ADLOG-006: Administrador de suscripciones de reenvío de eventos de Windows (WEF)
- Plataforma
- Active Directory
- Categoría
- AD Logging & EDR Posture
- Severidad
- High
- Pilar de Zero Trust
- Visibility & Analytics (peso 2)
- Fixtures de referencia
- 1
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Los registros que solo existen en el host que los generó son exactamente tan útiles como el disco local de ese host después de que el atacante lo borre. El reenvío de eventos de Windows envía los registros fuera del equipo a un recopilador en el momento de la escritura. Sin una GPO de SubscriptionManager que apunte cada endpoint al recopilador, el WEF no se produce.
Por qué importa
Every modern intrusion playbook ends with the same step: clear or tamper with local event logs to remove the trail. wevtutil cl Security, the Clear-EventLog cmdlet, scripted EventLog.Clear() calls, and direct manipulation of the .evtx file under %SystemRoot%\System32\winevt\Logs all destroy local evidence in seconds, and the act of clearing itself is only recorded in the local Security log as Event ID 1102 (which is then also gone). If those events were forwarded to a WEC server the instant they were written, the attacker is racing the wire and almost always loses. Without WEF, the SOC is one ransomware reboot away from having no telemetry at all for the period that matters. Beyond log clearing, WEF also defeats the now-common ransomware pattern of stopping the EventLog service before encryption begins: the events that fired before the service died have already been pushed. WEF is also the cheapest possible foundation for a meaningful detection program. It is built in, it does not require a per-endpoint agent license, it scales to tens of thousands of forwarders per collector, and it works equally well on workstations, servers, and domain controllers. Microsoft Defender for Identity, Microsoft Sentinel, Splunk Universal Forwarder, Elastic Winlogbeat, and every major SIEM ingest from a WEC collector or from the Forwarded Events channel directly. Skipping the SubscriptionManager GPO is the single most expensive defensive omission in a typical AD estate, because every other detection investment downstream (Sysmon, PowerShell ScriptBlock logging, command-line auditing, AD object auditing) produces events that never leave the box.
Ruta de ataque
1. Attacker gains code execution on a domain-joined host through phishing, password spray, or an unpatched edge service. 2. Before any noisy action, the attacker enumerates the local logging posture: reg query HKLM\Software\Policies\Microsoft\Windows\EventLog\EventForwarding\SubscriptionManager, sc query Wecsvc, sc query WinRM, and Get-WinEvent -ListLog * | Where-Object IsEnabled. If SubscriptionManager is empty or the WinRM service is stopped, the attacker knows the local Security and PowerShell logs are the entire telemetry surface. 3. Attacker runs reconnaissance that would normally generate high-signal events on the wire: SharpHound, BloodHound collection, Rubeus, certipy. With no WEF, the events land in local %SystemRoot%\System32\winevt\Logs\Security.evtx and stay there. 4. After the objective is met (DCSync, Golden Ticket, ransomware staging), the attacker clears the local logs: wevtutil cl Security, wevtutil cl Microsoft-Windows-PowerShell/Operational, wevtutil cl System. Each clear writes one Event ID 1102 to the cleared log and is then itself erased on the next clear of that channel. 5. Where WEF is configured but mis-scoped (for example, only domain controllers forward), the attacker pivots specifically to the un-forwarded tier and operates from there. The "Configure target Subscription Manager" GPO not being linked to the workstation OU is the most common version of this gap in practice. 6. On the collector side, attackers with privileged access sometimes target the WEC server itself: stopping the Wecsvc service, deleting the ForwardedEvents channel, or disabling subscriptions via wecutil ds. ADLOG-006 detects the upstream condition that makes those late-stage actions unnecessary in the first place.
Cómo lo evalúa Guerrilla
Guerrilla reads the policy registry hive on each in-scope computer via remote registry or WinRM Invoke-Command. It enumerates HKLM\Software\Policies\Microsoft\Windows\EventLog\EventForwarding\SubscriptionManager and parses each value into its Server, Refresh, IssuerCA, and ClientCertificate components. It then resolves the collector hostname, opens a TCP connection to port 5985 (or 5986 for HTTPS subscriptions), and issues a WS-Management Identify request to confirm the collector responds. Service state is read with Get-Service WinRM,Wecsvc, and local group membership of Event Log Readers is enumerated with Get-LocalGroupMember. Where the check is run against the WEC server itself, wecutil enum-subscription and wecutil get-subscription /f:xml are parsed to inventory active subscriptions, their xpath queries, and the target channel. The check distinguishes three failure modes: SubscriptionManager unset (the GPO was never applied), SubscriptionManager set but collector unreachable (DNS or network failure), and SubscriptionManager set and collector reachable but no subscriptions match the forwarder (the collector is up but is not asking for any events). Guerrilla emits the offending OU, the computer DN, the registry value observed, the WinRM service state, and the reachability of each configured collector.
Valor recomendado
La directiva de grupo 'Configurar el administrador de suscripciones de destino' está establecida en estaciones de trabajo y servidores para apuntar al recopilador WEF.
Remediación
Configuración del equipo > Directivas > Plantillas administrativas > Componentes de Windows > Reenvío de eventos > 'Configurar el administrador de suscripciones de destino' = Habilitado. Valor: Server=http://wec-server.domain.tld:5985/wsman/SubscriptionManager/WEC,Refresh=60. Configura las suscripciones en el recopilador con consultas xpath para los eventos que te interesan (4624, 4625, 4688, 4768, 4769, 4104, 1102, etc.). Si no tienes un recopilador WEF, este es el proyecto por el que empezar; casi siempre es más económico que un despliegue completo de agente SIEM para la misma telemetría.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| always-warn | WARN |
Mapeos a marcos de referencia
- NIST SP 800-53
- AU-4, AU-6
- CIS AD Benchmark
- 9.4.1
- MITRE ATT&CK
- T1070.001