Analysis and Evaluation of the Windows Event Log - Bill Buchanan

More documents

Recommendations

Info

Barrie Codona, BSc (Hons) Network Computing, 2007 6.5 Experiment 2: Accuracy This experiment will be used to check the accuracy of the application, to ensure that all the events that are being generated are actually being captured by the application. The tester application was slightly modified to allow for an event log file to be modified, it now randomly modifies the ‘SecEvent.txt’ file. For the purpose of this experiment a text file that is contained within a different directory to the data files, that are being created, is used to represent the event log file. The directory structure is represented by Figure 47. Data Files Event Log Files Figure 47: Test directory structure The tester application was set up to create 1,000 files and, at some random point during this time, to modify the ‘SecEvent.txt’ file. Figure 48 shows in its display box that the ‘File Counter’ is set to 1000 and that the ‘SecEvent.txt’ would be modified after the 426 th file was created. Figure 48: Tester application generating random event 59
Barrie Codona, BSc (Hons) Network Computing, 2007 Using the Event Log Viewer application (See Figure 49), it showed that the event log file had 1001 entries in it, and after browsing through the event viewer it displayed that the ‘SecEvent.txt’ file had been modified. This also clearly displays the HMAC check working, note that the original key is entered at the top of the window. Figure 49: Event viewer application This experiment was then rerun with the previous benchmark figures of 1,000, 5,000, 10,000 and 20,000 files being created. All of the tests provided positive results. Figure 50 is an extract from the event log file; it shows that it has successfully captured the event of the ‘SecEvent.txt’ file being modified. Figure 50: Custom event log 60
Page 1 and 2:
Analysis and Evaluation of the Wind
Page 3 and 4:
Barrie Codona, BSc (Hons) Network C
Page 5 and 6:
Page 7 and 8:
Page 9 and 10: Barrie Codona, BSc (Hons) Network C
Page 59: Barrie Codona, BSc (Hons) Network C
Page 75 and 76: Appendix A: Diary Sheets
Page 77 and 78: NAPIER UNIVERSITY SCHOOL OF COMPUTI
Page 85 and 86: Appendix B: Preliminary Gantt Chart
Page 87 and 88: Nov '07 Dec '07 Jan '08 Feb '08 Mar
Page 89 and 90: C:\Documents and Settings\Barrie\My
Page 95 and 96: Appendix D: Server Application Code
Page 99 and 100: Appendix E: Event Viewer Code
Page 105 and 106: Appendix G: Processor Monitor Code
Page 107 and 108: Appendix H: HMAC Brute Force Cracke
Page 111 and 112:
C:\Documents and Settings\Barrie\My
Page 113 and 114:
Appendix I: Windows Event Log Tests
Page 115 and 116:
Copy Security Log C:\windows\system
Page 117 and 118:
Another look at the Security Log re
Page 119 and 120:
The Event Service is then restarted
Page 121 and 122:
Another look at the ‘c:\windows\s
Page 123 and 124:
CO42019 - Project 4 Computer Name P
Page 125 and 126:
CO42019 - Project 4 Turned off the
Page 127 and 128:
CO42019 - Project 4 And then restar
Page 129 and 130:
CO42019 - Project 4 Modify the ‘l
Page 131 and 132:
CO42019 - Project 4 Project - Week
Page 133 and 134:
Page 135 and 136:
Page 137 and 138:
CO42019 - Project 4 As previously d
Page 139 and 140:
CO42019 - Project 4 The screenshot
Page 141 and 142:
CO42019 - Project 4 Displaying the
Page 143 and 144:
CO42019 - Project 4 Modifying the r
Page 145 and 146:
CO42019 - Project 4 Master File Tab
Page 147 and 148:
CO42019 - Project 4 Modify the sect
Page 149 and 150:
CO42019 - Project 4 Sectors 3748520
Page 151 and 152:
CO42019 - Project 4 This now shows
show all

Analysis and Evaluation of the Windows Event Log - Bill Buchanan

Create successful ePaper yourself

Delete template?

Save as template?