Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I would like to know if there is any way to know how a file was written onto my server (Windows server) i.e if a file X got written via http or via ftp or by simple network copy or someone manually created this file?
Are there any logs in Windows which could give me this information? Or any tools which could help me garner this info?
I am suspecting a breach and the webserver(IIS) logs do not provide much info.
Not reliably.
You can check FTP logs, IIS logs, and the event logs (for admin access at the time of file creation), but if it's malicious and the attacker wishes to cover their tracks then most of these files are easy to fake/corrupt etc.
The best way is to be preprepared and have an system that reacts to new files being create (usually in specific directories or with specific permissions). The system that detects this can then make a record of which services were running, incorruptible (possibly off-server) copies of logs, and which users/service-users were logged in at that time.
The only reliable way to check/monitor whether a file has been uploaded to your server is to make a record of the hashes of all files (of interest) on the server at a specific point in time, and then to compare the current files list, and their hashes, to see if a file has been uploaded (and is therefore a new file compared to the snapshot list) or if one has been changed (because the hash is different).
It's not enough to check file create/access/change times as applied by the operating system as these can be spoofed (faked) easily.
This is a lot of work, but there are file integrity tools out there - both open source and free, and commercial, that can help with the bookkeeping.
If you need to know today and you have no record of files and (for change detection) their hashes, then there is no reliable way to check for this. Checking for newly created files through a simple file search may work if it's not part of a sophisticated attack where the malicious attacker is trying to cover their tracks, but it's just not reliable.
It's very hard to identify HOW a file got onto your computer. Logs should be the only way.
But you mentioned 4 possibilities, which are (very) different.
You mentioned the IIS web server. How are the rights set up there? It's embarrassing to see that someone could copy a file due to abuse of webserver. Fix that, check for fixes/updates/patches for the version you use. IF a bug exists.
What rights do your users have? If they can write to every folder that can cause more damage in future. fix it!
Again...user rights here? Why was this allowed?
p.s. I'm writing this because you suspect a breach on IIS/others.
Back to the file that was created. Did you see file properties?
When it was created?
Maybe who is the file author?
You can find out who wrote the file from the NTFS file owner flag. Unless you correlate processes running with user accounts along with system logs, you won't be able to identify which process or application actually created the file.
You could also put file watcher on your server which would alert you on any file changes. An alternative would be to use a dedicated user account to run IIS and then monitor the files this user account creates or modifies. Refer to these excellent answers on how to achieve this: https://stackoverflow.com/questions/5729264/what-are-all-the-user-accounts-for-iis-asp-net-and-how-do-they-differ.
A file create or modify event will only be logged if you've enabled such logging on your windows server. Once this is enabled, you may use the system log viewer to view the events matching a particular file creation/modification. See this article https://technet.microsoft.com/en-in/sysinternals/bb897544 (very old, but remains valid) on how to setup file/folder logging via local security policy. You can also set this via GPO if you're running the server in an AD domain.
To access these log events via scripts you may refer to this article describing how to use windows powershell scripts to get log events: http://www.computerperformance.co.uk/powershell/powershell_eventlog.htm
I've often found it better to try out the straightforward solutions first to eliminate the common causes while investigating issues.
