AUDIT OF SYSTEM PROCESSES AND EVENTS IN WINDOWS, LINUX .

• Objectives of the practical lesson:
• Master the principles of auditing processes and events in operating systems.
• Develop practical skills in setting up auditing in Windows and Linux environments.
• Understand how to use auditing to improve the information security of systems.

• Objectives of the practical lesson:
• Learn the basic concepts: what is an event audit, why is it needed, and what types of audits there are.
• Get acquainted with audit configuration tools in Windows (group policies, Event Viewer ) and Linux ( auditd , ausearch ).
• Set up basic auditing on Windows and Linux:
1. Monitoring the start and end of processes.
2. Audit access to critical files.
• Learn to analyze audit results to identify suspicious activity.
• To develop recommendations for improving audit policy for a real organization.

WHAT IS PROCESS AND EVENT AUDITING?

Process and event auditing is the process of recording, storing, and analyzing information about actions occurring in the operating system or applications. �It records events such as process startup and termination, file access, configuration changes, user logins, and other important activities.

Definition :

Process and event auditing is the systematic monitoring and recording of actions and changes in a system for subsequent analysis, control, and improvement of security levels.

WHY IS AUDITING IMPORTANT FOR INFORMATION SECURITY?

Auditing plays a key role in ensuring security for several reasons:

• Incident detection : Auditing helps to promptly detect attempts at unauthorized access, hacking, or internal sabotage.
• Event investigation : Audit logs allow you to reconstruct a complete picture of events before, during, and after an incident.
• Compliance with standards and regulations : For example, standards such as ISO/IEC 27001, GDPR, HIPAA require audit mechanisms.
• Monitoring user and process activity : Allows you to track the actions of employees and programs, promptly identifying anomalies.
• Building trust : Organizations that have implemented auditing demonstrate responsibility in handling data and protecting infrastructure.

PROCESS AND EVENT AUDIT: WHAT IT TRACKS AND WHY IT'S IMPORTANT

AUDITING : AN OVERVIEW

Audit services

In Windows, event auditing is provided by special services and mechanisms:

• Security Account Manager (SAM) is responsible for user accounts and access control.
• Windows Event Log Service - collects, stores, and manages event logs.
• Audit Policy and Advanced Audit Policy allow you to configure audit rules for different types of events.

Together, these services provide centralized registration and storage of security information.

EVENT LOGS ( EVENT VIEWER)

Event Viewer is a built-in Windows utility designed to :

• Viewing event logs,
• Filtering and analyzing records,
• Identifying errors, warnings and suspicious activity.

Main journals:

• Security — security events (logins, accesses).
• Application — application events.
• System — system operation events (driver errors, service failures).

Path to open : �Start → Administrative Tools → Event Viewer �or the eventvwr.msc command via the command line.

AUDIT CATEGORIES

1. Login ( Logon / Logoff) Events )

• Audit of user login and logout attempts.
• Monitoring successful and unsuccessful login attempts.

2. Access to files and objects (Object Access)

• Tracking access to specific files, folders, and registry.
• Detect unauthorized reading, modification or deletion of data.

3. User rights and changes ( Privilege Use , User Rights Assignment )

• Audit privilege usage, such as running processes with elevated rights.
• Monitor changes to security groups and user policies.

HOW TO ENABLE LOGON AUDITING IN WINDOWS

1. Open Local Security Policy

• Press Win + R , enter the command:

secpol.msc

Press Enter to open the Local Security Policy window .

​

2. Go to audit settings

• In the left menu, select: �Local Policies → Audit Policy .

​

3. Set up login auditing

• Find the Audit logon attempts item ( Audit logon events ).
• Double click on it.
• In the window that opens, check the boxes:
• ✅ Successful attempts
• ✅ Unsuccessful attempts
• Click OK to save the settings.

​

4. Check event registration

• Open Event Viewer :
• Win + R → enter eventvwr.msc .
• Go to the journal:

Windows Logs →

Look for events with IDs:

• 4624 - successful login,
• 4625 - Failed login attempt.

SETTING UP AUDITING IN WINDOWS

1. Local Security Policy ( secpol.msc )

Local security policy allows you to configure event auditing at the level of a single computer.

Setup steps:

1. Open the Run window ( Win + R ) → enter the command:

secpol.msc

2. Go to menu:

Local Policies → Audit Policy

3. Configure the required audit parameters, for example:

• Login audit (successful and unsuccessful attempts).
• Audit of access to objects (files, folders).
• Audit of changes in security policies.

When to use:

• On single computers or in small networks without a domain structure.

GROUP POLICY ( GPEDIT.MSC )

The Local Group Policy Editor ( gpedit.msc ) allows you to fine-tune auditing settings, including advanced audit policies .

Setup steps:

1. Open the Run window ( Win + R ) → enter the command:

gpedit.msc

2. Go to menu:

Computer Configuration → Policies → Windows Settings → Security Settings → Advanced Audit Policy

3. Set up detailed rules:

Process audit,

Registry access audit,

Privilege use audit,

Audit of network connections.

When to use:

On workstations within domains, in corporate networks, when fine-tuning security is required.

AUDITING : AN OVERVIEW

1. Logs / var / log /

In Linux, all major system and application events are recorded in text log files, which are stored in the directory:

/var/log/

Main journals:

/var/log/auth.log — user authentication

/ var / log / secure — a similar log for some distributions (for example, CentOS , RHEL).

/ var / log / syslog — system-wide messages and notifications.

/var/log/audit/audit.log - Security audit records when using the

Important : Logs allow you to track all important events related to security and user actions.

AUDITING : AN OVERVIEW

2. System services: auditd and rsyslog

auditd — security audit service

• Special audit daemon ( audit daemon ), which monitors system calls, user actions, and security events.
• The configuration is usually located in the file:

/ etc /audit/ auditd.conf

Audit rules are set in:

/ etc /audit/rules.d /audit.rules​​

Key features of auditd :

Track whether files have been read, modified, or deleted.

Monitoring process startup.

Logging of successful and unsuccessful access attempts.

rsyslog — system logging service

Processes and records standard system messages.

Configuration in file:

/etc/rsyslog.conf​​​

Used to collect events from different system components and store them in / var / log /.

Note: rsyslog and auditd can operate in parallel, providing both standard and specialized logging of security events.

AUDITING : AN OVERVIEW

2. System services: auditd and rsyslog

auditd — security audit service

• Special audit daemon ( audit daemon ), which monitors system calls, user actions, and security events.
• The configuration is usually located in the file:

/ etc /audit/ auditd.conf

Audit rules are set in:

/ etc /audit/rules.d /audit.rules​​

Key features of auditd :

Track whether files have been read, modified, or deleted.

Monitoring process startup.

Logging of successful and unsuccessful access attempts.

rsyslog — system logging service

Processes and records standard system messages.

Configuration in file:

/etc/rsyslog.conf​​​

Used to collect events from different system components and store them in / var / log /.

Note: rsyslog and auditd can operate in parallel, providing both standard and specialized logging of security events.

AUDITING : AN OVERVIEW

3. Access rights and user activity tracking

Permissions in Linux are based on a system of users, groups, and file attributes:

• Each file and directory is assigned read ( r ), write ( w ), and execute ( x ) permissions.
• Commands for control:
• ls -l — view access rights.
• chmod , chown , chgrp — changing permissions and owners.

Tracking user actions :

• Authentication logs :
• Using sudo commands
• Custom events via auditd : you can track file access, process startup, and settings changes.
• Examples of events:

SETTING UP AUDITING IN LINUX

1. Installing and running auditd

auditd is the primary security auditing daemon in Linux. It records events in a dedicated log file

How to install and run:

For Debian /Ubuntu:

sudo apt update

sudo apt install auditd audispd -plugins

sudo systemctl enable auditd

sudo systemctl start auditd

For CentOS/RHEL:

sudo yum install audit

sudo systemctl enable auditd

sudo systemctl start auditd

Checking service status:

sudo systemctl status auditd

SETTING UP AUDITING IN LINUX

2. Configuration /etc/audit/audit.rules​​​​

The file /etc/audit/rules.d/audit.rules contains the rules by which auditd will monitor

Examples of basic rules:

• Track all file access attempts:

-w / etc /passwd -p wa -k passwd_changes

• Where:
• -w — file to be watched,
• -p wa — monitoring of recording (w) and attribute changes (a),
• -k — event label for filtering by key.
• Audit the execution of a specific command:

-a always,exit -F arch=b64 -S execve -k command_exec

• Where:
• -a always,exit — always log the exit from the system call,
• -F arch =b64 — filter for 64-bit architectures,
• -S execve - system call to run programs,
• -k — event label.
• Monitoring SSH configuration file changes:

-w / etc / ssh / sshd_config -p wa -k ssh_config

• After changing the rules, you need to restart the service:

sudo systemctl restart auditd

✅ Useful commands for working with audit:

• View log: sudo ausearch -k tag_name

PRACTICAL TASK 1 ( WINDOWS)

Objective of the task:

Learn how to set up login auditing and analyze successful and unsuccessful login event logs.

Instructions:

Step 1: Configure login auditing

1. Open the Run window ( Win + R).
2. Enter the command:

secpol.msc

3. Go to the section:

Local Policies → Audit Policy → Audit login attempts

4. Double - click Audit logon attempts.

5. Check the boxes:

✅ Successful attempts

✅ Unsuccessful attempts

6. Click OK to apply the changes.

PRACTICAL TASK 1 ( WINDOWS)

Step 2: Checking Events in Event Viewer

1. Open the Run window ( Win + R ).
2. Enter the command:

eventvwr.msc

3. Go to the section:

Windows Logs → Security

4. Find events by their ID:

4624 - Successful login,

4625 - Failed login attempt.

What you need to do and provide:

• Take screenshots of audit settings.
• Take screenshots of found events 4624 and 4625 in Event Viewer .
• Sign on screenshots:
• Where was the successful entry.
• Where was the failed login attempt.

✅ Important: After configuration, you can simulate an invalid login attempt (for example, enter an incorrect password when logging in) to see event 4625.

PRACTICAL TASK 2 ( LINUX)

Objective of the task:

auditd audit service on Linux and configure a rule to monitor changes to the / etc / passwd system file .

Instructions:

Step 1: Install and run auditd

1. Update package list:

sudo apt update

2. Install the audit service:

sudo apt install auditd audispd -plugins

(for CentOS/RHEL: sudo yum install audit)

3. Start and enable the service:

sudo systemctl enable auditd

sudo systemctl start auditd

PRACTICAL TASK 2 ( LINUX)

Step 2: Configure an audit rule for the / etc / passwd file

1. Open the rules file:

sudo nano /etc/audit/rules.d/audit.rules

2. Add a rule to audit changes:

-w / etc /passwd -p wa -k passwd_changes

Where:

-w / etc / passwd — watch the file,

-p wa — audit of entries and changes to attributes,

-k passwd_changes — key for quick filtering of events.

3. Save the changes and close the file.

4. Restart the auditd service :

sudo systemctl restart auditd

PRACTICAL TASK 2 ( LINUX)

Step 3. Checking the audit work

1. Edit the / etc / passwd file (e.g. add a space and save) or run the command:

sudo nano / etc /passwd

2. Find change records via:

sudo ausearch -k passwd_changes

What you need to do and provide:

• auditd service installation .
• Screenshot of the added rule in audit.rules .
• Screenshot of the ausearch command running with the change to the / etc / passwd file recorded .

✅ Important:

• After the test, return / etc / passwd to its original state!
• Use caution when working with system files.

​

THANK YOU FOR YOUR ATTENTION