MCADDF

[COLLECT-AUDIT-001]: Audit Log Comprehensive Collection

1. METADATA HEADER

Attribute Details
Technique ID COLLECT-AUDIT-001
MITRE ATT&CK v18.1 T1552.001 - Credentials in Files
Tactic Collection
Platforms Multi-Env (Windows AD, Azure, M365, Entra ID, Hybrid)
Severity Critical
CVE N/A
Technique Status ACTIVE
Last Verified 2026-01-10
Affected Versions Windows Server 2016-2025, Azure all versions, M365 all tenants
Patched In N/A (Operational Feature)
Author SERVTEP – Artur Pchelnikau

2. EXECUTIVE SUMMARY

Concept: Audit logs are comprehensive records of security-relevant activities across Microsoft environments: Windows Event Log (on-premises), Azure Activity Log (cloud infrastructure), M365 Unified Audit Log (collaboration and mail), and Entra ID/Azure AD Sign-in Logs (authentication events). These logs contain timestamped records of user actions, administrative changes, system events, and security anomalies. Comprehensive collection and analysis of audit logs reveals: (1) user access patterns and privilege escalation chains, (2) administrative configuration changes (often indicators of persistence mechanisms), (3) failed authentication attempts (brute force indicators), (4) sensitive data access and exfiltration events, (5) policy violations and compliance failures. An attacker with comprehensive audit log access can understand exactly what the organization has observed, what went undetected, and how to refine their attack techniques. Organizations with audit logging disabled or with short retention periods are unable to investigate historical breaches, making audit log collection critical for post-compromise threat hunting.

Attack Surface: Windows Event Viewer, Azure Activity Log API, Microsoft Purview Compliance Portal (M365 Unified Audit Log), Entra ID Sign-in Logs, Azure Monitor Log Analytics workspace, third-party SIEM ingestion points.

Business Impact: Complete visibility into security events, administrative actions, user behavior patterns, and forensic evidence for all breaches. Audit logs contain: (1) evidence of initial compromise (failed login attempts before successful breach), (2) administrative account misuse (privilege escalation), (3) data exfiltration indicators (bulk downloads, email forwards), (4) account creation/deletion events (backdoor accounts), (5) policy modifications (disabling MFA, Conditional Access rules). Loss of audit logs due to short retention or deletion during incident response prevents forensic investigation, blocks threat intelligence gathering, and eliminates legal evidence for breach notification and litigation.

Technical Context: Audit logs are available in all Microsoft environments by default (some require explicit enablement). Retention varies: Windows Event Log (default 7-30 days), Azure Activity (90 days default, up to 12 years with policy), M365 Unified Audit (90 days default, up to 10 years with Advanced Audit). Querying audit logs requires minimal permissions (Security Reader, Audit log viewer). Exfiltration requires simple export via portal or API. No special tools required.

Operational Risk

Compliance Mappings

Framework Control / ID Description
CIS Benchmark 6.2 Configure log retention to preserve logs for adequate period
DISA STIG AU-2 Audit Events – Determine auditable events (all security-relevant events)
CISA SCuBA Log.1.1 Ensure audit logging is enabled and retention is set appropriately
NIST 800-53 AU-2, AU-3, AU-12 Audit and Accountability – Log events, retention, and protection
GDPR Art. 5(1)(f), Art. 32 Data Protection – Integrity and confidentiality of logs
DORA Art. 19 Incident handling and response – Evidence preservation
NIS2 Art. 21 Cybersecurity Risk Management – Logging and monitoring
ISO 27001 A.12.4.1 Recording user activities and system events (audit logs)
ISO 27005 8.3 Risk Assessment – Audit logs as forensic evidence

3. TECHNICAL PREREQUISITES

Supported Versions:

Tools:

4. ENVIRONMENTAL RECONNAISSANCE

Management Station / PowerShell Reconnaissance

# Check if audit logging is enabled on local Windows system
Get-EventLog -LogName Security -Newest 1 -ErrorAction SilentlyContinue | Select-Object TimeGenerated, EventID

# Check if Windows audit policy is configured
auditpol /get /category:*

# Check Azure audit log availability
Connect-AzAccount
Get-AzActivityLog -MaxRecord 1

# Check M365 audit log availability
Connect-ExchangeOnline
Search-UnifiedAuditLog -ResultSize 1

What to Look For:

Version Note: Commands work identically across all Windows versions and Azure regions.

5. DETAILED EXECUTION METHODS AND THEIR STEPS

METHOD 1: Export Windows Event Logs via Event Viewer GUI

Supported Versions: Server 2016-2025 (all versions)

Step 1: Open Event Viewer and Select Security Log

Command:

  1. Press Win + R, type eventvwr.msc, press Enter
  2. Navigate to Windows Logs → Security (left sidebar)
  3. Right-click Security → Save All Events As…

Expected Output:

OpSec & Evasion:

Step 2: Export All Events to .EVTX File

Command:

  1. In Event Viewer, right-click Security log
  2. Click Save All Events As…
  3. Select location: C:\temp\Security_Logs.evtx
  4. Click Save

Expected Output:

What This Means:

OpSec & Evasion:

Step 3: Parse and Analyze Events with PowerShell

Command:

# Load the exported .evtx file
$events = Get-WinEvent -Path "C:\temp\Security_Logs.evtx" -MaxEvents 10000

# Filter for logon events (EventID 4624)
$logonEvents = $events | Where-Object {$_.Id -eq 4624}

# Filter for process creation (EventID 4688)
$processEvents = $events | Where-Object {$_.Id -eq 4688}

# Filter for account lockouts (EventID 4740)
$lockoutEvents = $events | Where-Object {$_.Id -eq 4740}

# Export filtered events to CSV
$logonEvents | Select-Object TimeCreated, @{n='EventID';e={$_.Id}}, @{n='Message';e={$_.Message}} | Export-Csv -Path "C:\temp\logon_events.csv"

Write-Host "Extracted $($logonEvents.Count) logon events"
Write-Host "Extracted $($processEvents.Count) process creation events"
Write-Host "Extracted $($lockoutEvents.Count) account lockout events"

Expected Output:

Extracted 15234 logon events
Extracted 8976 process creation events
Extracted 342 account lockout events

What This Means:

OpSec & Evasion:

References & Proofs:

METHOD 2: Export Azure Activity Logs via Azure Portal

Supported Versions: All Azure subscriptions and regions

Step 1: Navigate to Azure Monitor Activity Log

Command:

  1. Go to https://portal.azure.com
  2. Search for “Activity Log” in top search bar
  3. Select Activity Log from results

Expected Output:

What This Means:

OpSec & Evasion:

Step 2: Apply Filters to Target Specific Operations

Command:

  1. In Activity Log view, click “Add filter”
  2. Filter by Operation, select relevant operations:
    • “Create access review”
    • “Modify role assignment”
    • “Delete key vault”
    • “Create VM”
  3. Filter by Status: Select “Failed” to find attack attempts
  4. Filter by Time Range: Select 30 days (or maximum available)
  5. Click Apply

Expected Output:

What This Means:

OpSec & Evasion:

Step 3: Export Activity Log Events to CSV

Command:

  1. In filtered Activity Log view, click “Export to CSV”
  2. Select “Download”
  3. File downloads as activity-log-export.csv to Downloads folder

Expected Output:

Time,Subscription,Operation,Status,Resource,Resource Group,Caller,Request Size,Caller IP Address
2026-01-09T14:32:15Z,mysubscription,Microsoft.Authorization/roleAssignments/write,Succeeded,myresourcegroup,myresourcegroup,user@company.com,1234,203.0.113.45
2026-01-09T13:22:08Z,mysubscription,Microsoft.Storage/storageAccounts/delete,Failed,mystorageaccount,myresourcegroup,admin@company.com,567,203.0.113.46

What This Means:

OpSec & Evasion:

References & Proofs:

METHOD 3: Export M365 Unified Audit Log via Purview

Supported Versions: All M365 tenants with audit enabled (90 days default, 10 years with Advanced Audit)

Step 1: Connect to Purview and Verify Audit Log is Enabled

Command:

  1. Navigate to https://compliance.microsoft.com (Microsoft Purview)
  2. Go to Audit (left sidebar)
  3. If audit log is not enabled, click “Start recording user and admin activity”

Expected Output:

OpSec & Evasion:

Step 2: Search Audit Log for Specific Events

Command:

  1. In Purview Audit page, click “Search”
  2. Set Date range: Last 90 days (or maximum available)
  3. Under Activities, select relevant activities:
    • “Delete mailbox”
    • “Add-MailForwardingAddress” (email forwarding)
    • “Update user”
    • “Modify role assignment”
    • “Download Microsoft 365 data”
  4. Optional: Filter by Users (target accounts)
  5. Optional: Filter by File, folder, or site (data exfiltration targets)
  6. Click Search

Expected Output:

Activity: Add-MailForwardingAddress
User: admin@company.com
Date: 2026-01-09
Time: 14:32:15
Details: Forward emails from user@company.com to attacker@external-domain.com
Result IP: 203.0.113.45

What This Means:

OpSec & Evasion:

Step 3: Export Audit Log Results to CSV

Command:

  1. After search results display, click “Export” → “Download all results”
  2. File downloads as AuditLog_yyyy-mm-dd.csv

Expected Output:

CreationDate,UserIds,Operations,AuditData
2026-01-09T14:32:15Z,admin@company.com,Add-MailForwardingAddress,"{'Id':'xxxxxxxx','Item':{'Subject':'','Identity':'user@company.com'},'ModifiedProperties':{'Name':'ForwardingAddress','NewValue':'attacker@external.com'}}"

What This Means:

OpSec & Evasion:

References & Proofs:

METHOD 4: Query Audit Logs Programmatically via PowerShell

Supported Versions: All environments (Windows, Azure, M365)

Step 1: Connect to M365 and Extract Audit Logs

Command (M365 Unified Audit Log - no API available, PowerShell only):

# Connect to Exchange Online PowerShell (M365 Audit)
Connect-ExchangeOnline -UserPrincipalName "user@company.com"

# Search Unified Audit Log for last 90 days
$startDate = (Get-Date).AddDays(-90)
$endDate = Get-Date

$auditEvents = Search-UnifiedAuditLog -StartDate $startDate -EndDate $endDate -ResultSize 50000

# Filter for suspicious activities
$suspiciousEvents = $auditEvents | Where-Object {
    $_.Operations -in @(
        "Delete",
        "Update-InboxRules",
        "Add-MailForwardingAddress",
        "Set-Mailbox",
        "New-ExternalUser",
        "New-ApplicationAccessPolicy"
    )
}

# Export to CSV
$suspiciousEvents | Select-Object CreationDate, UserId, Operations, @{n='Details';e={$_.AuditData | ConvertFrom-Json}} | Export-Csv -Path "C:\temp\m365_audit_suspicious.csv" -NoTypeInformation

Write-Host "Extracted $($suspiciousEvents.Count) suspicious events from M365 Audit Log"

Expected Output:

Extracted 342 suspicious events from M365 Audit Log

What This Means:

OpSec & Evasion:

Step 2: Query Azure Activity Logs via Azure CLI

Command (Azure Activity Logs - programmatic access):

#!/bin/bash
# Connect to Azure
az login

# Query Activity Log for last 30 days
RESOURCE_GROUP="your-resource-group"
START_DATE=$(date -d '30 days ago' -u +%Y-%m-%dT%H:%M:%SZ)
END_DATE=$(date -u +%Y-%m-%dT%H:%M:%SZ)

# Export all activity logs
az monitor activity-log list \
  --resource-group $RESOURCE_GROUP \
  --start-time $START_DATE \
  --end-time $END_DATE \
  --query "[*].{Time:eventTimestamp, Operation:operationName, Caller:caller, Status:status}" \
  --output csv > /tmp/azure_activity.csv

echo "Activity logs exported to /tmp/azure_activity.csv"

Expected Output:

Time,Operation,Caller,Status
2026-01-09T14:32:15Z,Microsoft.Authorization/roleAssignments/write,user@company.com,Succeeded
2026-01-09T13:22:08Z,Microsoft.Compute/virtualMachines/delete,admin@company.com,Succeeded

OpSec & Evasion:

Step 3: Query Windows Event Logs Remotely via PowerShell Remoting

Command (Windows Event Logs - remote collection):

# Connect to remote server
$server = "SERVER-PROD-01"
Invoke-Command -ComputerName $server -ScriptBlock {
    # Export Security event log
    wevtutil epl Security "C:\temp\Security.evtx"
    
    # Get count of events
    Get-WinEvent -LogName Security -MaxEvents 1 | Select-Object RecordCount
}

# Copy exported file back to local machine
Copy-Item -Path "\\$server\C$\temp\Security.evtx" -Destination "C:\incident\Security.evtx"

Write-Host "Security event log exported from $server"

Expected Output:

What This Means:

OpSec & Evasion:

References & Proofs:

7. TOOLS & COMMANDS REFERENCE

Event Viewer (eventvwr.msc)

Version: Built-in (all Windows versions) Platforms: Windows Server 2016-2025, Windows 10-11

Usage:

# Open Event Viewer GUI
eventvwr.msc

# Or: Export logs via command line
wevtutil epl Security "C:\temp\Security.evtx"

# Query logs with PowerShell
Get-WinEvent -LogName Security -FilterXPath "*[System[(EventID=4624)]]" -MaxEvents 100

Search-UnifiedAuditLog (PowerShell)

Version: Part of Exchange Online PowerShell module v2.x Platforms: Windows, macOS, Linux (PowerShell 7+)

Installation:

Install-Module ExchangeOnlineManagement -Force
Connect-ExchangeOnline

Usage:

$results = Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-90) -EndDate (Get-Date) -ResultSize 5000
$results | Select-Object CreationDate, UserId, Operations | Export-Csv "audit.csv"

Azure CLI (az monitor activity-log)

Version: 2.50+ (current) Platforms: Windows, macOS, Linux

Installation:

# macOS
brew install azure-cli

# Linux (Ubuntu/Debian)
curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash

# Windows (PowerShell)
Invoke-WebRequest -Uri https://aka.ms/installazurecliwindows -OutFile AzureCLI.msi
Start-Process msiexec.exe -Wait -ArgumentList '/I AzureCLI.msi /quiet'

Usage:

az login
az monitor activity-log list --start-time 2026-01-01 --end-time 2026-01-10 --output json > activity_log.json

9. MICROSOFT SENTINEL DETECTION

Query 1: Bulk Export of Audit Logs

Rule Configuration:

KQL Query:

AuditLogs
| where OperationName == "Search-UnifiedAuditLog" or OperationName == "Export audit log"
| where Result == "Success"
| summarize ExportCount = count(), TotalRecords = sum(ResultCount) by UserPrincipalName, IpAddress
| where ExportCount > 3 // Multiple exports by same user = suspicious
| project UserPrincipalName, IpAddress, ExportCount, TotalRecords

What This Detects:

Manual Configuration (Azure Portal):

  1. Microsoft Sentinel → Analytics → + Create → Scheduled query rule
  2. Set name: Audit_Log_Bulk_Export_Detection
  3. Paste KQL query above
  4. Run every: 10 minutes
  5. Alert threshold: > 0 results
  6. Create rule

10. WINDOWS EVENT LOG MONITORING

Event IDs to Monitor:

Manual Configuration (Group Policy):

  1. Open Group Policy Management (gpmc.msc)
  2. Navigate to Computer Configuration → Policies → Windows Settings → Security Settings → Audit Policy
  3. Enable:
    • “Audit account logon events” (Success and Failure)
    • “Audit account management” (Success)
    • “Audit logon events” (Success and Failure)
    • “Audit object access” (Success and Failure)
  4. Run gpupdate /force and restart

13. DEFENSIVE MITIGATIONS

Priority 1: CRITICAL

Priority 2: HIGH

Validation Command (Verify Fix)

# Verify audit log retention is set to maximum
Get-UnifiedAuditLogRetentionPolicy | Select-Object Name, RetentionDays

# Expected: > 2000 days (5+ years minimum)

# Verify only Security group can access Event Viewer logs
Get-Acl "C:\Windows\System32\Winevt\Logs\Security.evtx" | Select-Object Owner, Access

# Expected: SYSTEM and Security group only

14. DETECTION & INCIDENT RESPONSE

Indicators of Compromise (IOCs)

Forensic Artifacts

Response Procedures

  1. Isolate: 
    # Disable compromised user account
Disable-AzADUser -ObjectId "compromised@company.com"
  2. Collect Evidence: 
    # Export all audit log searches by compromised user (last 30 days)
Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-30) -UserIds "compromised@company.com" | Export-Csv "incident_queries.csv"
    
# Check for exported files
Get-ChildItem -Path "C:\temp\", "C:\users\*\downloads\" -Filter "*audit*.csv", "*.evtx" -Recurse
  3. Remediate:
    • Change all M365 admin account passwords
    • Review all audit log exports in last 30 days (check Unified Audit Log for “ExportUnifiedAuditLog” events)
    • Delete any unauthorized Entra ID app registrations
    • Reset all bearer tokens / client secrets created in past 30 days
Step Phase Technique Description
1 Initial Access T1078 - Valid Accounts Compromise admin account or insider threat
2 Privilege Escalation T1548 - Abuse Elevation Control Mechanism Obtain audit log access via admin account
3 Collection [COLLECT-AUDIT-001] Extract 90+ days of comprehensive audit logs
4 Exfiltration T1020 - Automated Exfiltration Exfiltrate audit CSV files via email or cloud storage
5 Impact T1562.008 - Disable/Modify Cloud Logs Delete audit logs to cover tracks

16. REAL-WORLD EXAMPLES

Example 1: Ransomware Gang Post-Breach Reconnaissance

Example 2: Insider Threat – Departing Employee

17. REFERENCES & ACKNOWLEDGMENTS

Primary References:

This site is open source. Improve this page.