0

I'm analyzing several hacked machines on our network. On the original hacked machine, I've found event logs indicating a series of successful RDP connections to other machines, but when I go to those machines and check the RDP connection logs, I don't see any logs at all around that time period. I also don't see much in the security or application log except for DWM sessions starting.

I know that functionality to delete specific events from the log is not exposed, but do you know of any tools that can modify event log exports? I'm thinking maybe the log was backed up and cleared and then the backup was tampered with before restoring or something like that. Otherwise, I'm not sure how I could have logs on one machine but only have logs before and after on the others.

Thanks.

|improve this question|||||
  • Are they all Windows machines? – Yogesch Apr 26 '19 at 7:58
  • Yes, these are all windows machines. – S.C. Apr 26 '19 at 13:55
1

On Unix systems, the logs are just text files. Generally only specific processes/daemons have the ability to edit them, but a user with sudo access can do it too. Just process it like any other text file.

On Windows, it is again a similar story - in a nutshell, someone with admin rights can tamper the system. Although for Windows they will need specific tools like WinZapper. See this security.se question for a good discussion on this topic.

|improve this answer|||||
  • WinZapper looks interesting. I'll have to mess around with that and see if I can recreate what I see here. Thanks. – S.C. Apr 26 '19 at 13:58
  • .evtx are not just text files. – user2320464 Apr 26 '19 at 23:32
  • @user2320464 Indeed, they're not. Which is why one will need special tools to tinker/tamper with them. – Yogesch Apr 27 '19 at 6:00
2

As far as I know, there is no way to delete/alter individual events from an event log (Application, System, Security, etc.) under Windows. The "most" you can do is delete them, but even that would generate an event in the case where the Security log is cleared (Event ID 1102).

https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=1102

Apparently, Shadow Brokers released a tool called EventLogEdit that allows to edit events on the fly, even when the system is running.

https://threatpost.com/shadowbrokers-selling-windows-exploits-attack-tools/123027/

Though I have yet to read about it being used in any attacks so far.

|improve this answer|||||
  • Thanks. Yeah, I didn't see that log anywhere. – S.C. Apr 26 '19 at 13:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.