Writeup: Windows Event Logs
For this box I used Remmina on Kali Linux while connected to the TryHackMe VPN.
Link: Windows Event Logs Room on TryHackMe
Let's begin...
Answer: No answer needed
For the questions below, use Event Viewer to analyze Microsoft-Windows-PowerShell/Operational log.
Answer: No answer needed
What is the Event ID for the first event?
Scroll to the bottom to find it.
Answer: 40961
Filter on Event ID 4104. What was the 2nd command executed in the PowerShell session?
Create a filter on the event ID.
Then scroll to the bottom and take the second element.
Answer: whoami
What is the Task Category for Event ID 4104?
Answer: Execute a remote command
For the questions below, use Event Viewer to analyze the Windows PowerShell log.
Answer: No answer needed
What is the Task Category for Event ID 800?
Filter on Event ID 800.
Answer: Pipeline Execution Details
How many log names are in the machine?
wevtutil.exe el | Measure-Object
Answer: 1071
What is the definition for the query-events command?
wevtutil.exe qe /?
Answer: Read events from an event log, log file or using structured query.
What option would you use to provide a path to a log file?
Answer: /lf:true
What is the VALUE for /q?
Answer: XPATH query
The questions below are based on this command: wevtutil qe Application /c:3 /rd:true /f:text
Answer: No answer needed
What is the log name?
Answer: From the query, the log name is Application
What is the /rd option for?
Answer: Event read direction
What is the /c option for?
Answer: Maximum number of events to read
Answer the following questions using the online help documentation for Get-WinEvent
Answer: No answer needed
Execute the command from Example 1 (as is). What are the names of the logs related to OpenSSH?
Get-WinEvent -ListLog *
Answer: OpenSSH/Admin,OpenSSH/Operational
Execute the command from Example 7. Instead of the string *Policy* search for *PowerShell*. What is the name of the 3rd log provider?
Get-WinEvent -ListProvider *Powershell*
Answer: Microsoft-Windows-PowerShell-DesiredStateConfiguration-FileDownloadManager
Execute the command from Example 8. Use Microsoft-Windows-PowerShell as the log provider. How many event ids are displayed for this event provider?
(Get-WinEvent -ListProvider Microsoft-Windows-PowerShell).Events | Format-Table Id, Description | Measure-Object
Answer: 192
How do you specify the number of events to display?
Answer: -MaxEvents
How do you specify the number of events to display?
Answer: 4
Using Get-WinEvent and XPath, what is the query to find WLMS events with a System Time of 2020-12-15T01:09:08.940277500Z?
Answer: Get-WinEvent -LogName Application -FilterXPath '*/System/Provider[@Name="WLMS"] and */System/TimeCreated[@Name="SystemTime"]="2020-12-15T01:09:08.940277500Z"'
Using Get-WinEvent and XPath, what is the query to find a user named Sam with an Logon Event ID of 4720?
Answer: Get-WinEvent -LogName Security -FilterXPath '*/EventData/Data[@Name="TargetUserName"]="Sam" and */System/EventID=4720'
Based on the previous query, how many results are returned?
Answer: 2
Based on the output from the question #2, what is Message?
Answer: A user account was created
Still working with Sam as the user, what time was Event ID 4724 recorded? (MM/DD/YYYY H:MM:SS [AM/PM])
Get-WinEvent -LogName Security -FilterXPath '*/EventData/Data[@Name="TargetUserName"]="Sam" and */System/EventID=4724'
Answer: 12/17/2020 1:57:14 PM
What is the Provider Name?
Answer: Microsoft-Windows-Security-Auditing
I'm ready to look at some event logs...
Answer: No answer needed
What event ID is to detect a PowerShell downgrade attack?
Answer: From a bit of research, I stumbled upon this website which puts the "classic" event ID at 400
What is the Date and Time this attack took place? (MM/DD/YYYY H:MM:SS [AM/PM])
Get-WinEvent -Path .\merged.evtx -FilterXPath '*/System/EventID=400'
Answer: 12/18/2020 7:50:33 AM
A Log clear event was recorded. What is the 'Event Record ID'?
By going to the EventViewer and filtering by Task Category we can find a single Log Clear event. When moving to the Details pane and selecting XML View (or unpacking system in the Friendly View) we obtain our answer.
Answer: 27736
What is the name of the computer?
Same view as before, but under Computer.
Answer: PC01.example.corp
What is the name of the first variable within the PowerShell command?
(From the instructions we are advised to search for event ID 4104 and the text "ScriptBlockText" within the EventData element).
Get-WinEvent -Path .\merged.evtx -FilterXPath '*/EventData/Data[@Name="ScriptBlockText"] and */System/EventID=4104' -Oldest -MaxEvents 1 | Format-List
Answer: $Va5w3n8
What is the Date and Time this attack took place? (MM/DD/YYYY H:MM:SS [AM/PM])
Answer: 8/25/2020 10:09:28 PM
What is the Execution Process ID?
In the Event Viewer, we can filter by Event ID 4104, and then go down to the oldest event, in the XML view lies our answer.
Answer: 6620
What is the Group Security ID of the group she enumerated?
First, we find the event ID, by googling, which brings us to event ID 4799.
This is also the answer to Question 9.
Get-WinEvent -Path .\merged.evtx -FilterXPath '*/System/EventID=4799' -Oldest -MaxEvents 1 | Format-List
This gets us the following:
Answer: S-1-5-32-544
Answer: 4799
Hope you enjoyed this room and learned a thing or two.
Answer: No answer needed