Before them and move on to computer forensics a focus a bit on interpreting event values.
Planning attack recovery strategies need to be mindful of the comments given in the slide below.
It's crucial to be aware of all failed user attempts to access specified directories the ideal computer
system doesn't return any know answers.
The service failed.
There is no.
No results found et cetera.
In the ideal system each server only connects to the server he should connect to and the selected server
is always available and provides services without any downtime.
In this system users don't go beyond what they should do.
But in the real world there will always be no answers.
The service failed.
You don't have privileges.
Connection is wrong.
This is exactly the type of events that are relevant for security management.
We have to audit failed object access events events ID 560
as far as user control is concerned.
Pay close attention to password change attempts.
Note that this event is not exclusively related to password expirations enforced by a security policy.
This attempt could also indicate that an attacker is trying to crack a password or has cracked it already
and is now attempting to change it and make further use of the account he has taken over.
These events have to be monitored
events 7:54 is even more alarming.
It's a password reset event.
A reset is different from a password change in that a change requires a user to know the current password
in one of the next lectures will focus on the consequences of generating a new user security key in
Windows.
The key is used to secure some types of data.
For example the files that are encrypted by a user If an administrator resets the user's password.
This entails that the encrypted files will stay encrypted forever.
Event Succineidae relates to restoring an active directory controller password.
The password is submitted during an installation of Active Directory in the DC promo tool this is an
account that enables local access to a server.
We know already that any person who has local access to a server is de-facto that server's administrator
next.
There are events related to global and local groups
events six to four indicates that a new account has been created.
Unrestricted ability to create new objects in a system for example user accounts should never generally
be allowed.
A formal procedure that specifies the conditions for setting up accounts has to be enforced.
The second class of events will take a look at is related to the modification of the data that is logged
event 5:16 indicates that the log is full
5:17 occurs when the log is cleared.
520 is a change of the system time.
This can seem like a trivial thing but notice that the data recorded in the logs will form a basis for
further actions.
It could also constitute evidence of an attack all events saved in the logs come with the time of occurrence.
Which is local system time.
You can't simply assume 11 p.m. at the time of an event.
Since you can't rule out that someone might have changed the system clock at that hour the real hour
could have been for example 6 a.m. the time Mary calls in that case of an hour's
air 5:21 is a system error that causes the law to fail to record new events.
This should never be found in security logs.