diff --git a/CHANGELOG.md b/CHANGELOG.md index f416d5a..573a5db 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -11,6 +11,7 @@ Releases are tagged `vX.Y.Z` and published with a zip and a SHA256 checksum. ### Added - 🖧 **SMB server guest logons and security events are collected.** The server side of insecure guest-logon auditing is now on too (event 3023), with the two server logs it can land in: SMBServer/Security (Microsoft's docs; also session authentication failures 551, access denied 1006/1007/1009, weak session keys 1906) and SMBServer/Operational (where current Windows 11 builds write 3023). Both logs are raised from 8 MB to 128 MB. Mapped on the Settings catalog and Group Policy pages and carried in the GPO pack. Windows 11 24H2 / Server 2025 and later. +- 🖥️ **RDP logons are kept before the session starts.** Two RDP logs join the Core set: TerminalServices-RemoteConnectionManager/Operational (connections reaching the listener, 261, and successful authentication with user and source address, 1149) and RemoteDesktopServices-RdpCoreTS/Operational (connections accepted, 131, and failed on a bad user name or password, 140, the RDP brute-force signal). Both are on by default at only 1 MB, so they wrap within hours on an exposed host; now 128 MB. ### Fixed diff --git a/WinLogKit.Settings.ps1 b/WinLogKit.Settings.ps1 index e4d7ad3..aef0310 100644 --- a/WinLogKit.Settings.ps1 +++ b/WinLogKit.Settings.ps1 @@ -197,6 +197,17 @@ $script:BaselineChannels = @( Categories = @('Remote access') Purpose = 'RDP session connect/disconnect/reconnect (21/24/25) with source address - survives Security log clearing.' } + # Kit additions: the two RDP logs before the session starts. Both are on + # by default at 1 MB, so they wrap within hours on an exposed host. + # Event IDs as their providers define them. + @{ Name = 'Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational'; TargetBytes = $mb128; MustEnable = $true; Tier = 'Core'; DefaultSize = '1 MB'; MayBeAbsent = $true + Categories = @('Remote access','Authentication') + Purpose = 'RDP connections reaching the listener (261) and successful network-level authentication with user and source address (1149), logged before any session or Security-log logon exists.' } + + @{ Name = 'Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational'; TargetBytes = $mb128; MustEnable = $true; Tier = 'Core'; DefaultSize = '1 MB'; MayBeAbsent = $true + Categories = @('Remote access','Authentication') + Purpose = 'RDP transport: new connections accepted with the client address (131) and connections failed on a bad user name or password (140), the RDP brute-force signal.' } + @{ Name = 'Microsoft-Windows-TaskScheduler/Operational'; TargetBytes = $mb128; MustEnable = $true; Tier = 'Core'; DefaultSize = '1 MB' Categories = @('Scheduled and automated tasks','Persistence') Purpose = 'Task registration, updates and execution. DISABLED by default so must be enabled. Tasks are a top persistence mechanism.' } diff --git a/docs/gpo-paths.md b/docs/gpo-paths.md index 5efed39..8bf2ceb 100644 --- a/docs/gpo-paths.md +++ b/docs/gpo-paths.md @@ -129,6 +129,8 @@ Things to know before you start: | Microsoft-Windows-DriverFrameworks-UserMode/Operational | Log | No Group Policy template for this log's size or enablement. | | Microsoft-Windows-WMI-Activity/Operational | Log | No Group Policy template for this log's size. | | Microsoft-Windows-TerminalServices-LocalSessionManager/Operational | Log | No Group Policy template for this log's size. | +| Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational | Log | No Group Policy template for this log's size or enablement. | +| Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational | Log | No Group Policy template for this log's size or enablement. | | Microsoft-Windows-TaskScheduler/Operational | Log | No Group Policy template for this log's size or enablement. | | Microsoft-Windows-SMBServer/Audit | Log | No Group Policy template for this log's size. | | Microsoft-Windows-SmbClient/Audit | Log | No Group Policy template for this log's size. | diff --git a/docs/intune-csp.md b/docs/intune-csp.md index 06162d6..1d02a08 100644 --- a/docs/intune-csp.md +++ b/docs/intune-csp.md @@ -129,6 +129,8 @@ domain-joined hosts, see [Group Policy paths](gpo-paths.md)). | Microsoft-Windows-DriverFrameworks-UserMode/Operational | Log | No CSP for this log's size or enablement. | | Microsoft-Windows-WMI-Activity/Operational | Log | No CSP for this log's size. | | Microsoft-Windows-TerminalServices-LocalSessionManager/Operational | Log | No CSP for this log's size. | +| Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational | Log | No CSP for this log's size or enablement. | +| Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational | Log | No CSP for this log's size or enablement. | | Microsoft-Windows-TaskScheduler/Operational | Log | No CSP for this log's size or enablement. | | Microsoft-Windows-SMBServer/Audit | Log | No CSP for this log's size. | | Microsoft-Windows-SmbClient/Audit | Log | No CSP for this log's size. | diff --git a/docs/reference.md b/docs/reference.md index 0142d83..cfcf1ea 100644 --- a/docs/reference.md +++ b/docs/reference.md @@ -54,6 +54,8 @@ Reading the columns: | Microsoft-Windows-DriverFrameworks-UserMode/Operational | Channel | - | 1 MB -> 128 MB | Low | Y | :material-check: | :material-check: | :material-check: | | Microsoft-Windows-WMI-Activity/Operational | Channel | - | 1 MB -> 128 MB | Low | Y | :material-check: | :material-check: | :material-check: | | Microsoft-Windows-TerminalServices-LocalSessionManager/Operational | Channel | - | 1 MB -> 128 MB | Low | Y | :material-check: | :material-check: | :material-check: | +| Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational | Channel | 261, 1149 | 1 MB -> 128 MB | Low | - | :material-check: | :material-check: | :material-check: | +| Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational | Channel | 131, 140 | 1 MB -> 128 MB | Low | - | :material-check: | :material-check: | :material-check: | | Microsoft-Windows-TaskScheduler/Operational | Channel | - | 1 MB -> 128 MB | Low | Y | :material-check: | :material-check: | :material-check: | | Microsoft-Windows-SMBServer/Audit | Channel | 3021, 3022 | 8 MB -> 128 MB | Low | - | :material-check: | :material-check: | :material-check: | | Microsoft-Windows-SmbClient/Audit | Channel | 31998, 31999, 31997 | 8 MB -> 128 MB | Low | - | :material-check: | :material-check: | :material-check: | diff --git a/presets/ASD.csv b/presets/ASD.csv index 9525bba..3fe825e 100644 --- a/presets/ASD.csv +++ b/presets/ASD.csv @@ -23,6 +23,8 @@ "Channel","Microsoft-Windows-DriverFrameworks-UserMode/Operational","Microsoft-Windows-DriverFrameworks-UserMode/Operational","Core","All","Y","N","","USB device plug/unplug detail. DISABLED by default so must be enabled.","Removable and external devices" "Channel","Microsoft-Windows-WMI-Activity/Operational","Microsoft-Windows-WMI-Activity/Operational","Core","All","Y","N","","WMI operations. WMI event subscriptions are a common fileless persistence mechanism.","Execution; Persistence; Scheduled and automated tasks" "Channel","Microsoft-Windows-TerminalServices-LocalSessionManager/Operational","Microsoft-Windows-TerminalServices-LocalSessionManager/Operational","Core","All","Y","N","","RDP session connect/disconnect/reconnect (21/24/25) with source address - survives Security log clearing.","Remote access" +"Channel","Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational","Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational","Core","All","Y","N","","RDP connections reaching the listener (261) and successful network-level authentication with user and source address (1149), logged before any session or Security-log logon exists.","Remote access; Authentication" +"Channel","Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational","Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational","Core","All","Y","N","","RDP transport: new connections accepted with the client address (131) and connections failed on a bad user name or password (140), the RDP brute-force signal.","Remote access; Authentication" "Channel","Microsoft-Windows-TaskScheduler/Operational","Microsoft-Windows-TaskScheduler/Operational","Core","All","Y","N","","Task registration, updates and execution. DISABLED by default so must be enabled. Tasks are a top persistence mechanism.","Scheduled and automated tasks; Persistence" "Channel","Microsoft-Windows-SMBServer/Audit","Microsoft-Windows-SMBServer/Audit","Core","All","Y","N","","SMB server audit events, including signing/encryption capability auditing on Windows 11 24H2 / Server 2025 and later (3021/3022) - identifies clients that cannot do SMB signing or encryption before you enforce it.","Remote access; Network flow and sessions" "Channel","Microsoft-Windows-SmbClient/Audit","Microsoft-Windows-SmbClient/Audit","Core","All","Y","N","","SMB client audit events, including signing/encryption capability auditing (31998/31999) and insecure guest logons (31997) on Windows 11 24H2 / Server 2025 and later, and NTLM-blocking diagnostics.","Remote access; Network flow and sessions" diff --git a/presets/DomainController.csv b/presets/DomainController.csv index 76b6efd..89f0af2 100644 --- a/presets/DomainController.csv +++ b/presets/DomainController.csv @@ -23,6 +23,8 @@ "Channel","Microsoft-Windows-DriverFrameworks-UserMode/Operational","Microsoft-Windows-DriverFrameworks-UserMode/Operational","Core","All","Y","Y","","USB device plug/unplug detail. DISABLED by default so must be enabled.","Removable and external devices" "Channel","Microsoft-Windows-WMI-Activity/Operational","Microsoft-Windows-WMI-Activity/Operational","Core","All","Y","Y","","WMI operations. WMI event subscriptions are a common fileless persistence mechanism.","Execution; Persistence; Scheduled and automated tasks" "Channel","Microsoft-Windows-TerminalServices-LocalSessionManager/Operational","Microsoft-Windows-TerminalServices-LocalSessionManager/Operational","Core","All","Y","Y","","RDP session connect/disconnect/reconnect (21/24/25) with source address - survives Security log clearing.","Remote access" +"Channel","Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational","Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational","Core","All","Y","Y","","RDP connections reaching the listener (261) and successful network-level authentication with user and source address (1149), logged before any session or Security-log logon exists.","Remote access; Authentication" +"Channel","Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational","Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational","Core","All","Y","Y","","RDP transport: new connections accepted with the client address (131) and connections failed on a bad user name or password (140), the RDP brute-force signal.","Remote access; Authentication" "Channel","Microsoft-Windows-TaskScheduler/Operational","Microsoft-Windows-TaskScheduler/Operational","Core","All","Y","Y","","Task registration, updates and execution. DISABLED by default so must be enabled. Tasks are a top persistence mechanism.","Scheduled and automated tasks; Persistence" "Channel","Microsoft-Windows-SMBServer/Audit","Microsoft-Windows-SMBServer/Audit","Core","All","Y","Y","","SMB server audit events, including signing/encryption capability auditing on Windows 11 24H2 / Server 2025 and later (3021/3022) - identifies clients that cannot do SMB signing or encryption before you enforce it.","Remote access; Network flow and sessions" "Channel","Microsoft-Windows-SmbClient/Audit","Microsoft-Windows-SmbClient/Audit","Core","All","Y","Y","","SMB client audit events, including signing/encryption capability auditing (31998/31999) and insecure guest logons (31997) on Windows 11 24H2 / Server 2025 and later, and NTLM-blocking diagnostics.","Remote access; Network flow and sessions" diff --git a/presets/MemberServer.csv b/presets/MemberServer.csv index ee89c16..16ca556 100644 --- a/presets/MemberServer.csv +++ b/presets/MemberServer.csv @@ -23,6 +23,8 @@ "Channel","Microsoft-Windows-DriverFrameworks-UserMode/Operational","Microsoft-Windows-DriverFrameworks-UserMode/Operational","Core","All","Y","Y","","USB device plug/unplug detail. DISABLED by default so must be enabled.","Removable and external devices" "Channel","Microsoft-Windows-WMI-Activity/Operational","Microsoft-Windows-WMI-Activity/Operational","Core","All","Y","Y","","WMI operations. WMI event subscriptions are a common fileless persistence mechanism.","Execution; Persistence; Scheduled and automated tasks" "Channel","Microsoft-Windows-TerminalServices-LocalSessionManager/Operational","Microsoft-Windows-TerminalServices-LocalSessionManager/Operational","Core","All","Y","Y","","RDP session connect/disconnect/reconnect (21/24/25) with source address - survives Security log clearing.","Remote access" +"Channel","Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational","Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational","Core","All","Y","Y","","RDP connections reaching the listener (261) and successful network-level authentication with user and source address (1149), logged before any session or Security-log logon exists.","Remote access; Authentication" +"Channel","Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational","Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational","Core","All","Y","Y","","RDP transport: new connections accepted with the client address (131) and connections failed on a bad user name or password (140), the RDP brute-force signal.","Remote access; Authentication" "Channel","Microsoft-Windows-TaskScheduler/Operational","Microsoft-Windows-TaskScheduler/Operational","Core","All","Y","Y","","Task registration, updates and execution. DISABLED by default so must be enabled. Tasks are a top persistence mechanism.","Scheduled and automated tasks; Persistence" "Channel","Microsoft-Windows-SMBServer/Audit","Microsoft-Windows-SMBServer/Audit","Core","All","Y","Y","","SMB server audit events, including signing/encryption capability auditing on Windows 11 24H2 / Server 2025 and later (3021/3022) - identifies clients that cannot do SMB signing or encryption before you enforce it.","Remote access; Network flow and sessions" "Channel","Microsoft-Windows-SmbClient/Audit","Microsoft-Windows-SmbClient/Audit","Core","All","Y","Y","","SMB client audit events, including signing/encryption capability auditing (31998/31999) and insecure guest logons (31997) on Windows 11 24H2 / Server 2025 and later, and NTLM-blocking diagnostics.","Remote access; Network flow and sessions" diff --git a/presets/Workstation.csv b/presets/Workstation.csv index efa122f..b637dee 100644 --- a/presets/Workstation.csv +++ b/presets/Workstation.csv @@ -23,6 +23,8 @@ "Channel","Microsoft-Windows-DriverFrameworks-UserMode/Operational","Microsoft-Windows-DriverFrameworks-UserMode/Operational","Core","All","Y","Y","","USB device plug/unplug detail. DISABLED by default so must be enabled.","Removable and external devices" "Channel","Microsoft-Windows-WMI-Activity/Operational","Microsoft-Windows-WMI-Activity/Operational","Core","All","Y","Y","","WMI operations. WMI event subscriptions are a common fileless persistence mechanism.","Execution; Persistence; Scheduled and automated tasks" "Channel","Microsoft-Windows-TerminalServices-LocalSessionManager/Operational","Microsoft-Windows-TerminalServices-LocalSessionManager/Operational","Core","All","Y","Y","","RDP session connect/disconnect/reconnect (21/24/25) with source address - survives Security log clearing.","Remote access" +"Channel","Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational","Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational","Core","All","Y","Y","","RDP connections reaching the listener (261) and successful network-level authentication with user and source address (1149), logged before any session or Security-log logon exists.","Remote access; Authentication" +"Channel","Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational","Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational","Core","All","Y","Y","","RDP transport: new connections accepted with the client address (131) and connections failed on a bad user name or password (140), the RDP brute-force signal.","Remote access; Authentication" "Channel","Microsoft-Windows-TaskScheduler/Operational","Microsoft-Windows-TaskScheduler/Operational","Core","All","Y","Y","","Task registration, updates and execution. DISABLED by default so must be enabled. Tasks are a top persistence mechanism.","Scheduled and automated tasks; Persistence" "Channel","Microsoft-Windows-SMBServer/Audit","Microsoft-Windows-SMBServer/Audit","Core","All","Y","Y","","SMB server audit events, including signing/encryption capability auditing on Windows 11 24H2 / Server 2025 and later (3021/3022) - identifies clients that cannot do SMB signing or encryption before you enforce it.","Remote access; Network flow and sessions" "Channel","Microsoft-Windows-SmbClient/Audit","Microsoft-Windows-SmbClient/Audit","Core","All","Y","Y","","SMB client audit events, including signing/encryption capability auditing (31998/31999) and insecure guest logons (31997) on Windows 11 24H2 / Server 2025 and later, and NTLM-blocking diagnostics.","Remote access; Network flow and sessions" diff --git a/tools/Export-ReferenceTable.ps1 b/tools/Export-ReferenceTable.ps1 index 3464411..2a3f1d4 100644 --- a/tools/Export-ReferenceTable.ps1 +++ b/tools/Export-ReferenceTable.ps1 @@ -72,7 +72,8 @@ function Get-PurposeEventText { } # Kit-added items that Yamato's own scripts do not contain: the SMB -# auditing (all SmbAudit rows plus its four channels), the NTLM audit +# auditing (all SmbAudit rows plus its four channels), the two pre-session +# RDP logs, the NTLM audit # registry values, the PowerShell 7 policy fallbacks (#44) and the forced # subcategory audit setting (#71). They must not # carry the Y letter. Situational items (the old Optional tier: IPsec Driver, @@ -80,7 +81,8 @@ function Get-PurposeEventText { # whatever their tier. $yExcludedIds = @('NtlmOutboundAudit', 'NtlmInboundAudit', 'NtlmDomainAudit', 'PS7ScriptBlock64', 'PS7ScriptBlock32', 'PS7ModuleLogging64', 'PS7ModuleLogging32', 'ForceSubcategoryAudit') -$yExcludedChannels = @('Microsoft-Windows-SMBServer/Audit', 'Microsoft-Windows-SmbClient/Audit', 'Microsoft-Windows-SMBServer/Security', 'Microsoft-Windows-SMBServer/Operational') +$yExcludedChannels = @('Microsoft-Windows-SMBServer/Audit', 'Microsoft-Windows-SmbClient/Audit', 'Microsoft-Windows-SMBServer/Security', 'Microsoft-Windows-SMBServer/Operational', + 'Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational', 'Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational') function Test-Situational { param([hashtable]$Item) return ($Item.ContainsKey('Situational') -and $Item.Situational)