Spotting the Adversary with Windows Event Log Monitoring

The XPath queries below are used for the Event Viewer’s Custom Views.
EventID Log Level LogonType Authentication Package Name
4624 Security Information 10 Negotiate
528 Security Information 10 Negotiate
Windows 7
*[System[(Level=4 or Level=0) and (EventID=4624)]]
and
*[EventData[Data[@Name='AuthenticationPackageName'] = 'Negotiate']]
and
*[EventData[Data[@Name='LogonType'] and (Data='10')]]
Windows XP
*[System[(Level=4 or Level=0) and (EventID=528)]]
and
*[EventData[Data[6] = 'Negotiate' and Data[4]=10]]
The only difference between the above two queries is the event ID. Windows 7 and Windows XP
respectively have event ID 4624 and 528 to indicate a successful logon. A LogonType with the value of
10 indicates a Remote Interactive logon. [51]
5 Event Log Retention
It is recommended that the forwarded events log file on the server designated as the central point for
log collection is set to a size of approximately 1GB and enable the Archive the log when full, do not
overwrite events policy to control the behavior when the event log has reach capacity. The theoretical
maximum log file size for the forwarded events log on Windows Server 2008 R2 is 2 terabytes [52] , but as
the log file becomes larger the Event Viewer UI takes longer to load and show results for custom views.
Depending on the size of the network, a 1GB forwarded events log file can hold anywhere from a few
hours to a few days worth of log data. Due to this size limitation, it is important to review the log
regularly (once a day) and setup archiving, or alternatively feed the log data into some larger Security
Information Event Management (SIEM) system.
Client workstations and servers should be following the existing DISA STIG for setting the size of other
log files (Application, System, Setup, and Security). [53][54][55]
51 http://msdn.microsoft.com/en-us/library/windows/desktop/aa380129(v=vs.85).aspx
52 http://technet.microsoft.com/en-us/library/hh125924(v=ws.10).aspx
53 DISA STIG: Windows XP Security Technical Implementation Guide Version 6. Group ID (Vulid): V-1118
54 DISA STIG: Windows 7 Security Technical Implementation Guide Version 1. Group ID (Vulid): V-26579, V-26580, V-26581, V-26582
55 DISA STIG: Windows Server 2008 R2 Security Technical Implementation Guide Version 1. Group ID (Vulid): V-26579, V-26580, V-26581, V-
26582
36