Just doing some reading surrounding analysing intrusions, I’ve read that Windows Event Logs can be modified by an attacker to cover their tracks, how accurate is this and what are the alternative for a systems analyst?
For this question, I am going to assume that the windows event service is running on the same machine that is being attacked.
Yes, an attacker could tamper with audit logs to hide their tracks if they gained control of the machine.
Typically, this is mitigated by forwarding logs to a centralised logging service. This has two benefits:
- It makes log tampering much more difficult, and;
- Events from across the network and be correlated and queried.
If you have a good logging and monitoring strategy in place, this should allow you to detect, respond and recover much more quickly, limiting the severity of the security incident.
Strong access management can also help to reduce the risk of an unauthorised individual modifying logs. Write permissions should be limited, and manual changes to the logs should generate security alerts.