Latest Version: 3.7.2265
WLS is a Windows service that reads, formats, and sends Windows event logs as well as additional information as configured to a log receiver. Analysis of this data can help identify anomalous or malicious activity, as well as provide context for user behavior.
WLS includes the following capabilities:
- Augment process creation events with user defined metadata including hashes and PE information
- Remote configuration to allow for secure changes to the WLS configuration
- Route logs to one or more servers based on the current host network configuration
- Hourly performance logging
- Log current certificate information and changes
- Log commands entered by a user into cmd.exe, powershell.exe, and more
- Log devices connected / disconnected
- Log drives mounted / unmounted
- Log file data about file paths in logs with user defined metadata
- Log changed files in defined directories
- Log local users and groups
- Log all or specific Windows event logs, with powerful filtering to reduce noise
- Log file changes (tail)
- Log loaded modules (dlls)
- Log named pipe creation / deletion
- Log performance counters
- Log open / listening ports
- Log local print activity
- Log registry changes
- Log service activity / status
- Log session activity
- Log task scheduler tasks
- Log Windows Boot Configuration Log (WBCL)
- Log Windows objects (mutant / semaphore)
- Log WMI information
Splunk dashboards shown are provided as-is with a WLS license.
WLS requires .NET 4.0+ client or full and is compatible with Windows XP/Server 2003 – Windows 11/Server 2022. Requires < 5MB for initial installation, and up to the user-defined on-disk quota for the caching DB when the log server is unavailable.
WLS includes the required SQLite libraries and a Software Bill of Materials (SBOM) to validate the provided installation files and dependencies and the executable is signed and timestamped.
Install with colocated configuration file:
msiexec.exe /i setup.msi /qn
Install with HTTPS remote configuration file:
msiexec.exe /i setup.msi /RemoteURL="https://server.domain/WLS
Install with UNC remote configuration file:
msiexec.exe /i /setup.msi /RemoteURL="\\server.domain\WLS"
msiexec.exe /x setup.msi /qn
Run in debug mode (from elevated command prompt):
wls.exe /i /e /debugmode
All settings can be user-defined to meet expectations for the environment. The manual included with a license contains all definitions, options, and examples for each setting.
WLS configuration is defined by an XML file that is generated by the provided configuration utility and/or edited manually. Only non-default settings need to be specified. The XML file can then be signed by a system generated signature to guarantee integrity of the XML file, or by an existing certificate to guarantee integrity and verify the signature is trusted.
Remote configuration is done by specifying a path to a rules file that contains host conditions to map systems to the appropriate configuration(s). A remote configuration rule editor is provided.
All default settings, only watch the Application, Security, and System logs
<WLS> <Config> <Logging> <AutoWatchNewLogSources>0</AutoWatchNewLogSources> <Logs> <Application>1</Application> <Security>1</Security> <System>1</System> </Logs> </Logging> </Config> </WLS>
Additional data sources enabled
... <CertificateMonitor> <Enabled>1</Enabled> </CertificateMonitor> <SessionMonitor> <Enabled>1</Enabled> </SessionMonitor> ...
Example signed XML. Configuration utility signs and verifies files/folders
... </Config> <RSAKeyValue><Modulus>otCgojt4iZbb+y+FdXBn...u6gAkw==</Modulus><Exponent>AQAB</Exponent></RSAKeyValue><Signature xmlns="http://www.w3.org/2000/09/xmldsig#"><SignedInfo><CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315" /><SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" /><Reference URI=""><Transforms><Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" /><DigestValue>yw+...fE=</DigestValue></Reference></SignedInfo><SignatureValue>ESC...OEcyw==</SignatureValue></Signature></WLS>
If you’d like licensing or other information about WLS, send me a note via the contact form. WLS is currently available to US entities, but does require a signed license agreement.