Int 2: Windows Event Log Forensics - Menganalisis EVTX untuk Investigasi

cd ~ && mkdir forensics-int2 && cd forensics-int2

# Event ID Penting untuk Forensik
echo "=== Windows Event ID Penting ==="
cat << 'EVENTS'
Login & Logoff:
  4624 - Account Logon Success ✅
  4625 - Account Logon Failed ❌ (brute force)
  4634 - Account Logoff
  4648 - Logon with explicit credentials
  4776 - Credential Validation (domain)

Privilege Escalation:
  4672 - Admin Logon (special privileges)
  4732 - User added to Security Group
  4720 - User account created

Persistence:
  7045 - New service created 🚩
  4698 - Scheduled task created
  4657 - Registry value modified

Execution:
  4688 - New process created
  4689 - Process exited
  4104 - PowerShell ScriptBlock logging

Object Access:
  4663 - File accessed
  4656 - Handle to object requested
EVENTS

# Simulasi analisis event log
python3 << 'PYEOF'
events = [
    # (Time, EventID, Description)
    ("08:00:00", 4624, "Admin login from 192.168.1.100"),
    ("08:05:00", 4625, "Failed login for 'admin' from 203.0.113.5"),
    ("08:05:01", 4625, "Failed login for 'admin' from 203.0.113.5"),
    ("08:05:02", 4625, "Failed login for 'admin' from 203.0.113.5"),
    ("08:05:03", 4625, "Failed login for 'admin' from 203.0.113.5"),
    ("08:05:04", 4625, "Failed login for 'admin' from 203.0.113.5"),
    ("08:05:10", 4625, "10 more failed logins from 203.0.113.5"),
    ("08:05:30", 4624, "✅ Login SUCCESS from 203.0.113.5"),
    ("08:05:31", 4672, "⚠️ Special privileges assigned to user"),
    ("08:06:00", 4688, "Process: cmd.exe created (PID 1234)"),
    ("08:06:05", 4688, "Process: powershell.exe created (PID 1235)"),
    ("08:06:10", 7045, "🚩 New service: 'UpdateService' installed"),
    ("08:06:15", 4698, "🚩 New scheduled task: 'SystemCheck' created"),
    ("08:06:20", 4688, "Process: nc.exe created (PID 1240)"),
    ("08:10:00", 1102, "⚠️ Audit log CLEARED!"),
]

print("=== Windows Event Log Analysis ===")
print(f"{'Time':<12} {'EventID':<10} {'Description'}")
print("-"*65)

# Filter: cari anomali
suspicious_ids = [4625, 4672, 7045, 4698, 1102, 4104]
for t, eid, desc in events:
    marker = ""
    if eid == 4625:
        marker = " ← Brute Force!"
    elif eid in [7045, 4698]:
        marker = " ← Persistence!"
    elif eid == 1102:
        marker = " ← 🔴 LOG CLEARED!"
    elif eid == 4672:
        marker = " ← Privilege Escalation"
    print(f"{t:<12} {eid:<10} {desc}{marker}")

print("\n📌 Timeline Rekonstruksi:")
print("  08:05:00-30 - Brute force SSH (203.0.113.5)")
print("  08:05:30 - Login berhasil")
print("  08:05:31 - Privilege escalation (admin rights)")
print("  08:06:00-05 - Execute cmd.exe + powershell.exe")
print("  08:06:10-15 - Install service + task (persistence)")
print("  08:06:20 - nc.exe (reverse shell)")
print("  08:10:00 - 🔴 Log DIHAPUS (menutup jejak)")
PYEOF