Spotting the Adversary with Windows Event Log Monitoring

1 Introduction
It is increasingly difficult to detect malicious activity, which makes it extremely important to monitor and
collect log data from as many useful sources as possible. This paper provides an introduction to
collecting important Windows workstation event logs and storing them in a central location for easier
searching and monitoring of network health.
The focus of this guidance document is to assist the United States Government and Department of
Defense administrators in configuring central event log collection and recommend a basic set of events
to collect on an enterprise network using Group Policy.
Many commercially available tools exist for central event log collection, but this paper focuses on using
the built-in tools already available in the Microsoft Windows operating system (OS). Central event log
collection requires a Windows server operating system version 2003 R2 or above. Using a Windows
Server 2008 R2 or above server is recommended. There are no additional licensing costs for using the
event log collection feature. The cost of using this feature is based on the amount of additional storage
hardware needed to support the amount of log data collected. This factor is dependent on the number
of workstations within the log collection network.
The Windows operating system includes monitoring capabilities and logs data for most activities
occurring within the operating system. The vast amount of logged events does not make it easy for an
administrator to identify specific important events. This document defines a recommended set of events
to collect and review on a frequent basis. The recommended set of events is common to both client and
server versions of Windows. Product specific events, such as Microsoft Exchange or Internet Information
Services (IIS), are not discussed in the document, but should be centrally collected and reviewed as well.
This guidance document is broken into three main parts. The first part, Deployment, focuses on
configuring and deploying central log collection; the second part, Hardening Event Collection,
concentrates on security hardening; the last section, Recommended Events to Collect, describes
recommended events that should be collected. If a third party commercial product is already being used
within the organization to centrally collect events, then skip ahead to the Recommended Events to
Collect section. Review the recommended events and ensure they are being collected.
During the development of this guide, testing was done using Windows 7 and Windows XP Service Pack
3 (SP3) clients running Windows Remote Management (WinRM) 2.0. A Windows 8 client with WinRM
3.0 was also briefly tested and found to work the same as Windows 7. Windows Server 2008 R2 was
used for the central event collection server. Configuration of Windows Server 2012 should work
identically to Windows Server 2008 R2, but was not tested for this guide.
2 Deployment
The Windows Collector service has the ability to collect specific events from all domain computers for
viewing on a single computer. The Event Forwarding feature of the Windows Collector Service has the
ability to retrieve or receive events from remote computers. Event Forwarding can operate as Collector-
1