LogonTracer: Analyze Active Directory Event Logs Using Visualize and Machine Learning

No ratings

Presented at CODEBLUE2018@TOKYO 2018 by

Shusei Tani

Event log analysis is a crucial element in DFIR. In lateral movement incidents, analyzing Windows Active Directory event logs make it possible to identify hosts that had compromised. For such investigation, it is quite difficult to conduct detailed analysis in Windows Event Viewer; it is rather ordinary to export the logs to text format or import them into SIEM/log management system. However, in text format, since the number of event logs can be massive depending on the environment, this can be a struggle for analysts. Moreover, in the case of SIEM, it does not necessarily detect suspicious logs.To resolve this issue, we examined a new approach to analyze event logs. As a result, visualization of event logs using network analysis and machine learning can automate analysis that was difficult to analyze.This presentation proposes the analysis technique by visualizing the event log. It offers easy event log analysis by visualizing the relations between accounts and hosts. Also, it can identify automatically compromised accounts by adding network analysis and machine learning to event log visualization.