Analysis and Evaluation of the Windows Event Log - Bill Buchanan

Barrie Codona, BSc (Hons) Network Computing, 2007
Figure 49: Event viewer application. ……………………………….…..….……… 60
Figure 50: Custom event log. ……………………………………………………… 60
Figure 51: Client XML string without HMAC. ……………..…………….……… 61
Figure 52: Client XML string with HMAC. …………………..…..……………… 61
Figure 53: HMAC test data. ……………………………………….……………… 61
Figure 54: HashCalc Screenshot. ………………………………….……………… 62
Figure 55: iFrame.in Hash Calculator. …………………………….……………… 63
Figure 56: Three character HMAC test data. ……………………………………… 64
Figure 57: HMAC brute force application. ……………………………...………… 64
Figure 58: Four character key HMAC test data. …………………………..……… 64
Figure 59: Found four character key. ……………………………………………… 64
Figure 60: HMAC key entropy. ………………………………………..….……… 65
Figure 61: Custom event log showing ‘SecEvent.Evt’. …………………………… 66
7