Understanding Windows Event Logs | Digital Forensics Case Study| Windows Event Forensics- Part2

Let's Clear our understanding for windows event logs with a Digital Forensics Case Study. Since we have now learned the basics of windows event logs and learned how to repair the corrupted logs and analyze them using LogParser 2.2, it is time to analyze the logs in depth with a Forensics Case Study.
-------------------------------------------------------------------------------------------------------------------------
📝

Request you you to watch the full episode to clear the full flow of investigation!!

🔥

Details of the Case Study-

1. User account creation Alert on CJ Endpoint.
2. Sam couldn’t identify the details of which account got created since those details are masked.
3. Same called the user to identify if there is any stored sensitive data on his/her machine. Grabbed one PWD protected ZIP file.
4. Sam can’t take a full machine dump.
5. Sam collected the Windows Event Logs from the system (Application, Security, System) and Registry Dump.

Now we are being a Forensic Investigator, we need to identify what went wrong and how did it happen!

🙏
***If you enjoy this video, please consider Subscribing to my channel and share this to your community as well*** 🙏

🔥

🔗
Links for your Need-
-------------------------------------------------------------------------------------------------------------------------

⏭
What's next in BlackPerl?
-------------------------------------------------------------------------------------------------------------------------
In the next episode, we will come up with more such tools and techniques for DFIR and will try to explain them with real life usecases.
Also, if you want us to cover any particular topic, please let us know in the comment section below.

📞📲
We are socially active as well-
-----------------------------------------------------------------------------------------------------------------------
Twitter: @blackperl_dfir

⌚
Timelines
-------------------------------------------------------------------------------------------------------------------------
0:00 ⏩ Intro
1:34 ⏩ Case Study Details
4:51 ⏩ Demo
41:00 ⏩ Summarize
-------------------------------------------------------------------------------------------------------------------------
Thanks for watching!! Be CyberAware!! 🤞

[BlackPerl]

Hey Guys... Another Case Study is here! I tried to explain how can we use LogParser to analyze the Windows Event logs and even the full workflow of an incident. I hope you will enjoy the episode and if you have any query, please feel free to post it. 😊

CMDs I have used in this episode-

User Creation:

"C:\Program Files (x86)\Log Parser 2.2\LogParser.exe" -stats:OFF -i:EVT "SELECT * FROM Logs\Good Event Logs\SecEvent.evtx' WHERE EventID = '624'"

"C:\Program Files (x86)\Log Parser 2.2\LogParser.exe" -stats:OFF -i:EVT "SELECT TimeGenerated as Time, EventType, EventTypeName, Strings as User, ComputerName FROM Logs\Good Event Logs\SecEvent.evtx' WHERE EventID = '624'"

User Login:

LogParser -stats:OFF -i:EVT "SELECT * FROM Logs\Good Event Logs\SecEvent.evtx' WHERE Strings LIKE 'helpdesk%' and (EventID = '528' or EventID = '540')"


LogParser -stats:OFF -i:EVT "SELECT TimeGenerated as LoginTime, EventTypeName, ComputerName, SID FROM Logs\Good Event Logs\SecEvent.evtx' WHERE Strings LIKE 'helpdesk%' and (EventID = '528' or EventID = '540')"


User Logoff:

LogParser -stats:OFF -i:EVT "SELECT TimeGenerated as LoginTime, EventTypeName, ComputerName, SID FROM Logs\Good Event Logs\SecEvent.evtx' WHERE Strings LIKE 'helpdesk%' and EventID = '538'"

Program Install:

LogParser -stats:OFF -i:EVT "SELECT * FROM Logs\Good Event Logs\AppEvent.evtx' WHERE EventID = '11728'"

LogParser -stats:OFF -i:EVT "SELECT Strings FROM Logs\Good Event Logs\AppEvent.evtx' WHERE EventID = '11728' AND

[RamaKrishna-lgzo]

Awesome information sir, I learnt new skills as a digital forensics investigator

[futurebuddies]

Awesome explanation Archan. thanks a lot for creating this one.

[kkkyyymmm]

Thank you for your great video!! I have one question, is it possible to check if the user have manually cleared their windows event log? Does window record this as an event in the new log?

[cyberwarriorall]

bro you are awesome. Excellent. I just love them.. I was looking for these kind of videos. Do you have any o365 log analysis as well?

[cyberwarriorall]

can you suggest some queries for catching powershell queries

[b.kranthikumar]

Could you please explain how to analysis by using SIEM tool

[CulinaryMyway]

Thanks for this video. I have a doubt- let’s say if attacked has cleared audit logs and u see 1102 event. Is there any other way where we can check security logs or recover them ?

[innocentgamer]

Really useful and informative brother keep it up ...keep going brother you are rocking 🎉

[anishdash]

awesome content. learned something new today.

[zivakhan]

which event ids needs to be monitored for suspicious behaviour? Can you make a video on it?

[laptoplifestylegeez]

This was a absolutely one of the best videos I've seen on log analysis thank you so much can you please post the link again on where you got the zip file password cracker

[jamescullins]

Was waiting for this one so eagerly! Thanks for sharing. Can you share the event logs for practice?
Can I search logs with ip addresses?