Spotting the Adversary with Windows Event Log Monitoring

5985:TCP:192.168.1.2:Enabled:Windows Remote Management
This rule ensures that connections between Windows XP clients using WinRM are blocked.
2.7.2 Collector Firewall Modification
As done in the Source Firewall Modifications section, repeat the steps for the predefined WinRM rule.
Setting the Predefined set of computers option to Local subnet is recommended. This rule can be
changed to best suit your environment.
Figure 20: The Event Collector Firewall allowing Local subnet to Connect
Group Policy Firewall Problem
While viewing a subscription in Event Viewer, the following error may appear. As the dialog states, a
firewall exception needs to be applied. Verify that when you enabled the predefined firewall rules via a
Group Policy that the firewall profile for the rule is enabled as well.
A more detailed error message can be obtained by providing the name of the desired subscription
(subscriptionID):
wecutil get-subscriptionruntimestatus SubscriptionID
2.8 Disabling WinRM and Windows Collector Service
Windows Remote Management (WinRM) and Event Forwarding can be stopped from operating in the
network. The collector needs to halt and disable the Windows Event Collector and Windows Remote
Management services. These services can be stopped in the Services Microsoft Management Console
(MMC) snap-in. The subscriptions created in the Event Viewer should be disabled on the log aggregation
server.
To disable collection of events on the server:
21