# Event Log Manipulation

## **Event Log Manipulation Detection: Ensuring Evidence Integrity**

Event logs are essential for tracking system and security activities, providing vital evidence for forensic investigations. However, attackers often attempt to manipulate these logs by **clearing** or **disabling them** to cover their tracks. This guide outlines the key event IDs for detecting such manipulations and provides strategies to mitigate these threats.

***

## **Key Event IDs for Detecting Log Manipulation**

### **1. Event ID 1102: Security Log Cleared**

* **Log Location**: **Security Logs**
* **Details**:
  * Triggered when the **Security log** is cleared.
  * Records the **user account** that initiated the action.
* **Use Case**:
  * Detect potential **compromise** or malicious activity by tracking accounts that clear security logs.

**Example:**

A newly created or compromised account clears the security logs after performing malicious actions to erase evidence.

### **2. Event ID 104: Any Log Cleared**

* **Log Location**: **System Logs**
* **Details**:
  * Triggered when **any log** (except Security) is cleared.
  * Specifies which log (e.g., **System**, **PowerShell**) was cleared.
* **Use Case**:
  * Monitor for suspicious clearing of logs such as **PowerShell Operational Logs**, which may indicate the use of **malicious scripts**.

**Example:**

An attacker clears the **System Logs** to hide traces of abnormal system behavior or the use of tools like **Task Scheduler**.

### **3. Event ID 1100: Event Logging Disabled**

* **Log Location**: **Security Logs**
* **Details**:
  * Triggered when the **Event Log service** is manually stopped.
  * Captures the account that disabled logging.
* **Use Case**:
  * Detect high-priority incidents where logging services are disabled, potentially indicating the start of a stealthy attack phase.

**Example:**

An attacker disables event logging to prevent security tools from capturing their activities.

***

## **Why Attackers Manipulate Event Logs**

### **1. Covering Tracks**

* **Goal**: Erase evidence of malicious activities such as privilege escalation, lateral movement, or data exfiltration.

### **2. Disrupting Security Monitoring**

* **Goal**: Disable or interfere with **SIEMs** and **monitoring tools**, preventing automated detection and alerting.

### **3. Avoiding Detection**

* **Goal**: Prevent the generation of **alerts** by removing critical logs or stopping the logging service.

***

## **Detection and Mitigation Strategies**

### **1. Monitor Key Event IDs**

* Set up alerts for the following event IDs:
  * **1102**: Security Log Cleared.
  * **104**: Any Log Cleared.
  * **1100**: Event Logging Disabled.

### **2. Privilege Escalation Detection**

* **Clearing logs** or **disabling event logging** requires **administrative privileges**.
  * Monitor **Event ID 4672** (Special Privilege Assignments) to detect accounts with elevated privileges.

### **3. SIEM Integration**

* Integrate logs into a **SIEM** solution to:
  * Correlate events in real time.
  * Generate alerts for log-clearing and service-disabling actions.

### **4. Behavioral Analysis**

* **Baseline Logging Behavior**:
  * Frequent log clearing or disabling logging services is uncommon and should raise red flags.
  * Analyze **log-clearing patterns** to identify anomalies.

### **5. Enforce Logging Policies via GPOs**

* Use **Group Policy Objects (GPOs)** to ensure critical event logging is always enabled.
* Forward logs to a **remote server** to preserve copies even if local logs are deleted.

### **6. Regular Audit and Review**

* Conduct regular **audits of log files** to ensure integrity.
* Review **log retention policies** to prevent accidental or malicious deletion.

***

## **Example Detection Workflow**

1. **SIEM Alert**:
   * An alert is triggered for **Event ID 1102** (Security Log Cleared).
2. **Immediate Investigation**:
   * Review the **account** and **time** associated with the event.
   * Look for related **Event IDs** (e.g., **104**, **1100**) indicating broader log manipulation or service stoppage.
3. **Correlate with Other Events**:
   * Check for **privilege escalation** (Event ID **4672**) or suspicious activity just before the logs were cleared.
4. **Response**:
   * **Isolate** the system.
   * **Disable** the compromised account.
   * **Preserve forensic evidence** by securing a remote copy of logs.

***

## **Key Points**

Event log manipulation is a clear indicator of malicious activity aimed at hiding traces of an attack. By focusing on **critical event IDs** like **1102**, **104**, and **1100**, and implementing robust monitoring and alerting strategies, organizations can detect and respond to log manipulation attempts quickly, ensuring the integrity of their forensic investigations.
