WEBVTT

0:00:04.720000 --> 0:00:08.780000
 Windows Logging Primer, Channels,
 Providers and Keylogs.

0:00:08.780000 --> 0:00:10.480000
 So welcome everyone.

0:00:10.480000 --> 0:00:15.600000
 In this video, we're going to be revisiting
 Windows Logging, but a bit

0:00:15.600000 --> 0:00:19.440000
 more specific. We're going to be a
 bit more specific without approach.

0:00:19.440000 --> 0:00:23.880000
 Of course, I went over the Windows Logging
 process early on in this course,

0:00:23.880000 --> 0:00:28.560000
 but the key thing that I want to explain
 now because it is relevant is

0:00:28.560000 --> 0:00:30.760000
 the channels, providers and keylogs.

0:00:30.760000 --> 0:00:35.360000
 So this will give you a better understanding
 of the various channels,

0:00:35.360000 --> 0:00:41.360000
 providers and some of the key logs
 or specifically event IDs that you

0:00:41.360000 --> 0:00:45.620000
 need to be aware of, which we will
 be contextualizing very soon.

0:00:45.620000 --> 0:00:50.660000
 In any case, this really brings us to
 a key question, which is understanding

0:00:50.660000 --> 0:00:53.520000
 Windows Logging for Incident Response.

0:00:53.520000 --> 0:00:57.600000
 So this video will provide you with
 a technical primer on how Windows

0:00:57.600000 --> 0:01:01.740000
 Logging works, specifically breaking
 down the key components like event

0:01:01.740000 --> 0:01:05.340000
 channels, log providers and collection
 mechanisms, a lot of which we have

0:01:05.340000 --> 0:01:06.500000
 already explored.

0:01:06.500000 --> 0:01:10.080000
 However, we'll be exploring the most
 critical log sources for defenders,

0:01:10.080000 --> 0:01:16.600000
 including the security, Sysmon, PowerShell,
 Schedule tasks and WMI activity

0:01:16.600000 --> 0:01:21.760000
 channels. So, the underlying point here,
 the upshot is that each of these

0:01:21.760000 --> 0:01:28.260000
 log sources on Windows plays a unique
 role in capturing system activity.

0:01:28.260000 --> 0:01:33.420000
 And together, they form a comprehensive
 view of potential malicious behavior

0:01:33.420000 --> 0:01:35.900000
 within Windows environments.

0:01:35.900000 --> 0:01:40.320000
 So let's take a look at some of the
 fundamental components with regards

0:01:40.320000 --> 0:01:44.940000
 to Windows Logging, which we didn't explore
 technically when we were taking

0:01:44.940000 --> 0:01:46.480000
 a look at the process.

0:01:46.480000 --> 0:01:48.800000
 So firstly, we have providers.

0:01:48.800000 --> 0:01:53.420000
 So a provider is simply a software component
 that generates log events.

0:01:53.420000 --> 0:01:58.660000
 And examples of this would be Microsoft
 Windows Security Auditing, Microsoft

0:01:58.660000 --> 0:02:02.580000
 Windows Sysmon. We'll talk a little
 bit about Sysmon in the next video

0:02:02.580000 --> 0:02:05.140000
 and we'll take a look
 at how to deploy it.

0:02:05.140000 --> 0:02:08.980000
 Another example would be Microsoft
 Windows PowerShell.

0:02:08.980000 --> 0:02:13.220000
 Each provider defines the structure
 and content of the events that it

0:02:13.220000 --> 0:02:18.060000
 emits, right? Or the information
 contained in the log therein.

0:02:18.060000 --> 0:02:19.660000
 You then have channels.

0:02:19.660000 --> 0:02:20.660000
 So what is a channel?

0:02:20.660000 --> 0:02:25.880000
 A channel is a log stream where events
 from providers are published.

0:02:25.880000 --> 0:02:29.600000
 So think of a channel as a log file or
 container that aggregates specific

0:02:29.600000 --> 0:02:31.320000
 kinds of events.

0:02:31.320000 --> 0:02:35.140000
 And the types of channels you typically
 see, we'll get into them shortly,

0:02:35.140000 --> 0:02:36.520000
 are admin levels.

0:02:36.520000 --> 0:02:40.580000
 So these are high-level operational
 events used for troubleshooting.

0:02:40.580000 --> 0:02:41.800000
 You have operational channels.

0:02:41.800000 --> 0:02:47.180000
 So these contain detailed logs used
 for auditing and monitoring.

0:02:47.180000 --> 0:02:48.640000
 You then have analytics.

0:02:48.640000 --> 0:02:52.220000
 So high-volume fine-grained events
 typically off by default.

0:02:52.220000 --> 0:02:54.000000
 You need to enable that.

0:02:54.000000 --> 0:02:58.320000
 And then debug. So these are developer
-focused and very low-level details.

0:02:58.320000 --> 0:02:59.960000
 Nothing that can be...

0:02:59.960000 --> 0:03:05.140000
 Can tell you a lot about a particular
 event that was logged.

0:03:05.140000 --> 0:03:08.840000
 And then we have event collection,
 which we went through.

0:03:08.840000 --> 0:03:13.320000
 But when we talk about event collection,
 this refers to mechanisms like

0:03:13.320000 --> 0:03:20.180000
 Windows Event Forwarding or WEF, or
 syslog alerts, for example, NX log,

0:03:20.180000 --> 0:03:23.860000
 Win log beat. And they
 gather logs centrally.

0:03:23.860000 --> 0:03:28.380000
 So this is useful for real-time monitoring
 and correlation in scene platforms.

0:03:28.380000 --> 0:03:31.660000
 Not really important, but I wanted
 to highlight this here.

0:03:31.660000 --> 0:03:35.760000
 Now, this is sort of the focus of this
 video, the key channels and they're

0:03:35.760000 --> 0:03:39.760000
 using digital forensics
 and incident response.

0:03:39.760000 --> 0:03:43.900000
 So we took a look at early on in this
 course, the security channel.

0:03:43.900000 --> 0:03:48.100000
 So this can be found with the event
 viewer under Windows Logs Security.

0:03:48.100000 --> 0:03:51.360000
 The provider, and this is very important,
 the provider name is going to

0:03:51.360000 --> 0:03:54.540000
 be Microsoft Windows Security Auditing.

0:03:54.540000 --> 0:03:57.960000
 And this contains logs related
 to log on attempts.

0:03:57.960000 --> 0:04:02.180000
 So think of event IDs 4624 and 4625.

0:04:02.180000 --> 0:04:06.880000
 Privilege use, so event
 4670 and a few others.

0:04:06.880000 --> 0:04:10.620000
 And then object access, when we talk
 about objects and windows, we're

0:04:10.620000 --> 0:04:16.020000
 referring to files, registry, the event
 ID here as an example, well, not

0:04:16.020000 --> 0:04:19.400000
 example, but one of them would be 4663.

0:04:19.400000 --> 0:04:24.200000
 And you also find logs related to audit
 policy changes, you know, account

0:04:24.200000 --> 0:04:25.660000
 management, etc.

0:04:25.660000 --> 0:04:27.780000
 So why is this channel important?

0:04:27.780000 --> 0:04:32.540000
 Well, as you can probably tell, it's
 crucial for detecting brute force,

0:04:32.540000 --> 0:04:35.880000
 lateral movement, and or
 privilege escalation.

0:04:35.880000 --> 0:04:38.000000
 You then have the Sysmon channel.

0:04:38.000000 --> 0:04:41.280000
 Again, don't worry if you're not sure
 of what Sysmon is because it's a

0:04:41.280000 --> 0:04:47.000000
 custom utility or service, as it were,
 that enhances the information contained

0:04:47.000000 --> 0:04:48.860000
 in Windows event logs.

0:04:48.860000 --> 0:04:53.620000
 But the Sysmon channel, the path is
 typically application and service

0:04:53.620000 --> 0:04:58.560000
 logs, Microsoft Windows Sysmon,
 and then operational.

0:04:58.560000 --> 0:05:02.520000
 The provider here is, you know, pretty
 much, it's just one, it's fairly

0:05:02.520000 --> 0:05:04.900000
 simple. It's Microsoft Windows Sysmon.

0:05:04.900000 --> 0:05:08.740000
 So this has its own unique event IDs.

0:05:08.740000 --> 0:05:12.060000
 So it'll contain information
 about process creation.

0:05:12.060000 --> 0:05:16.460000
 The ID for that is one, network connections,
 the ID for that is three,

0:05:16.460000 --> 0:05:19.140000
 file creations, the ID for that is 11.

0:05:19.140000 --> 0:05:22.060000
 And then you also have registry
 and WMI activity.

0:05:22.060000 --> 0:05:28.620000
 I will go through what the IDs
 for that type of activity are.

0:05:28.620000 --> 0:05:31.440000
 And why is this important?

0:05:31.440000 --> 0:05:33.900000
 You know, isn't already obvious.

0:05:33.900000 --> 0:05:37.580000
 Well, it offers rich correlated data
 not available in standard Windows

0:05:37.580000 --> 0:05:40.540000
 event logs, which is true.

0:05:40.540000 --> 0:05:43.980000
 You then have the PowerShell channel,
 which I mentioned, but now I'm going

0:05:43.980000 --> 0:05:45.900000
 to dive a little bit deeper into it.

0:05:45.900000 --> 0:05:48.980000
 So the paths are Windows PowerShell.

0:05:48.980000 --> 0:05:51.880000
 So this is, you know, where you'll find
 your traditional PowerShell host

0:05:51.880000 --> 0:05:56.800000
 events. You then have another, I had
 already mentioned that earlier, you

0:05:56.800000 --> 0:06:01.240000
 then have, sorry, you have another provider
 or you have the actual provider.

0:06:01.240000 --> 0:06:03.580000
 So Microsoft Windows PowerShell
 operational.

0:06:03.580000 --> 0:06:08.480000
 So this is where you find script block
 logging transcription and, you

0:06:08.480000 --> 0:06:11.220000
 know, module loads, for
 example, very important.

0:06:11.220000 --> 0:06:15.200000
 And the key event IDs here
 are four, one, zero, four.

0:06:15.200000 --> 0:06:16.860000
 So script block logging.

0:06:16.860000 --> 0:06:21.080000
 So this reveals the full PowerShell
 code, which can be immensely useful,

0:06:21.080000 --> 0:06:22.720000
 you know, for obvious reasons.

0:06:22.720000 --> 0:06:26.100000
 And then four, one, zero, three,
 which is for command invocation.

0:06:26.100000 --> 0:06:28.360000
 So again, why is this important?

0:06:28.360000 --> 0:06:31.340000
 Well, it allows for detection
 of fileless malware.

0:06:31.340000 --> 0:06:36.020000
 So PowerShell commands or malware being
 executed in memory, scripts being

0:06:36.020000 --> 0:06:41.560000
 executed in memory, you know, living
 off the land, LOTL attacks, so on

0:06:41.560000 --> 0:06:45.620000
 and so forth. And then you have
 the schedule tasks channel.

0:06:45.620000 --> 0:06:51.100000
 So the path for this is Microsoft Windows
 task scheduler operational.

0:06:51.100000 --> 0:06:56.080000
 And then the provider is going to be
 Microsoft Windows task scheduler.

0:06:56.080000 --> 0:06:58.900000
 The key events here are
 106, very important.

0:06:58.900000 --> 0:07:04.800000
 That's for task registered or creation,
 200 or 201 tasks started, and

0:07:04.800000 --> 0:07:06.940000
 102 tasks completed.

0:07:06.940000 --> 0:07:08.540000
 Again, why is this important?

0:07:08.540000 --> 0:07:13.160000
 Well, attackers often create scheduled
 tasks for persistence or execution.

0:07:13.160000 --> 0:07:15.160000
 So very, very important.

0:07:15.160000 --> 0:07:17.600000
 You then have the WMI activity channel.

0:07:17.600000 --> 0:07:22.600000
 The path for this is Microsoft Windows
 WMI activity operational.

0:07:22.600000 --> 0:07:26.420000
 The provider is Microsoft
 Windows WMI activity.

0:07:26.420000 --> 0:07:30.940000
 And the key events here would be 5, 8,
 5, 7, 2, 5, 8, 6, 1, which accounts

0:07:30.940000 --> 0:07:35.680000
 for WMI queries, providers,
 and consumer creation.

0:07:35.680000 --> 0:07:37.840000
 So again, why is this important?

0:07:37.840000 --> 0:07:42.020000
 Well, WMI is a stealthy method for
 reconnaissance and persistence, and

0:07:42.020000 --> 0:07:47.600000
 logging WMI use is critical for
 identifying advanced threats.

0:07:47.600000 --> 0:07:50.080000
 So why does all of this matter?

0:07:50.080000 --> 0:07:52.180000
 A for contextual visibility.

0:07:52.180000 --> 0:07:55.760000
 So each log source gives
 a piece of the puzzle.

0:07:55.760000 --> 0:08:01.280000
 Combined, they reveal attacker behavior
 or they reveal larger or more

0:08:01.280000 --> 0:08:03.680000
 widespread activity.

0:08:03.680000 --> 0:08:07.560000
 For detection, so events from PowerShell
 and Sysmon channels often provide

0:08:07.560000 --> 0:08:12.880000
 early indicators of compromise, IOCs,
 response and investigation.

0:08:12.880000 --> 0:08:17.820000
 So very useful in tracing execution flow,
 lateral movement, and establishing

0:08:17.820000 --> 0:08:22.160000
 timelines. And then you have
 persistence detection.

0:08:22.160000 --> 0:08:27.500000
 So WMI schedule tasks and registry modifications
 are key areas for, you

0:08:27.500000 --> 0:08:31.300000
 know, persistence mechanisms
 or hidden back doors.

0:08:31.300000 --> 0:08:35.080000
 All right, so with that being said,
 that brings us to the end of this

0:08:35.080000 --> 0:08:37.920000
 video. And I will be seeing
 you in the next video.