{"id":708,"date":"2022-01-03T11:25:39","date_gmt":"2022-01-03T11:25:39","guid":{"rendered":"https:\/\/forensics.cyber-kill-chain.ch\/bin\/?page_id=708"},"modified":"2022-01-13T14:01:10","modified_gmt":"2022-01-13T14:01:10","slug":"hids-host","status":"publish","type":"page","link":"https:\/\/forensics.cyber-kill-chain.ch\/bin\/forensic-domains\/hids-host\/","title":{"rendered":"HIDS\/Host"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-page\" data-elementor-id=\"708\" class=\"elementor elementor-708\" data-elementor-settings=\"[]\">\n\t\t\t\t\t\t\t<div class=\"elementor-section-wrap\">\n\t\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-e0d0544 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"e0d0544\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-f591cbc\" data-id=\"f591cbc\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-c3a027f elementor-widget elementor-widget-spacer\" data-id=\"c3a027f\" data-element_type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-0359e77 elementor-widget elementor-widget-heading\" data-id=\"0359e77\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor - v3.5.4 - 23-01-2022 *\/\n.elementor-heading-title{padding:0;margin:0;line-height:1}.elementor-widget-heading .elementor-heading-title[class*=elementor-size-]>a{color:inherit;font-size:inherit;line-height:inherit}.elementor-widget-heading .elementor-heading-title.elementor-size-small{font-size:15px}.elementor-widget-heading .elementor-heading-title.elementor-size-medium{font-size:19px}.elementor-widget-heading .elementor-heading-title.elementor-size-large{font-size:29px}.elementor-widget-heading .elementor-heading-title.elementor-size-xl{font-size:39px}.elementor-widget-heading .elementor-heading-title.elementor-size-xxl{font-size:59px}<\/style><h1 class=\"elementor-heading-title elementor-size-default\">HIDS\/Host<\/h1>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-3d95e6d elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"3d95e6d\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-50 elementor-top-column elementor-element elementor-element-9b35217\" data-id=\"9b35217\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-7c6a47a elementor-widget elementor-widget-heading\" data-id=\"7c6a47a\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Definition und Begriff<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9a1870b elementor-widget elementor-widget-text-editor\" data-id=\"9a1870b\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor - v3.5.4 - 23-01-2022 *\/\n.elementor-widget-text-editor.elementor-drop-cap-view-stacked .elementor-drop-cap{background-color:#818a91;color:#fff}.elementor-widget-text-editor.elementor-drop-cap-view-framed .elementor-drop-cap{color:#818a91;border:3px solid;background-color:transparent}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap{margin-top:8px}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap-letter{width:1em;height:1em}.elementor-widget-text-editor .elementor-drop-cap{float:left;text-align:center;line-height:1;font-size:50px}.elementor-widget-text-editor .elementor-drop-cap-letter{display:inline-block}<\/style>\t\t\t\t<p>Computer k\u00f6nnen Dienste f\u00fcr Benutzer oder andere Computer in einem Netz anbieten. Auf diesen Computern sammeln sich Spuren, die forensische ausgewertet werden k\u00f6nnen. Dabei werden die im Computer enthaltenen <a href=\"https:\/\/forensics.cyber-kill-chain.ch\/bin\/forensic-domains\/data-media\/\" target=\"_blank\" rel=\"noopener\">Datentr\u00e4ger<\/a> oder der Arbeitsspeicher untersucht, oder es kommen Host Intrusion Detection Systeme (HIDS) zur Anwendung, die Vorg\u00e4nge auf den Computern <a href=\"https:\/\/forensics.cyber-kill-chain.ch\/bin\/forensic-domains\/log-files\/\" target=\"_blank\" rel=\"noopener\">loggen<\/a>.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t<div class=\"elementor-column elementor-col-50 elementor-top-column elementor-element elementor-element-ca41b84\" data-id=\"ca41b84\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-c70ba59 elementor-widget elementor-widget-page-title\" data-id=\"c70ba59\" data-element_type=\"widget\" data-widget_type=\"page-title.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\n\t\t<div class=\"hfe-page-title hfe-page-title-wrapper elementor-widget-heading\">\n\n\t\t\t\t\t\t\t\t<h6 class=\"elementor-heading-title elementor-size-default\">\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\tOverview: \t\t\t\t\tHIDS\/Host  \n\t\t\t<\/h6 > \n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-2433f51 elementor-widget elementor-widget-shortcode\" data-id=\"2433f51\" data-element_type=\"widget\" data-widget_type=\"shortcode.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-shortcode\"><!-- Beginning of Link Library Output --><div id='linklist1' class='linklist'><!-- Div Linklist -->\n<div class=\"LinkLibraryCat LinkLibraryCat8 level0\"><!-- Div Category --><div id=\"data-sources\"><!-- Div Category Name --><div class=\"linklistcatname\"><!-- Div Cat Name --><span class=\"linklistcatclass\">Data Sources<\/span><\/div><!-- DivOrHeader --><\/div><!-- Div Category Name -->\n\t<ul>\n<li><a href=\"https:\/\/cyber-kill-chain.ch\/datasources\/DS0009\" id=\"link-1436\" class=\"track_this_link \" rel=\"noopener noreferrer\">Process (DS0009)<\/a><\/li>\n<li><a href=\"https:\/\/cyber-kill-chain.ch\/datasources\/DS0005\" id=\"link-1446\" class=\"track_this_link \" rel=\"noopener noreferrer\">WMI (DS0005)<\/a><\/li>\n<li><a href=\"https:\/\/cyber-kill-chain.ch\/datasources\/DS0024\" id=\"link-1445\" class=\"track_this_link \" rel=\"noopener noreferrer\">Windows Registry (DS0024)<\/a><\/li>\n<li><a href=\"https:\/\/cyber-kill-chain.ch\/datasources\/DS0006\" id=\"link-1444\" class=\"track_this_link \" rel=\"noopener noreferrer\">Web Credential (DS0006)<\/a><\/li>\n<li><a href=\"https:\/\/cyber-kill-chain.ch\/datasources\/DS0034\" id=\"link-1443\" class=\"track_this_link \" rel=\"noopener noreferrer\">Volume (DS0034)<\/a><\/li>\n<li><a href=\"https:\/\/cyber-kill-chain.ch\/datasources\/DS0002\" id=\"link-1442\" class=\"track_this_link \" rel=\"noopener noreferrer\">User Account (DS0002)<\/a><\/li>\n<li><a href=\"https:\/\/cyber-kill-chain.ch\/datasources\/DS0020\" id=\"link-1441\" class=\"track_this_link \" rel=\"noopener noreferrer\">Snapshot (DS0020)<\/a><\/li>\n<li><a href=\"https:\/\/cyber-kill-chain.ch\/datasources\/DS0019\" id=\"link-1440\" class=\"track_this_link \" rel=\"noopener noreferrer\">Service (DS0019)<\/a><\/li>\n<li><a href=\"https:\/\/cyber-kill-chain.ch\/datasources\/DS0012\" id=\"link-1438\" class=\"track_this_link \" rel=\"noopener noreferrer\">Script (DS0012)<\/a><\/li>\n<li><a href=\"https:\/\/cyber-kill-chain.ch\/datasources\/DS0015\" id=\"link-1410\" class=\"track_this_link \" rel=\"noopener noreferrer\">Application Log (DS0015)<\/a><\/li>\n<li><a href=\"https:\/\/cyber-kill-chain.ch\/datasources\/DS0029\" id=\"link-1433\" class=\"track_this_link \" rel=\"noopener noreferrer\">Network Traffic (DS0029)<\/a><\/li>\n<li><a href=\"https:\/\/cyber-kill-chain.ch\/datasources\/DS0023\" id=\"link-1431\" class=\"track_this_link \" rel=\"noopener noreferrer\">Named Pipe (DS0023)<\/a><\/li>\n<li><a href=\"https:\/\/cyber-kill-chain.ch\/datasources\/DS0011\" id=\"link-1430\" class=\"track_this_link \" rel=\"noopener noreferrer\">Module (DS0011)<\/a><\/li>\n<li><a href=\"https:\/\/cyber-kill-chain.ch\/datasources\/DS0008\" id=\"link-1427\" class=\"track_this_link \" rel=\"noopener noreferrer\">Kernel (DS0008)<\/a><\/li>\n<li><a href=\"https:\/\/cyber-kill-chain.ch\/datasources\/DS0035\" id=\"link-1426\" class=\"track_this_link \" rel=\"noopener noreferrer\">Internet Scan (DS0035)<\/a><\/li>\n<li><a href=\"https:\/\/cyber-kill-chain.ch\/datasources\/DS0022\" id=\"link-1420\" class=\"track_this_link \" rel=\"noopener noreferrer\">File (DS0022)<\/a><\/li>\n<li><a href=\"https:\/\/cyber-kill-chain.ch\/datasources\/DS0016\" id=\"link-1418\" class=\"track_this_link \" rel=\"noopener noreferrer\">Drive (DS0016)<\/a><\/li>\n<li><a href=\"https:\/\/cyber-kill-chain.ch\/datasources\/DS0017\" id=\"link-1415\" class=\"track_this_link \" rel=\"noopener noreferrer\">Command (DS0017)<\/a><\/li>\n\t<\/ul>\n<\/div><!-- Div End Category -->\n<span class=\"nolinksfoundincat\">No links found<\/span><script type='text\/javascript'>\njQuery(document).ready(function()\n{\njQuery('.arrow-up').hide();\njQuery('#linklist1 a.track_this_link').click(function() {\nlinkid = this.id;\nlinkid = linkid.substring(5);\npath = '';\njQuery.ajax( {    type: 'POST',    url: 'https:\/\/forensics.cyber-kill-chain.ch\/bin\/wp-admin\/admin-ajax.php',     data: { action: 'link_library_tracker',             _ajax_nonce: 'e1ebdf9706',             id:linkid, xpath:path }     });\nreturn true;\n});\njQuery('#linklist1 .expandlinks').click(function() {\ntarget = '.' + jQuery(this).attr('id');\nsubcattarget = '.' + jQuery(this).attr('data-subcat');\nif ( jQuery( target ).is(':visible') ) {\njQuery(target).slideUp();\njQuery(subcattarget).slideToggle();\njQuery(this).children('img').attr('src', 'https:\/\/forensics.cyber-kill-chain.ch\/bin\/wp-content\/plugins\/link-library\/icons\/expand-32.png');\n} else {\njQuery(target).slideDown();\njQuery(subcattarget).slideToggle();\njQuery(this).children('img').attr('src', 'https:\/\/forensics.cyber-kill-chain.ch\/bin\/wp-content\/plugins\/link-library\/icons\/collapse-32.png');\n}\n});\njQuery('#linklist1 .linklistcatclass').click(function() {\njQuery(this).siblings('.expandlinks').click();\n});\njQuery('#linklist1 .linklistcatnamedesc').click(function() {\njQuery(this).siblings('.expandlinks').click();\n});\n});\n<\/script>\n<\/div><!-- Div Linklist -->\n<!-- End of Link Library Output -->\n\n<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-9933a31 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"9933a31\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-50 elementor-top-column elementor-element elementor-element-bdf1a42\" data-id=\"bdf1a42\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-0c1a6ee elementor-widget elementor-widget-heading\" data-id=\"0c1a6ee\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Praktische Relevanz<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-b42c895 elementor-widget elementor-widget-heading\" data-id=\"b42c895\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Zentrale Logserver<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-e3990bb elementor-widget elementor-widget-text-editor\" data-id=\"e3990bb\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\tWertvoll ist der Einsatz von zentralen Logservern<span class=\"footnote_referrer\"><a role=\"button\" tabindex=\"0\" onclick=\"footnote_moveToReference_1415_1('footnote_plugin_reference_1415_1_1');\" onkeypress=\"footnote_moveToReference_1415_1('footnote_plugin_reference_1415_1_1');\" ><sup id=\"footnote_plugin_tooltip_1415_1_1\" class=\"footnote_plugin_tooltip_text\">1<\/sup><\/a><span id=\"footnote_plugin_tooltip_text_1415_1_1\" class=\"footnote_tooltip\"><span class=\"autor-continuous-text\">Messier<\/span>, Network Forensics, S. 216; <\/span><\/span><script type=\"text\/javascript\"> jQuery('#footnote_plugin_tooltip_1415_1_1').tooltip({ tip: '#footnote_plugin_tooltip_text_1415_1_1', tipClass: 'footnote_tooltip', effect: 'fade', predelay: 0, fadeInSpeed: 200, delay: 400, fadeOutSpeed: 200, position: 'top center', relative: true, offset: [-7, 0], });<\/script>, die nur einer stark beschr\u00e4nkten Nutzergruppe zug\u00e4nglich sind; am besten ausschliesslich im Vier-Augen-Prinzip. Es sollte nicht ausschliesslich auf einen zentralen Logserver abgest\u00fctzt werden, sondern die NIDS sollten zum einen eigenst\u00e4ndig ihre Logs noch \u00fcber einen l\u00e4ngeren Zeitraum vorhalten k\u00f6nnen und zum andern sollten zentrale Logserver idealerweise Redundanzen und eine andere Lokalit\u00e4t aufweisen. Auch Logserver sollten Backuping betreiben.\t\t\t\t<style>\/*! elementor - v3.5.4 - 23-01-2022 *\/\n.elementor-widget-text-editor.elementor-drop-cap-view-stacked .elementor-drop-cap{background-color:#818a91;color:#fff}.elementor-widget-text-editor.elementor-drop-cap-view-framed .elementor-drop-cap{color:#818a91;border:3px solid;background-color:transparent}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap{margin-top:8px}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap-letter{width:1em;height:1em}.elementor-widget-text-editor .elementor-drop-cap{float:left;text-align:center;line-height:1;font-size:50px}.elementor-widget-text-editor .elementor-drop-cap-letter{display:inline-block}<\/style>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t<div class=\"elementor-column elementor-col-50 elementor-top-column elementor-element elementor-element-180ce1f\" data-id=\"180ce1f\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap\">\n\t\t\t\t\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-4e1ccd1 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"4e1ccd1\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-50 elementor-top-column elementor-element elementor-element-cb9038d\" data-id=\"cb9038d\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-0f27dfc elementor-widget elementor-widget-heading\" data-id=\"0f27dfc\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Hinweise zur Beweissicherung bei Log Files<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-dc87025 elementor-widget elementor-widget-text-editor\" data-id=\"dc87025\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<ul>\n \t<li>Die forensischen Grunds\u00e4tze gelten bei Log Files uneingeschr\u00e4nkt;<\/li>\n \t<li>Administratoren\/Owner von Log Files oder Systemen mit relevanten Log Files oder von zentralen Log Verwaltungsinstanzen d\u00fcrfen nicht die eigenen untersuchungen f\u00fchren (vgl. )<\/li>\n \t<li>Log Files m\u00fcssen in einem Kontext betrachtet und analysiert werden: Es m\u00fcssen gleichzeitig mit der Log File-Sicherung aktuelle Netzwerktopologien herausverlangt oder erstellt werden; anders lassen sich viele netzwerktechnische Sachverhalte nicht interpretieren;<\/li>\n \t<li>Verschiedene Log Files m\u00fcssen zeitlich synchronisiert werden, damit wird die zeitliche Interpretation der Vorkommnisse stark erleichtert<span class=\"footnote_referrer\"><a role=\"button\" tabindex=\"0\" onclick=\"footnote_moveToReference_1415_1('footnote_plugin_reference_1415_1_2');\" onkeypress=\"footnote_moveToReference_1415_1('footnote_plugin_reference_1415_1_2');\" ><sup id=\"footnote_plugin_tooltip_1415_1_2\" class=\"footnote_plugin_tooltip_text\">2<\/sup><\/a><span id=\"footnote_plugin_tooltip_text_1415_1_2\" class=\"footnote_tooltip\"><span class=\"\"autor-continuous-text\"\">BSI<\/span>, Leitfaden IT-Forensik, S. 203; <span class=\"\"autor-continuous-text\"\">Mohan\/Anderson\/Collie\/Del Vel\/McKemmish<\/span>, S. 84 f.<\/span><\/span><script type=\"text\/javascript\"> jQuery('#footnote_plugin_tooltip_1415_1_2').tooltip({ tip: '#footnote_plugin_tooltip_text_1415_1_2', tipClass: 'footnote_tooltip', effect: 'fade', predelay: 0, fadeInSpeed: 200, delay: 400, fadeOutSpeed: 200, position: 'top center', relative: true, offset: [-7, 0], });<\/script>;<\/li>\n \t<li> &#8230;<\/li>\n<\/ul>\n<div><\/div>\n<div><\/div>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t<div class=\"elementor-column elementor-col-50 elementor-top-column elementor-element elementor-element-2d00c7a\" data-id=\"2d00c7a\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap\">\n\t\t\t\t\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-50aad52 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"50aad52\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-50 elementor-top-column elementor-element elementor-element-087d4ec\" data-id=\"087d4ec\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t<div class=\"elementor-column elementor-col-50 elementor-top-column elementor-element elementor-element-c447211\" data-id=\"c447211\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap\">\n\t\t\t\t\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-a640420 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"a640420\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-50 elementor-top-column elementor-element elementor-element-b737815\" data-id=\"b737815\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-4313caf elementor-widget elementor-widget-heading\" data-id=\"4313caf\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Weitere Materialien<\/h2><style>\/*! elementor - v3.5.4 - 23-01-2022 *\/\n.elementor-heading-title{padding:0;margin:0;line-height:1}.elementor-widget-heading .elementor-heading-title[class*=elementor-size-]>a{color:inherit;font-size:inherit;line-height:inherit}.elementor-widget-heading .elementor-heading-title.elementor-size-small{font-size:15px}.elementor-widget-heading .elementor-heading-title.elementor-size-medium{font-size:19px}.elementor-widget-heading .elementor-heading-title.elementor-size-large{font-size:29px}.elementor-widget-heading .elementor-heading-title.elementor-size-xl{font-size:39px}.elementor-widget-heading .elementor-heading-title.elementor-size-xxl{font-size:59px}<\/style>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-650ad92 elementor-widget elementor-widget-text-editor\" data-id=\"650ad92\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<ul><li><a href=\"https:\/\/it-forensik.fiw.hs-wismar.de\/index.php\/Log-File\" target=\"_blank\" rel=\"noopener\">https:\/\/it-forensik.fiw.hs-wismar.de\/index.php\/Log-File<\/a><\/li><li><a href=\"https:\/\/forensicswiki.xyz\/page\/Windows_Event_Log_(EVT)\" target=\"_blank\" rel=\"noopener\">https:\/\/forensicswiki.xyz\/page\/Windows_Event_Log_(EVT)<\/a><\/li><li><a href=\"https:\/\/en.wikipedia.org\/wiki\/Log_analysis\" target=\"_blank\" rel=\"noopener\">https:\/\/en.wikipedia.org\/wiki\/Log_analysis<\/a><\/li><\/ul>\t\t\t\t<style>\/*! elementor - v3.5.4 - 23-01-2022 *\/\n.elementor-widget-text-editor.elementor-drop-cap-view-stacked .elementor-drop-cap{background-color:#818a91;color:#fff}.elementor-widget-text-editor.elementor-drop-cap-view-framed .elementor-drop-cap{color:#818a91;border:3px solid;background-color:transparent}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap{margin-top:8px}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap-letter{width:1em;height:1em}.elementor-widget-text-editor .elementor-drop-cap{float:left;text-align:center;line-height:1;font-size:50px}.elementor-widget-text-editor .elementor-drop-cap-letter{display:inline-block}<\/style>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-c3119a7 elementor-widget elementor-widget-shortcode\" data-id=\"c3119a7\" data-element_type=\"widget\" data-widget_type=\"shortcode.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-shortcode\"><div class=\"speaker-mute footnotes_reference_container\"> <div class=\"footnote_container_prepare\"><h5><span role=\"button\" tabindex=\"0\" class=\"footnote_reference_container_label pointer\" onclick=\"footnote_expand_collapse_reference_container_1415_1();\">Referenzen<\/span><span role=\"button\" tabindex=\"0\" class=\"footnote_reference_container_collapse_button\" style=\"display: none;\" onclick=\"footnote_expand_collapse_reference_container_1415_1();\">[<a id=\"footnote_reference_container_collapse_button_1415_1\">+<\/a>]<\/span><\/h5><\/div> <div id=\"footnote_references_container_1415_1\" style=\"\"><table class=\"footnotes_table footnote-reference-container\"><caption class=\"accessibility\">Referenzen<\/caption> <tbody> \r\n\r\n<tr class=\"footnotes_plugin_reference_row\"> <th scope=\"row\" class=\"footnote_plugin_index_combi pointer\"  onclick=\"footnote_moveToAnchor_1415_1('footnote_plugin_tooltip_1415_1_1');\"><a id=\"footnote_plugin_reference_1415_1_1\" class=\"footnote_backlink\"><span class=\"footnote_index_arrow\">&#8593;<\/span>1<\/a><\/th> <td class=\"footnote_plugin_text\"><span class=\"autor-continuous-text\">Messier<\/span>, Network Forensics, S. 216; <\/td><\/tr>\r\n\r\n<tr class=\"footnotes_plugin_reference_row\"> <th scope=\"row\" class=\"footnote_plugin_index_combi pointer\"  onclick=\"footnote_moveToAnchor_1415_1('footnote_plugin_tooltip_1415_1_2');\"><a id=\"footnote_plugin_reference_1415_1_2\" class=\"footnote_backlink\"><span class=\"footnote_index_arrow\">&#8593;<\/span>2<\/a><\/th> <td class=\"footnote_plugin_text\"><span class=\"\"autor-continuous-text\"\">BSI<\/span>, Leitfaden IT-Forensik, S. 203; <span class=\"\"autor-continuous-text\"\">Mohan\/Anderson\/Collie\/Del Vel\/McKemmish<\/span>, S. 84 f.<\/td><\/tr>\r\n\r\n <\/tbody> <\/table> <\/div><\/div><script type=\"text\/javascript\"> function footnote_expand_reference_container_1415_1() { jQuery('#footnote_references_container_1415_1').show(); jQuery('#footnote_reference_container_collapse_button_1415_1').text('\u2212'); } function footnote_collapse_reference_container_1415_1() { jQuery('#footnote_references_container_1415_1').hide(); jQuery('#footnote_reference_container_collapse_button_1415_1').text('+'); } function footnote_expand_collapse_reference_container_1415_1() { if (jQuery('#footnote_references_container_1415_1').is(':hidden')) { footnote_expand_reference_container_1415_1(); } else { footnote_collapse_reference_container_1415_1(); } } function footnote_moveToReference_1415_1(p_str_TargetID) { footnote_expand_reference_container_1415_1(); var l_obj_Target = jQuery('#' + p_str_TargetID); if (l_obj_Target.length) { jQuery( 'html, body' ).delay( 0 ); jQuery('html, body').animate({ scrollTop: l_obj_Target.offset().top - window.innerHeight * 0.2 }, 380); } } function footnote_moveToAnchor_1415_1(p_str_TargetID) { footnote_expand_reference_container_1415_1(); var l_obj_Target = jQuery('#' + p_str_TargetID); if (l_obj_Target.length) { jQuery( 'html, body' ).delay( 0 ); jQuery('html, body').animate({ scrollTop: l_obj_Target.offset().top - window.innerHeight * 0.2 }, 380); } }<\/script><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t<div class=\"elementor-column elementor-col-50 elementor-top-column elementor-element elementor-element-a7d720d\" data-id=\"a7d720d\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap\">\n\t\t\t\t\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>HIDS\/Host Definition und Begriff Computer k\u00f6nnen Dienste f\u00fcr Benutzer oder andere Computer in einem Netz anbieten. Auf diesen Computern sammeln sich Spuren, die forensische ausgewertet werden k\u00f6nnen. Dabei werden die im Computer enthaltenen Datentr\u00e4ger oder der Arbeitsspeicher untersucht, oder es kommen Host Intrusion Detection Systeme (HIDS) zur Anwendung, die Vorg\u00e4nge auf den Computern loggen. einplfegen: [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":1000,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"elementor_header_footer","meta":[],"yoast_head":"<title>HIDS\/Host - forensics.cyber-kill-chain.ch<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/forensics.cyber-kill-chain.ch\/bin\/forensic-domains\/hids-host\/\" \/>\n<meta property=\"og:locale\" content=\"de_DE\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"HIDS\/Host - forensics.cyber-kill-chain.ch\" \/>\n<meta property=\"og:description\" content=\"HIDS\/Host Definition und Begriff Computer k\u00f6nnen Dienste f\u00fcr Benutzer oder andere Computer in einem Netz anbieten. Auf diesen Computern sammeln sich Spuren, die forensische ausgewertet werden k\u00f6nnen. Dabei werden die im Computer enthaltenen Datentr\u00e4ger oder der Arbeitsspeicher untersucht, oder es kommen Host Intrusion Detection Systeme (HIDS) zur Anwendung, die Vorg\u00e4nge auf den Computern loggen. einplfegen: [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/forensics.cyber-kill-chain.ch\/bin\/forensic-domains\/hids-host\/\" \/>\n<meta property=\"og:site_name\" content=\"forensics.cyber-kill-chain.ch\" \/>\n<meta property=\"article:modified_time\" content=\"2022-01-13T14:01:10+00:00\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"3 Minuten\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebSite\",\"@id\":\"https:\/\/forensics.cyber-kill-chain.ch\/bin\/#website\",\"url\":\"https:\/\/forensics.cyber-kill-chain.ch\/bin\/\",\"name\":\"forensics.cyber-kill-chain.ch\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/forensics.cyber-kill-chain.ch\/bin\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"de-CH\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/forensics.cyber-kill-chain.ch\/bin\/forensic-domains\/hids-host\/#webpage\",\"url\":\"https:\/\/forensics.cyber-kill-chain.ch\/bin\/forensic-domains\/hids-host\/\",\"name\":\"HIDS\/Host - forensics.cyber-kill-chain.ch\",\"isPartOf\":{\"@id\":\"https:\/\/forensics.cyber-kill-chain.ch\/bin\/#website\"},\"datePublished\":\"2022-01-03T11:25:39+00:00\",\"dateModified\":\"2022-01-13T14:01:10+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/forensics.cyber-kill-chain.ch\/bin\/forensic-domains\/hids-host\/#breadcrumb\"},\"inLanguage\":\"de-CH\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/forensics.cyber-kill-chain.ch\/bin\/forensic-domains\/hids-host\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/forensics.cyber-kill-chain.ch\/bin\/forensic-domains\/hids-host\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/forensics.cyber-kill-chain.ch\/bin\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Cyber Kill Chain Forensics | LAYER 8\",\"item\":\"https:\/\/forensics.cyber-kill-chain.ch\/bin\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"HIDS\/Host\"}]}]}<\/script>","yoast_head_json":{"title":"HIDS\/Host - forensics.cyber-kill-chain.ch","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/forensics.cyber-kill-chain.ch\/bin\/forensic-domains\/hids-host\/","og_locale":"de_DE","og_type":"article","og_title":"HIDS\/Host - forensics.cyber-kill-chain.ch","og_description":"HIDS\/Host Definition und Begriff Computer k\u00f6nnen Dienste f\u00fcr Benutzer oder andere Computer in einem Netz anbieten. Auf diesen Computern sammeln sich Spuren, die forensische ausgewertet werden k\u00f6nnen. Dabei werden die im Computer enthaltenen Datentr\u00e4ger oder der Arbeitsspeicher untersucht, oder es kommen Host Intrusion Detection Systeme (HIDS) zur Anwendung, die Vorg\u00e4nge auf den Computern loggen. einplfegen: [&hellip;]","og_url":"https:\/\/forensics.cyber-kill-chain.ch\/bin\/forensic-domains\/hids-host\/","og_site_name":"forensics.cyber-kill-chain.ch","article_modified_time":"2022-01-13T14:01:10+00:00","twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"3 Minuten"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebSite","@id":"https:\/\/forensics.cyber-kill-chain.ch\/bin\/#website","url":"https:\/\/forensics.cyber-kill-chain.ch\/bin\/","name":"forensics.cyber-kill-chain.ch","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/forensics.cyber-kill-chain.ch\/bin\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"de-CH"},{"@type":"WebPage","@id":"https:\/\/forensics.cyber-kill-chain.ch\/bin\/forensic-domains\/hids-host\/#webpage","url":"https:\/\/forensics.cyber-kill-chain.ch\/bin\/forensic-domains\/hids-host\/","name":"HIDS\/Host - forensics.cyber-kill-chain.ch","isPartOf":{"@id":"https:\/\/forensics.cyber-kill-chain.ch\/bin\/#website"},"datePublished":"2022-01-03T11:25:39+00:00","dateModified":"2022-01-13T14:01:10+00:00","breadcrumb":{"@id":"https:\/\/forensics.cyber-kill-chain.ch\/bin\/forensic-domains\/hids-host\/#breadcrumb"},"inLanguage":"de-CH","potentialAction":[{"@type":"ReadAction","target":["https:\/\/forensics.cyber-kill-chain.ch\/bin\/forensic-domains\/hids-host\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/forensics.cyber-kill-chain.ch\/bin\/forensic-domains\/hids-host\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/forensics.cyber-kill-chain.ch\/bin\/"},{"@type":"ListItem","position":2,"name":"Cyber Kill Chain Forensics | LAYER 8","item":"https:\/\/forensics.cyber-kill-chain.ch\/bin\/"},{"@type":"ListItem","position":3,"name":"HIDS\/Host"}]}]}},"_links":{"self":[{"href":"https:\/\/forensics.cyber-kill-chain.ch\/bin\/wp-json\/wp\/v2\/pages\/708"}],"collection":[{"href":"https:\/\/forensics.cyber-kill-chain.ch\/bin\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/forensics.cyber-kill-chain.ch\/bin\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/forensics.cyber-kill-chain.ch\/bin\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/forensics.cyber-kill-chain.ch\/bin\/wp-json\/wp\/v2\/comments?post=708"}],"version-history":[{"count":25,"href":"https:\/\/forensics.cyber-kill-chain.ch\/bin\/wp-json\/wp\/v2\/pages\/708\/revisions"}],"predecessor-version":[{"id":2648,"href":"https:\/\/forensics.cyber-kill-chain.ch\/bin\/wp-json\/wp\/v2\/pages\/708\/revisions\/2648"}],"up":[{"embeddable":true,"href":"https:\/\/forensics.cyber-kill-chain.ch\/bin\/wp-json\/wp\/v2\/pages\/1000"}],"wp:attachment":[{"href":"https:\/\/forensics.cyber-kill-chain.ch\/bin\/wp-json\/wp\/v2\/media?parent=708"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}