Date post: | 23-Dec-2015 |
Category: |
Documents |
Upload: | jonas-butler |
View: | 221 times |
Download: | 0 times |
Changes to Accounts (Win XP)
• Event ID 624 records account creation
• Event ID 642 records changes to existing accounts
• Event ID 626 shows accounts being activated
Changes to Accounts(Win Vista +)
• Event ID 4720records account creation
• Event ID 4738 records changes to existing accounts
• Event ID 4722 shows accounts being activated
Changes to Accounts(Win XP)
• New Account Name is account being modified
• Caller User Name is account causing action
Changes to Accounts(Win Vista +)
• New Account: Account Name is account being modified
• Subject: Security ID is account causing action
Changes to Groups
• Changes to group membership are common ways to increase an attacker’s privilege level
• These events generate logs with the Event ID based on the type of group
Changes to Groups
Vista +Event ID
Win XP/2003 Event ID
Action Indicated
4728 632 Member added to global security group
4729 633 Member removed from global security group
4732 636 Member added to local security group
4733 637 Member removed from local security group
4746 650 Member added to local distribution group
4747 651 Member removed from local distribution group
4751/4761 655 Member added to global distribution group
4752 656 Member removed from global distribution group
4756 660 Member added to universal security group
4757 661 Member removed from universal security group
N/A 665 Member added to universal distribution group
4762 666 Member removed from universal distribution group
Changes to Groups(Win XP)
• The account that is impacted (added or removed from a group) is called the Member ID
• Group that is changed is called the Target Account Name
• The account that initiated the change is called the Caller User Name
Changes to Groups(Win Vista +)
• The account that is impacted (added or removed from a group) is called the Member: Security ID
• Group is the group that is changed
• The account that initiated the change is called the Account Name
Object Access
• Objects include files, folders, printers, etc.
• Auditing must be configured for each object
• The object handle can be used to correlate related events in the event log
Object Access(Win XP)
• Event ID 560 records opening of handles
• Event ID 562 records closing of handles
• Event ID 567 shows which access permissions were actually used
Object Access(Win Vista+)
• Event ID 4656 records opening of handles
• Event ID 4658 records closing of handles
• Event ID 4657 shows which access permissions were actually used