Hi everybody and welcome to this quick video about Windows logging.
So in this video we're gonna go over where the windows logs are how to view them what some of them are.
So you can get a better idea of what or what sort of logging is is enabled by default on a Windows machine.
Now keep in mind that they're scared scares gonna be other videos that go into more detail on you know
for example of how to clear the logs.
Well when should you clear him why should you only clear certain parts.
How do you do that as well as knowing when to look for other things like Splunk forwarders or sis log
maybe not on a Windows machine but for Splunk Florida's on a Windows machine so it knows where logs
are getting sent.
So from an attacker's perspective you don't think that all the logs are just sitting on the system when
in fact they're being sent out to an engine that will then create alerts based on what you've been doing.
So just keep this in mind this is a high overview of just kind of windows logging in general.
So we're gonna start off with the generic logging location for Windows.
So when we come here it's under our local C drive windows and then we should see something called logs.
Now depending on the services or roles that you have installed for the server or just for the desktop
you will see different files here such as you know you if you are an FTB server you'll see ATP files
here.
I guess you'll see I ask server files here.
So as a quick example look at DSM.
So this is the Windows Defender.
Do a quick look we can see that what's running
just gives you the logs are normally in a text based format for the most part.
However there are some such as something like the Windows Update so it comes in this 80 l extension.
So an e-mail extension is the event your extension for Windows which we're going to go over in just
a second.
So just keep in mind that the intel is the event now logs can also be dumped in a variety of places.
There are people that will dump them on the desktop into the root of the drive for example.
So it's always good to do a quick double check.
And what I didn't mention in the previous videos is sometimes windows or people might hide files.
So if you come into this view and you hit hide show hidden items we see in this particular case there's
no extra stuff in logs.
However if we come back here we see this program data that's a little bit Great out compared to the
others so if we turn this off you see it goes away.
I know you didn't talk about program data in the other video but we can do a quick recap so program
data is where a lot of the temporary settings and other types of data is stored when an application
runs.
So a lot of malware will dump its its binaries here or keep copies of itself over here or keep settings
over here.
A quick look you see there's nothing too fancy on here this is pretty much the standard stuff that we're
going to see just some basic information some of it's empty for folder structure entirely depends.
So that's logging for the Windows system itself.
So we're going to look at the event viewer which will handle all of the other types of logging that
we want to look for so here we've got a few options.
We've got custom views windows logs application and service logs and subscriptions.
So we're going to leave subscriptions out of here and not want to do that custom views or you can create
custom essentially filters for that log so you can have a general overview so you can kind of get an
idea of what that looks like here where you've got summary of the events recently viewed things
the summary of the logs in general so you can do if you wanted to look for just password failures you
could you would use a custom view so application logs there's a few different things here we've got
hardware events.
So if something on the hardware fails you'll see it here.
Same thing in area X or key management stuff for Curb rows which we have a whole module on anything
that issues with power shell and then we can go even further under this and go all the way down to like
a specific for example of bits client we can go and find out exactly what's happening around the bits
client itself.
So in this case it was shut down successfully but delayed for six hundred seconds.
So we want to keep track of what's here and knowing where you was no matter what you've done.
Starting a service stopping a service it's not just in the windows log under application let's say you
might have to know that it's under it's going under here and we restarted bits so we would want to reset.
You would want to make sure that in here we noticed that we've restarted something and maybe we made
a modification to it to read it and restarted it for privilege escalation you would you would take a
look here make sure you cover those tracks if need be around the windows logs.
These are gonna be your standard ones that you're going to go to when looking for information about
why something failed.
So we have the application log which is again based on application.
So this is not just services this is you ran you downloaded some random executable and ran it whatever
that ends up being if it fails it's going to end up here.
Let me take a quick look.
You don't see anything too catastrophic.
We do see stuff around the licensing.
Where was it.
So we've got two hundred and fifty seven thousand minutes left.
So on our license scored a little bit stuff as it successfully started started.
So it is on a fresh reboot as well so you're going to see a lot of this.
Next up is the setup.
Now I'm not going to go too much in the setup.
Essentially it's it's when you when you're in the process of setting up the machine any errors that
might have that might have happened throughout the process is going to end up in their forwarded logs
is a process of you being able to forward logs to a different machine.
Again I'm not going to go into too much detail around this.
Normally this is not done by the OS.
Normally this is something like Splunk that will that will move things off of it.
We have the system log which contains driver failures hardware issues anything that the system controls
so you can see here that the background intelligence transfer service so bits was changed from OnDemand
to auto start and that's perfectly fine.
This is around the time that we
should have built the service.
So see here we've got another one geo location positioning has been disabled by the user so this is
when we were disabling and enabling things time services now sync.
So there's some good information in here but we're mainly looking for errors and since this is a relatively
new one we're not gonna see too many permission does not grant local permissions.
OK so a failure on security permissions.
That's fine.
That could be due to somebody trying to log in and it might been doing something in the background.
So it leaves us with our last one which is the big one that you're going to want to keep in mind.
So you've got the security so this is where all of our audits come into place so if we see here we've
got it looks like we had a audit log in failure
shouldn't be fines and it's gotten no I.D..
That must be a service trying to do something.
So if we see here.
OK.
Perfect.
So we have the administrator tried to log in and failed.
Now this was me doing this on purpose so I had a log entry for you to take a look at.
But notice that the account name is here.
So if somebody does a fat finger and hits misses the tab and types their password into the user name
field as well in hits enter you're going to see it here.
So that's a good thing to take a look for a quick look at audit failures on a machine.
We'll give you a good idea of if somebody has done that.
There are there are quite a few scripts that can pass through that logs to look for something similar
to that.
And then we can see here there was a successful authentication here so these are the event logs and
the windows system logs in a pre high overview.
Again we can go into each into detail on some of these individual logs play around with the customer
views and making sure let's say create a custom view that you can see audit failures so you can see
the type here.
Five so you can base search on that and you can also base search on the event idea which is the more
preferred method is right here.
So you would want to use the event I.D. So forty six twenty five is a log in failure.
And if you did a custom view for just that we should just get log and failure.
So just for sake of giving this a try we want logs filter that logs.
We want the security log we want this event tidy based.
All right.
OK.
And we'll just call on you.
So as we can see here we see username bad error occurred during a log in.
That's fine and then we see our username was password was bad air during log in error during log and
that's fine.
But we can see that right here we've got our exact one that we were looking for.
So go out and play around this try out a few different things in the custom views and take a look at
your own system logs if you're running a Windows machine at home.
Go ahead and you should be able to look at this stuff up on your own to see kind of what any times you
felt the log in.
Or maybe there's some services that are failing that you just never knew of.
So go ahead and take a look at it and then move on to the next set of videos where we're going to dive
a little bit deeper into the Windows operating system.