Security Log Analysis

Frameworks: MITRE ATT&CK v16, NIST SP 800-92 (Guide to Computer Security Log Management) Role: SOC Analyst, Security Engineer Time: 20-40 min per analysis Output: Log analysis findings, anomaly identification, baseline recommendations, ATT&CK-mapped observations

---

1. When to Use

If a target is provided via arguments, focus the review on: $ARGUMENTS

Invoke this skill when any of the following conditions are met:

• Log review -- The analyst needs to examine logs from a specific system, time window, or user to identify suspicious activity.
• Anomaly investigation -- An unusual pattern has been observed (unexpected logon, unfamiliar process, abnormal network traffic) and requires log-based investigation.
• Baseline establishment -- The team needs to define what "normal" looks like for a log source to enable future anomaly detection.
• Event ID interpretation -- The analyst needs to understand what a specific Windows Event ID, Sysmon Event ID, or Linux log entry means in a security context.
• Log correlation -- Multiple log sources need to be analyzed together to reconstruct a sequence of events or trace an attacker's actions.
• Post-incident log review -- After an alert or incident, logs need to be systematically reviewed to determine scope, timeline, and impact.
• Log architecture assessment -- The team is evaluating whether the right log sources are being collected for security monitoring.

Do not use when: The task is writing SIEM detection rules (use siem-rules), triaging a fired alert (use alert-triage), or authoring Sigma rules (use detection-engineering).

---

2. Context the Agent Needs

Before beginning analysis, gather or confirm:

• Analysis objective: What question are you trying to answer? (e.g., "Was this account compromised?", "What happened on this server between 2:00 and 3:00 AM?", "Is this outbound traffic malicious?")
• Time window: The specific time range to analyze.
• Scope: Which hosts, users, IP addresses, or network segments are in scope?
• Available log sources: Which logs are available? (Windows Event Logs, Sysmon, EDR, firewall, proxy, DNS, cloud audit, application logs.)
• Known-good context: What is expected/normal for this environment? (Authorized admin accounts, expected service accounts, normal working hours, approved applications.)
• Related alerts or incidents: Are there existing alerts, tickets, or incident reports associated with this investigation?
• SIEM access: Which SIEM platform contains the logs? (Determines query language and table names.)

---

3. Process

Step 1: Log Source Taxonomy

Understand what each log source provides and which ATT&CK data sources it maps to.

Authentication Logs

Log Source	Platform	Key Events	ATT&CK Data Source
Windows Security Event Log	Windows	Logon (4624), Failed logon (4625), Explicit credential use (4648), Special privilege logon (4672)	Logon Session (DS0028)
Azure AD Sign-in Logs	Cloud (Azure)	Interactive and non-interactive sign-ins, Conditional Access results, MFA status	Logon Session (DS0028)
Linux auth logs	Linux	/var/log/auth.log (Debian/Ubuntu), /var/log/secure (RHEL/CentOS) -- SSH logons, su/sudo usage, PAM events	Logon Session (DS0028)
AWS CloudTrail	Cloud (AWS)	ConsoleLogin, AssumeRole, GetSessionToken, SwitchRole	Logon Session (DS0028)

Network Flow and Connection Logs

Log Source	Platform	Key Events	ATT&CK Data Source
Firewall logs	Network	Allow/deny decisions, source/dest IP and port, protocol, bytes transferred	Network Traffic (DS0029)
NetFlow/IPFIX	Network	Flow records with src/dst IP, ports, protocol, byte/packet counts, duration	Network Traffic (DS0029)
Sysmon Event ID 3	Windows	Outbound network connections with process context (which process initiated the connection)	Network Traffic (DS0029)
VPC Flow Logs	Cloud (AWS/Azure/GCP)	Accept/reject decisions for VPC network interfaces	Network Traffic (DS0029)

DNS Logs

Log Source	Platform	Key Events	ATT&CK Data Source
DNS server query logs	Network	All DNS resolution requests and responses	Network Traffic: DNS (DS0029)
Sysmon Event ID 22	Windows	DNS queries made by processes on the endpoint	Network Traffic: DNS (DS0029)
DNS firewall/RPZ logs	Network	Blocked DNS queries matching threat intelligence	Network Traffic: DNS (DS0029)
Passive DNS	Network	Historical DNS resolution data	Network Traffic: DNS (DS0029)

Proxy and Web Logs

Log Source	Platform	Key Events	ATT&CK Data Source
Web proxy logs	Network	HTTP/HTTPS requests with URL, user agent, response code, bytes	Network Traffic: HTTP (DS0029)
Cloud proxy (Zscaler, Netskope)	Cloud	Web traffic with DLP findings, threat categories, user identity	Network Traffic: HTTP (DS0029)
Web server access logs	Application	Inbound HTTP requests with method, URI, status code, source IP	Application Log (DS0015)

Endpoint Logs

Log Source	Platform	Key Events	ATT&CK Data Source
Sysmon (Windows)	Windows	Process creation (1), network connection (3), file creation (11), registry (12/13/14), DNS query (22)	Process (DS0009), File (DS0022), Windows Registry (DS0024)
Windows Security 4688	Windows	Process creation with command line (requires audit policy)	Process (DS0009)
EDR telemetry	Endpoint	Process tree, file modifications, network connections, loaded modules	Process (DS0009), File (DS0022), Module (DS0011)
Linux auditd	Linux	Syscall logging, file access, process execution, user commands	Process (DS0009), File (DS0022)

Cloud Audit Logs

Log Source	Platform	Key Events	ATT&CK Data Source
AWS CloudTrail	AWS	API calls -- CreateUser, AttachUserPolicy, RunInstances, PutBucketPolicy	Cloud Service (DS0025)
Azure Activity Log	Azure	Resource operations -- create, delete, modify at the control plane	Cloud Service (DS0025)
GCP Cloud Audit Logs	GCP	Admin activity, data access, system events	Cloud Service (DS0025)
Microsoft 365 Unified Audit Log	SaaS	Exchange, SharePoint, Teams, Azure AD activity	Application Log (DS0015)

Step 2: Critical Windows Event IDs

These Event IDs are the most security-relevant events in the Windows Security Event Log. Analysts should know these by memory.

Authentication Events

Event ID	Description	Security Relevance	ATT&CK Mapping
4624	Successful logon	Tracks who logged into what system and how (logon type). Baseline for normal logon patterns.	T1078 -- Valid Accounts
4625	Failed logon	Indicates brute force attempts, password spraying, or credential guessing. High volume from a single source is suspicious.	T1110 -- Brute Force
4648	Logon using explicit credentials (runas)	Indicates a user explicitly provided different credentials. Used in lateral movement and privilege escalation.	T1078 -- Valid Accounts
4672	Special privileges assigned to new logon	Indicates a privileged logon (administrator, backup operator). Every 4672 event represents a session with elevated rights.	T1078 -- Valid Accounts

Windows logon types (Event ID 4624 LogonType field):

LogonType	Name	Description	Security Context
2	Interactive	Physical console logon or KVM	Normal for workstations; unusual for servers
3	Network	Access to shared resource (SMB, mapped drive)	Expected for file servers; lateral movement indicator on workstations
4	Batch	Scheduled task execution	Expected for automation; unexpected batch logons warrant investigation
5	Service	Service start under a service account	Expected for known services; new service logons are suspicious
7	Unlock	Workstation unlock	Normal for workstations
8	NetworkCleartext	Logon with plaintext credentials over network	Security concern -- credentials exposed; legacy protocol indicator
9	NewCredentials	Caller cloned token with new credentials (runas /netonly)	Lateral movement technique; always investigate
10	RemoteInteractive	RDP logon	Expected for designated jump servers; suspicious on workstations or non-RDP servers
11	CachedInteractive	Logon with cached domain credentials	Normal when DC is unreachable; suspicious if DC is available

Process and Service Events

Event ID	Description	Security Relevance	ATT&CK Mapping
4688	New process created	Tracks every process execution including command line (if enabled). Foundation for endpoint detection.	T1059 -- Command and Scripting Interpreter
4698	Scheduled task created	Adversaries create scheduled tasks for persistence and execution. New tasks on servers should be investigated.	T1053.005 -- Scheduled Task
7045	Service installed (System log)	New service installation is a common persistence and privilege escalation mechanism. New services on production servers are high-priority.	T1543.003 -- Windows Service

Account Management Events

Event ID	Description	Security Relevance	ATT&CK Mapping
4720	User account created	New account creation outside of HR provisioning workflow is suspicious. Adversaries create accounts for persistence.	T1136.001 -- Local Account
4728	Member added to security-enabled global group	Privilege escalation via group membership change. Monitor additions to Domain Admins, Enterprise Admins.	T1098 -- Account Manipulation
4732	Member added to security-enabled local group	Monitor additions to local Administrators group.	T1098 -- Account Manipulation
4756	Member added to security-enabled universal group	Monitor additions to high-privilege universal groups.	T1098 -- Account Manipulation

Defense Evasion Events

Event ID	Description	Security Relevance	ATT&CK Mapping
1102	Audit log cleared	Adversaries clear event logs to remove evidence. Log clearing on a production system is almost always malicious.	T1070.001 -- Clear Windows Event Logs
4657	Registry value modified	Registry modifications can indicate persistence (Run keys), defense evasion, or configuration changes.	T1112 -- Modify Registry

Step 3: Critical Sysmon Event IDs

Sysmon (System Monitor) provides enhanced endpoint telemetry beyond native Windows logging.

Sysmon EID	Description	Security Use
1	Process creation	Full command line, parent process, hashes -- primary detection source
3	Network connection	Outbound connections with process context -- C2 detection
7	Image loaded	DLL loading -- detect DLL side-loading, injection
8	CreateRemoteThread	Thread injection into another process -- code injection detection
10	ProcessAccess	Process accessing another process -- credential dumping (LSASS access)
11	FileCreate	File creation with full path -- malware dropping, staging
12/13/14	Registry events	Registry create, set value, rename -- persistence detection
15	FileCreateStreamHash	Alternate data stream creation -- hiding data
22	DNSEvent	DNS queries with process context -- C2 domain resolution
23	FileDelete	File deletion with archiving -- anti-forensics detection
25	ProcessTampering	Process image change -- process hollowing/herpaderping

Step 4: Linux Authentication Log Patterns

/var/log/auth.log and /var/log/secure Patterns

Successful SSH login:

Jan 15 14:23:01 webserver01 sshd[12345]: Accepted publickey for admin from 10.1.2.3 port 54321 ssh2: RSA SHA256:AbCdEf...
Jan 15 14:23:01 webserver01 sshd[12345]: pam_unix(sshd:session): session opened for user admin(uid=1000) by (uid=0)

Failed SSH login:

Jan 15 14:23:05 webserver01 sshd[12346]: Failed password for invalid user test from 203.0.113.50 port 22222 ssh2
Jan 15 14:23:05 webserver01 sshd[12346]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.0.113.50 user=test

Sudo usage (successful):

Jan 15 14:25:00 webserver01 sudo: admin : TTY=pts/0 ; PWD=/home/admin ; USER=root ; COMMAND=/usr/bin/cat /etc/shadow

Sudo usage (failed):

Jan 15 14:25:10 webserver01 sudo: developer : user NOT in sudoers ; TTY=pts/1 ; PWD=/home/developer ; USER=root ; COMMAND=/usr/bin/passwd root

Account creation:

Jan 15 14:30:00 webserver01 useradd[12400]: new user: name=backdoor, UID=1001, GID=1001, home=/home/backdoor, shell=/bin/bash

Key Linux log analysis patterns:

Pattern	Indicates	ATT&CK Mapping
Multiple Failed password from same source IP	Brute force attack	T1110 -- Brute Force
Failed password for invalid user	Username enumeration or spray	T1110.003 -- Password Spraying
Accepted password from unusual IP or at unusual time	Potential compromised credentials	T1078 -- Valid Accounts
sudo command to sensitive files (/etc/shadow, /etc/passwd)	Credential access or reconnaissance	T1003.008 -- /etc/passwd and /etc/shadow
useradd or usermod outside change management	Persistence via new account	T1136.001 -- Local Account
su to root from non-admin user	Privilege escalation attempt	T1548 -- Abuse Elevation Control Mechanism
session opened for user root by (uid=XXX) where XXX is non-zero	Privilege escalation success	T1548 -- Abuse Elevation Control Mechanism
sshd.*Did not receive identification string	Port scanning or reconnaissance	T1046 -- Network Service Discovery

Step 5: Anomaly Detection Patterns

Identify deviations from established baselines that may indicate malicious activity.

Anomaly categories:

Category	Baseline Metric	Anomaly Indicator	Example
Temporal	Normal working hours for user/system	Activity outside established hours	Domain admin logon at 3:00 AM on a holiday
Volumetric	Average daily event count per source	Significant deviation from mean (> 2 std dev)	500 failed logons from a host that averages 5
Geographic	Normal logon locations	Logon from new country or impossible travel	US-based user authenticates from Eastern Europe
Behavioral	Normal processes, commands, and network destinations	First-time process execution, new outbound destination	PowerShell on a server that has never run PowerShell
Relational	Normal user-to-resource access patterns	Access to resources outside normal scope	Finance user accessing engineering source code repository
Protocol	Expected protocols on network segments	Unexpected protocol usage	DNS over HTTPS (DoH) from a workstation, or SMB on an internet-facing interface

Step 6: Baseline Establishment

NIST SP 800-92 alignment: NIST SP 800-92, Section 4.2, recommends establishing baselines for log data to enable anomaly detection. Baselines should be built from a minimum of 30 days of clean (non-compromised) data.

Baseline construction process:

1. Select the log source and the specific metric to baseline (e.g., daily count of Event ID 4625 per source IP).
2. Collect 30-90 days of historical data during a known-clean period.
3. Calculate statistics: mean, median, standard deviation, 95th percentile, 99th percentile.
4. Identify recurring patterns: daily cycles (business hours vs. off-hours), weekly cycles (weekday vs. weekend), monthly cycles (month-end processing).
5. Set thresholds: Define anomaly thresholds at mean + 2 standard deviations for moderate alerts and mean + 3 standard deviations for high-priority alerts.
6. Document exclusions: Record known legitimate outliers (patch Tuesday, quarterly audits, penetration tests) that should not trigger anomaly alerts.
7. Review and update baselines quarterly or after significant environment changes.

Baseline metrics to establish:

Metric	Log Source	Granularity	Purpose
Failed logon count by source IP	Authentication logs	Per hour	Brute force detection
Distinct hosts accessed per user	Authentication logs	Per day	Lateral movement detection
Process creation count by host	Endpoint logs	Per day	Malware/tool execution detection
Outbound bytes by host	Network flow	Per hour	Data exfiltration detection
DNS query count by host	DNS logs	Per hour	C2 beaconing detection
New user accounts created	Account management logs	Per day	Persistence detection
Privileged logon count	Authentication logs (4672)	Per day	Privilege abuse detection

Step 7: Log Correlation Techniques

Combine data from multiple log sources to reconstruct attack sequences and increase detection confidence.

Correlation strategies:

Strategy	Description	Example
Temporal join	Events from different sources occurring within a defined time window	Failed logons (4625) followed by successful logon (4624) from same source within 15 minutes
Entity pivot	Start from one entity and trace its activity across all log sources	From a suspicious IP, find all authentication, DNS, proxy, and firewall entries
Kill chain reconstruction	Map events to ATT&CK tactics in chronological order	Phishing email -> malicious attachment execution -> C2 callback -> discovery commands -> lateral movement
IOC sweep	Search for known indicators across all log sources	Search all logs for a specific IP, domain, hash, or user agent string
Statistical correlation	Identify events that co-occur more frequently than expected	Hosts that generate both DNS queries to DGA domains and outbound connections on unusual ports

Cross-source correlation example -- Compromised Account Investigation:

Step 1: Start with the suspicious event
  -> Authentication log: Successful logon (4624) from unusual IP at 2:15 AM

Step 2: Pivot on user identity
  -> Authentication log: Check all logon events for this user in the past 7 days
  -> Azure AD: Check sign-in logs for MFA status, Conditional Access results
  -> Previous alerts: Any prior alerts for this user?

Step 3: Pivot on source IP
  -> Threat intelligence: Is this IP in any TI feeds?
  -> Firewall log: What other internal hosts did this IP connect to?
  -> DNS log: What domains were resolved from this IP?
  -> Proxy log: What URLs were accessed from this IP?

Step 4: Pivot on host
  -> Endpoint log (Sysmon/EDR): What processes were created on the host after logon?
  -> Network log: What outbound connections were made from the host after logon?
  -> File log: What files were created, modified, or accessed after logon?

Step 5: Build timeline
  -> Combine all findings into a chronological sequence
  -> Map each event to an ATT&CK technique
  -> Identify gaps in visibility (log sources not available)

---

4. Findings Classification

Severity	Label	Definition	SLA
P1	Critical	Log analysis confirms active compromise: credential theft, data exfiltration, or destructive activity observed in logs.	Escalate to IR team immediately.
P2	High	Log analysis reveals high-confidence anomalies consistent with an intrusion: unusual privileged logons, new persistence mechanisms, or C2 communication patterns.	Escalate within 1 hour.
P3	Medium	Log analysis identifies suspicious patterns requiring further investigation: behavioral anomalies, first-seen activity, or partial kill chain indicators.	Investigate within 4 hours.
P4	Low	Log analysis reveals informational findings: minor policy deviations, logging gaps, or baseline drift without immediate threat indication.	Document and review within 24 hours.

---

5. Output Format

Produce log analysis findings in this structure:

## Security Log Analysis Report
**Date:** [YYYY-MM-DD]
**Skill:** log-analysis v1.0.0
**Frameworks:** MITRE ATT&CK v16, NIST SP 800-92
**Analyst:** [Name or AI-assisted]

### Analysis Objective
[1-2 sentences describing what question this analysis is answering]

### Scope
| Field | Value |
|-------|-------|
| Time Window | [Start -- End, UTC] |
| Systems | [Hostnames, IPs, or network segments] |
| Users | [Usernames or "all users"] |
| Log Sources | [List of log sources analyzed] |

### Findings Summary
| # | Finding | Severity | ATT&CK Technique | Log Source | Evidence |
|---|---------|----------|-------------------|------------|----------|
| 1 | [Description] | [P1-P4] | [T1078 or N/A] | [Source] | [Key event reference] |
| 2 | [Description] | [P1-P4] | [T1078 or N/A] | [Source] | [Key event reference] |

### Detailed Findings
#### Finding 1: [Title]
**Severity:** [P1-P4]
**ATT&CK Mapping:** [Technique ID -- Name]
**Log Source:** [Source]
**Evidence:**
[Relevant log entries, timestamps, and entity details]

**Analysis:**
[Interpretation of the evidence -- why is this significant or benign?]

### Timeline
| Timestamp (UTC) | Source | Event | ATT&CK Technique | Assessment |
|-----------------|--------|-------|-------------------|------------|
| [HH:MM:SS] | [Source] | [Description] | [T-ID] | [Suspicious / Benign / Confirmed malicious] |

### Baseline Observations
[Any baseline deviations noted, with comparison to established norms]

### Visibility Gaps
[Log sources that were not available but would have provided relevant data]

### Recommendations
- [ ] [Action 1]
- [ ] [Action 2]

---

6. Framework Reference

MITRE ATT&CK v16

For log analysis, ATT&CK provides the mapping between adversary techniques and the data sources that reveal them. The ATT&CK "Data Sources" knowledge base (https://attack.mitre.org/datasources/) defines 40+ data sources with specific data components, enabling analysts to understand exactly which logs provide visibility into which techniques.

Key ATT&CK Data Sources for log analysis:

Data Source	ID	Key Components
Logon Session	DS0028	Logon Session Creation, Logon Session Metadata
Process	DS0009	Process Creation, Process Access, Process Termination
File	DS0022	File Creation, File Modification, File Deletion
Network Traffic	DS0029	Network Connection Creation, Network Traffic Flow, Network Traffic Content
Windows Registry	DS0024	Registry Key Creation, Registry Key Modification
Command	DS0017	Command Execution
User Account	DS0002	User Account Creation, User Account Modification
Cloud Service	DS0025	Cloud Service Modification
Scheduled Job	DS0003	Scheduled Job Creation
Service	DS0019	Service Creation, Service Modification

NIST SP 800-92 -- Guide to Computer Security Log Management