| 일 | 월 | 화 | 수 | 목 | 금 | 토 |
|---|---|---|---|---|---|---|
| 1 | 2 | |||||
| 3 | 4 | 5 | 6 | 7 | 8 | 9 |
| 10 | 11 | 12 | 13 | 14 | 15 | 16 |
| 17 | 18 | 19 | 20 | 21 | 22 | 23 |
| 24 | 25 | 26 | 27 | 28 | 29 | 30 |
This splunk query will return any failed attempts initiated by users to launch an RDP (remote desktop) session in a Windows environment. Ensure the Splunk App for Windows is installed grab it here: https://apps.splunk.com/app/742/ Windows Server 2008 and Newer:
Windows Server 2003 and Older:
The following splunk queries will return results for failed attempts to change passwords. This is likely a result of users not meeting password requirements. Be sure to have the Splunk App for Windows is installed grab it here: https://apps.splunk.com/app/742/ Windows 2003 and Older:
Windows 2008 and Newer:
The following splunk query works on Windows Sever 2008 and newer operating systems. It returns results based on modifications to individual file level permissions. Ensure the Splunk App for Windows is installed grab it here: https://apps.splunk.com/app/742/
The following splunk queries will return results based on any user account who attempts to delete a file. This will return both successful and failed attempts. Ensure the Splunk App for Windows is installed grab it here: https://apps.splunk.com/app/742/ Windows 2003 and older:
Windows 2008 and newer:
The following splunk queries will display any file access attempts (successful or failed) by user account. Ensure the Splunk App for Windows is installed grab it here: https://apps.splunk.com/app/742/ Windows 2003 and older:
Windows 2008 and newer:
The following splunk query will return results of all new services installed on windows machines (this works on any windows OS tested thus far). Ensure the Splunk App for Windows is installed grab it here: https://apps.splunk.com/app/742/
This splunk query will return changes to any group in a windows environment. You MUST have the Splunk App for Windows Infrastructure app installed located here: https://apps.splunk.com/app/1680/ Windows Server 2003 and older:
Windows Server 2008 and newer:
These splunk queries will return deleted accounts in Associated with Windows Environments (NOTE* The 2003 query requires that the splunk for windows app be installed): 2003:
2008:
The following splunk query will give you all permission changes for each user. There are four queries. 1. Windows 2008 Permission Increases:
2. Windows 2008 Permission Decreases:
3.Windows 2003 Permission Increases:
4. Windows 2003 Permission Decreases:
Splunk query for all successful logons to windows:
This splunk query will return results for failed logon attempts to accounts that do not exist. This has been tested and confirmed on Windows Server 2008 and newer machines:
The following splunk query will return the number of failed logon attempts per user per host for each day. You will need to have the following apps installed: Splunk Add-on for Microsoft Windows You can adjust the warning (case) threshold to fit your needs. (This query is for Windows 2008 and newer operating systems)
[…]
Below is the query indicating time (duration) between account creation and account deletion. I have added a range to indicate severity, remove and modify as needed. Windows 2008 and newer:
Splunk query for all failed logon attempts within a windows environment.
Run the following (modify user field as needed) to show weekend activity:
The following queries will return modifications to time in a windows environment. It ignores system and service accounts. Windows 2008 and newer:
Windows 2003 and older:
This query will return results for accounts disabled on a windows 2008 or newer operating system for a given time range:
This query will return results on all accounts enabled for a given time range. It is using EventCodes for windows 2008 and newer operating systems:
This query will list all users who initiated a time change. System accounts change time automatically, as such I’ve ignored system accounts from the query output. Windows 2008 and newer:
Windows 2003 and before:
This query outputs a table that indicates the time difference between Rights granted and Rights revoked. Modify the maxspan time within the transaction function to meet your environments needs. Regex is used here, and is part of the query. Windows 2008 and newer:
Windows 2003 and before:
1 | sourcetype=WinEventLog:Security (EventCode=608 OR EventCode=609) | rex "Message=User\sRight\sAssigned:\s+User\sRight:\s+(?\w+)"| rex "Message=User\sRight\sRemoved:\s+User\sRight:\s+(?\w+)"| eval Rights=coalesce(RightGranted,RightRemoved) | eval status=case(EventCode=608, "New Rights Granted by:", EventCode=609, "Rights Removed by:")| transaction Rights user startswith="Assigned" endswith="Removed" |where duration > 0| eval duration = duration/60 |eval n=round(duration,2) | eval Date=strftime(_time, "%Y/%m/%d") | table Date, host, status, User, user, Rights, n | rename User as "Source Account" | rename user as "Target Account" | rename n as "Minutes between Rights Granted Then Removed" | sort - date |
Tweaked wenthold response to include more EventCodes. Also depending on the environment EventCode 4800|4801|4802 which is screen lock may be the closest thing to getting a log off time. > original post on splunk answers: https://answers.splunk.com/answers/597752/report-for-showing-users-logon-logoff-and-the-dura.html
This query will show a timechart of the status of an Locked Out Account
Use the following search to create a stacked barchart of AD Password change attempts:
The below will detect a form of brute force which most will miss. Whereas other scripts detect multiple logins against a single account, they fail to detect 4 failed logins against 40 accounts. This first checks for all accounts having an account login failure of 4 or more, it then checks for the quantity of […]
This eval for password can be easily used for any field where a user can accidentally type in a password or even worse both username/password during login which generates a failed event. Below example is for Windows failed login. The eval will match 10 or more characters with 1 uppercase, 1 lower case, 1 […]
The following Splunk search should be ran over a long period of time (at least it worked best that way in my environment). This query will show potentially suspicious activity based on processes within a Windows environment. It could also indicate a sanctioned security scan (so don’t run out there and start pointing fingers based […]
This splunk search will show file shares being accessed within windows environments.
This Splunk Search Query will indicate any user who attempted to login to a disabled account. (Tested only on Windows 7 / Server 2008 and newer Windows logs).
This Splunk search query example will return results indicating failed vs successful login attempts in a Windows environment:
This will hit all of the host and pull back the eventlogs and group them by Message. You can change the source to what ever windows eventlogs you need
The following Splunk query will return results for concurrent logon sessions (in a Windows Environment) on any given server (or multiple servers) with slight modification. First you must define the time span in which you consider “concurrent” this is defined in the “bucket” section below and the example uses a 30 minute range (widen […]
This splunk query will list all successful logins by account name for a given time range. This query will work on a variety of Windows Operating systems to include XP, 2003, Vista, 2008, 7, 8, and server 2012. I’ve tested in some capacity in Windows 10 for some of my queries, so far they appear […]
This Splunk search will show anytime the windows audit logs (event viewer logs) have been cleared or deleted. Ensure the Splunk App for Windows is installed, you can grab it here: https://apps.splunk.com/app/742/
The following Splunk query will display successful windows logins and overlay an average on visualizations.
This Splunk search will show any failed login attempt and graphically overlay an average value.
The following splunk query example will return results on any Windows remote desktop connection attempts. This could be a result of a bad password, invalid user name, or any number of other reasons. Ensure the Splunk App for Windows is installed grab it here: https://apps.splunk.com/app/742/ Windows Server 2008 and Newer:
Windows Server 2003 and […]
This splunk query unmodified will return results on any account regardless of duration, however it uses an “eval case” argument to determine what is “critical” (such as accounts deleted within a day of being created) or what is simply note worthy (normal behavior). Ensure the Splunk App for Windows is installed grab it here: https://apps.splunk.com/app/742/ […]
The following Splunk queries will show any accounts that have been enabled from a previously disabled state. Ensure the Splunk App for Windows is installed grab it here: https://apps.splunk.com/app/742/ Windows Server 2008 and Newer:
Windows Server 2003 and Older:
Source: https://gosplunk.com/
| 걱정노트 - 29/02/16 (0) | 2016.02.29 |
|---|---|
| The profession -- and everything it involves -- has changed dramatically, but it has been (and still is) a fun ride. (0) | 2015.10.05 |
| Taylor Swift says (0) | 2015.10.02 |
| How to train your mental (0) | 2015.09.16 |
| 그냥 (0) | 2015.09.09 |
