Network Evidence and Windows Event Logs

What it is

Network evidence records what crossed or was seen by the network. Windows event logs record what happened on a host: who logged on, what changed and what failed. Together they reconstruct who did what, from where and when.

The exam asks for network evidence types, logon type numbers, the structure of the legacy log file and the event IDs that matter in an investigation.

How it works

Network based evidence

Full capture gives the most detail but takes the most storage. Flow data is small and shows who talked to whom.

Logon types

Event log file formats

Windows XP and Server 2003 use the legacy EVT format in %SystemRoot%\System32\config. Vista and later use EVTX, a binary XML format in %SystemRoot%\System32\winevt\Logs. EVTX files begin with the signature ElfFile and hold 64 KB chunks that begin with ElfChnk.

Organization of event records (EVT)

An EVT file is a header, a series of event records, a floating footer area and an end of file record. The log works as a circular buffer: when full, new records overwrite old ones unless retention is set otherwise.

ELF_LOGFILE_HEADER

The 48 byte header holds these fields.

EventLogRecord structure

Each record starts with its Length and the same LfLe signature (Reserved field), then holds RecordNumber, TimeGenerated, TimeWritten, EventID, EventType, NumStrings, EventCategory, StringOffset, UserSidLength and UserSidOffset, DataLength and DataOffset. The variable part follows: source name, computer name, user SID, strings and data, then a copy of the length. Event types are Error, Warning, Information, Success Audit and Failure Audit.

Windows 11 event logs and audit events

The main logs are Security, System, Application and Setup, plus many under Applications and Services Logs, such as PowerShell/Operational, TaskScheduler/Operational, Windows Defender/Operational and TerminalServices logs. Sysmon, if installed, adds its own Operational log.

Event 4688 appears only if process creation auditing is enabled, and 4104 only if PowerShell script block logging is active (or the block is flagged as suspicious).

Query examples:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625}
wevtutil qe Security /q:"*[System[(EventID=4624)]]" /c:20 /f:text

Evaluating account management events

A new account followed shortly by a group membership change to Administrators is a classic persistence sign. Many 4625 events from one source followed by a 4624 can signal password guessing that succeeded.

A worked example

At 02:10 the Security log shows many 4625 events for one account from an address, then a 4624 with logon type 10. A 4720 and a 4732 appear a minute later.

The sequence suggests a successful Remote Desktop logon after guessing, then creation of a new account added to a privileged group. The investigator preserves the log and records the source address and times.

How the exam asks about this

• "Which logon type represents Remote Desktop?" → Type 10, RemoteInteractive.
• "Which event ID shows that the Security log was cleared?" → 1102.
• "Which event ID records a failed logon?" → 4625.