Analysis and Evaluation of the Windows Event Log - Bill Buchanan

Barrie Codona, BSc (Hons) Network Computing, 2007
in which case the program automatically replaces the Security Event Log with a
predetermined file and then restarts the service.
Experiment 8 – Master File Table. For this experiment a program called Directory
Snoop was used in conjunction with the Hex Editor. Directory Snoop
(http://www.briggsoft.com/dsnoop.htm) is an application that allows for the
inspection of the NTFS Master File Table. Which, as previously discussed in the
Literature Review chapter, is a relation database that contains information about every
file on the local disk Directory Snoop was used to find the actual sectors of the local
disk that was allocated to the Security Log. This sector was then opened up with the
Hex Editor and some changes were made to the timestamp data. Upon viewing this
information with the Directory Snoop it showed that the changes had actually been
made, however when the Event Viewer was opened up it did not show these changes.
This implied that that when the Event Log Service is first started it reads the contents
of the event logs from disk into memory and does not read them again until it is
restarted.
The server was then restarted to force the event log to reread the modified sectors,
once again the Event Viewer was opened, however the changes had not taken effect.
Directory Snoop was again used to check the sectors that had been modified and it
showed that they had been restored to their original values. The Event Logging
Service must have completely written the contents of its array in memory back to
disk.
3.5 Conclusions
From the above experiments multiple vulnerabilities have been identified, it is
possible to change the time that events happened at, usernames can be modified, the
event log can be copied and pasted into another machine. The most surprising points
learned was that there is no security in the event log at all, no hashing to see if it had
been modified and nothing to stop an event log from one machine being used on
another.
Being able to modify the event log only involved having access to the Security Event
Log file and then modifying the data contained within. Thus, if the Event Log files
28