Configures Windows Event Logging with advanced audit policies to generate high-fidelity security events for threat detection and forensic investigation. Use when enabling audit policies for logon events, process creation, privilege use, and object access to feed SIEM detection rules. Activates for requests involving Windows audit policy, event log configuration, security logging, or detection-oriented logging.
インストールする前に、エージェントに与えられる指示の中身を確認できます。
Use this skill when:
Do not use for Sysmon configuration (separate skill) or Linux audit logging.
Computer Configuration → Windows Settings → Security Settings
→ Advanced Audit Policy Configuration → Audit Policies
Recommended settings:
Account Logon:
- Audit Credential Validation: Success, Failure
- Audit Kerberos Authentication: Success, Failure
Account Management:
- Audit Security Group Management: Success
- Audit User Account Management: Success, Failure
Logon/Logoff:
- Audit Logon: Success, Failure
- Audit Logoff: Success
- Audit Special Logon: Success
- Audit Other Logon/Logoff Events: Success, Failure
Object Access:
- Audit File Share: Success, Failure
- Audit Removable Storage: Success, Failure
- Audit SAM: Success
Policy Change:
- Audit Audit Policy Change: Success, Failure
- Audit Authentication Policy Change: Success
Privilege Use:
- Audit Sensitive Privilege Use: Success, Failure
Detailed Tracking:
- Audit Process Creation: Success
- Audit DPAPI Activity: Success, Failure
# Registry: Enable command line logging in Event 4688
New-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit" `
-Name ProcessCreationIncludeCmdLine_Enabled -Value 1 -PropertyType DWORD -Force
# GPO: Computer Configuration → Administrative Templates → System → Audit Process Creation
# "Include command line in process creation events" → Enabled
# Increase Security log to 1 GB (default 20 MB is insufficient)
wevtutil sl Security /ms:1073741824
# Increase PowerShell Operational log
wevtutil sl "Microsoft-Windows-PowerShell/Operational" /ms:536870912
# Set log retention to overwrite as needed
wevtutil sl Security /rt:false
# Configure via GPO:
# Computer Configuration → Administrative Templates → Windows Components
# → Event Log Service → Security
# Maximum log file size (KB): 1048576
# On collector server:
wecutil qc /q
# Create subscription for high-value events:
# Event IDs: 4624 (logon), 4625 (failed logon), 4688 (process create),
# 4672 (special privilege), 4720 (user created), 4728 (group membership),
# 7045 (service installed), 1102 (log cleared)
# On source endpoints (GPO):
# Configure WinRM: winrm quickconfig
# Configure event forwarding: Computer Configuration → Admin Templates
# → Windows Components → Event Forwarding
# Configure target Subscription Manager: Server=http://collector:5985/wsman/SubscriptionManager/WEC
Authentication Events:
4624 - Successful logon (Type 2=Interactive, 3=Network, 10=RemoteInteractive)
4625 - Failed logon attempt
4648 - Logon using explicit credentials (RunAs, pass-the-hash indicator)
4672 - Special privileges assigned (admin logon)
4776 - NTLM credential validation
Process Events:
4688 - Process creation (with command line if enabled)
4689 - Process termination
Account Events:
4720 - User account created
4722 - User account enabled
4724 - Password reset attempted
4728 - Member added to security group
4732 - Member added to local group
4756 - Member added to universal group
Service/System Events:
7045 - New service installed (persistence indicator)
1102 - Audit log cleared (evidence tampering)
4697 - Service installed in the system
Lateral Movement Indicators:
4648 + 4624(Type 3) - Credential-based lateral movement
5140 - Network share accessed
5145 - Network share access check (detailed file share)
| Term | Definition |
|---|---|
| Advanced Audit Policy | Granular audit subcategories (58 subcategories vs. 9 basic categories) |
| Event ID 4688 | Process creation event; essential for tracking execution on endpoints |
| WEF | Windows Event Forwarding; centralized log collection without third-party agents |
| Logon Type | Numeric code indicating authentication method (2=interactive, 3=network, 10=RDP) |
まだレビューはありません。使ってみた感想をお寄せください。
概要と使いどころ
Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys) online or offline using SharpDPAPI, SharpChrome, Mimikatz, or Impacket's dpapi.py, including domain-wide decryption via the DPAPI backup key. Use during authorized red-team credential-access engagements after gaining a foothold or when triaging DPAPI blobs pulled from a host.
日本語の概要は準備中です。原文の説明を表示しています。
Take over Active Directory accounts by writing attacker-controlled public keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, or Certipy, then authenticate via PKINIT to recover the target's NT hash without a password reset. Use when BloodHound shows GenericWrite/GenericAll/AddKeyCredentialLink over a target, as a stealthier alternative to ForceChangePassword, during authorized red-team engagements.
日本語の概要は準備中です。原文の説明を表示しています。
Prepare a defense-contractor environment for CMMC Level 2 certification: scope CUI and FCI, implement the 110 NIST SP 800-171 Rev 2 security requirements across 14 families, compute the SPRS score with the DoD Assessment Methodology, manage a compliant POA&M, and ready the organization for a C3PAO assessment. Use when an organization handles Controlled Unclassified Information (CUI) under a DoD contract, when a contract carries DFARS clause 252.204-7012/7019/7020/7021, when preparing for or responding to a CMMC assessment, when computing or improving an SPRS score, when building a System Security Plan or POA&M for 800-171, or when scoping which systems are in the CUI boundary. Keywords: CMMC, CMMC Level 2, NIST 800-171, SP 800-171 Rev 2, CUI, FCI, SPRS, DFARS 7012, C3PAO, POA&M, System Security Plan, DoD Assessment Methodology, 110 controls, defense industrial base, DIB, FedRAMP equivalency.
日本語の概要は準備中です。原文の説明を表示しています。
Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verification (MD5/SHA) during acquisition. Use when imaging a suspect drive, USB device, or memory card for investigation, preserving volatile disk evidence during incident response, or producing a verified copy for legal or law-enforcement proceedings before any destructive analysis.
日本語の概要は準備中です。原文の説明を表示しています。
Detect dangerous ACL misconfigurations in Active Directory using ldap3 to identify GenericAll, WriteDACL, and WriteOwner abuse paths
日本語の概要は準備中です。原文の説明を表示しています。
Perform static analysis of Android APK malware using apktool for resource decompilation, jadx for Java source recovery, and androguard for manifest inspection, dangerous permission-combination detection, and identification of obfuscated code, dynamic code loading, and reflection-based API calls. Use to statically triage a suspicious APK without executing it or to build mobile malware detection rules.
日本語の概要は準備中です。原文の説明を表示しています。