Log Analysis

Log analysis is the process of examining logs to identify events of interest.
Logs help uncover the details surrounding the 5 W’s of incident investigation: who triggered the incident, what happened, when the incident took place, where the incident took place, and why the incident occurred.

Log Investigation#

Several methodologies, best practices, and essential techniques are employed to create a coherent timeline and conduct effective log analysis investigations.

• Timestamp:
  Logs will typically include timestamps that record when an event occurred. With the potential of many distributed devices, applications, and systems generating individual log events across various regions, it’s crucial to consider each log’s time zone and format. Converting timestamps to a consistent time zone is necessary for accurate log analysis and correlation across different log sources. Many log monitoring solutions solve this by timezone detection and automatic configuration or conversion to standard time formats (like UNIX timestamps). This consistent timestamp can then be converted to a local timezone during visualization, which makes reporting and analysis more efficient.
• Timeline:
  Timeline is a chronological representation of the logged events, ordered based on their occurrence. The ability to visualize a timeline is a powerful tool for contextualizing and comprehending the events that occurred over a specific period. With an effective timeline, security analysts can trace the sequence of events leading up to an incident, allowing them to identify the initial point of compromise and understand the attacker’s tactics, techniques and procedures (TTPs).
• Super Timeline:
  A super timeline, also known as a consolidated timeline provide a comprehensive view of events across different systems, devices, and applications, allowing analysts to understand the sequence of events holistically. This is particularly useful for investigating security incidents involving multiple components or systems.
  Plaso (Python Log2Timeline) ↗ is an open-source tool that automates the creation of timelines from various log sources. It’s specifically designed for digital forensics and log analysis and can parse and process log data from a wide range of sources to create a unified, chronological timeline.
• Data visualization tools:
  Data visualization tools, such as Kibana (of the Elastic Stack) and Splunk, help to convert raw log data into interactive and insightful visual representations through a user interface. Tools like these enable security analysts to understand the indexed data by visualizing patterns and anomalies, often in a graphical view.
• Monitoring and Alerts:
  Many SIEM solutions (like Splunk and the Elastic Stack) allow the creation of custom alerts based on metrics obtained in log events. Events worth creating alerts for may include multiple failed login attempts, privilege escalation, access to sensitive files, or other indicators of potential security breaches. Alerts ensure that security teams are promptly notified of suspicious activities that require immediate attention.
• Threat Intelligence
  When analyzing a log file, we can search for the presence of adversaries from Threat Intelligence sources using datas like IP Addresses, File Hashes, Domains etc.

Common Patterns#

Rrecognizing common patterns and trends in log data is crucial for identifying potential security threats. These “patterns” refer to the identifiable artifacts left behind in logs by threat actors or cyber security incidents.

Abnormal User Behavior#

One of the primary patterns that can be identified is related to unusual or anomalous user behavior. This refers to any actions or activities conducted by users that deviate from their typical or expected behavior.

To effectively detect anomalous user behavior, organizations can employ log analysis solutions that incorporate detection engines and machine learning algorithms to establish normal behavior patterns. Deviations from these patterns or baselines can then be alerted as potential security incidents. Some examples of these solutions include Splunk User Behavior Analytics (UBA) ↗, IBM QRadar UBA ↗, and Azure AD Identity Protection ↗.

The specific indicators can vary greatly depending on the source, but some examples of this that can be found in log files include:

• Multiple failed login attempts
  • Unusually high numbers of failed logins within a short time may indicate a brute-force attack.
• Unusual login times
  • Login events outside the user’s typical access hours or patterns might signal unauthorized access or compromised accounts.
• Geographic anomalies
  • Login events from IP addresses in countries the user does not usually access can indicate potential account compromise or suspicious activity.
  • In addition, simultaneous logins from different geographic locations (or indications of impossible travel) may suggest account sharing or unauthorized access.
• Frequent password changes
  • Log events indicating that a user’s password has been changed frequently in a short period may suggest an attempt to hide unauthorized access or take over an account.
• Unusual user-agent strings
  • In the context of HTTP traffic logs, requests from users with uncommon user-agent strings that deviate from their typical browser may indicate automated attacks or malicious activities.
  • For example, by default, the Nmap scanner ↗ will log a user agent containing “Nmap Scripting Engine.” The Hydra brute-forcing tool ↗, by default, will include “(Hydra)” in its user-agent. These indicators can be useful in log files to detect potential malicious activity.

Common Attack Signatures#

Identifying common attack signatures in log data is an effective way to detect and quickly respond to threats. Attack signatures contain specific patterns or characteristics left behind by threat actors. They can include malware infections, web-based attacks (SQL injection, cross-site scripting, directory traversal), and more.

• SQL Injection
  SQL injection attempts to exploit vulnerabilities in web applications that interact with databases. Look for unusual or malformed SQL queries in the application or database logs to identify common SQL injection attack patterns. Suspicious SQL queries might contain unexpected characters, such as single quotes ('), comments (--, #), union statements (UNION), or time-based attacks (WAITFOR DELAY, SLEEP()).
• Cross-Site Scripting (XSS)
  Exploiting cross-site scripting (XSS) vulnerabilities allow attackers to inject malicious scripts into web pages. To identify common XSS attack patterns, it is often helpful to look for log entries with unexpected or unusual input that includes script tags (<script>) and event handlers (onmouseover, onclick, onerror).
• Path Traversal Attack
  Exploiting path traversal vulnerabilities allows attackers to access files and directories outside a web application’s intended directory structure, leading to unauthorized access to sensitive files or code. To identify common traversal attack patterns, look for traversal sequence characters (../ and ../../) and indications of access to sensitive files (/etc/passwd, /etc/shadow). Directory traversals are often URL encoded (or double URL encoded) to avoid detection by firewalls or monitoring tools. Because of this, %2E and %2F are useful URL-encoded characters to know as they refer to the . and / respectively. A useful directory traversal payload list to reference can be found here ↗.

CLI tools for log analysis#

• cat
• less
• tail ( use -f to follow log file, -n to specify no of lines)
• head
• wc: provides information about the number of lines, words, and characters in a log file.
• cut: extracts specific columns (fields) from files based on specified delimiters. (eg: cut -d ' ' -f 1 apache.log to extract first field from a log file having a delimiter of space character)
• sort: arranges the data in files in ascending or descending order based on specific criteria. (-n: to sort numerically, -r: to reverse order)
• uniq: identifies and removes adjacent duplicate lines from sorted input. (append the -c option to output unique lines and prepend the count of occurrences for each line)
• sed: is a powerful text-processing tools, it can replace specific patterns or strings in log entries (eg: sed 's/31\/Jul\/2023/July 31, 2023/g' apache.log to replace all occurrences of “31/Jul/2023” with “July 31, 2023”). add the -i option to edit the file in place or use a redirect operator > to save the output to the original or another file.
• awk: also a text processing tool, used for conditional actions based on specific field values. (eg: awk '$9 >= 400' apache.log to print log entries where the 9th field (HTTP response code) is >= to 400)
• grep: powerful text search tool. (-c to count the entries matching the search criteria, -n to add line numbers, -v to invert, ie, to select lines that do not contain the specified pattern or keyword, -E for Regex).
• Sigma
• YARA