Wednesday, 6 December 2017
One comments

LogonTracer: Investigate Malicious Windows Logon By Visualizing And Analyzing Windows Event Log

LogonTracer: Investigate Malicious Windows Logon By Visualizing And Analyzing Windows Event Log


LogonTracer: Investigate Malicious Windows Logon By Visualizing And Analyzing Windows Event Log.


Investigate malicious logon by visualizing and analyzing Windows active directory event logs.


LogonTracer uses PageRank and ChangeFinder to detect malicious hosts and accounts from event log.

This tool can visualize the following event id related to Windows logon based on this research.
  • 4624: Successful logon
  • 4625: Logon failure
  • 4768: Kerberos Authentication (TGT Request)
  • 4769: Kerberos Service Ticket (ST Request)
  • 4776: NTLM Authentication
  • 4672: Assign special privileges


Requirements

The following tools are used

Usage

Install

1. Download and install Neo4j community edition.
2. Clone or download LogonTracer.

$ git clone https://github.com/JPCERTCC/LogonTracer.git

3. Install Neo4j JavaScript driver to static directory.
$ cd LogonTracer/static
$ npm install neo4j-driver

4. Install Python modules.
$ pip3 install -r requirements.txt

or

$ pip3 install numpy py2neo python-evtx lxml changefinder flask

If statsmodels installation fails, install numpy first.

5. Start the Neo4j server.

How to Use

Start LogonTracer
  • Start LogonTracer by the following command option -r.
  • Use -h to see help message.

$ python3 logontracer.py -r -o 8080 -u neo4j -p password -s localhost

Access http://[LogonTracer_Server]:8080/ via Web browser.

Import EVTX
Import the event log using Web GUI or logontracer.py.

Use Web GUI
Event log can be imported with upload EVTX button.



Use python script
Event log can be imported by logontracer.py option -e.

$ python3 logontracer.py -e Security.evtx -z +9 -u neo4j -p password -s localhost

Search and visualize the event log

Using the navigation bar to search for account name, host name, IP address, event id and event count.

Export button can download graph data of CSV, JPG, PNG and JSON.


Using the side-bar to search for account names matching specific criteria.
  • All users: Visualizing all users and hosts.
  • SYSTEM privileges: Visualizing users with system privileges.
  • RDP Logon: Visualizing RDP logon users and hosts (Logon type: 10).
  • Network Logon: Visualizing logon users and hosts from remote network (Logon type: 3).
  • Batch Logon: Visualizing batch server logon (Logon type: 4).
  • Service Logon: Visualizing Services Control Manager logon (Logon type: 5).
  • ms14-068 exploit failure: Visualizing the error log that the ms14-068 exploit failed.
  • Logon failure: Visualizing users who failed to log on.

Node details
  • Node Red SYSTEM privileges account
  • Node Blue Standard user account
  • Node Green IP address and host

PageRank

  • PageRank is an algorithm for checking the importance of web pages.
  • LogonTracer uses PageRank to examine the importance of accounts and hosts in a domain network.
  • An account with high PageRank logs on to many hosts and may be used by the attackers' lateral movement.

Timeline

  • Timeline button displays hourly event log counts in time series.
  • Hosts with drastic changes are highlighted.
  • For anomaly detection using this index, use change point analysis algorithm Change Finder.
  • For downloading timeline summary and detailed CSV data, click "Download".



Docker Image

If you are using Docker, you can pull the following image.
https://hub.docker.com/r/jpcertcc/docker-logontracer/

$ docker run \
   --detach \
   --publish=7474:7474 --publish=7687:7687 --publish=8080:8080 \
   -e LTHOSTNAME=[IP Address] \
   jpcertcc/docker-logontracer

Notes
  1. Event logs that LogonTracer analyzes are not recorded by default settings.
  2. If you have not enabled the audit policy, you need to enable the audit policy.
  3. You can change the audit policy from Local Group Policy Editor (gpedit.msc).

Computer Configuration > Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies - Local Group Policy Object

By enabling the following items, the event ID will be recorded.

1, Account Logon
  • Audit Credential Validation
  • Audit Kerberos Authentication Service
  • Audit Kerberos Service Ticket Operations

2. Logon/Logoff

  • Audit Logon
  • Audit Special Logon

1 comments:

  1. I was able to spy on my cheating ex-Husband phone without him finding out…..it really helped my lawyer during my divorce i have been scammed so many times but cyberhackpros is the best hacker i have met he helped me regain my freedom and lost money by scammers …you can contact [email protected] for spying and hacking phones,computer,email,Facebook and other social networks account,his services are cheap …[email protected] or call +1 512 605 1256,please tell him i referred you

    ReplyDelete

 
Toggle Footer
Top