ADLOG-006: Windows Event Forwarding (WEF) Subscription Manager
- Platform
- Active Directory
- Category
- AD Logging & EDR Posture
- Severity
- High
- Zero Trust pillar
- Visibility & Analytics (weight 2)
- Golden fixtures
- 1
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
Guerrilla resolves the effective value of the policy registry keys that the "Configure target Subscription Manager" GPO writes, and the runtime state of the Windows Remote Management (WinRM) and Windows Event Collector services that source-initiated WEF depends on. The specific evaluation surface includes: - HKLM\Software\Policies\Microsoft\Windows\EventLog\EventForwarding\SubscriptionManager : ordered REG_SZ values pointing at one or more collector URIs, each in the form Server=http://wec.fqdn:5985/wsman/SubscriptionManager/WEC,Refresh=60. - HKLM\Software\Policies\Microsoft\Windows\WinRM\Client : AllowBasic, AllowUnencryptedTraffic, TrustedHosts where source-initiated WEF over HTTPS or with non-default authentication is in use. - The WinRM and Wecsvc service start type and current state on each forwarder (Wecsvc only runs on the collector, WinRM must be Running on every forwarder). - The Network Service account membership in the local Event Log Readers group on every forwarder (required by source-initiated WEF so the forwarding client can read the channels it ships). - The collector subscription configuration (wecutil enum-subscription / get-subscription) is read where the collector is reachable, and each subscription is parsed for its xpath query, target Event Channel, and configuration mode (Normal vs MinLatency vs MinBandwidth). The check fails when the SubscriptionManager value is absent or empty on any in-scope OU, when WinRM is Disabled or Stopped, when Network Service is missing from Event Log Readers, or when the configured collector URI does not resolve or refuses TCP 5985 / 5986.
Why it matters
Every modern intrusion playbook ends with the same step: clear or tamper with local event logs to remove the trail. wevtutil cl Security, the Clear-EventLog cmdlet, scripted EventLog.Clear() calls, and direct manipulation of the .evtx file under %SystemRoot%\System32\winevt\Logs all destroy local evidence in seconds, and the act of clearing itself is only recorded in the local Security log as Event ID 1102 (which is then also gone). If those events were forwarded to a WEC server the instant they were written, the attacker is racing the wire and almost always loses. Without WEF, the SOC is one ransomware reboot away from having no telemetry at all for the period that matters. Beyond log clearing, WEF also defeats the now-common ransomware pattern of stopping the EventLog service before encryption begins: the events that fired before the service died have already been pushed. WEF is also the cheapest possible foundation for a meaningful detection program. It is built in, it does not require a per-endpoint agent license, it scales to tens of thousands of forwarders per collector, and it works equally well on workstations, servers, and domain controllers. Microsoft Defender for Identity, Microsoft Sentinel, Splunk Universal Forwarder, Elastic Winlogbeat, and every major SIEM ingest from a WEC collector or from the Forwarded Events channel directly. Skipping the SubscriptionManager GPO is the single most expensive defensive omission in a typical AD estate, because every other detection investment downstream (Sysmon, PowerShell ScriptBlock logging, command-line auditing, AD object auditing) produces events that never leave the box.
Attack path
1. Attacker gains code execution on a domain-joined host through phishing, password spray, or an unpatched edge service. 2. Before any noisy action, the attacker enumerates the local logging posture: reg query HKLM\Software\Policies\Microsoft\Windows\EventLog\EventForwarding\SubscriptionManager, sc query Wecsvc, sc query WinRM, and Get-WinEvent -ListLog * | Where-Object IsEnabled. If SubscriptionManager is empty or the WinRM service is stopped, the attacker knows the local Security and PowerShell logs are the entire telemetry surface. 3. Attacker runs reconnaissance that would normally generate high-signal events on the wire: SharpHound, BloodHound collection, Rubeus, certipy. With no WEF, the events land in local %SystemRoot%\System32\winevt\Logs\Security.evtx and stay there. 4. After the objective is met (DCSync, Golden Ticket, ransomware staging), the attacker clears the local logs: wevtutil cl Security, wevtutil cl Microsoft-Windows-PowerShell/Operational, wevtutil cl System. Each clear writes one Event ID 1102 to the cleared log and is then itself erased on the next clear of that channel. 5. Where WEF is configured but mis-scoped (for example, only domain controllers forward), the attacker pivots specifically to the un-forwarded tier and operates from there. The "Configure target Subscription Manager" GPO not being linked to the workstation OU is the most common version of this gap in practice. 6. On the collector side, attackers with privileged access sometimes target the WEC server itself: stopping the Wecsvc service, deleting the ForwardedEvents channel, or disabling subscriptions via wecutil ds. ADLOG-006 detects the upstream condition that makes those late-stage actions unnecessary in the first place.
How Guerrilla assesses it
Guerrilla reads the policy registry hive on each in-scope computer via remote registry or WinRM Invoke-Command. It enumerates HKLM\Software\Policies\Microsoft\Windows\EventLog\EventForwarding\SubscriptionManager and parses each value into its Server, Refresh, IssuerCA, and ClientCertificate components. It then resolves the collector hostname, opens a TCP connection to port 5985 (or 5986 for HTTPS subscriptions), and issues a WS-Management Identify request to confirm the collector responds. Service state is read with Get-Service WinRM,Wecsvc, and local group membership of Event Log Readers is enumerated with Get-LocalGroupMember. Where the check is run against the WEC server itself, wecutil enum-subscription and wecutil get-subscription /f:xml are parsed to inventory active subscriptions, their xpath queries, and the target channel. The check distinguishes three failure modes: SubscriptionManager unset (the GPO was never applied), SubscriptionManager set but collector unreachable (DNS or network failure), and SubscriptionManager set and collector reachable but no subscriptions match the forwarder (the collector is up but is not asking for any events). Guerrilla emits the offending OU, the computer DN, the registry value observed, the WinRM service state, and the reachability of each configured collector.
Recommended value
Group Policy 'Configure target Subscription Manager' is set on workstations and servers to point at the WEF collector.
Remediation
Computer Configuration > Policies > Administrative Templates > Windows Components > Event Forwarding > 'Configure target Subscription Manager' = Enabled. Value: Server=http://wec-server.domain.tld:5985/wsman/SubscriptionManager/WEC,Refresh=60. Configure subscriptions on the collector with xpath queries for the events you care about (4624, 4625, 4688, 4768, 4769, 4104, 1102, etc.). If you don't have a WEF collector, this is the project to start; it's almost always cheaper than a full SIEM agent rollout for the same telemetry.
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| always-warn | WARN |
Framework mappings
- NIST SP 800-53
- AU-4, AU-6
- CIS AD Benchmark
- 9.4.1
- MITRE ATT&CK
- T1070.001