Leveraging & Collecting Windows Event Logs into a SIEM for threat hunting and lateral movement detection. Demonstrate how security analysts can leverage existing Microsoft Windows features to monitor Windows Event Logs across their domain. Several examples will be provided to show how an analyst can use these logs to detect persistence mechanisms (scheduled tasks), Windows AD modifications and backdoors, malicious PowerShell, process auditing, lateral movement, and more. This talk is separate from the many Sysinternals Sysmon presentations because it focuses on auditing capabilities available without installing extra clients. Additionally, the existing auditing capabilities can be used to detect security events that Sysmon can not. For instance, "SeEnableDelegationPrivilege" AD privilege shown by @harmj0y post https://www.harmj0y.net/blog/activedirectory/the-most-dangerous-user-right-you-probably-have-never-heard-of/ which would be logged in Windows EventID:4704 or these threats ( https://adsecurity.org/?p=2053 | https://www.harmj0y.net/blog/activedirectory/roasting-as-reps/ ) which would log EventID:4738 There will also be a discussion on how you can quickly leverage a setup, for free, using Elasticsearch (ELK stack). A part of this will include getting new ideas for "hunts" by collecting windows event logs from your sandbox environment (we used Cuckoo with 300+ samples a day). We will show how these logs can be leveraged by other IT departments such as helpdesk or system admins/dev ops. Many times if you want anything done in infosec you need the help of other departments. Therefore, what better way than to help them detect failing computers, user lock-outs, server errors, host auditing differentials (useful in STIG'ed environments), and more.

Adam and Nate work within the Department of Defense as contractors. They have experience in many different areas such as reverse engineering, network forensics, incident response, and network security monitoring engineering for 10Gbps+ networks.

Back to BSides Detroit video list