Security Hardening & Tamper Protection

A comprehensive guide to the anti-tamper mechanisms, file integrity monitoring, and cryptographic defenses built into Login AlertX.

Overview & Adversary Model

In high-security environments, sophisticated attackers or malicious insiders may attempt to neutralize monitoring tools before executing unauthorized actions. Common adversary techniques include disabling Windows security event logging, modifying configuration files to drop recipient emails, or sending forged commands to background services.

Introduced in Login AlertX v4.3.1, the application includes a multi-layered Security Self-Defense & Anti-Tamper Architecture that actively protects the monitoring engine, audits its own integrity, and automatically self-heals system policies if tampering is detected.

The Four Layers of Protection

1. File Integrity Monitoring (FIM)

Tracks cryptographic SHA-256 baselines of critical configuration files (owner.json, license registries, and notification settings). If an unauthorized process modifies these files directly on disk, a high-severity TamperDetected alert is immediately dispatched across all alert channels.

2. Windows Audit Self-Remediation

Monitors Windows Security Audit policy for Logon and Credential Validation subcategories. If an attacker disables failure auditing to suppress Event 4625 (Failed Logon), Login AlertX automatically re-enables the policy and dispatches an alert.

3. Hardened IPC Named Pipes

Restricts inter-process communication (IPC) strictly to SYSTEM and BuiltinAdministrators using client impersonation token validation. Unprivileged standard user accounts cannot inject commands to pause monitoring or disable alert channels.

4. DPAPI CurrentUser Secret Storage

Migrated credential encryption from machine-wide scope to the CurrentUser (SYSTEM profile) scope. Stored SMTP passwords, OAuth refresh tokens, and API keys cannot be decrypted by other local administrative accounts.

How Tamper Detection Operates

Baseline Generation: During initial startup and whenever settings are saved legitimately through the user interface, Login AlertX creates an encrypted SHA-256 baseline in integrity.dat.
Periodic Verification: Every 5 minutes, the background service recalculates hash checksums against the baseline.
Instant Dispatch: If a discrepancy is found, an immediate high-priority alert is generated and sent via Email, Mobile Push, Telegram, and Webhooks.
Extended Staleness Retention: Tamper alerts are designated as 60-minute resilient events, ensuring that even if an attacker briefly cuts network connectivity, the alert will deliver the instant internet access is restored.

Windows Security Audit Policies Monitored

Subcategory	Policy Setting Enforced	Monitored Event ID	Security Purpose
Logon	`Success and Failure`	Event 4624 (Success), Event 4625 (Failure)	Guarantees that both valid logins and failed password attempts are captured in real-time.
Credential Validation	`Success and Failure`	Event 4776 (NTLM validation)	Detects domain controller and local NTLM authentication attempts and credential stuffing.