Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add events 4720 4722 4723 4724 4725 4726 4738 4740 4767 4781 - LogonID correlation #13530

Merged
merged 13 commits into from
Oct 15, 2019
Merged

Add events 4720 4722 4723 4724 4725 4726 4738 4740 4767 4781 - LogonID correlation #13530

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
13 commits
Select commit Hold shift + click to select a range
062ed90
Add events 4720 4722 4723 4724 4725 4726 4738 4740 4767 4781
janniten Sep 6, 2019
fe52a52
Update golden files
andrewkroh Oct 1, 2019
fc0bc91
Update x-pack/winlogbeat/module/security/config/winlogbeat-security.js
janniten Oct 2, 2019
3d332f1
Update x-pack/winlogbeat/module/security/config/winlogbeat-security.js
janniten Oct 2, 2019
51d8537
Add events 4720 4722 4723 4724 4725 4726 4738 4740 4767 4781 - LogonI…
janniten Oct 2, 2019
066d11b
Formating changes
andrewkroh Oct 4, 2019
7ae0f07
Update golden files
andrewkroh Oct 4, 2019
d95ab0f
Update module docs with new event IDs
andrewkroh Oct 9, 2019
3f2fb29
Add events 4720 4722 4723 4724 4725 4726 4738 4740 4767 4781 - LogonI…
janniten Oct 14, 2019
26c76ce
Update files
andrewkroh Oct 14, 2019
56258e9
Update CHANGELOG.next.asciidoc
andrewkroh Oct 14, 2019
f5e6de0
Merge branch 'master' into usr_mgm_evt
andrewkroh Oct 14, 2019
2c7e1f8
Update golden files with event.provider
andrewkroh Oct 15, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGELOG.next.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -446,6 +446,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
- Add support for event ID 22 (DNS query) to the Sysmon module. {pull}12960[12960]
- Add certain winlog.event_data.* fields to the index template. {issue}13700[13700] {pull}13704[13704]
- Fill `event.provider`. {pull}13937[13937]
- Add support for user management events to the Security module. {pull}13530[13530]

==== Deprecated

Expand Down
10 changes: 10 additions & 0 deletions winlogbeat/docs/modules/security.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,16 @@ The module has transformations for the following event IDs:
* 4647 - User initiated logoff (interactive logon types).
* 4648 - A logon was attempted using explicit credentials.
* 4672 - Special privileges assigned to new logon.
* 4720 - A user account was created.
* 4722 - A user account was enabled.
* 4723 - An attempt was made to change an account's password.
* 4724 - An attempt was made to reset an account's password.
* 4725 - An user account was disabled.
* 4726 - An user account was deleted.
* 4738 - An user account was changed.
* 4740 - An user account was locked out.
* 4767 - An account was unlocked.
* 4781 - The name of an account was changed.

More event IDs will be added.

Expand Down
10 changes: 10 additions & 0 deletions x-pack/winlogbeat/module/security/_meta/docs.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,16 @@ The module has transformations for the following event IDs:
* 4647 - User initiated logoff (interactive logon types).
* 4648 - A logon was attempted using explicit credentials.
* 4672 - Special privileges assigned to new logon.
* 4720 - A user account was created.
* 4722 - A user account was enabled.
* 4723 - An attempt was made to change an account's password.
* 4724 - An attempt was made to reset an account's password.
* 4725 - An user account was disabled.
* 4726 - An user account was deleted.
* 4738 - An user account was changed.
* 4740 - An user account was locked out.
* 4767 - An account was unlocked.
* 4781 - The name of an account was changed.

More event IDs will be added.

Expand Down
123 changes: 107 additions & 16 deletions x-pack/winlogbeat/module/security/config/winlogbeat-security.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,23 @@ var security = (function () {
"11": "CachedInteractive",
};

var eventActionTypes = {
Copy link
Member

@andrewkroh andrewkroh Oct 9, 2019 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@webmat This is adding these event.action values based on the event ID. Do you want these action values or would you like to hold off until the action values are more well defined for ECS?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@andrewkroh @webmat I was thinking about that point this morning. Personally i think is is better to define the event.action as defined in for auditbeat (some of them can be maybe reused). For example: event.action -> deleted-group-account-from
what do you thing? I can modify the event.action in order to match or follow the same criteria as auditbeat

Copy link
Contributor Author

@janniten janniten Oct 14, 2019 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I took the events actions from auditbeat'a logs and I think these event.action are more suitable.

Event event.action
4624 logged-in
4625 logon-failed
4634 logged-out
4672 logged-in-special
4720 added-user-account
4722 enabled-user-account
4723 changed-password
4724 reseted-password
4725 disabled-user-account
4726 deleted-user-account
4738 modified-user-account
4740 locked-out-user-account
4767 unlocked-user-account
4781 renamed-user-account

@andrewkroh @webmat What do you think?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The field event.action is not reserved, and can therefore be defined each source. So no limitations coming from ECS in that regard :-)

These values for event.action look fine to me 👍

Copy link
Contributor Author

@janniten janniten Oct 14, 2019 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@andrewkroh do I change the event.actions to the ones in the table above or should I keep the previous ones?
I have already write the code to support the events for group management (**) and some enhancements in order to map the UAC values to a human readable form for events 4720 y 4738. If you prefer we can continue with this PR and once closed, I can create a new one with the new event.actions, new events support and the UAC enhancements.
What do you think?

Copy link
Member

@andrewkroh andrewkroh Oct 14, 2019 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I like the proposed ones that match up with auditbeat. Can you please change them in this PR? Then I'll push an update with the golden files.

The UAC fields can be done in another PR.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done!

"4624": "logged-in",
"4625": "logon-failed",
"4634": "logged-out",
"4672": "logged-in-special",
"4720": "added-user-account",
"4722": "enabled-user-account",
"4723": "changed-password",
"4724": "reset-password",
"4725": "disabled-user-account",
"4726": "deleted-user-account",
"4738": "modified-user-account",
"4740": "locked-out-user-account",
"4767": "unlocked-user-account",
"4781": "renamed-user-account",
};

// Descriptions of failure status codes.
// https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625
var logonFailureStatus = {
Expand Down Expand Up @@ -1030,6 +1047,17 @@ var security = (function () {
return msobjsMessageTable[code];
};

var addActionDesc = function(evt){
var code = evt.Get("event.code");
if (!code) {
return;
}
var eventActionDescription = eventActionTypes[code];
if (eventActionDescription) {
evt.Put("event.action", eventActionDescription);
}
};

var addLogonType = function(evt) {
var code = evt.Get("winlog.event_data.LogonType");
if (!code) {
Expand Down Expand Up @@ -1074,19 +1102,6 @@ var security = (function () {
evt.Put("winlog.logon.failure.sub_status", descriptiveFailureStatus);
};

// Add logon IDs to winlog.logon.id to make it easy to find all activity
// related to a logon ID.
var addLogonIds = function(evt) {
var id = evt.Get("winlog.event_data.SubjectLogonId");
if (id) {
evt.AppendTo("winlog.logon.id", id);
}
id = evt.Get("winlog.event_data.TargetLogonId");
if (id) {
evt.AppendTo("winlog.logon.id", id);
}
};

var copyTargetUser = new processor.Chain()
.Convert({
fields: [
Expand All @@ -1096,7 +1111,15 @@ var security = (function () {
],
ignore_missing: true,
})
.Add(addLogonIds)
.Build();

var copyTargetUserLogonId = new processor.Chain()
.Convert({
fields: [
{from: "winlog.event_data.TargetLogonId", to: "winlog.logon.id"},
],
ignore_missing: true,
})
.Build();

var copySubjectUser = new processor.Chain()
Expand All @@ -1108,7 +1131,24 @@ var security = (function () {
],
ignore_missing: true,
})
.Add(addLogonIds)
.Build();

var copyOldTargetUser = new processor.Chain()
.Convert({
fields: [
{from: "winlog.event_data.OldTargetUserName", to: "user.name"},
],
ignore_missing: true,
})
.Build();

var copySubjectUserLogonId = new processor.Chain()
.Convert({
fields: [
{from: "winlog.event_data.SubjectLogonId", to: "winlog.logon.id"},
],
ignore_missing: true,
})
.Build();

var renameCommonAuthFields = new processor.Chain()
Expand Down Expand Up @@ -1155,36 +1195,57 @@ var security = (function () {
// Handles 4634 and 4647.
var logoff = new processor.Chain()
.Add(copyTargetUser)
.Add(copyTargetUserLogonId)
.Add(addLogonType)
.Add(addActionDesc)
.Build();

// Handles both 4624 and 4648.
var logonSuccess = new processor.Chain()
.Add(addAuthSuccess)
.Add(copyTargetUser)
.Add(copyTargetUserLogonId)
.Add(addLogonType)
.Add(renameCommonAuthFields)
.Add(addActionDesc)
.Build();

var event4625 = new processor.Chain()
.Add(addAuthFailed)
.Add(copyTargetUser)
.Add(copyTargetUserLogonId)
.Add(addLogonType)
.Add(addFailureCode)
.Add(addFailureStatus)
.Add(addFailureSubStatus)
.Add(renameCommonAuthFields)
.Add(addActionDesc)
.Build();

var event4672 = new processor.Chain()
.Add(copySubjectUser)
.Add(copySubjectUserLogonId)
.Add(function(evt) {
var privs = evt.Get("winlog.event_data.PrivilegeList");
if (!privs) {
return;
}
evt.Put("winlog.event_data.PrivilegeList", privs.split(/\s+/));
})
.Add(addActionDesc)
.Build();

var userMgmtEvts = new processor.Chain()
.Add(copyTargetUser)
.Add(copySubjectUserLogonId)
.Add(renameCommonAuthFields)
.Add(addActionDesc)
.Build();

var userRenamed = new processor.Chain()
.Add(copyOldTargetUser)
.Add(copySubjectUserLogonId)
.Add(addActionDesc)
.Build();

return {
Expand All @@ -1193,7 +1254,7 @@ var security = (function () {

// 4625 - An account failed to log on.
4625: event4625.Run,

// 4634 - An account was logged off.
4634: logoff.Run,

Expand All @@ -1206,6 +1267,36 @@ var security = (function () {
// 4672 - Special privileges assigned to new logon.
4672: event4672.Run,

// 4720 - A user account was created
4720: userMgmtEvts.Run,

// 4722 - A user account was enabled
4722: userMgmtEvts.Run,

// 4723 - An attempt was made to change an account's password
4723: userMgmtEvts.Run,

// 4724 - An attempt was made to reset an account's password
4724: userMgmtEvts.Run,

// 4725 - A user account was disabled.
4725: userMgmtEvts.Run,

// 4726 - An user account was deleted.
4726: userMgmtEvts.Run,

// 4738 - An user account was changed.
4738: userMgmtEvts.Run,

// 4740 - An account was locked out
4740: userMgmtEvts.Run,

// 4767 - A user account was unlocked.
4767: userMgmtEvts.Run,

// 4781 - The name of an account was changed.
4781: userRenamed.Run,

process: function(evt) {
var event_id = evt.Get("winlog.event_id");
var processor = this[event_id];
Expand Down
Loading