0

I wish to implement logging and auditing features on a Windows 10 client used for carrying out secure transactions through our FTP server, with a client organisation.

What all features could I select in the Windows' auditing options, so that I could make it very useful to detect malware, unauthorised admin privilege usage, unauthorised network usage, and etc?

1

Interesting question. I've worked in secure file transfer software and I am currently in log collection.

Are you carrying out managed file transfers? For example, you have a secure file transfer configuration rules set to automate certain tasks. Or do you mean that you have a Win 10 machine set up with a GUI file transfer software that is being used by a user?

Also this is on the FTP protocol, right? Not like FTPES/FTPIS? Is the network accessible as something like a VPN for local network? AFAIK, some users still use FTP but under certain circumstances, and any other circumstance we'd recommend they use FTPS.

--

I could make it very useful to detect malware, unauthorised admin privilege usage, unauthorised network usage, and etc?

To start, here's a few to look into:

Windows EventLog collection. To start, check out Malware Archaelogy's talk Security Compliance - Finding Advanced Attacks PDF via search which lists out EventIDs to log and monitor.

Windows Registry Monitoring. To monitor changes in the registry made by Windows or a certain program.

Windows DNS Monitoring ie monitor any calls to CnC servers.

If you have any important files (like the file transfer configuration file) you may want to implement file integrity monitoring to monitor for any changes to this file.

Then you would want to collect these logs with something like NXLog (disclaimer, I am involved in that project) and send these out to a centralized log server on the event that the FTP client is unavailable or goes down.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.