, the IPv4/IPv6 filter values should be set
to *. This ensures that WinRM starts running and listens on the “any” IP address (IPv4 is 0.0.0.0 and IPv6
is “::”) for both protocols. The IPv6 filter is not required to enable a WinRM listener. Enabling an IPv6
listener is an administrative decision. The WinRM service only listens on an IPv4 address when no IPv6
address (or *) is supplied for the filter.
2.4.3 Enabling Event Forwarding Policy
The source needs to be configured to forward events to the targeted subscription manager. The
subscription manager (collector) hosts all the subscriptions created on the collector. The source needs
to contact the manager to retrieve the list of subscriptions. These subscriptions specify the events to
forward. Once the source gathers all the events pertaining to these subscriptions, the events will be
delivered to the collector.
The Configure the server address, refresh interval, and issuer certificate authority of a target policy
sets the configuration settings on how to communicate with the collector. This policy sets the collector’s
internet address, how often to send events to the collector, and a thumbprint of the client’s certificate if
using HTTPS. This policy must be enabled to forward events.
Event Forwarding is the main component for enabling event monitoring in an enterprise. Event
Forwarding policies can be located by navigating to Computer Configuration > Policies > Administrative
Templates > Windows Components > Event Forwarding.
To enable Event Forwarding:
1. Set the Configure the server address, refresh interval, and issuer certificate authority of a
target Subscription Manager policy to Enabled
2. Click the Show… button
13