Four Steps to Improve Windows Logging for Incident Response
Summary
The article recommends expanding Windows Security log capacity, maintaining Sysmon, enabling Volume Shadow Copies, and correctly sizing the USN Journal to preserve forensic evidence. It also advises human verification when using AI in DFIR workflows.
Key points
- Windows Security logs can overwrite older events, potentially removing authentication records such as Event IDs 4624 and 4625 before investigators can review them.
- Increase the Security log size from the stated default of 32 MB to 1 GB to retain more event history.
- Install and regularly update Sysmon to capture detailed process activity, including indicators of time-stomping and process hollowing.
- Enable Volume Shadow Copies to help mitigate log-clearing attempts and retain historical file-system artifacts.
- Verify that the USN Journal exists and is sized to reduce the risk of forensic records being overwritten too quickly.
- AI can assist DFIR work with data gathering, unfamiliar technologies, and command-line analysis, but its output requires human verification.
Article Details
- Defense Focus
- Improve Windows log retention and forensic visibility so investigators can reconstruct incident timelines and preserve evidence.
- Detection Methods
- Retain Security event logs to support review of successful and failed authentications, including Events 4624 and 4625.
- Use Sysmon to record detailed process activity, including indicators of time-stomping and process hollowing.
- Use Volume Shadow Copies and the USN Journal to preserve historical file-system artifacts and activity.
- Data Sources
- Windows Security event logs
- Sysmon process-activity logs
- Volume Shadow Copies
- USN Journal ($J)
- Linux audit log timestamps, in the context of cross-platform incident reviews
- Platforms
- Windows
- Linux
- Defensive Actions
- Increase the Windows Security log size from the default 32 MB to 1 GB.
- Deploy Sysmon and keep it updated.
- Enable and maintain Volume Shadow Copies.
- Verify that the USN Journal exists and is sized to avoid rapid overwriting.
- Use AI-assisted analysis only as a support for investigative tasks, and verify its output with human review.
MITRE ATT&CK
People
Products
Microsoft Windowsserve as an unintentional bottleneck to successful timeline reconstruction. Andrew’s deep knowledge of Windows logging, combined with his passion for incident response, provides a rare and deep view into WindowsSysmon- Install and Update Sysmon: Deploy Sysmon to log detailed process activity, capturing threat actor tactics like time-stomping and process hollowing. While scheduled for inclusion in Windows 11 updates, it still