In this lesson, we're going to take a quick look
at application logs.
Now, application logs are going to be created
for every single application you have on your system.
A lot of these are going to be logged directly inside
of the applications folder itself,
or they may be consolidated centrally inside
of your logging system, such as a SIEM or a Syslog server
or on a Windows machine inside your application log file.
Now for this example, I'm using a generalized version
of a log file.
And in this application log we're going to see a lot
of different events that have happened,
we'll have to determine what was malicious,
what was suspicious, and what was just normal user activity.
Now as we go through this generic log, you'll see the date,
the time, the event ID, the description,
the user who performed the action, the action taken,
and the details.
Here, we can see all these actions happened on the same day
and within a couple of minutes of each other
starting at 17:31 in the afternoon
and finishing around 17:33.
So all this happened within about a minute or two.
Next, you'll see the event ID.
This is an event ID that is created by the operating system,
so you can easily identify what these events are,
and you'll notice these are all sequential,
so if I was talking to another cybersecurity analyst,
I could say, "Hey, look at line 5,400,
I think there's something wrong there,"
and they can know exactly where in the logs to look.
The next thing we have is our description column,
and here you can see all the things that happened.
And from here we're going to look at all of these entries,
line by line, and see exactly what happened.
So first, we see that a document was opened
and that document was opening the 'AnnualReport.docx' file.
So obviously, we're using a word processor here.
The second thing was that a template was loaded
and that template was loaded successfully.
There is no error shown in the details.
Third, we have the document being saved
and the user saved the document called 'MeetingNotes.docx'.
So far, I don't see anything malicious here.
The fourth line is that a print job started
and jsmith tried to start a print job
to print out the 'Contract_Agreement.docx' file,
and the next line shows that that print
was successfully completed
and 'Contract_Agreement.docx' was printed.
Now the next line at 5400 is where things start to get
a little suspicious for us,
because we're seeing a blocked action.
Here, we have a macro execution attempt.
This was done by jsmith and it was inside of the docx file
called 'Q3-Financials.docx'.
In there, there was a macro detected
and based on the security setting of Word at the time,
this was detected and blocked.
The next one we have at 5401 is a macro security alert.
This was a notification being sent to the user
saying there's a potentially malicious macro
inside of your file, and so we wanted to inform the user
of this action so they could decide what to do.
Now at this point, we go to 5402
and we see that the macro content
was being scanned by the system.
The scan was complete
and the macro code matches known malware,
telling us this is something malicious
that we want to take care of.
At 5403, we see the file was quarantined
and the action taken was quarantined
and we see the file 'Q3-Financials.docx' was quarantined,
so it can no longer infect our system
or other people's systems.
Next, at 5404, we see the document was closed
and that was the user closing the 'AnnualReport.docx'.
Next, we see a template was unloaded
and this was unloading that template file
that was loaded earlier up in line 5396.
Then, we have a document being saved
and they saved 'RevisedPlan.docx'.
They then sent an email
and that was sent out with 'MeetingMinutes.docx'.
And then we see the document was opened,
the user opened the 'Budget_Planning.xlsx',
which is an Excel document.
And then we have 5409, where an admin alert was generated
to let the administrators know there was a malicious macro
detected and blocked for 'Q3-Financials.docx'.
So at this point, what do we know happened?
Well, we can see that there was one file that was infected
with malware and everything else seems normal
and it's not a malicious issue,
but the one that was malicious is that macro.
And so if we were asked on the exam
which of these files is suspicious or malicious,
we would answer 'Q3-Financials.docx'
based on this log analysis.