1. Mastering Windows Network Forensics and Investigation Chapter 14: Other Audit Events

2. Chapter Topics: Logging of Modifications to Groups, Accounts, Policies Object Access Logs

3. Changes to Accounts (Win XP) Event ID 624 records account creation Event ID 642 records changes to existing accounts Event ID 626 shows accounts being activated

4. Changes to Accounts (Win Vista +) Event ID 4720records account creation Event ID 4738 records changes to existing accounts Event ID 4722 shows accounts being activated

5. Changes to Accounts (Win XP) New Account Name is account being modified Caller User Name is account causing action

6. Changes to Accounts (Win Vista +) New Account: Account Name is account being modified Subject: Security ID is account causing action

7. Changes to Accounts

9. Changes to Groups Changes to group membership are common ways to increase an attacker’s privilege level These events generate logs with the Event ID based on the type of group

10. Changes to Groups Vista + Event ID Win XP/2003 Event ID Action Indicated 4728632Member added to global security group 4729633Member removed from global security group 4732636Member added to local security group 4733637Member removed from local security group 4746650Member added to local distribution group 4747651Member removed from local distribution group 4751/4761655Member added to global distribution group 4752656Member removed from global distribution group 4756660Member added to universal security group 4757661Member removed from universal security group N/A665Member added to universal distribution group 4762666Member removed from universal distribution group

11. Changes to Groups (Win XP) The account that is impacted (added or removed from a group) is called the Member ID Group that is changed is called the Target Account Name The account that initiated the change is called the Caller User Name

12. Changes to Groups (Win Vista +) The account that is impacted (added or removed from a group) is called the Member: Security ID Group is the group that is changed The account that initiated the change is called the Account Name

13. Changes to Groups

14. Changes to Audit Policy Event ID 612 shows the end result of a change in audit policy

15. Changes to Audit Policy Event ID 4719 shows the end result of a change in audit policy

16. Object Access Objects include files, folders, printers, etc. Auditing must be configured for each object The object handle can be used to correlate related events in the event log

17. Object Access (Win XP) Event ID 560 records opening of handles Event ID 562 records closing of handles Event ID 567 shows which access permissions were actually used

18. Object Access (Win Vista+) Event ID 4656 records opening of handles Event ID 4658 records closing of handles Event ID 4657 shows which access permissions were actually used

19. Object Access