Windows Security Event Analysis

Event logs are the valuable source of information in detecting and investigating security incidents. As part of the regulatory requirements many companies collect and store logs from different sources but few of them analyze the collected logs proactively. This post shows how the security event logs can be collected from Windows operating systems using winlogbeat and send to ELK infrastructure for further analysis.

Some of the useful Security Events for forensics analysis or incident response in a Windows machine

Successful/Failed logon events provide the details about how the user or process tried to logon and the logon type information is given as a number.

Logon failue codes

winlogbeat.yml settings

winlogbeat.event_logs:
  - name: Security
    ignore_older: 72h

output.logstash:
  # The Logstash hosts
  hosts: ["10.10.10.10:5044"]

Logstash settings (input,filter and output)

input {
  beats {
    port => 5044
  }
}

if [type]=="wineventlog"
        {
        mutate { add_field => { "indexType" => "WIN-LOGS" }
                        }
                }

if [indexType]== "WIN-LOGS"
{
 elasticsearch {
    hosts => "http://elasticsearchhost:9200"
    manage_template => false
    index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
        document_type => doc
  }
}

Kibana query for password changed events

event_id:4724

Kibana query for remote desktop login

event_id:4624 AND event_data.LogonType:10

Visualizations in Kibana

Password change events

Remote desktop logins