Spotting the Adversary with Windows Event Log Monitoring

ID Level Event Log Event Source
Firewall Rule Add 2004 Informational Microsoft-Windows-
Windows Firewall
With Advanced
Security/Firewall
Firewall Rule
Change
Firewall Rules
Deleted
Firewall Failed to
load Group Policy
Windows XP
2005 Informational Microsoft-Windows-
Windows Firewall
With Advanced
Security/Firewall
2006,
2033
Informational
Microsoft-Windows-
Windows Firewall
With Advanced
Security/Firewall
2009 Error Microsoft-Windows-
Windows Firewall
With Advanced
Security/Firewall
Table 10: Windows 7 Firewall Events
Microsoft-Windows-Windows
Firewall With Advanced
Security
Microsoft-Windows-Windows
Firewall With Advanced
Security
Microsoft-Windows-Windows
Firewall With Advanced
Security
Microsoft-Windows-Windows
Firewall With Advanced
Security
Windows Firewall port exception
list change
Windows Firewall application
exception list change
The Windows Firewall logging
settings have changed
ID Type Event Log Event Source
852 Success Audit Security Security
851 Success Audit Security Security
854 Success Audit Security Security
Table 11: Windows XP Firewall Events
The above events for the listed versions of the Windows operating system are only applicable to
modifications of the local firewall settings.
The Windows Firewall raises certain events when modification of its configuration occurs. Deletion of a
firewall rule on Windows XP will raise an event based on the rule type. However, no unique firewall rule
deletion event is recorded. When an application (851) or port (852) firewall rule changes, the respective
event will annotate the cause of the change in the Change type field. The Change type field will state
Remove when a rule is deleted.
4.5 Clearing Event Logs
It is unlikely that event log data would be cleared during normal operations and it is likely that a
malicious attacker may try to cover their tracks by clearing the event log. When the event log gets
cleared, it is suspicious. Centrally collecting events has the added benefit of making it much harder for
an attacker to cover their tracks. Using redundant collection servers can also reduce concern of a single
point of failure.
Windows 7
31