All About File System Access in Windows

If you look into windows security audit logs, certain event types have fields with "%%xxxx" instead of a human readable fields.  Example is as below

{

 "EventTime": "2017-07-25 01:08:22"

 "Hostname": "meroadmin.changeme.com"

 "Keywords": -9214364837600034816

 "EventType": "AUDIT_SUCCESS"

 "SeverityValue": 2

 "Severity": "INFO"

 "EventID": 4663

 "SourceName": "Microsoft-Windows-Security-Auditing"

 "ProviderGuid": "{54849625-5478-4994-A5BA-3E3B0328C30D}"

 "Version": 1

 "Task": 12800

 "OpcodeValue": 0

 "RecordNumber": 717215

 "ProcessID": 496

 "ThreadID": 504

 "Channel": "Security"

 "Message": "An attempt was made to access an object."

 "Category": "File System"

 "Opcode": "Info"

 "SubjectUserSid": "S-1-5-21-1541309266-3090300489-3544281362-500"

 "SubjectUserName": "Administrator"

 "SubjectDomainName": "CHANGEME"

 "SubjectLogonId": "0x1e5a2a"

 "ObjectServer": "Security"

 "ObjectType": "File"

 "ObjectName": "C:\\Program Files (x86)\\nxlog\\conf"

 "HandleId": "0x1608"

 "AccessList": "%%4416\r\n\t\t\t\t"

 "AccessMask": "0x1"

 "ProcessName": "C:\\Windows\\explorer.exe"

 "ResourceAttributes": "S:AI"

 "EventReceivedTime": "2017-07-25 01:08:24"

 "SourceModuleName": "in"

 "SourceModuleType": "im_msvistalog"

}

You can see such codes in many other events like 4688. Explanation for these events are as below

AccessList                Description

%%4416                    ReadData (or ListDirectory)

%%4417                    WriteData (or AddFile)

%%4418                    AppendData (or AddSubdirectory or CreatePipeInstance)

%%4419                    ReadEA

%%4420                    WriteEA

%%4421                    Execute/Traverse

%%4422                    DeleteChild

%%4423                    ReadAttributes

%%4424                    WriteAttributes

%%1537                    DELETE

%%1538                    READ_CONTROL

%%1539                    WRITE_DAC

%%1540                    WRITE_OWNER

%%1541                    SYNCHRONIZE

%%1542                    ACCESS_SYS_SEC

%%4432                    Query Key Value

%%4433                    Set Key Value

%%4434                    Create Sub Key

%%4435                    Enumerate sub-keys

%%4436                    Notify about changes to keys

%%4437                    Create Link

Access Mask

0x1                            ReadData (or ListDirectory)

0x2                            WriteData (or AddFile)

0x4                            AppendData (or AddSubdirectory or CreatePipeInstance)

0x8                            ReadEA

0x10                         WriteEA

0x20                         Execute/Traverse

0x40                         DeleteChild

0x80                         ReadAttributes

0x100                       WriteAttributes

0x10000                    DELETE

0x20000                    READ_CONTROL

0x40000                    WRITE_DAC

0x80000                    WRITE_OWNER

0x100000                  SYNCHRONIZE

0x1000000                ACCESS_SYS_SEC

DELETE	The right to delete the object.
READ_CONTROL	The right to read the information in the object's security descriptor, not including the information in the system access control list (SACL).
SYNCHRONIZE	The right to use the object for synchronization. This enables a thread to wait until the object is in the signaled state. Some object types do not support this access right.
WRITE_DAC	The right to modify the discretionary access control list (DACL) in the object's security descriptor.
WRITE_OWNER	The right to change the owner in the object's security descriptor.

Audit File Move in Windows System

There are various requirements like compliance, forensics, ransomware detection, other malware attack, monitoring user activities etc that need organizations to monitor file system activities like file deleted, moved, created etc. While working with windows operating system you might feel it is easy to monitor such by simple looking into corresponding events but there are no straightforward and coherent file activity events in the Windows event log.

In this blog we will check out the case of file moved i.e. file cut paste activity.

Why to monitor?

1. In case of ransomware attack you might want to know which files were encrypted. When files are encrypted it means there are multiple logs being generated. Let's look at the sequence of operation: first, existing files are deleted; second, those files are renamed or their extensions are changed… so new files are created. Windows logs this process of encryption as two distinct event.
2. Build an alert when critical files are moved by any user.

How to monitor?

Whenever certain file/folder is moved two events are generated. First will be file delete followed by file/folder create in new location.

Event id 4663. Look into ObjectType, HandleId, ObjectName, AccessList and AccessMask.

ObjectType=File for file and folder activities

• First part: File is deleted in original place

eventId=4663 (accessList=%%1537 OR accessList=DELETE) accessMask=0x10000 objectType=File handleId=*

• Second part: Same File is created in destination

eventId=4663 (accessList="WriteData (or AddFile)" OR accessList=%%4417) accessMask=0x2 objectType=File handleId=*

• Now we need to join these two case to find file/folder that was moved. Join condition; look for same handleId, fileName and different path

[eventId=4663 (accessList=%%1537 OR accessList=DELETE) accessMask=0x10000 objectType=File handleId=*] as fileDelete followed by [eventId=4663 (accessList="WriteData (or AddFile)" OR accessList=%%4417) accessMask=0x2 objectType=File handleId=*] as fileCreate on fileDelete.handleId=fileCreate.handleId and fileCreate.fileName=fileDelete.fileName | search for fileDelete.path!=fileCreate.path

Note: Extract path and fileName from objectName using regex

(?P<path>.*)\(?P<fileName>.*)

What to monitor?

timestamp, user name, file name, operation (create, read, modify, rename, delete, etc.), and a result (success or failure).

Audit File Rename in Windows

There are various requirements like compliance, forensics, ransomware detection, other malware attack, monitoring user activities etc that need organizations to monitor file system activities like file deleted, moved, created etc. While working with windows operating system you might feel it is easy to monitor such by simple looking into corresponding events but there are no straightforward and coherent file activity events in the Windows event log.

In this blog we will check out the case of file moved i.e. file cut paste activity.

Why to monitor?

1. In case of ransomware attack you might want to know which files were encrypted. When files are encrypted it means there are multiple logs being generated. Let's look at the sequence of operation: first, existing files are deleted; second, those files are renamed or their extensions are changed… so new files are created. Windows logs this process of encryption as two distinct event.
2. Build an alert when critical files are renamed by any user.

How to monitor?

Whenever certain file/folder is renamed two events are generated. First will be file delete followed by file/folder create in same location.

Event id 4663. Look into ObjectType, HandleId, ObjectName, AccessList and AccessMask.

ObjectType=File for file and folder activities

• First part: File is deleted in original place

eventId=4663 (accessList=%%1537 OR accessList=DELETE) accessMask=0x10000 objectType=File handleId=*

• Second part: Same new file is created in same location

eventId=4663 (accessList="WriteData (or AddFile)" OR accessList=%%4417) accessMask=0x2 objectType=File handleId=*

• Now we need to join these two cases to find file/folder that was renamed. Condition for join; look for same processId and filePath. In this case handle id would not be same so we cannot use handleid for correlation here. Also, please note that this may result is some false positives.

[eventId=4663 (accessList=%%1537 OR accessList=DELETE) accessMask=0x10000 objectType=File handleId=*] as fileDelete followed by [eventId=4663 (accessList="WriteData (or AddFile)" OR accessList=%%4417) accessMask=0x2 objectType=File handleId=*] as fileCreate on fileDelete.processId=fileCreate.processId and fileCreate.filePath=fileDelete.filePath

Note: Extract path and fileName from objectName using regex

(?P<filePath>.*)\(?P<fileName>.*)

What to monitor?

timestamp, user name, file name, operation (renamed), and a result (success or failure).

Audit File Delete in Windows

There are various requirements like compliance, forensics, ransomware detection, other malware attack, monitoring user activities etc that need organizations to monitor file system activities like file deleted, moved, created etc. While working with windows operating system you might feel it is easy to monitor such by simple looking into corresponding events but there are no straightforward and coherent file activity events in the Windows event log.

Whenever such critical event occurs we would want an alert to be generated.

In this blog we will check out the case of file delete.

Why to monitor?

In case of ransomware attack you might want to know which files were encrypted. When files are encrypted it means there are multiple logs being generated. Let's look at the sequence of operation: first, existing files are deleted; second, those files are renamed or their extensions are changed… so new files are created. Windows logs this process of encryption as two distinct event.

Build an alert when critical files were deleted by any user.

How to monitor?

There are two important ways to monitor file delete activities

1. Event id 4663. In this event look into accessList and accessMask. Simple query is quite simple and looks as below
   event_id=4663 (accessList=%%1537 OR accessList=DELETE) accessMask=0x10000
2. Correlate Event id 4663 and 4660. 4660 is event which gets logged when any object is deleted. But the drawback of this event is that it only gives information about certain object being deleted. Not the actual object that was deleted. But it will give an information of who deleted that object. However, we need full information regarding delete event for it to be useful. So what we can do is correlate 4660 with event id 4663 that have same handle id. Alert rule will take query as below

[event_id 4663 handle_id=*] join [event_id=4660 handle_id=*] on handle_id after the join you can easily find the object that was deleted and other required information

Note: 4660 is the only event that will give you delete object. It is not generated when you rename or move file/folder though delete event is generated. It is because those files are not actually deleted.

What to monitor?

 timestamp, user name, file name, operation (create, read, modify, rename, delete, etc.), and a result (success or failure).

Log sample

{

 "EventTime": "2017-07-25 01:08:22"

 "Hostname": "meroadmin.changeme.com"

 "Keywords": -9214364837600034816

 "EventType": "AUDIT_SUCCESS"

 "SeverityValue": 2

 "Severity": "INFO"

 "EventID": 4663

 "SourceName": "Microsoft-Windows-Security-Auditing"

 "ProviderGuid": "{54849625-5478-4994-A5BA-3E3B0328C30D}"

 "Version": 1

 "Task": 12800

 "OpcodeValue": 0

 "RecordNumber": 717215

 "ProcessID": 496

 "ThreadID": 504

 "Channel": "Security"

 "Message": "An attempt was made to access an object."

 "Category": "File System"

 "Opcode": "Info"

 "SubjectUserSid": "S-1-5-21-1541309266-3090300489-3544281362-500"

 "SubjectUserName": "Administrator"

 "SubjectDomainName": "CHANGEME"

 "SubjectLogonId": "0x1e5a2a"

 "ObjectServer": "Security"

 "ObjectType": "File"

 "ObjectName": "C:\\Program Files (x86)\\nxlog\\conf"

 "HandleId": "0x1608"

 "AccessList": "%%1537\r\n\t\t\t\t"

 "AccessMask": "0x10000"

 "ProcessName": "C:\\Windows\\explorer.exe"

 "ResourceAttributes": "S:AI"

 "EventReceivedTime": "2017-07-25 01:08:24"

 "SourceModuleName": "in"

 "SourceModuleType": "im_msvistalog"

}