nerdexam
GIAC

GCIH · Question #377

What is one indication that someone is running a Windows event log editing tool on your server?

The correct answer is B. Event log service is stopped and started. Editing Windows event logs requires stopping the Event Log service to release its exclusive lock on the log files, making a stop-then-start sequence the primary behavioral indicator of tampering.

Incident Response & Cyber Kill Chain

Question

What is one indication that someone is running a Windows event log editing tool on your server?

Options

  • AA fourth, hidden log can be seen in Explorer if 'display hidden files' is selected
  • BEvent log service is stopped and started
  • CThe 'last accessed' time stamp on secevent.evt was during a suspicious incident
  • DPermissions are modified on event .LOG files

How the community answered

(24 responses)
  • A
    4% (1)
  • B
    83% (20)
  • C
    8% (2)
  • D
    4% (1)

Why each option

Editing Windows event logs requires stopping the Event Log service to release its exclusive lock on the log files, making a stop-then-start sequence the primary behavioral indicator of tampering.

AA fourth, hidden log can be seen in Explorer if 'display hidden files' is selected

Windows does not maintain a secret fourth event log that appears in Explorer when hidden files are shown; event logs are structured binary files stored in a fixed system path, not hidden directory entries.

BEvent log service is stopped and startedCorrect

The Windows Event Log service holds an exclusive file handle on .evt/.evtx log files while running, so editing tools must stop the service before they can write to or truncate those files. The stop and restart actions themselves generate auditable events (IDs 6005 and 6006) that are logged when the service resumes, creating a detectable artifact. This start-stop pattern is the most reliable and commonly observed indicator that a log editing tool was executed.

CThe 'last accessed' time stamp on secevent.evt was during a suspicious incident

The last-accessed timestamp on secevent.evt is updated by routine security auditing activity and normal log reads, making it an unreliable indicator specific to editing tool use.

DPermissions are modified on event .LOG files

Modifying ACL permissions on log files is not a step required by event log editing tools and would not reliably distinguish editing activity from other administrative actions.

Concept tested: Windows event log tampering detection via service stop-start

Source: https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-1100

Topics

#event log tampering#Windows event logs#anti-forensics#log integrity

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GCIH Practice