Full Report
See how the Huntress Tactical Response team tackles security telemetry gaps. We share real-world techniques for working with missing logs, degraded telemetry, and cloud logging challenges to uncover critical insights and improve investigations.
Analysis Summary
# Best Practices: Managing Imperfect Security Telemetry
## Overview
These practices address the critical challenge of investigating security incidents when logs are missing, audit policies have been tampered with, or telemetry is degraded. They focus on alternative data sourcing and human-centric investigation techniques to bypass technical "blind spots."
## Key Recommendations
### Immediate Actions
1. **Verify Audit Policy Integrity:** Check if critical Windows Event IDs (e.g., 4624 for logons, 4688 for process creation) are currently being recorded. If logs stop abruptly, treat the silence as a high-priority indicator of potential tampering.
2. **Pivot to Secondary Log Sources:** If primary authentication logs (4624) are missing, immediately check NTLM credential validation logs (Event ID 4776) or service installation logs (Event ID 7045).
3. **Internal Communication:** Contact on-site IT staff or partners to verify if recent maintenance, legitimate software deployments, or known RMM (Remote Monitoring and Management) activities explain the telemetry gaps.
### Short-term Improvements (1-3 months)
1. **Implement EDR/ITDR Correlation:** Integrate Endpoint Detection and Response (EDR) with Identity Threat Detection and Response (ITDR) to link endpoint compromises to cloud identity shifts, filling gaps where local logs may be deleted.
2. **Standardize Audit Logging GPO:** Deploy a Group Policy Object (GPO) that enforces "Advanced Audit Policy Configuration" to ensure consistent logging across all workstations and servers, preventing "forgotten" legacy systems from lacking telemetry.
3. **External ASN Monitoring:** Start tracking Autonomous System Numbers (ASNs) for all remote connections to identify logins originating from high-risk or non-standard hosting providers.
### Long-term Strategy (3+ months)
1. **Centralized Log Aggregation (SIEM/Data Lake):** Move away from local-only log storage. Ensure logs are shipped in real-time to a central repository to prevent attackers from clearing their tracks by deleting local Event Viewer entries.
2. **Telemetry Gap Analysis:** Conduct regular "fire drills" where a system's logs are intentionally ignored to see if secondary artifacts (DNS cache, active network connections, shimcache) can still provide a cohesive story of an attack.
## Implementation Guidance
### For Small Organizations
- **Focus on Defaults:** Ensure basic Windows logging is enabled and check the "System" and "Security" logs manually during suspicious events.
- **Leverage Free Tools:** Use built-in Windows tools like `netstat` and `ipconfig /displaydns` to capture volatile network data before a reboot.
### For Medium Organizations
- **Centralized Management:** Use RMM or GPO to push standardized logging configurations to all assets.
- **Credential Hygiene:** Audit for plain-text passwords in scripts or configuration files, as these are often used by attackers when telemetry is low.
### For Large Enterprises
- **Behavioral Correlation:** Use automated tools to link cloud identity (Entra ID/Azure) logs with physical endpoint activity.
- **Advanced Hunting:** Use ASN filtering to flag logins from VPS providers (e.g., DigitalOcean, Linode) that bypass traditional geographic geofencing.
## Configuration Examples
### Windows Advanced Audit Policy
To ensure lateral movement is captured even if one log type fails, enable:
- **Audit Logon:** Success & Failure
- **Audit Special Logon:** Success
- **Audit Process Creation:** Include Command Line (Event ID 4688)
- **Audit Account Management:** To catch unauthorized user creation (Event ID 4720)
## Compliance Alignment
- **NIST SP 800-53:** AU Control Family (Audit and Accountability).
- **CIS Controls:** Control 8 (Audit Log Management).
- **ISO/IEC 27001:** Annex A.12.4 (Logging and Monitoring).
## Common Pitfalls to Avoid
- **Assuming "No Logs" means "No Breach":** Attackers frequently disable logging (e.g., `wevtutil cl security`) as a first step.
- **Ignoring Legacy Systems:** "The server under the desk" is often the weakest link and lacks the telemetry present on modern systems.
- **Over-reliance on Single Artifacts:** Never rely solely on Event ID 4624; always cross-reference with 4776, 4672 (Superuser logons), and network connections.
## Resources
- **Huntress Blog (Intrusion Analysis Methodology):** hxxps[:]//www[.]huntress[.]com/blog/intrusion-analysis-methodology
- **Microsoft Documentation (Audit Policy):** learn[.]microsoft[.]com/en-us/windows/security/threat-protection/auditing/advanced-security-audit-policy-settings
- **MITRE ATT&CK (Indicator Removal on Host):** attack[.]mitre[.]org/techniques/T1070/