1

Just doing some reading surrounding analysing intrusions, I’ve read that Windows Event Logs can be modified by an attacker to cover their tracks, how accurate is this and what are the alternative for a systems analyst?

0

For this question, I am going to assume that the windows event service is running on the same machine that is being attacked.

Yes, an attacker could tamper with audit logs to hide their tracks if they gained control of the machine.

Typically, this is mitigated by forwarding logs to a centralised logging service. This has two benefits:

  • It makes log tampering much more difficult, and;
  • Events from across the network and be correlated and queried.

If you have a good logging and monitoring strategy in place, this should allow you to detect, respond and recover much more quickly, limiting the severity of the security incident.

Strong access management can also help to reduce the risk of an unauthorised individual modifying logs. Write permissions should be limited, and manual changes to the logs should generate security alerts.

| improve this answer | |
  • Thanks for your response. But say for example a system analyst was brought in to analyse and improve a system that had lack of security culture with no centralised system etc; obviously that makes it harder to detect an attack. With that said, what other methodologies of analysing an attack would you reccomend if that was to be the case? – C.Mann Nov 13 '19 at 20:33
  • 1
    Practical things that you could do in the immediate term are: Ensure that logging permissions are correctly set; check that what you're logging is sufficient for your purposes, and; periodically check the logs to a documented schedule. The frequency at which you check the logs should be proportionate to the risk and your ability to monitor the logs. – Show_me_your_selector Nov 14 '19 at 18:51
  • Thanks very much, very helpful and great feedback. – C.Mann Nov 14 '19 at 21:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.