Windows Security Monitoring: Scenarios and Patterns

ISBN-13: 9781119390640 / Angielski / Miękka / 2018 / 648 str.

Miroshnikov, Andrei

Opis

Go deep into Windows security tools to implement more robust protocols and processes Windows Security Monitoring goes beyond Windows admin and security certification guides to provide in-depth information for security professionals. Written by a Microsoft security program manager, DEFCON organizer and CISSP, this book digs deep into the underused tools that help you keep Windows systems secure. Expert guidance brings you up to speed on Windows auditing, logging, and event systems to help you exploit the full capabilities of these powerful native tools, while scenario-based instruction provides clear illustration of how these events unfold in the real world. From security monitoring and event detection to incident response procedures and best practices, this book provides detailed information on all of the security tools your Windows system has to offer. Windows includes many native tools that can help IT professionals and security experts spot and remedy suspicious activities on servers, networks, and end-user computers. If you're like many Windows pros, you're probably not taking full advantage of these features. This book takes you deep into Windows' underutilized built-in security tools to help you beef up your monitoring, detection, and response processes.

• Detect anomalous events and implement centralized alerting infrastructure
• Dig into the native Windows tools that enable robust security measures
• Understand the details of Powershell, Applocker, LogParser, and other tools
• Adopt effective incident response processes for various common scenarios

Fully applicable to a range of Windows versions--back to Windows Vista and Windows Server 2008--this book is designed for real-world implementation. As the threats to your data grow more numerous by the day, it becomes ever more critical to use every security tool at your disposal. Windows Security Monitoring offers complete, expert guidance toward robust security with specialist-level use of powerful Windows tools.

Spis treści

Introduction xxix

Part I Introduction to Windows Security Monitoring 1

Chapter 1 Windows Security Logging and Monitoring Policy 3

Part II Windows Auditing Subsystem 11

Chapter 2 Auditing Subsystem Architecture 13

Chapter 3 Auditing Subcategories and Recommendations 47

Part III Security Monitoring Scenarios 81

Chapter 4 Account Logon 83

Chapter 5 Local User Accounts 141

Chapter 6 Local Security Groups 201

Chapter 7 Microsoft Active Directory 237

Chapter 8 Active Directory Objects 285

Chapter 9 Authentication Protocols 323

Chapter 10 Operating System Events 367

Chapter 11 Logon Rights and User Privileges 419

Chapter 12 Windows Applications 437

Chapter 13 Filesystem and Removable Storage 485

Chapter 14 Windows Registry 523

Chapter 15 Network File Shares and Named Pipes 559

Appendix A Kerberos AS—REQ, TGS—REQ, and AP—REQ Messages Ticket Options 585

Appendix B Kerberos AS—REQ, TGS—REQ, and AP—REQ Messages Result Codes 589

Appendix C SDDL Access Rights 597

Object–Specific Access Rights 598

Index 603

O autorze

Andrei Miroshnikov is a former security program manager with Microsoft. He is an organizer and author for the DEFCON security conference "Forensics CTF" village and has been a speaker at Microsoft′s Bluehat security conference. In addition, Andrei is an author of the "Windows 10 and Windows Server 2016 Security Auditing and Monitoring Reference" and multiple internal Microsoft security training documents. Among his many professional qualifications, he has earned the (ISC)² CISSP and Microsoft MCSE: Security certifications.

Blurb

Dig deep into the Windows auditing subsystem to monitor for malicious activities and enhance Windows system security

Written by a former Microsoft security program manager, DEFCON "Forensics CTF" village author and organizer, and CISSP, this book digs deep into the Windows security auditing subsystem to help you understand the operating system′s event logging patterns for operations and changes performed within the system. Expert guidance brings you up to speed on Windows auditing, logging, and event systems to help you exploit the full capabilities of these powerful components. Scenario–based instruction provides clear illustration of how these events unfold in the real world. From security monitoring and event patterns to deep technical details about the Windows auditing subsystem and components, this book provides detailed information on security events generated by the operating system for many common operations such as user account authentication, Active Directory object modifications, local security policy changes, and other activities.

This book is based on the author′s experience and the results of his research into Microsoft Windows security monitoring and anomaly detection. It presents the most common scenarios people should be aware of to check for any potentially suspicious activity.

Learn to:

• Implement the Security Logging and Monitoring policy
• Dig into the Windows security auditing subsystem
• Understand the most common monitoring event patterns related to operations and changes in the Microsoft Windows operating system