configuring-windows-event-logging-for-detection

配置 Windows 事件日志记录以进行检测

何时使用

在以下情况下使用此技能：

• 配置 Windows 高级审核策略以进行安全监控
• 启用带命令行记录的进程创建审核（事件 4688）
• 设置登录/注销审核以进行身份验证监控
• 规划事件日志存储规模并转发到 SIEM 平台

请勿使用于 Sysmon 配置（单独技能）或 Linux 审核日志记录。

先决条件

• 具有组策略管理访问权限的 Windows Server 或 Windows 10/11 系统
• 具有组策略对象（GPO）创建权限的 Active Directory 环境
• 已配置为接收 Windows 事件日志转发的 SIEM 平台
• 了解 Windows 安全事件 ID 和审核类别

工作流

步骤 1：通过 GPO 配置高级审核策略

Computer Configuration → Windows Settings → Security Settings
  → Advanced Audit Policy Configuration → Audit Policies

Recommended settings:
Account Logon:
  - Audit Credential Validation: Success, Failure
  - Audit Kerberos Authentication: Success, Failure

Account Management:
  - Audit Security Group Management: Success
  - Audit User Account Management: Success, Failure

Logon/Logoff:
  - Audit Logon: Success, Failure
  - Audit Logoff: Success
  - Audit Special Logon: Success
  - Audit Other Logon/Logoff Events: Success, Failure

Object Access:
  - Audit File Share: Success, Failure
  - Audit Removable Storage: Success, Failure
  - Audit SAM: Success

Policy Change:
  - Audit Audit Policy Change: Success, Failure
  - Audit Authentication Policy Change: Success

Privilege Use:
  - Audit Sensitive Privilege Use: Success, Failure

Detailed Tracking:
  - Audit Process Creation: Success
  - Audit DPAPI Activity: Success, Failure

步骤 2：在进程创建事件中启用命令行

# Registry: Enable command line logging in Event 4688
New-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit" `
  -Name ProcessCreationIncludeCmdLine_Enabled -Value 1 -PropertyType DWORD -Force

# GPO: Computer Configuration → Administrative Templates → System → Audit Process Creation
# "Include command line in process creation events" → Enabled

步骤 3：配置事件日志大小

# Increase Security log to 1 GB (default 20 MB is insufficient)
wevtutil sl Security /ms:1073741824

# Increase PowerShell Operational log
wevtutil sl "Microsoft-Windows-PowerShell/Operational" /ms:536870912

# Set log retention to overwrite as needed
wevtutil sl Security /rt:false

# Configure via GPO:
# Computer Configuration → Administrative Templates → Windows Components
#   → Event Log Service → Security
# Maximum log file size (KB): 1048576

步骤 4：配置 Windows 事件转发（WEF）

# On collector server:
wecutil qc /q

# Create subscription for high-value events:
# Event IDs: 4624 (logon), 4625 (failed logon), 4688 (process create),
# 4672 (special privilege), 4720 (user created), 4728 (group membership),
# 7045 (service installed), 1102 (log cleared)

# On source endpoints (GPO):
# Configure WinRM: winrm quickconfig
# Configure event forwarding: Computer Configuration → Admin Templates
#   → Windows Components → Event Forwarding
# Configure target Subscription Manager: Server=http://collector:5985/wsman/SubscriptionManager/WEC

步骤 5：用于检测的关键事件 ID

Authentication Events:
  4624 - Successful logon (Type 2=Interactive, 3=Network, 10=RemoteInteractive)
  4625 - Failed logon attempt
  4648 - Logon using explicit credentials (RunAs, pass-the-hash indicator)
  4672 - Special privileges assigned (admin logon)
  4776 - NTLM credential validation

Process Events:
  4688 - Process creation (with command line if enabled)
  4689 - Process termination

Account Events:
  4720 - User account created
  4722 - User account enabled
  4724 - Password reset attempted
  4728 - Member added to security group
  4732 - Member added to local group
  4756 - Member added to universal group

Service/System Events:
  7045 - New service installed (persistence indicator)
  1102 - Audit log cleared (evidence tampering)
  4697 - Service installed in the system

Lateral Movement Indicators:
  4648 + 4624(Type 3) - Credential-based lateral movement
  5140 - Network share accessed
  5145 - Network share access check (detailed file share)

关键概念

术语	定义
高级审核策略	细粒度审核子类别（58 个子类别 vs. 9 个基本类别）
事件 ID 4688	进程创建事件；对于跟踪端点上的执行至关重要
WEF	Windows 事件转发；无需第三方 Agent 的集中式日志收集
登录类型	指示身份验证方法的数字代码（2=交互式，3=网络，10=RDP）

工具与系统

• Windows 事件转发（WEF）：内置的集中式日志收集
• NXLog：适用于 Windows 事件的开源日志转发 Agent
• Winlogbeat：用于将 Windows 事件日志发送到 Elasticsearch 的 Elastic Agent
• Palantir WEF Configuration：开源 WEF 订阅模板

常见陷阱

• 使用基本审核策略而非高级审核策略：基本审核策略和高级审核策略会冲突。始终仅使用高级审核策略。
• 默认日志大小过小：在繁忙的服务器上，20 MB 的安全日志几分钟内就会填满。设置至少 1 GB。
• 缺少命令行记录：不含命令行内容的事件 4688 检测价值极小。始终启用 ProcessCreationIncludeCmdLine_Enabled。
• 不转发日志：当端点被勒索软件清除时，本地事件日志会丢失。立即转发到集中式 SIEM。