Windows
All
- NTFS
  - $Bitmap
  - $I30
  - $LogFile
  - $MFT
  - $MFTMir
  - $Secure
  - $UsnJrnl
  - MACB timestamps
- ETW
  - Overview
  - Procedure - Tools
  - Events integrity
  - System uptime
  - Authentication
    - Destination host
    - Source host
    - Domain Controllers
  - Remote Desktop
    - Destination host
    - Source host
    - Remote Desktop Gateway
  - PowerShell remoting
    - Destination host
    - Source host
  - Users and security groups
  - Process creation
  - PowerShell activity
  - AppLocker
  - Network shares
  - Devices and USB activity
  - Windows Defender
  - Windows Firewall
  - Windows Services
  - Windows Scheduled Tasks
  - Registry ASEP
  - WMI
  - AD NTDS dumping
  - Sigma rules
- Registry
  - Overview
  - Timestamp
  - Procedure - Tools
  - System information
    - ComputerName
    - CurrentVersion
    - Security - Policy
    - ProfileList
    - SAM - Local users
    - TimeZoneInformation
    - Select
    - Network interfaces (Interfaces)
    - Network interfaces (NetworkList)
    - LanmanServer\Shares
    - FirewallPolicy
    - Installed applications (App Paths)
    - Installed applications (Uninstall)
  - Devices and USB activity
    - Windows devices terminology
    - Enum\USB
    - Enum\USBSTOR
    - Enum\SWD\WPDBUSENUM
    - MountedDevices
    - DeviceClasses
    - Windows Portable Devices
    - VolumeInfoCache
    - EMDMgmt
    - MountPoints2
  - Auto-Start Extensibility Points
  - BAM / DAM
  - ComDlg32
    - OpenSaveMRU / OpenSavePidlMRU
    - LastVisitedMRU / LastVisitedPidlMRU
    - CIDSizeMRU
  - FeatureUsage
  - Map Network Drive MRU
  - MountPoints2
  - MUICache
  - PortProxy
  - RecentApps
  - RunMRU
  - Scheduled tasks (Taskcache)
  - Services
  - Shellbags
  - Terminal Server Client\Servers
  - TypedPaths
  - TypedURLs
  - UserAssist
  - WordWheelQuery
- Amcache
- Hiberfil.sys
- Jumplists
- LNK / Shortcut files
- .NET CLR UsageLogs
- PCA
- PowerShell ConsoleHost_history
- PowerShell Transcript
- Prefetch
- RDP
  - Processes
  - ETW - Destination host
  - ETW - Source host
  - ETW - Remote Desktop Gateway
  - RDP Bitmap Cache
  - Registry - Terminal Server Client
  - mstsc Jumplists
- RecentFileCache
- Recycle Bin
- Setupapi logs
- Shimcache
- SRUM
- Thumbs.db / Thumbcache
- UAL / SUM
- WebCacheV01
- Windows Defender
  - ETW events
  - Microsoft Support logs
  - DetectionHistory files
  - Quarantine
- Windows Push Notifications (wpndatabase.db)
- Windows Search Database
- Windows Timeline / ActivitiesCache
- WMI
  - Processes
  - ETW events
  - WMI Event Subscription
- Third-party softwares
  - RULER Project - Anti-virus
  - RULER Project - Remote Monitoring and Management
  - Web browsers
By tag
- Type - NTFS
- Type - ETW
- Type - Registry
- Category - System information
- Category - File knowledge
- Category - Files and folders access
- Category - Program execution
- Category - PowerShell activity
- Category - Browsing history
- Category - Network usage
- Category - USB activity
- Category - Lateral movement
- Category - Local persistence
  - All
  - User-scoped (without requiring admin privileges)
- Category - Defense evasion
- Category - Miscellaneous
- Category - Active Directory
Windows server roles
- Active Directory Domain Services
- Active Directory Certificate Services
- Microsoft Exchange
- Microsoft Remote Access VPN
Linux
Work in progress!
All
- System information
  - Basic information
  - User and group identifiers
- Logging frameworks
  - Syslog
  - Linux Audit system
- Shell histories
- SSH
  - SSH known_hosts
- utmp, wtmp, and btmp
- viminfo
- wget HSTS history
By tag
- Type - Filesystem
- Type - Logging framework
- Category - System information
- Category - File knowledge
- Category - Files and folders access
- Category - Program execution
- Category - Lateral movement
  - All
  - Destination host
  - Source host
  - SSH
- Category - Local persistence
- Category - Defense evasion
- Category - Miscellaneous
Linux based appliances
- VMware ESXi
Azure / Office365
Required privileges
Office365 security review
- Licensing plans
- Mailbox auditing configuration
- Emails forwarding
- Mailbox delegations
- OAuth permissions
Azure / Office365 logs
- Overview
- Procedure - Logs search and collection
- Office365 workloads logs
  - Exchange Online workload
  - Microsoft Flow workload
- Azure activity / subscription logs
AWS
Required privileges
Basic security review
AWS logs
- Overview
- Procedure - Logs search and collection
- CloudTrail
  - Key fields
  - Notable API / events
Others
Procedure - Image acquisition and mounting
Network PCAP
SMTP email headers

ETW - Remote Desktop - Source host

Channel:

Microsoft-WindowsTerminalServicesRDPClient/Operational.
Events: 1024, 1029, 1102.

Overview

Channel	Conditions	Events
`Microsoft-WindowsTerminalServicesRDPClient/Operational`	Default configuration.	Event `1024: RDP ClientActiveX is trying to connect to the server (<HOSTNAME>)`.
`Microsoft-WindowsTerminalServicesRDPClient/Operational`	Default configuration.	Event `1102: The client has initiated a multi-transport connection to the server <IP>`.
`Microsoft-WindowsTerminalServicesRDPClient/Operational`	Default configuration.	Event `1029: Base64(SHA256(UserName)) is = <HASH>`. This `CyberChef` formula can be used to compute the hash.

For each event of the Microsoft-WindowsTerminalServicesRDPClient/Operational channel, the domain and SID of the user initiating the Remote Desktop are logged.

Tags:

View on GitHub