Audit Log: collection, analysis & forensics

An audit log is a chronological, tamper-evident record that captures every significant action performed on a system, application, or network asset. Audit log entries typically include a timestamp, the identity of the actor, the action performed, the target object, and the outcome. In cybersecurity, audit logs are the primary source of truth for accountability and incident reconstruction. They cover authentication events, privilege escalations, file access, configuration changes, and administrative commands. On Windows systems, audit logs are generated by the Security Event Log subsystem and governed by Group Policy audit policies (Advanced Audit Policy Configuration). On Linux, auditd feeds structured records into /var/log/audit/audit.log. Network devices emit syslog or SNMP trap streams that complement host-level records. Without a consistent audit log strategy, blind spots emerge across the attack surface. Regulators such as PCI-DSS, ISO 27001, and SOC 2 mandate specific audit log retention and integrity controls. The value of an audit log is directly proportional to the fidelity of the audit policy: logging too little misses attacker actions, while logging too much creates noise that buries real incidents.

Effective audit log monitoring starts with centralizing records into a SIEM platform such as Splunk, Elastic SIEM, or Microsoft Sentinel before local retention windows expire. On Windows, critical Event IDs include 4624 (successful logon), 4625 (failed logon), 4648 (explicit credential use), 4672 (special privileges assigned), 4698 (scheduled task creation), 4719 (audit policy change), and 4732 (member added to privileged group). Event ID 1102 signals Security log clearance, a strong indicator of log tampering. On Linux, auditd rules targeting execve syscalls and privileged binary execution (sudo, su, passwd) provide equivalent coverage. Key detection patterns include a sudden spike in 4625 events from a single source IP (brute force), 4719 events outside change windows (policy weakening), and gaps in log timestamps that suggest deletion or rotation manipulation. SIEM correlation rules should baseline normal logon hours per user and alert on deviations. Log integrity can be enforced using Windows Event Forwarding (WEF) to push events to a hardened collector in near real time. Immutable log shipping to write-once storage adds a forensic-grade chain of custody that survives endpoint compromise.

Red Team operators routinely target audit log infrastructure to extend dwell time and cover lateral movement. Common techniques include disabling the Windows audit policy via 'auditpol /clear', stopping the EventLog service, or using wevtutil to selectively purge specific log channels without triggering a full 1102 event. The MITRE ATT&CK technique T1562.002 (Impair Defenses: Disable Windows Event Logging) documents this pattern precisely. On Linux, attackers may kill the auditd daemon, flush rules with 'auditctl -D', or redirect log output to /dev/null. Timestomping (T1070.006) modifies file metadata to corrupt forensic timelines reconstructed from audit logs. To harden against these attacks, enforce audit policy via GPO with tamper protection enabled, restrict EventLog service permissions so only SYSTEM can stop it, and ship logs off-host within seconds using WEF or a syslog forwarder. Enable the 'Audit Policy Change' subcategory and alert on any change. On Linux, lock auditd rules at boot with 'auditctl -e 2' (immutable mode), which requires a reboot to alter. Periodic hash verification of audit log files using tools like AIDE provides an additional integrity check layer.