--- name: performing-log-analysis-for-forensic-investigation-c1fb803d5945 description: Collect, parse, and correlate system, application, and security logs to reconstruct events and establish timelines during forensic investigations. domain: cybersecurity subdomain: digital-forensics tags: - forensics - log-analysis - siem - event-correlation - timeline-analysis - evidence-collection version: '1.0' author: mahipal license: Apache-2.0 nist_csf: - RS.AN-03 - DE.AE-02 - RS.MA-01 mitre_attack: - T1005 - T1074 - T1119 - T1070 - T1685.002 --- # Performing Log Analysis for Forensic Investigation ## When to Use - When reconstructing the timeline of a security incident from available log sources - During post-breach investigation to identify initial access, lateral movement, and exfiltration - When correlating events across multiple systems and log sources - For establishing evidence of unauthorized access or policy violations - When preparing forensic reports requiring detailed event chronology ## Prerequisites - Access to collected log files (Windows Event Logs, syslog, application logs) - Log parsing tools (LogParser, jq, awk, or ELK stack) - Understanding of log formats (EVTX, syslog, JSON, CSV) - NTP-synchronized timestamps across all log sources for correlation - Sufficient storage for log aggregation and indexing - Timeline analysis tools (log2timeline, Plaso) ## Workflow ### Step 1: Collect and Preserve Log Sources ```bash # Create case log directory structure mkdir -p /cases/case-2024-001/logs/{windows,linux,network,application,web} # Extract Windows Event Logs from forensic image cp /mnt/evidence/Windows/System32/winevt/Logs/*.evtx /cases/case-2024-001/logs/windows/ # Key Windows Event Logs to collect # Security.evtx - Authentication, access control, policy changes # System.evtx - Service starts/stops, driver loads, system errors # Application.evtx - Application errors and events # Microsoft-Windows-PowerShell%4Operational.evtx - PowerShell execution # Microsoft-Windows-Sysmon%4Operational.evtx - Sysmon detailed events # Microsoft-Windows-TaskScheduler%4Operational.evtx - Scheduled tasks # Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx - RDP # Collect Linux logs cp /mnt/evidence/var/log/auth.log* /cases/case-2024-001/logs/linux/ cp /mnt/evidence/var/log/syslog* /cases/case-2024-001/logs/linux/ cp /mnt/evidence/var/log/kern.log* /cases/case-2024-001/logs/linux/ cp /mnt/evidence/var/log/secure* /cases/case-2024-001/logs/linux/ cp /mnt/evidence/var/log/audit/audit.log* /cases/case-2024-001/logs/linux/ # Collect web server logs cp /mnt/evidence/var/log/apache2/access.log* /cases/case-2024-001/logs/web/ cp /mnt/evidence/var/log/nginx/access.log* /cases/case-2024-001/logs/web/ # Hash all collected logs for integrity find /cases/case-2024-001/logs/ -type f -exec sha256sum {} \; > /cases/case-2024-001/logs/log_hashes.txt ``` ### Step 2: Parse Windows Event Logs ```bash # Install python-evtx for EVTX parsing pip install python-evtx # Convert EVTX to XML/JSON for analysis python3 -c " import Evtx.Evtx as evtx import json, xml.etree.ElementTree as ET with evtx.Evtx('/cases/case-2024-001/logs/windows/Security.evtx') as log: for record in log.records(): print(record.xml()) " > /cases/case-2024-001/logs/windows/Security_parsed.xml # Using evtxexport (libevtx-utils) sudo apt-get install libevtx-utils evtxexport /cases/case-2024-001/logs/windows/Security.evtx \ > /cases/case-2024-001/logs/windows/Security_exported.txt # Key Security Event IDs to investigate # 4624 - Successful logon # 4625 - Failed logon # 4648 - Logon using explicit credentials (runas, lateral movement) # 4672 - Special privileges assigned (admin logon) # 4688 - Process creation (with command line if auditing enabled) # 4697 - Service installed # 4698/4702 - Scheduled task created/updated # 4720 - User account created # 4732 - Member added to security-enabled local group # 1102 - Audit log cleared # Extract specific events with python-evtx python3 << 'PYEOF' import Evtx.Evtx as evtx import xml.etree.ElementTree as ET target_events = ['4624', '4625', '4648', '4672', '4688', '4697', '1102'] with evtx.Evtx('/cases/case-2024-001/logs/windows/Security.evtx') as log: for record in log.records(): root = ET.fromstring(record.xml()) ns = {'ns': 'http://schemas.microsoft.com/win/2004/08/events/event'} event_id = root.find('.//ns:EventID', ns).text if event_id in target_events: time = root.find('.//ns:TimeCreated', ns).get('SystemTime') print(f"[{time}] EventID: {event_id}") for data in root.findall('.//ns:Data', ns): print(f" {data.get('Name')}: {data.text}") print() PYEOF ``` ### Step 3: Parse and Analyze Linux/Syslog Entries ```bash # Parse auth.log for SSH and sudo events grep -E '(sshd|sudo|su\[|passwd|useradd|usermod)' \ /cases/case-2024-001/logs/linux/auth.log* | \ sort > /cases/case-2024-001/analysis/auth_events.txt # Extract failed SSH login attempts grep 'Failed password' /cases/case-2024-001/logs/linux/auth.log* | \ awk '{print $1,$2,$3,$9,$11}' | sort | uniq -c | sort -rn \ > /cases/case-2024-001/analysis/failed_ssh.txt # Extract successful SSH logins grep 'Accepted' /cases/case-2024-001/logs/linux/auth.log* | \ awk '{print $1,$2,$3,$9,$11}' > /cases/case-2024-001/analysis/successful_ssh.txt # Parse audit logs for file access and command execution ausearch -if /cases/case-2024-001/logs/linux/audit.log \ --start 2024-01-15 --end 2024-01-20 \ -m EXECVE > /cases/case-2024-001/analysis/audit_commands.txt ausearch -if /cases/case-2024-001/logs/linux/audit.log \ -m USER_AUTH,USER_LOGIN,USER_CMD \ > /cases/case-2024-001/analysis/audit_auth.txt # Parse web access logs for suspicious requests cat /cases/case-2024-001/logs/web/access.log* | \ grep -iE '(union.*select| /cases/case-2024-001/analysis/web_attacks.txt # Extract unique IP addresses from web logs awk '{print $1}' /cases/case-2024-001/logs/web/access.log* | \ sort | uniq -c | sort -rn > /cases/case-2024-001/analysis/web_ips.txt ``` ### Step 4: Correlate Events Across Sources ```bash # Normalize timestamps and merge log sources python3 << 'PYEOF' import csv import datetime from collections import defaultdict events = [] # Parse Windows Security events (pre-exported to CSV) with open('/cases/case-2024-001/analysis/windows_events.csv') as f: reader = csv.DictReader(f) for row in reader: events.append({ 'timestamp': row['TimeCreated'], 'source': 'Windows-Security', 'event_id': row['EventID'], 'description': row['Description'], 'details': row.get('Details', '') }) # Parse Linux auth events with open('/cases/case-2024-001/analysis/auth_events.txt') as f: for line in f: parts = line.strip().split() if len(parts) >= 6: events.append({ 'timestamp': ' '.join(parts[:3]), 'source': 'Linux-Auth', 'event_id': parts[4].rstrip(':'), 'description': ' '.join(parts[5:]), 'details': '' }) # Sort by timestamp events.sort(key=lambda x: x['timestamp']) # Write correlated timeline with open('/cases/case-2024-001/analysis/correlated_timeline.csv', 'w', newline='') as f: writer = csv.DictWriter(f, fieldnames=['timestamp', 'source', 'event_id', 'description', 'details']) writer.writeheader() writer.writerows(events) print(f"Total correlated events: {len(events)}") PYEOF # Quick correlation: find events within time windows # Look for lateral movement patterns grep "4648\|4624.*Type.*3\|4624.*Type.*10" /cases/case-2024-001/analysis/windows_events.csv | \ sort > /cases/case-2024-001/analysis/lateral_movement.txt ``` ### Step 5: Generate Forensic Timeline Report ```bash # Create structured investigation report cat << 'REPORT' > /cases/case-2024-001/analysis/log_analysis_report.txt LOG ANALYSIS FORENSIC REPORT ============================= Case: 2024-001 Analyst: [Examiner Name] Date: $(date -u) LOG SOURCES ANALYZED: - Windows Security Event Log (Security.evtx) - 245,678 events - Windows System Event Log (System.evtx) - 45,234 events - Windows PowerShell Operational - 12,456 events - Linux auth.log - 34,567 entries - Apache access.log - 567,890 entries - Linux audit.log - 89,012 entries KEY FINDINGS: 1. Initial Access: [timestamp] - Successful RDP login from external IP 2. Privilege Escalation: [timestamp] - New admin account created 3. Lateral Movement: [timestamp] - Pass-the-hash detected across 3 systems 4. Data Exfiltration: [timestamp] - Large data transfer to external IP 5. Log Tampering: [timestamp] - Security event log cleared (Event 1102) TIMELINE OF EVENTS: [See correlated_timeline.csv for complete chronology] REPORT # Package analysis artifacts tar -czf /cases/case-2024-001/log_analysis_package.tar.gz \ /cases/case-2024-001/analysis/ ``` ## Key Concepts | Concept | Description | |---------|-------------| | Event correlation | Linking related events across multiple log sources by time, IP, user, or session | | Log normalization | Converting diverse log formats into a common schema for unified analysis | | Timeline analysis | Chronological ordering of events to reconstruct incident sequence | | Log integrity | Verifying logs have not been tampered with using hashes and chain of custody | | Logon types | Windows categorization of authentication methods (2=interactive, 3=network, 10=RDP) | | Audit policy | System configuration determining which events are recorded in logs | | Log rotation | Automatic archiving of log files that affects evidence availability | | Anti-forensics | Attacker techniques for clearing or modifying logs to cover tracks | ## Tools & Systems | Tool | Purpose | |------|---------| | python-evtx | Python library for parsing Windows EVTX event log files | | evtxexport | Command-line EVTX export utility from libevtx | | LogParser | Microsoft SQL-like query engine for Windows logs | | ausearch | Linux audit log search utility | | jq | JSON query tool for parsing structured log formats | | ELK Stack | Elasticsearch, Logstash, Kibana for log aggregation and visualization | | Chainsaw | Sigma-based Windows Event Log analysis tool | | Hayabusa | Fast Windows Event Log forensic timeline generator | ## Common Scenarios **Scenario 1: Brute Force Attack Detection** Filter Security.evtx for Event ID 4625 (failed logons), group by source IP and target account, identify patterns of rapid successive failures, find the successful logon (4624) that followed, trace subsequent activity from the compromised account. **Scenario 2: Insider Threat Investigation** Collect all log sources from the suspect's workstation and accessed servers, correlate file access events with authentication events, build timeline of data access during non-business hours, identify data transfers to external media or cloud storage. **Scenario 3: Web Application Compromise** Parse web server access logs for SQLi, XSS, and path traversal patterns, identify the attack IP and timeline, correlate with application logs for successful exploitation, trace post-exploitation activity through system and auth logs. **Scenario 4: Ransomware Incident Timeline** Identify the initial execution through process creation events (4688), trace privilege escalation through service installation (4697), map lateral movement via network logons (4624 Type 3), identify encryption start from file system activity, find the earliest IoC for remediation scoping. ## Output Format ``` Log Analysis Summary: Investigation Period: 2024-01-15 00:00 to 2024-01-20 23:59 UTC Total Events Analyzed: 894,567 Log Sources: 6 (3 Windows, 3 Linux) Critical Events: Failed Logons: 1,234 (from 5 unique IPs) Successful Logons: 456 (3 anomalous) Account Changes: 12 (1 unauthorized admin creation) Process Creations: 8,234 (15 suspicious) Log Clearings: 2 (Security log cleared at 2024-01-18 03:00 UTC) Service Installs: 3 (1 unknown service) Attack Timeline: 2024-01-15 14:32 - Initial access via RDP brute force 2024-01-15 14:45 - Admin account "svcbackup" created 2024-01-16 02:15 - Lateral movement to 3 servers 2024-01-17 03:00 - Data staging in C:\ProgramData\temp\ 2024-01-18 01:30 - 4.2 GB exfiltrated to 185.x.x.x 2024-01-18 03:00 - Security logs cleared Report: /cases/case-2024-001/analysis/log_analysis_report.txt ``` --- Source attribution: mukul975 Original project: https://github.com/mukul975/Anthropic-Cybersecurity-Skills/blob/54a798831d2266a3ca61ce68a7acb80b81160d57/skills/performing-log-analysis-for-forensic-investigation/SKILL.md License: Apache-2.0 License information: https://www.apache.org/licenses/LICENSE-2.0 Original upstream instructions; downloaded from Mega AI Hub. ## Upstream license notice Apache License Version 2.0, January 2004 http://www.apache.org/licenses/ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 1. Definitions. "License" shall mean the terms and conditions for use, reproduction, and distribution as defined by Sections 1 through 9 of this document. "Licensor" shall mean the copyright owner or entity authorized by the copyright owner that is granting the License. "Legal Entity" shall mean the union of the acting entity and all other entities that control, are controlled by, or are under common control with that entity. For the purposes of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity. "You" (or "Your") shall mean an individual or Legal Entity exercising permissions granted by this License. "Source" form shall mean the preferred form for making modifications, including but not limited to software source code, documentation source, and configuration files. "Object" form shall mean any form resulting from mechanical transformation or translation of a Source form, including but not limited to compiled object code, generated documentation, and conversions to other media types. "Work" shall mean the work of authorship, whether in Source or Object form, made available under the License, as indicated by a copyright notice that is included in or attached to the work (an example is provided in the Appendix below). "Derivative Works" shall mean any work, whether in Source or Object form, that is based on (or derived from) the Work and for which the editorial revisions, annotations, elaborations, or other modifications represent, as a whole, an original work of authorship. For the purposes of this License, Derivative Works shall not include works that remain separable from, or merely link (or bind by name) to the interfaces of, the Work and Derivative Works thereof. "Contribution" shall mean any work of authorship, including the original version of the Work and any modifications or additions to that Work or Derivative Works thereof, that is intentionally submitted to the Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner. For the purposes of this definition, "submitted" means any form of electronic, verbal, or written communication sent to the Licensor or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Licensor for the purpose of discussing and improving the Work, but excluding communication that is conspicuously marked or otherwise designated in writing by the copyright owner as "Not a Contribution." "Contributor" shall mean Licensor and any individual or Legal Entity on behalf of whom a Contribution has been received by the Licensor and subsequently incorporated within the Work. 2. Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form. 3. Grant of Patent License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by such Contributor that are necessarily infringed by their Contribution(s) alone or by combination of their Contribution(s) with the Work to which such Contribution(s) was submitted. If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed. 4. Redistribution. You may reproduce and distribute copies of the Work or Derivative Works thereof in any medium, with or without modifications, and in Source or Object form, provided that You meet the following conditions: (a) You must give any other recipients of the Work or Derivative Works a copy of this License; and (b) You must cause any modified files to carry prominent notices stating that You changed the files; and (c) You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works; and (d) If the Work includes a "NOTICE" text file as part of its distribution, then any Derivative Works that You distribute must include a readable copy of the attribution notices contained within such NOTICE file, excluding any notices that do not pertain to any part of the Derivative Works, in at least one of the following places: within a NOTICE text file distributed as part of the Derivative Works; within the Source form or documentation, if provided along with the Derivative Works; or, within a display generated by the Derivative Works, if and wherever such third-party notices normally appear. The contents of the NOTICE file are for informational purposes only and do not modify the License. You may add Your own attribution notices within Derivative Works that You distribute, alongside or as an addendum to the NOTICE text from the Work, provided that such additional attribution notices cannot be construed as modifying the License. You may add Your own copyright statement to Your modifications and may provide additional or different license terms and conditions for use, reproduction, or distribution of Your modifications, or for any such Derivative Works as a whole, provided Your use, reproduction, and distribution of the Work otherwise complies with the conditions stated in this License. 5. Submission of Contributions. Unless You explicitly state otherwise, any Contribution intentionally submitted for inclusion in the Work by You to the Licensor shall be under the terms and conditions of this License, without any additional terms or conditions. Notwithstanding the above, nothing herein shall supersede or modify the terms of any separate license agreement you may have executed with Licensor regarding such Contributions. 6. Trademarks. This License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor, except as required for reasonable and customary use in describing the origin of the Work and reproducing the content of the NOTICE file. 7. Disclaimer of Warranty. Unless required by applicable law or agreed to in writing, Licensor provides the Work (and each Contributor provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness of using or redistributing the Work and assume any risks associated with Your exercise of permissions under this License. 8. Limitation of Liability. In no event and under no legal theory, whether in tort (including negligence), contract, or otherwise, unless required by applicable law (such as deliberate and grossly negligent acts) or agreed to in writing, shall any Contributor be liable to You for damages, including any direct, indirect, special, incidental, or consequential damages of any character arising as a result of this License or out of the use or inability to use the Work (including but not limited to damages for loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses), even if such Contributor has been advised of the possibility of such damages. 9. Accepting Warranty or Additional Liability. While redistributing the Work or Derivative Works thereof, You may choose to offer, and charge a fee for, acceptance of support, warranty, indemnity, or other liability obligations and/or rights consistent with this License. However, in accepting such obligations, You may act only on Your own behalf and on Your sole responsibility, not on behalf of any other Contributor, and only if You agree to indemnify, defend, and hold each Contributor harmless for any liability incurred by, or claims asserted against, such Contributor by reason of your accepting any such warranty or additional liability. END OF TERMS AND CONDITIONS APPENDIX: How to apply the Apache License to your work. To apply the Apache License to your work, attach the following boilerplate notice, with the fields enclosed by brackets "[]" replaced with your own identifying information. (Don't include the brackets!) The text should be enclosed in the appropriate comment syntax for the file format. Please do not remove or change the license header comment from a contributed file except when necessary. Copyright 2026 mukul975 Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. # Mega AI Hub resource metadata Creator / publisher: mukul975 Original project: https://github.com/mukul975/Anthropic-Cybersecurity-Skills/blob/54a798831d2266a3ca61ce68a7acb80b81160d57/skills/performing-log-analysis-for-forensic-investigation/SKILL.md Attribution basis: Source repository record Fields of work: Data & Analytics, Development & Engineering, Operations Roles: Business Process Analyst, Data Analyst, Security Engineer Specialties: Backend, Testing Tools: Elk Stack, Logparser, Python Evtx Country applicability: Country not specified Classification basis: Source catalog labels Instruction SHA-256: 4353c380b5e49d850fafc2f35a549bf3e5b09901c8200bf99b255d5bf5f6f3bd