Analysis and Evaluation of the Windows Event Log - Bill Buchanan

Barrie Codona, BSc (Hons) Network Computing, 2007
Table of Figures
Figure 1: Log server protected by a firewall……………….………..……..………. 10
Figure 2: Log architecture with time stamping machine……………………..….… 18
Figure 3: Copying the Windows security log………………………………….…... 24
Figure 4: Replacing the Windows security log. ……………….…………..………. 25
Figure 5: 32 bit time. ……………………………………...……….….…………… 26
Figure 6: Modifying the 32 bit time. …………………….………………………… 27
Figure 7: Event logger schematics. ……………………………..………………… 31
Figure 8: Client-Server prototype. ………………………………………………… 33
Figure 9: Client generated XML string. ………………..…….…………………… 34
Figure 10: Client XML string with HMAC. ……………….……………………… 34
Figure 11: Server XML string. …………………………………….……………… 35
Figure 12: The event viewer interface. ………………..……..…………………… 35
Figure 13: Client side pseudo code. ………………………………………..……… 36
Figure 14: Server side pseudo code. …………………………….………………… 37
Figure 15: Event viewer pseudo code. ………………………………….………… 37
Figure 16: Testing design. ………………………………………………....……… 38
Figure 17: Generate a large number of files pseudo code. ……….…………….… 39
Figure 18: Generate files with error checking. ……………………………..…..… 39
Figure 19: Tester application. …………………………………………..………… 40
Figure 20: Connecting to a server. ………………………………..……..………… 41
Figure 21: The FileSystemWatcher class. ……………………..…………..……… 42
Figure 22: Capturing events. …………………………………………..………..… 43
Figure 23: Generating an HMAC hash signature. …….……..…………………… 43
Figure 24: Encrypting data. ………………………………….…………………… 44
Figure 25: Sending data to the server. ……………………….…………………… 44
Figure 26: Listening for a connection. ……………………….…………………… 45
Figure 27: Generating RSA key pair. …………………………..….……………… 45
Figure 28: Receiving a message. ………………………………..………………… 46
Figure 29: Decrypting a message. ………………………………..…..…………… 46
Figure 30: Saving event data to disk. ……………………………………………… 47
Figure 31: Reading a file. ………………………………………….……………… 48
Figure 32: Dividing up an XML string. …………………………….……..……… 48
Figure 33: Checking the hash signature. ……………………………..…………… 59
Figure 34: Data flow. ………………….……………………………………..…… 52
Figure 35: Updated Client-Server communications. ……………………………… 53
Figure 36: Processor monitor application. ………………………..….…………… 54
Figure 37: Generating 1,000 files with no encryption. ………..…..……………… 54
Figure 38: Generating 5,000 files with no encryption. ………..……..…………… 55
Figure 39: Generating 10,000 files with no encryption. ……………..…………… 55
Figure 40: Generating 20,000 files with no encryption. ……………..…………… 55
Figure 41: Generating 1,000 files with symmetric encryption………..…………… 56
Figure 42: Generating 5,000 files with symmetric encryption………..…………… 56
Figure 43: Generating 10,000 files with symmetric encryption………..………..… 57
Figure 44: Generating 20,000 files with symmetric encryption………..……..…… 57
Figure 45: Symmetric encryption comparison. ……………………….…………… 58
Figure 46: Asymmetric encryption comparison. ………………………..………… 58
Figure 47: Test directory structure. ………………………………………..……… 59
Figure 48: Tester application generating random event. …………………..……… 59
6