Just doing some reading surrounding analysing intrusions, I’ve read that Windows Event Logs can be modified by an attacker to cover their tracks, how accurate is this and what are the alternative for a systems analyst?
1 Answer
For this question, I am going to assume that the windows event service is running on the same machine that is being attacked.
Yes, an attacker could tamper with audit logs to hide their tracks if they gained control of the machine.
Typically, this is mitigated by forwarding logs to a centralised logging service. This has two benefits:
- It makes log tampering much more difficult, and;
- Events from across the network and be correlated and queried.
If you have a good logging and monitoring strategy in place, this should allow you to detect, respond and recover much more quickly, limiting the severity of the security incident.
Strong access management can also help to reduce the risk of an unauthorised individual modifying logs. Write permissions should be limited, and manual changes to the logs should generate security alerts.
-
Thanks for your response. But say for example a system analyst was brought in to analyse and improve a system that had lack of security culture with no centralised system etc; obviously that makes it harder to detect an attack. With that said, what other methodologies of analysing an attack would you reccomend if that was to be the case?– C.MannCommented Nov 13, 2019 at 20:33
-
1Practical things that you could do in the immediate term are: Ensure that logging permissions are correctly set; check that what you're logging is sufficient for your purposes, and; periodically check the logs to a documented schedule. The frequency at which you check the logs should be proportionate to the risk and your ability to monitor the logs. Commented Nov 14, 2019 at 18:51
-