[logs] Windows Security Event 538 analysis/paper

Previous message: todd glassey: "Re: [logs] NTP Client?"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

rgerhardsat_private

Hi all,

we are trying to base some log analysis on Windows security event 538.
Unfortunately, there seem to be some shortcomings with it. My co-worker
Wajih has done a paper on that event and its shortcomings. We would
appreciate any feedback on this paper. I have also posted a similar
question to the respective Microsoft peer help newsgroup.

The URL is:

http://www.monitorware.com/Common/en/SecurityReference/Event-ID-538-Expl
ained.asp

This is a long URL which may be broken by the news client. It should end
in ".asp". If it doesn't, please reassemble it before pasting to the web
browser.

Any help is appreciated. Of course, I will post a summary of any updates
we (hopefully) receive ;)

Thanks
Rainer Gerhards

_______________________________________________
LogAnalysis mailing list
LogAnalysisat_private
http://lists.shmoo.com/mailman/listinfo/loganalysis