Log Analysis

Scope

What this is: Analysing system and application logs to reconstruct attack timelines and identify IOCs.

Competition relevance: Digital forensics and incident response. Windows Event Logs, syslog, web server logs.

Why it matters: Logs reveal attacker actions, compromised accounts, and lateral movement.

WSOS 2026 alignment: This topic directly supports Section 8: Investigation and digital forensics (reconstructing attacker activity from log evidence).

Competition area: Spans the digital forensics and incident response area (timeline reconstruction) and the defensive operations area (using logs for threat detection).

Offline competence: Windows Event Viewer (eventvwr.msc) and PowerShell’s Get-WinEvent work offline. Linux logs (/var/log/*) are local files. Use grep, awk, and PowerShell offline. No network required for log analysis.

---

Competency Matrix

Level	Expectation
Regional	Filter Windows Event Logs. Identify failed/successful logins. Basic grep usage.
National	Multi-source log correlation. Timeline creation. SIEM query basics.
Squad/Team Selection	Advanced SIEM queries. Automated log parsing scripts. Anomaly detection.
International	Custom log parser development. ML-based anomaly detection.

---

Technical Content

Windows Event Logs

Key Event IDs:

• 4624: Successful logon
• 4625: Failed logon
• 4672: Special privileges assigned (admin logon)
• 4768/4769: Kerberos TGT/TGS requests
• 4776: NTLM authentication
• 7045: Service installed (malware persistence)

Viewing logs:

# Event Viewer GUI: eventvwr.msc

# PowerShell
Get-EventLog -LogName Security -Newest 100
Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4625}

# Filter by time
Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4624; StartTime='2024-01-01'}

# Export to CSV
Get-WinEvent -LogName Security | Export-Csv security.csv

Finding compromised accounts:

# Multiple failed logins from same account
Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4625} |
  Group-Object {$_.Properties[5].Value} |
  Sort-Object Count -Descending | Select-Object -First 10

Competition context: Look for login anomalies, privilege escalation (4672), and persistence mechanisms (7045).

---

Timeline Correlation

Building timelines:

1. Extract timestamps from all log sources
2. Normalize to single timezone (UTC recommended)
3. Sort chronologically
4. Identify causality chains

Example:

# Merge Windows Event Log + Apache logs + auth.log
# Convert all to common format: TIMESTAMP,SOURCE,EVENT

# Windows (PowerShell)
Get-WinEvent -LogName Security |
  ForEach-Object { "$($_.TimeCreated),Windows,$($_.Message)" } > timeline.csv

# Linux (auth.log)
awk '{print $1" "$2" "$3",Linux,"$0}' /var/log/auth.log >> timeline.csv

# Apache
awk '{print $4",Apache,"$0}' /var/log/apache2/access.log >> timeline.csv

# Sort timeline
sort timeline.csv > sorted_timeline.csv

Competition context: Correlate attacker’s initial access → privilege escalation → lateral movement → exfiltration.

---

Web Server Logs

Apache/Nginx access log format:

IP - - [timestamp] "METHOD /path HTTP/1.1" STATUS SIZE "REFERER" "USER-AGENT"

Finding attacks:

# SQL injection attempts
grep -i "union\|select\|or 1=1" /var/log/apache2/access.log

# Directory traversal
grep -E "\.\./|\.\.%2F" /var/log/apache2/access.log

# Successful exploitation (200 OK to known vuln paths)
grep " 200 " /var/log/apache2/access.log | grep -i "admin\|upload"

# Suspicious user agents
grep -i "sqlmap\|nmap\|nikto" /var/log/apache2/access.log

---

Linux Syslog

Key log files:

• /var/log/auth.log: Authentication attempts, sudo usage
• /var/log/syslog: General system messages
• /var/log/apache2/access.log: Web requests
• /var/log/apache2/error.log: Web errors

Finding suspicious activity:

# Failed SSH logins
grep "Failed password" /var/log/auth.log

# Successful sudo commands
grep "sudo.*COMMAND" /var/log/auth.log

# User added to sudoers
grep "usermod.*sudo" /var/log/auth.log

---

Competition Strategy & Marking

What gets marked:

• Attack timeline documented (initial access → privilege escalation → exfil)
• Compromised accounts identified
• Attack vectors identified (SQLi, brute force, etc.)
• IOCs extracted (IPs, filenames, user agents)

Evidence and reporting requirements:

• Log excerpts showing key events with full context (Event ID, timestamp, source, message)
• Timeline visualisation or CSV showing chronological attack progression
• Event IDs with descriptions (e.g., “Event 4625: Failed logon attempt”)
• Timestamps normalised to UTC
• Screenshots of Windows Event Viewer showing filtered results
• PowerShell/grep commands used to extract evidence
• Statistical summary (e.g., “42 failed login attempts from 192.168.1.100 between 10:00-10:05”)
• Clear naming: logs_timeline_attack_sequence.csv, logs_event4625_bruteforce.png

Time allocation:

• Windows Event Log analysis: 30 minutes
• Web log analysis: 20 minutes
• Timeline creation: 20 minutes

Time-boxed drill suggestion: 70-minute log analysis sprint: Given Windows Security logs, Apache access/error logs, and auth.log, identify the initial access vector, trace privilege escalation, identify compromised accounts, build a complete attack timeline (initial scan → exploit → privilege escalation → lateral movement → data access), extract all attacker IP addresses, and document findings with log excerpts and timeline CSV.

---

False Flags / Wrong Paths

Common Traps

Timezone confusion Logs may be in different timezones. Normalize to UTC.

Log rotation Attacker activity may span multiple log files (.log, .log.1, .log.2.gz).

False positives Legitimate admin activity looks like attacks. Correlate with other evidence.

---

Practice Checklist

• Can filter Windows Event Logs by Event ID
• Can identify failed/successful login patterns
• Can grep web logs for attack patterns
• Can correlate logs from multiple sources
• Can build attack timeline
• Can identify compromised accounts
• Complete log analysis in under 60 minutes

---

References

• Regional Roadmap: Digital forensics
• National Roadmap: Digital forensics