Windows Server File Share Audit File Attribute Modification

Question

My goal is to identify what user has set the Hidden attribute on a file within the local file share.

I have enabled File Share access auditing as per this article. In short: Added a group policy entry to enable certain accesses to be written to Event Log + enabled auditing on the Folder level for all access types.

As a result, I get such entries in Event Log:

Subject:
    Security ID:        Domain\Username
    Account Name:       Username
    Account Domain:     Domain
    Logon ID:       0x329558

Object:
    Object Server:      Security
    Object Type:        File
    Object Name:        E:\share\filename.xml
    Handle ID:      0xfc4
    Resource Attributes:    S:AI

Process Information:
    Process ID:     0x4
    Process Name:       

Access Request Information:
    Accesses:       WriteAttributes

    Access Mask:        0x100

What attributes exactly did the user set? Is it what is listed in Resource Attributes? They don't look like they mean 'Hidden', and I don't get any other entries in the Event Log of type WriteAttributes (I search thoroughly via PowerShell). And some process is definitely setting this Hidden flag.

Questions:

• Does this Event Log entry contain information about the attributes that the application was actually setting?
• How else can I track this activity? Process Monitor did not capture a single SetBasicinformationFile event, but the file has still become Hidden!

Answer 1

You should be able to accomplish this with a simple batch script where you repeatedly execute dir /b /a:h and then evaluate the errorlevel. The /b switch is optional but shows the directory output in a bare minimum format.

When you run this command, it will return an ERRORLEVEL of 1 when no hidden files are found, which is what you want. If a file is hidden then it will return an ERRORLEVEL of 0, which you don't want, and that's where you can then trigger something.

Now, this won't tell you who hid the file, but if you call it often enough (say every 30 seconds) then you will at least have a time frame as to when it happened, and you should then be able to correlate it with 4663 events that occurred right around that time. I'm assuming you have auditing already on in this folder?

You can call this script with any scheduler, although this is actually a good scenario for the EventSentry Light utility which has a built-in scheduler that can trigger email alerts based on the errorlevel of any script you run. It even includes the output of the script. That feature is called "application scheduler". Of course you can also write your own script and trigger an email with PowerShell, VBScript or something like blat.exe.

The auditing part may be the trickiest if Windows auditing isn't granular enough to catch somebody just hiding a file. But even then auditing on the parent folder should show some activity, like directory listing for example.

Answer 2

File/Share auditing doesn't provide complete details of what was changed. Resource Attributes is for the Dynamic Access Control feature, to provide granular information about the DAC classification criteria that caused the audit event.

ProcMon on the server may work, but you need to be careful how it is configured. It should be configured to Drop Filtered Events, collect only File events, Save to a Backing File (not Virtual Memory), and the specific Operation (SetBasicInformationFile), and possibly the Path. You would then export the configuration to a PMC file and use that when launching. It's also a good idea to specify a /Runtime in seconds, then move/rename the file when it ends and relaunch, because ProcMon occasionally flakes out and may adversely impact the system.