# LogonTracer | Investigate Malicious Windows Logon By Visualizing & Analyzing Windows Event Log

**URL:** <https://onehack.st/t/logontracer-investigate-malicious-windows-logon-by-visualizing-analyzing-windows-event-log/85376>\
**Category:** Tools & Scripts\
**Tags:** tools\
**Created:** [May 9, 2020, 1:28pm UTC](https://onehack.st/t/logontracer-investigate-malicious-windows-logon-by-visualizing-analyzing-windows-event-log/85376 "2020-05-09T13:28:17Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![BlueHacker](https://onehack.st/user_avatar/onehack.st/bluehacker/32/174721_2.png) [@BlueHacker](https://onehack.st/u/BlueHacker)\
**Post date:** [May 9, 2020, 1:28pm UTC](https://onehack.st/t/logontracer-investigate-malicious-windows-logon-by-visualizing-analyzing-windows-event-log/85376/1 "2020-05-09T13:28:18Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/a/c/ac21f1317a061facb4c37f9aac5f26c14532052c.png)

Many computer infect with Trojan or RAT, attacker can spy victim computer, grab any data, put keylogger and do something horrible on your computer. LogonTracer maybe can help a little bit, this tool will analyze/detect windows logon and automatically create a visual report, and if malicious logon detect you can see the report.

## **Concept**

**LogonTracer** is a tool to [investigate malicious logon](https://xploitlab.com/logontracer-investigate-malicious-windows-logon/) by visualizing and analyzing Windows Active Directory event logs. This tool associates a host name (or an IP address) and account name found in logon-related events and displays it as a graph. This way, it is possible to see in which account login attempt occurs and which host is used.  
This tool can visualize the following event id related to Windows logon based on [this research](https://www.first.org/resources/papers/conf2016/FIRST-2016-105.pdf).

- **4624** : Successful logon
- **4625** : Logon failure
- **4768** : Kerberos Authentication (TGT Request)
- **4769** : Kerberos Service Ticket (ST Request)
- **4776** : NTLM Authentication
- **4672** : Assign special privileges

More details are described in the following documents :

- [Visualise Event Logs to Identify Compromised Accounts – LogonTracer –](http://blog.jpcert.or.jp/2017/11/visualise-event-logs-to-identify-compromised-accounts---logontracer-.html)
- [イベントログを可視化して不正使用されたアカウントを調査](https://www.jpcert.or.jp/magazine/acreport-logontracer.html) (Japanese)

 ![image](https://onehack.st/uploads/default/original/3X/7/9/794601a0fa5e06b8d25b6c6f2c2b27572cd31bae.png)

## **Additional Analysis**

LogonTracer uses [PageRank](https://en.wikipedia.org/wiki/PageRank), [Hidden Markov model](https://en.wikipedia.org/wiki/Hidden_Markov_model) and [ChangeFinder](https://pdfs.semanticscholar.org/c5bc/7ca31914d3cdfe1b2932cbc779875e645bbb.pdf) to detect malicious hosts and accounts from event log.

![LogonTracer Users Investigate malicious Windows logon by visualizing and analyzing Windows event log](https://xploitlab.com/wp-content/uploads/2019/07/LogonTracer-Users-Investigate-malicious-Windows-logon-by-visualizing-and-analyzing-Windows-event-log.png)

With LogonTracer, it is also possible to display event logs in a chronological order.

 ![image](https://onehack.st/uploads/default/original/3X/b/e/be972a20747ec6795daf62d6f39f9e6981a98d0c.png)

## **Use LogonTracer**

To use LogonTracer, you can :

- [Install](https://github.com/JPCERTCC/LogonTracer/wiki/how-to-install)
- [Use docker](https://github.com/JPCERTCC/LogonTracer/wiki/jump-start-with-docker)

## **Documentation**

If you want to know more details, please check [the LogonTracer wiki](https://github.com/JPCERTCC/LogonTracer/wiki).

## **Demonstration**

Following [YouTube’s video](https://www.youtube.com/watch?v=aX-vTd7-moY) shows how to use LogonTracer.

## **Architecture**

LogonTracer is written in Python and uses Neo4j for database. The following tools are used.

- Python 3
- [Neo4j](https://neo4j.com/) for a graph database.
- [Neo4j JavaScript driver](https://github.com/neo4j/neo4j-javascript-driver) for connects to Neo4j using the binary protocol.
- [Cytoscape](http://www.cytoscape.org/) for visualizing a graph network.
- [Flask](http://flask.pocoo.org/) is a microframework for Python.

## GitHub:

> **[GitHub - JPCERTCC/LogonTracer: Investigate malicious Windows logon by visualizing...](https://github.com/JPCERTCC/LogonTracer)**
>
> Investigate malicious Windows logon by visualizing and analyzing Windows event log