Log_Review.pdf

(42 KB) Pobierz
CRITICAL LOG REVIEW CHECKLIST FOR SECURITY INCIDENTS
This cheat sheet presents a checklist for reviewing critical logs when responding to a security incident. It can also be used for routine log review.
G ENE R AL APPROACH
1. Identify which log sources and automated tools you can use during
the analysis.
2. Copy log records to a single location where you will be able to
review them.
3. Minimize “noise” by removing routine, repetitive log entries from
view after confirming that they are benign.
4. Determine whether you can rely on logs’ time stamps; consider time
zone differences.
5. Focus on recent changes, failures, errors, status changes, access
and administration events, and other events unusual for your
environment.
6. Go backwards in time from now to reconstruct actions after and
before the incident.
7. Correlate activities across different logs to get a comprehensive
picture.
8. Develop theories about what occurred; explore logs to confirm or
disprove them.
WHAT TO LOOK F OR ON NET WOR K DE VI C ES
• Look at both inbound and outbound activities.
• Examples below show log excerpts from Cisco ASA logs; other
devices have similar functionality.
Tra c allowed on rewall
Tra c blocked on rewall
Bytes transferred (large les?)
Bandwidth and protocol usage
Detected attack activity
User account changes
Administrator access
“Built … connection”,
“access-list … permitted”
“access-list … denied”, “deny inbound”;
“Deny … by”
“Teardown TCP connection …
duration … bytes …”
“limit … exceeded”, “CPU utilization”
“attack from”
“user added”, “user deleted”,
“User priv level changed”
“AAA user …”, “User … locked out”,
“login failed”
P OT EN TI AL SECURIT Y LO G SOURCE S
• Server and workstation operating system logs
• Application logs (e.g., web server, database server)
• Security tool logs (e.g., anti-virus, change detection, intrusion
detection/prevention system)
• Outbound proxy logs and end-user application logs
• Remember to consider other, non-log sources for security events.
WHAT TO LOOK F OR ON W E B S E RVE RS
• Excessive access attempts to non-existent files
• Code (SQL, HTML) seen as part of the URL
• Access to extensions you have not implemented
• Web service stopped/started/failed messages
• Access to “risky” pages that accept user input
• Look at logs on all servers in the load balancer pool
• Error code 200 on files that are not yours
Failed user authentication
Invalid request
Internal server error
Error code 401, 403
Error code 400
Error code 500
T Y PIC AL LOG LOC ATION S
• Linux OS and core applications: /var/log
• Windows OS and core applications: Windows Event Log
(Security, System, Application)
• Network devices: usually logged via Syslog; some use proprietary
locations and formats
OT HE R RESOURCE S
• Windows event ID lookup:
www.eventid.net
• A listing of many Windows Security Log events:
ultimatewindowssecurity.com/.../Default.aspx
• Log analysis references:
www.loganalysis.org
• A list of open-source log analysis tools:
securitywarriorconsulting.com/logtools
• Anton Chuvakin’s log management blog:
securitywarriorconsulting.com/logmanagementblog
• Other security incident response-related cheat sheets:
zeltser.com/cheat-sheets
W H AT TO LO O K FO R O N L I NU X
Successful user login
Failed user login
User log-o
User account change
or deletion
Sudo actions
Service failure
“Accepted password”, “Accepted publickey”,
“session opened”
“authentication failure”, “failed password”
“session closed”
“password changed”, “new user”, “delete user”
“sudo: … COMMAND=…” “FAILED su”
“failed” or “failure”
W HAT TO LOOK FO R O N W INDOWS
• Event IDs are listed below for Windows 2000/XP. For Vista/7 security
event ID, add 4096 to the event ID.
• Most of the events below are in the Security log;
many are only logged on the domain controller.
User logon/logo events
User account changes
Password changes
Service started or stopped
Object access denied
(if auditing enabled)
Successful logon 528, 540;
failed logon 529-537, 539; logo 538, 551, etc
Created 624; enabled 626;
changed 642; disabled 629; deleted 630
To self: 628; to others: 627
7035, 7036, etc.
560, 567, etc
Authored by Anton Chuvakin (chuvakin.org) and
Lenny Zeltser (zeltser.com).
Reviewed by Anand Sastry.
Distributed according to the
Creative Commons v3 “Attribution” License.
Cheat sheet version 1.0.

Plik z chomika:

Inne pliki z tego folderu:

Inne foldery tego chomika:

Zgłoś jeśli naruszono regulamin