Recommended Windows 2008 Audit Policy

Randy F. Smith has a good resource for the Windows 2008 Audit Policy.

IIS status code

Here is a link to some good information about the IIS status / sub-status codes for IIS 5 and 6.

Chris Crowe’s blog on IIS.

Monitoring Network Shares

I had a discussion today with a customer who was trying to monitor when their users tried to access network shares and failed.  He had all the correct accesses setup, removed “Everyone” and gave access to only those groups that needed access.  He even turned on the correct Object Access auditing, but his problem was that when anyone outside the correct groups tried to access the folder they got the message that ”  \\<server name>\<share> was not accessable.  You might not have permission … ” but the Audit Failure 560 events (his server is W2k3) were not being generated. 

This is something that I’ve seen quite often, the issue comes from the  Share Permissions that have been set.  Because he removed the Everyone group from the Share Permission the Audit Failure events for 560 (Object Access Auditing) were not being generated. 

So if you need to be able to track when unauthorized users are attempting to access shares for which they do not have access, leave the Everyone group with Read permission under the Share Permissions tab on the folder (as seen in the screen shot below). 

 

Now on the Security tab make sure that you turn on the correct Object Access auditing  (stay away from FULL CONTROL; you will flood yourself with noise events).  Now since in this example we want to track when people fail to open the network share, goto the Security tab, then click on the Advanced button, then the Auditing tab.  Click the add button and set this auditing for Everyone and check Traverse Folder and List Folder boxes under the Failed column.

Now when users attempt to open this network share event id 560 Audit Failure event will be generated telling you who, what, when.  Now the from where is not going to be listed in the 560 event but can be tracked down by looking at the Client Logon ID hex code listed in the event description.

Looking at the Object Name will tell you what file/folder the user was trying to access.  If the Image File Name is blank then you know they were attempting to access the resource from the network, if this field has a value then they used the program listed to access the resource locally.  Client User Name will tell you who the user was if they accessed remotely (if they are accessesing locally then look at the Primary User Name).  The Client Logon ID (or Primary Logon ID) will help you link back to the logon event (528 or 540 in the case of W2k3 and older OS).  Looking at the Accesses list we can see the ReadData/ListDirectory which is what we are auditing for.

Detecting Insider Threats

Over the last few weeks I have been putting together a whitepaper on detecting insider threats (on a Windows network).  The paper is finished and is available here.  In the next few days I will be setting up a webinar that will cover this topic watch www.prismmicrosys.com for a link to the webinar.

Tips on Tracking Down a Hack Attempt

On Tuesday March 17, 2009 I conducted a webinar for Prism Microsystems on how Log Management can help you track down a hack attempt.  Now I know there are multiple ways to hack a network, the purpose of this webinar was to show that if you are collecting the log data from ALL your sources, network equipment/Unix/Linux/Windows that you can track down these attempts very quickly.  Log Management can also help you become more proactive vs always being reactive.  Here is a link to the recorded version of the webinar, here is a link for the slides used in the webinar.

‘Tigger’/Syzor Trojan

Good article at darkreading.com about the ‘Tigger’/Syzor Trojan written by Tim Wilson.  In this article he points to a blog by Michael Kassner with more info on ‘Tigger’/Syzor trojan.

Analyzing ID 537 and the Status Codes

When looking through the logs have you ever come across that generic login failure event id 537?  Doesn’t really give you much at first glance, 90% of the time the user name in description field is blank.  This event comes in 2 forms, the workstation version and the DC version.

First I’m going to show the workstation version followed by the DC version.

As seen in the security log from Wrkstation1:

Event Type:        Failure Audit

Event Source:    Security

Event ID:              537

User:                     NT AUTHORITY\SYSTEM

Computer:          Wrkstation1

Description:

Logon Failure:

                Reason:                                An error occurred during logon

                User Name:       

                Domain:                              

                Logon Type:       3

                Logon Process:  Kerberos

                Authentication Package:               Kerberos

                Workstation Name:        -

                Status code:       0xC000006D

                Substatus code:                0xC0000133

 

As seen in the security log on DC1:

 

Event Type:        Failure Audit

Event Source:    Security

Event ID:              537

User:                     NT AUTHORITY\SYSTEM

Computer:          DC1

Description:

Logon Failure:

                Reason:                                An error occurred during logon

                User Name:       

                Domain:                              

                Logon Type:       3

                Logon Process:  Kerberos

                Authentication Package:               Kerberos

                Workstation Name:        -

                Status code:       0xC000006D

                Substatus code:                0xC0000133

                Caller User Name:           -

                Caller Domain:   -

                Caller Logon ID: -

                Caller Process ID:             -

                Transited Services:          -

                Source Network Address:            192.168.1.144

                Source Port:       0

 

 

When you get the information from the DC you will be able to track down the system that generated the logon failure either by the Source Network Address or by the Workstation Name in the description field.  The part of this event that holds any real data is the status code (and thank you Microsoft for using HEX codes instead of plain English).

Most of the time you will beat your head against a wall trying to figure out what in the world these codes mean.

Well stop looking I have found a MSDN reference to the NTSTATUS codes. 

 

Now in the above 2 examples the Status code: 0xC000006D means that “The attempted logon is invalid. This is either due to a bad username or authentication information.”  Since we already know this look at the Substatus code:  0xC0000133 which means “The time at the primary domain controller is different from the time at the backup domain controller or member server by too large an amount.”  Now the “too large an amount” refers to 5 minutes.  Check the system time on the DC where the event happened and check the workstation (Source Network Address).

 

Hope this helps.

Password Never Expires and Account Set to Expire

Recently I was asked, “What type of user account changes do you watch for?”  There are several but I wanted to focus on 2 changes that most people ask for.  1 “How can I tell if someone’s password has been set to never expire?” and 2nd “How can I tell if an account has been set to expire?”.  We will look at both the Windows 2003 and older Windows OS event (id 642) and the Windows 2008/Vista event (id 4738).  Sure there are scripts that you can run against your AD and Local System accounts to gather this information.  But if you have the correct auditing turned on (Audit Account Mgmt) you can get this information via the event logs and if you are collecting your logs using a log management tool you can get this info in real time.  I’m not going to show the entire event descriptions for id’s 642 and 4738, but I will show the sections that are important to us.  What’s nice about both of these events is that they appear whenever an account has been changed; this can be at the time of account creation or after an account is created.

For id 642 you need to look at the following:

                Target Account Name:   joe.user                  (User whose account was changed)

                Target Domain: Acme                                    (Users domain ; can also indicate local account)

                Caller User Name:   bob.admin                  (Admin who made the change)

               

For id 4738 look at the following:

                Subject:

                                Account Name:  bob.admin         (Admin who made the change)

                Target Account:

                                Account Name:  joe.user              (User whose account was changed)

                                Account Domain:  Acme               (Users domain; can also indicate local account)

 

This information holds true for any change to the account either local or one that is part of your AD.  The next information will tell you What changed on the account.  So for question 1, password set to never expire you need to watch for the following.

For id 642 and 4738:

                Changed Attributes:

                                User Account Control:

                                                ‘Don’t Expire Password’ – Enabled           (Box has been checked for password to never expire)

 

Now when you reverse the change and uncheck the password never expires box you will see ‘Don’t Expire Password’ – Disabled

 

Now for question 2, determine when an account has been set to expire.

For id 642 and 4738:

                Changed Attributes:

                                Account Expires:              x/xx/xxxx  xx:xx:xx PM                 (This gives you the Date/Time that the account will expire)

If an account is setup to never expire then the Account Expires will have a dash (-) after it.

I’m now on Twitter

For those who want to follow along here is the link to my twitter:

twitter.com/eventlogguru

Webinar hosted by Whitehatworld

The other day I conducted a webinar that was hosted by Whitehatworld.com.  I have been asked by several people if I would post a link to the recording, so click here to view the webinar.  The webinar topic was “Security Beyond the Windows Event Log – Monitoring Ten Critical Conditions”.