Windows Logging Service (WLS)

Forensics
1

Latest Version: 3.7.2265

Introduction

WLS is a Windows service that reads, formats, and sends Windows event logs as well as additional information as configured to a log receiver. Analysis of this data can help identify anomalous or malicious activity, as well as provide context for user behavior.

Overview

WLS includes the following capabilities:

  • Augment process creation events with user defined metadata including hashes and PE information
  • Remote configuration to allow for secure changes to the WLS configuration
  • Route logs to one or more servers based on the current host network configuration
  • Hourly performance logging
  • Log current certificate information and changes
  • Log commands entered by a user into cmd.exe, powershell.exe, and more
  • Log devices connected / disconnected
  • Log drives mounted / unmounted
  • Log file data about file paths in logs with user defined metadata
  • Log changed files in defined directories
  • Log local users and groups
  • Log all or specific Windows event logs, with powerful filtering to reduce noise
  • Log file changes (tail)
  • Log loaded modules (dlls)
  • Log named pipe creation / deletion
  • Log performance counters
  • Log open / listening ports
  • Log local print activity
  • Log registry changes
  • Log service activity / status
  • Log session activity
  • Log task scheduler tasks
  • Log Windows Boot Configuration Log (WBCL)
  • Log Windows objects (mutant / semaphore)
  • Log WMI information

Screenshots

Splunk dashboards shown are provided as-is with a WLS license.

Overall performance

Host performance

Dashboards for WLS monitoring

Dashboards to analyze all WLS reported data

Local user analysis

Session activity, including authentication method

Setup for index, logtypes, HMAC key, and alert email addresses

Requirements

WLS requires .NET 4.0+ client or full and is compatible with Windows XP/Server 2003 – Windows 11/Server 2022. Requires < 5MB for initial installation, and up to the user-defined on-disk quota for the caching DB when the log server is unavailable.

WLS includes the required SQLite libraries and a Software Bill of Materials (SBOM) to validate the provided installation files and dependencies and the executable is signed and timestamped.

Usage

Install with colocated configuration file: msiexec.exe /i setup.msi /qn

Install with HTTPS remote configuration file: msiexec.exe /i setup.msi /RemoteURL="https://server.domain/WLS

Install with UNC remote configuration file: msiexec.exe /i /setup.msi /RemoteURL="\\server.domain\WLS"

Uninstall: msiexec.exe /x setup.msi /qn

Run in debug mode (from elevated command prompt): wls.exe /i /e /debugmode

Configuration

All settings can be user-defined to meet expectations for the environment. The manual included with a license contains all definitions, options, and examples for each setting.

WLS configuration is defined by an XML file that is generated by the provided configuration utility and/or edited manually. Only non-default settings need to be specified. The XML file can then be signed by a system generated signature to guarantee integrity of the XML file, or by an existing certificate to guarantee integrity and verify the signature is trusted.

Remote configuration is done by specifying a path to a rules file that contains host conditions to map systems to the appropriate configuration(s). A remote configuration rule editor is provided.

Example Configurations

All default settings, only watch the Application, Security, and System logs

<WLS>
  <Config>
    <Logging>
      <AutoWatchNewLogSources>0</AutoWatchNewLogSources>
      <Logs>
        <Application>1</Application>
        <Security>1</Security>
        <System>1</System>
      </Logs>
    </Logging>
  </Config>
</WLS>

Additional data sources enabled

...
<CertificateMonitor>
  <Enabled>1</Enabled>
</CertificateMonitor>
<SessionMonitor>
  <Enabled>1</Enabled>
</SessionMonitor>
...

Example signed XML. Configuration utility signs and verifies files/folders

...
</Config>
  
  
<RSAKeyValue><Modulus>otCgojt4iZbb+y+FdXBn...u6gAkw==</Modulus><Exponent>AQAB</Exponent></RSAKeyValue><Signature xmlns="http://www.w3.org/2000/09/xmldsig#"><SignedInfo><CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315" /><SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" /><Reference URI=""><Transforms><Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" /><DigestValue>yw+...fE=</DigestValue></Reference></SignedInfo><SignatureValue>ESC...OEcyw==</SignatureValue></Signature></WLS>

Article Link: Windows Logging Service (WLS) | digirati82