Research Notes from Building a Windows Event Log Hunting Workflow
Source Reddit Cybersecurity
Discussion
LogHound is an open-source post-exploitation tool designed to collect, parse, and analyze Windows Security Event Logs (. evtx) to aid red teams and penetration testers in tracking lateral movement, user sessions, and machine ownership. It addresses challenges in accessing and exfiltrating locked Windows event logs by leveraging native Windows tools and legitimate protocols to avoid detection by endpoint security solutions. The tool processes large event logs efficiently and exports data compatible with BloodHound CE for visualization and further analysis. It is intended for authorized use in penetration testing and forensic investigations.
r/cybersecurity (opens in a new tab)u/No_Catch45500 points0 comments
One thing that kept slowing me down during investigations and security assessments wasn't exploitation. Once I had initial access (e.g. Domain Admin), there is often still a large gap in demonstrating the exploitability of business-critical assets.
You might tell a customer, "I got Domain Admin, job done". But in reality, that’s not always enough. A CISO may understand why it’s critical, but what would the CTO or CEO say? They need dead-head proofs, so you go beyond and look for business-critical assets, that`s where post-exploitation begins!)
You
My small research is about logs. Windows ones.
Collecting Windows Event Logs does not simply mean copying EVTX files.
We`ve got some problems here :)
- How do I acquire logs when Windows blocks direct access?
- How do I exfiltrate the content?
- How do I process it?
- How do I work around AV, even trying to read it?
- How do I get even some use out of it?
In practice, things become more complicated when investigating live systems.
Windows keeps many log files open and actively written to.
After several iterations I ended up building a small open-source project called LogHound.
I'm curious how other people here approach large-scale log analysis during:
- DFIR investigations
- Red Team operations
- malware analysis
- incident response
- system troubleshooting
So here is how i solved all the problems:
How do I acquire logs when Windows blocks direct access?
We know - Windows blocks every .evtx file with process and does not let anyone to read\copy\download it. So we`re looking for a simple solution
As it is a post-exploitation engagement, we could make use of native Windows tools, especially - wevtutils. A small command lets us do all the dumping/filtering job
wevtutil epl Security "%s" /q:%s
How do I exfiltrate the content?
As we are talking about Red Team engagements, we would like to make use of smth legitimate and widespread everywhere - and impackets smb library fits the best here. Minimum load logs, straightforward protocol and speed.
How do I process it?
If I were in a defender role, I would probably use some PowerShell module or GUI. Here we do not have such privileges, so Python`s evtx lib + multithreading + filtering at start help to do the job quickly.
How do I work around AV, even trying to read it?
Well, nowadays you cannot just log in to Windows, get some shell and execute commands. 99% of available pentester tools would be blocked by every EDR, so we are also looking for smth legit and widespread.
Most reason that is not the case with GitHub tools - EDRs collects behavioral patterns even with legit protocols and detects it easy. I`ll use a legit WMI query with Win32_Process.Create, hoping I won't leave a lot of indicators... and, for now, it works!
How do I get even some use out of it?
Collecting post-exploitation data is a fun process, but you can't really make a profit from gigabytes of raw data, and I`m glad there are strong visualisation frameworks like BloodHound. It has a pretty convenient JSON scheme and, if not very adaptive but usable API. So I decided - importing that data to the BloodHound scheme would work out the best.
And after all, we could continue our post-exploitation activities with a bit more useful information :)
Project: