System & Web Log Analysis

Web Server Log Analysis (Nginx / Apache)

Web server access logs record every HTTP request in Combined Log Format:

192.168.1.50 - - [08/Aug/2026:14:32:10 +0000] "GET /index.php?id=1%20UNION%20SELECT%20null,flag%20FROM%20flags HTTP/1.1" 200 4521 "http://google.com" "Mozilla/5.0"

Essential grep / ripgrep One-Liners

# Extract top IP addresses making requests
cat access.log | awk '{print $1}' | sort | uniq -c | sort -nr | head -n 10

# Search for common attack patterns (SQLi, XSS, Path Traversal, Command Injection)
grep -Ei 'union|select|script|etc/passwd|eval|base64|%27|%22' access.log

# Filter requests by HTTP status codes (e.g., 500 errors indicating server crashes)
awk '$9 == 500 {print $0}' access.log

# Filter by suspicious HTTP User-Agents (sqlmap, nmap, nikto, dirbuster)
grep -Ei 'sqlmap|nikto|nmap|gobuster|dirbuster|python-requests' access.log

---

Linux System & Authentication Logs

Key log locations:

• /var/log/auth.log (Ubuntu/Debian) or /var/log/secure (RHEL/CentOS) — SSH logins, sudo commands.
• /var/log/syslog or /var/log/messages — System events.
• /var/log/nginx/access.log — Web requests.

# Detect successful SSH logins
grep "Accepted password" /var/log/auth.log
grep "Accepted publickey" /var/log/auth.log

# Detect failed SSH brute-force attempts
grep "Failed password" /var/log/auth.log | awk '{print $(NF-3)}' | sort | uniq -c | sort -nr

# Identify elevated root executions via sudo
grep "COMMAND=" /var/log/auth.log

---

Windows Event Log Analysis (.evtx)

Windows Event Logs record system events in binary XML format.

Key Event IDs for Incident Response

Event ID	Event Description	Significance
4624	Successful Account Logon	Identifies user, IP address, and Logon Type (3=Network, 10=Remote Desktop).
4625	Failed Account Logon	Highlights brute-force attempts.
4688	New Process Created	Tracks command-line arguments executed by users/malware.
4720	User Account Created	Indicates attacker creating backdoor accounts for persistence.
4738	User Account Modified	Account setting changes (e.g., password resets).

Sysmon Event IDs (System Monitor)

Event ID	Sysmon Event Description
1	Process Creation (includes full command line & parent process)
3	Network Connection (source IP, destination IP & port)
7	Image Loaded (DLL loading)
10	ProcessAccess (LSASS memory dumping attempts)
11	FileCreate (malware drops)
13	RegistryEvent (Persistence keys created)

Extracting & Parsing EVTX Logs

Use evtx_dump (Rust tool) or EvtxECmd (Eric Zimmerman tool):

EvtxECmd.exe -f Security.evtx --csv C:\Analysis\ --csvf Security_Parsed.csv

# Linux CLI parsing evtx to JSON
evtx_dump Security.evtx | jq '. | select(.Event.System.EventID == 4624)'