Cách khắc phục lỗi user access logging service

User Access Logging (UAL) is feature in Windows Server that aggregates client usage data by role on a local server. The DFIR team at KPMG released a great blog which spotlights User Access Logs by delving into the different components that make up the database.

Nội dung chính Show

Artefact Features
Acquisition
Repairing the Databases
Parsing and Analysis
Querying on Live Machines
Cách khắc phục

Artefact Features

Applicable OS: Windows Server 2012+ Requirements: Enabled by default on supported OS Evidence of: Lateral Movement-User/IP requests to a server (per day) Location:

C:\Windows\System32\LogFiles\SUM\Current.mdb
C:\Windows\System32\LogFiles\SUM\SystemIdentity.mdb
C:\Windows\System32\LogFiles\SUM\<GUID>.mdb

Format: ESE Databases Current Parsing Tools:

Brian Moran’s KStrike
Eric Zimmerman’s SumECmd

Retention: 2–3 years. Current.mdb contains the most recent 24 hours (by default) and is then moved into the database for the current year named with a unique GUID. The last 2 years are retained in separate databases aswell:

If an attacker has cleared all logs from the environment and there is no centralised logging, UAL could be a valuable resource used in investigations.

Acquisition

These databases will be locked by the OS if the host is running, so when conducting live response you will need to use a tool that does a low level copy such as RawCopy.

RawCopy.exe /FileNamePath:c:\Windows\System32\LogFiles\Sum\Current.mdb /Outpath:c:\Dev\Sum\

A tool like Velociraptor will also allow you to copy the files of a live system.

Repairing the Databases

If you attempt to run SumECmd.exe, depending on how you acquire the files, you will get an error stating the databases need to be repaired. Using

esentutl.exe /p Current.mdbesentutl.exe /p SystemIdentity.mdbesentutl.exe /p "{<GUID>}.mdb"

0, you can repair the *.mdb files:

esentutl.exe /p Current.mdbesentutl.exe /p SystemIdentity.mdbesentutl.exe /p "{<GUID>}.mdb"

Here is an example of the repair command on

esentutl.exe /p Current.mdbesentutl.exe /p SystemIdentity.mdbesentutl.exe /p "{<GUID>}.mdb"

Parsing and Analysis

Once you have valid ESE databases, you can point SumECmd.exe to the directory where you have your files.

SumECmd.exe -d C:\Location\of\Sumfiles\ --csv C:\Output\Directory

The output should provide a number of csv exports for review.

The

esentutl.exe /p Current.mdbesentutl.exe /p SystemIdentity.mdbesentutl.exe /p "{<GUID>}.mdb"

3 contains something like the following which maps certain user activity with first and last access times and Role description.

NOTE: It is not documented or tested on what specific activities qualify an entry to be recorded for each Microsoft role.

Querying on Live Machines

Another option for live response is to query the system directly using WMI or Powershell.

WMI Example Gwmi -Namespace “root\AccessLogging” -query “SELECT FROM MsftUal_DeviceAccess WHERE LastSeen >=’1/01/2013' and LastSeen <=’3/31/2013*PowerShell Commandlets (more here) Get-UalUserAccess Get-UalDailyUserAccess

Example of

esentutl.exe /p Current.mdbesentutl.exe /p SystemIdentity.mdbesentutl.exe /p "{<GUID>}.mdb"

If you are testing, you can decrease the polling time from the default 24 hours (for example two minutes):

Khi làm việc với jenkins, đặt biệt là đối với agent windows, có bao giờ bạn gặp phải rắc rối là chạy command ở command prompt thì được mà chạy cũng là lệnh đó nhưng trên jenkins thì bị lỗi * denied.

Đó là do lúc bạn chạy lệnh ở command prompt, bạn chạy lệnh với user có quyền cao, còn ở jenkins, jenkins chạy lệnh đó với user hệ thống, thường là nt authoritysystem, đây là user ẩn mặc định của hệ thống.

Nội dung

Cách khắc phục

Để khắc phục vấn đề trên mình cần tạo một user khác, cáp quyền admin cho user đó, gán nó vào jenkins slave service. Nhưng trước hết bạn cần chạy jenkins slave dưới dạng là một service của windows, nếu bạn chưa rõ có thể xem lại bài viết ở đây.