## Contents

## Summary

## Active Directory Searches

## Server Searches

## Account Usage Searches (user rights assignments)

## O365 / Azure Searches
 
Pick your search head (as of April 2023):  
[https://splunk-isso.cbp.dhs.gov/](https://splunk-isso.cbp.dhs.gov/) (prod)  
[https://splunk.splunk-dev.cbp.dhs.gov](https://splunk.splunk-dev.cbp.dhs.gov) (development systems / SAT)  
[https://splunk-vuln.cbp.dhs.gov](https://splunk-vuln.cbp.dhs.gov) (vulnerability tracking)
 
Old assignments no longer valid  
[https://splunk-financial.cbp.dhs.gov/](https://splunk-financial.cbp.dhs.gov/) (eliminated April 2023)  
[https://splunk.cbp.dhs.gov](https://splunk.cbp.dhs.gov) (appears abandoned)  
[https://aws-splunk.cbp.dhs.gov](https://aws-splunk.cbp.dhs.gov) (eliminated April 2023) (AD and member servers, desktops)
 
## Summary (most of these can be modified to search all records or records for a specific user or system)

|   |   |   |
|---|---|---|
|**Description**|**Event ID**|**Sample**|
|**Logon success/failure**|4624 success  <br>4625 failure|index=wineventlog source="WinEventLog:Security" EventCode IN (4624,4625)  <br>\| table ComputerName, subject, _time, Security_ID, Logon_Type, Account_Domain, Account_Name, Elevated_Token  <br>\| sort _time \| reverse|
|**Use of weak mapping method (certificate)**|39|index=wineventlog source="WinEventLog:System" EventCode IN (39) user=baabq19 \| table user, Certificate_Subject|
|**Logon success/failure (tailored to users)**  <br>**Interactive, unlock, and RDP**|4624 success|index=wineventlog source="WinEventLog:Security" EventCode IN (4624) Logon_Type IN (2,7,10,11) Account_Name!=DWM-* Account_Name!=UMFD-* Account_Name!=SVC-* Account_Domain=AD  <br>\| eval Account_Name=mvindex(Account_Name,1) \| eval Account_Domain=mvindex(Account_Domain,1)  <br>\| table Account_Name, Workstation_Name, Logon_Type, Account_Domain, subject, _time|
|**Member added / removed from LOCAL group**<br><br>  <br><br>Something is amiss with the desktops and remote assistance|4732 Added  <br>4733 Removed  <br>4735 Modified|index="wineventlog" EventCode IN (4732,4733,4735) source="WinEventLog:Security" Security_ID!=*defaultuser0  <br>\| eval Modified_By=mvindex(Security_ID,0), Account_Modified=mvindex(Security_ID,1), Group_Name=mvindex(Security_ID,2)  <br>\| table EventCode, _time, Account_Modified, subject, Group_Name, Modified_By  <br>\| sort _time, Account_Modified|
|**Member added/removed from DOMAIN group**|4728 Added  <br>4729 Removed|index="wineventlog" EventCode IN (4728,4729) source=WinEventLog:Security Security_ID!=*defaultuser0  <br>\| eval Modified_By=mvindex(Security_ID,0), Account_Modified=mvindex(Security_ID,1), Action=if(EventCode=4728, "Add", "Remove"), Group_Name=mvindex(Security_ID,2)  <br>\| table EventCode, _time, Account_Modified, Action, Group_Name, Modified_By, Keywords \| sort _time, Account_Modified|
|**Local computer user right added/removed**|4704 Assigned  <br>4705 Removed|source="WinEventLog:Security" EventCode IN (4704,4705) \| table ComputerName, subject, _time, User_Right, user|
|**Security log cleared**|1102||
|**Computer object deleted/created**|4743 deleted  <br>4741 added|EventCode IN (4743,4741) source=WinEventLog:Security \| table _time, Account_Name, Keywords, EventCode, DNS_Host_Name|
|**User object created (local)**<br><br>  <br><br>(less defaultuser0 from imaging process)|4720|EventCode IN (4720) source=WinEventLog:Security SAM_Account_Name!=defaultuser0  <br>\| eval Account_Name=mvindex(Security_ID,0), Account_Location=mvindex(Account_Domain,1)  <br>\| rename user AS User_Target Account_Name as Created_By  <br>\| table _time, Account_Location, Created_By, SAM_Account_Name, Display_Name, User_Principal_Name, Keywords|
|**User object deleted (local)**<br><br>  <br><br>(less defaultuser0 from imaging process)|4726|EventCode IN (4726) source=WinEventLog:Security Account_Name!=defaultuser0  <br>\| eval Account_Name=mvindex(Security_ID,0), Account_Location=mvindex(Account_Domain,1)  <br>\| rename user AS User_Target Account_Name as "Deleted By"  <br>\| table _time, Account_Location, User_Target, "Deleted By", Keywords|
|**AD account authentication failure**|4625 logon fail|index=wineventlog EventCode IN (4625,4740) user=XyourAccountX  <br>\| eval Account_Name=mvindex(Account_Name,1)  <br>\| table _time, Account_Name, Failure_Reason, Account_Name, Workstation_Name, Source_Network_Address, Logon_Process, EventCode  <br>\| sort _time,Account_Name|
|**AD account lockouts** (identify computer causing lockout)<br><br>  <br><br>Add Account_Name=yourAccount to narrow|4740 lockout|index=wineventlog EventCode=4740 source=WinEventLog:Security  <br>\| eval Account_Name=mvindex(Account_Name,1) \| rename Caller_Computer_Name as "ComputerOrigin"  <br>\| table _time, Account_Name, ComputerOrigin, EventCode, host \| dedup ComputerOrigin, Account_Name|
|**Bad password / logon failure**|4625|index=wineventlog EventCode IN (4625) \| table _time, ComputerName, Account_Name, Failure_Reason, Workstation_Name, Source_Network_Address, Authentication_Package|
|**BSOD**|1001|index=wineventlog EventCode IN (1001) source="WinEventLog:System" "SourceName=BugCheck"  <br>\| table ComputerName, _time, Message  <br>\| sort ComputerName, _time|
|**Shutdown/Restart**<br><br>  <br><br>Any reason any way incl unexpected, MECM, user initiated, BSOD, dirty…|41 dirty  <br>1001 BSOD  <br>1074 user  <br>6005-6006  <br>6008 random|index=wineventlog EventCode IN (41, 1001,1074,6005,6006,6008) source="WinEventLog:System" SourceName!=SNMP  <br>\| table ComputerName, _time, EventCode, Message, Shutdown_Type<br><br>  <br><br>**Specific Computer:**  <br>index=wineventlog EventCode IN (41, 1001,1074,6005,6006,6008) source=WinEventLog:System host===TASB30A-V0061*==  <br>\| table ComputerName _time Message \| sort ComputerName, _time|
|**List computers reporting to Splunk**|All Windows<br><br>  <br><br>All Win Servers|\| tstats dc(host) where index=wineventlog by host<br><br>  <br><br>\| tstats dc(host) where index=wineventlog where host=t* by host|
|**Process execution**|4688|index=wineventlog EventCode=4688 source="WinEventLog:Security"  <br>\| eval Account_Name=if(Security_ID="NULL SID", (mvindex(Security_ID,0)), Security_ID)  <br>\| table ComputerName, _time, Account_Name, New_Process_Name, Process_Command_Line, Creator_Process_Name|
|**WIP****￼****Process & command line**  <br>**(Powershell or command)**  <br>**Excluding system**||index=wineventlog host=anwg01aben EventCode=4104 User!=SYSTEM \| table _time, User, ComputerName, Message  <br>  <br>index=wineventlog EventCode IN (4104,4688) \| table EventCode, ComputerName, Message|
|**App installed/removed**|1033 Installed  <br>1034 Removed|index=wineventlog source="WinEventLog:Application" EventCode IN (1033,1034) SourceName=MsiInstaller  <br>\| table ComputerName, _time, User, Message \| sort ComputerName, _time|
|**Unexpected shutdown (when sys boots again)**|6008|index=wineventlog EventCode=6008 source=WinEventLog:System host=tnwg01a*  <br>\| table ComputerName _time Message \| sort ComputerName, _time|
|**GPO changed**<br><br>  <br><br>(I believe) Run get-gpo -guid "{guid-here}"|5136|index=wineventlog EventCode IN (5136) source=WinEventLog:Security versionNumber  <br>\| table _time, Name, Account_Name, LDAP_Display_Name, Type|
|**File system auditing**  <br>(Note must have enabled auditing on file system first)|4663|index=wineventlog host=tnwg01a-v2223 LogName=Security EventCode IN (4663)  <br>\| table ComputerName, _time, Security_ID, Object_Type, Object_Name, Process_Name, Accesses, EventCode, action|
|**Custom event for PIV diagnostic (NOT USED)**|3001|index=wineventlog EventCode=3003 source=WinEventLog:Application \| table Hash, DiagResults, RFC822_1, ADmailAttribute, DHSAttribute13|
|**Find computers submitting RC4 encrypted tickets** (should be using AES because capable of AES)|4769|index=wineventlog EventCode=4769 Service_Name="*$" (Ticket_Options=0x40810000 OR Ticket_Options=0x40800000 OR Ticket_Options=0x40810010) Ticket_Encryption_Type=0x17  <br>\| stats count by dest, service, service_id, Ticket_Encryption_Type, Ticket_Options|
|**Find servers lacking HIPS and/or Antivirus**||Using [https://splunk-vuln.cbp.dhs.gov](https://splunk-vuln.cbp.dhs.gov)<br><br>  <br><br>\| tstats summariesonly=false latest(_time) as latestTime, latest(scoring_details.latestScan) as latestScan, latest(scoring_details.justification) as justification, latest(scoring_details.pattern_age) as pattern_age, latest(scoring_details.hips_enabled) as hips_enabled, latest(scoring_details.last_scan_time) as last_scan_time, latest(scoring_details.pattern_date) as pattern_date, latest(scoring_details.agent_type) as agent_type, latest(scoring_details.osType) as osType, latest(scoring_details.osDistro) as osDistro, latest(scoring_details.hwamApplicable) as hwamApplicable, latest(scoring_details.swamApplicable) as swamApplicable, latest(scoring_details.cmApplicable) as cmApplicable, latest(scoring_details.vmApplicable) as vmApplicable, latest(scoring_details.num_prohibited_software) as num_prohibited_software, latest(scoring_details.receivedCredScan) as receivedCredScan, latest(scoring_details.vmScore) as vmScore, latest(scoring_details.cmScore) as cmScore, latest(scoring_details.vmCriticalCVEs) as vmCriticalCVEs, latest(scoring_details.highPct) as highPct, latest(scoring_details.critPct) as critPct, latest(scoring_details.vmHighCVEs) as vmHighCVEs latest(scoring_details.vmCriticalCveIds) as vmCriticalCveIds, latest(scoring_details.vmHighCveIds) as vmHighCveIds, latest(scoring_details.repository_name) as repository_name, latest(scoring_details.deviceClass) as deviceClass from datamodel=iscm_p2.scoring_details where scoring_details.environment="Production" AND scoring_details.deviceClass="SERVER" AND (scoring_details.osType="Windows") by scoring_details.info_search_time, scoring_details.dest_host, scoring_details.domain, scoring_details.environment, scoring_details.fismaID  <br>\| `drop_dm_object_name("scoring_details")`  <br>\| eventstats max(info_search_time) as latestEvent by dest_host, domain, fismaID, environment  <br>\| where info_search_time=latestEvent  <br>\| where justification="null"  <br>\| lookup cbp_fisma_systems fismaID output systemName, systemShortName, programOffice, hvamescfo as designation  <br>\| eval  <br>avApplicable=case(deviceClass LIKE "Server" OR deviceClass LIKE "Workstation" OR deviceClass LIKE "Non-Windows Workstation" OR deviceClass LIKE "UNKNOWN", "yes", 1==1, "no"),  <br>avCompliance=case(avApplicable="yes" AND pattern_age\<=15, "pass", avApplicable="yes" AND (pattern_age\>15 OR isnull(pattern_age)), "fail"),  <br>hipsCompliance=case(avApplicable="yes" AND hips_enabled="On", "pass", avApplicable="yes" AND (hips_enabled="Off" OR isnull(hips_enabled)), "fail"),  <br>hips_enabled = case(avApplicable="yes" AND isnull(hips_enabled), "Off", 1==1, hips_enabled),  <br>last_scan_time = case(avApplicable="yes" AND isnull(last_scan_time), "UNKNOWN", 1==1, last_scan_time),  <br>pattern_date = case(avApplicable="yes" AND isnull(pattern_date), "UNKNOWN", 1==1, pattern_date),  <br>pattern_age = case(avApplicable="yes" AND isnull(pattern_age), "UNKNOWN", 1==1, pattern_age),  <br>agent_type = case(avApplicable="yes" AND isnull(agent_type), "UNKNOWN", 1==1, agent_type),  <br>avScore = case(avApplicable="yes" AND avCompliance="pass", "50", 1==1, 0),  <br>hipsScore = case(avApplicable="yes" AND hipsCompliance="pass", "50", 1==1, 0),  <br>hbdScore = avScore + hipsScore,  <br>osType = case(osType=0, "UNKNOWN", 1==1, osType),  <br>osDistro = case(osDistro=0, "UNKNOWN", 1==1, osDistro) \| stats  <br>count(eval(if(avCompliance="pass",avCompliance, null()))) as totalAvPassed,  <br>count(eval(if(avCompliance="fail", avCompliance, null()))) as totalAvFailed,  <br>count(eval(if(avApplicable="yes", avCompliance, null()))) as totalAvApplicable,  <br>count(eval(if(hipsCompliance="pass", hipsCompliance, null()))) as totalHipsPassed,  <br>count(eval(if(hipsCompliance="fail", hipsCompliance, null()))) as totalHipsFailed by osType, dest_host  <br>\| eval  <br>avScore = (totalAvPassed/totalAvApplicable) * 50,  <br>hipsScore = (totalHipsPassed/totalAvApplicable) * 50,  <br>hbdScore = avScore + hipsScore  <br>\| fillnull hbdScore value=100  <br>\| fields osType, dest_host, avScore, hipsScore, hbdScore|
|**M365 Delivery Report**||index=o365 sourcetype="ms:o365:reporting:messagetrace" SenderAddress="ActiveDirectoryAdmin@cbp.dhs.gov" \| table _time, SenderAddress Status, RecipientAddress, Received, Subject|
 
**Others/notes**
 
## Active Directory
 
##### Domain controller successful user login

index=wineventlog source="WinEventLog:Security" EventCode=4624 user=BADFJON Workstation_Name=ADCC10AOFW
 
index=wineventlog source="WinEventLog:Security" EventCode=4624 user=BADFJON Workstation_Name=ADCC10AOFW | table _time user Workstation_Name
 
index=wineventlog source="WinEventLog:Security" EventCode=4624 user=BADFJON Workstation_Name=ADCC10AOFW | table _time user Workstation_Name Source_Network_Address dest
 
##### Find event 5829 (netlogon vulnerable connections):

index=wineventlog fisma_app=cds source="WinEventLog:System" EventCode=5829 | stats count by Machine_SamAccountName
 
##### Account lockout

index=wineventlog source="WinEventLog:Security" user=SVC-OFAM-HIRSCH-01 subject="A user account was locked out"
 
##### PIV logon errors due to revocation checking

index=wineventlog source="WinEventLog:System" EventCode=21 SourceName="Microsoft-Windows-Kerberos-Key-Distribution-Center" | stats count by host
 
##### Changes made to domain admin (or others)

source="WinEventLog:Security" (EventCode=4728 OR EventCode=4729) Group_Name="*domain admins*"  
| rename src_user AS "Changed By", user AS "Target User" name as "Action Taken"  
| table "Changed By" "Target User" "Action Taken" Group_Name Account_Domain _time  
| sort - _time
   

## Server/service Queries
 
index=wineventlog fisma_app=cds source="WinEventLog:Security" EventCode=4624 user=baabq19 | stats count by _time user Workstation_Name
 
##### Determine process kicked off and who called it with command line

source="WinEventLog:Security" EventCode=4688 host=tnwg01a-v3639 | table ComputerName, _time, New_Process_Name, Process_Command_Line, New_Process_ID, Creator_Process_Name, Creator_Process_ID
 
##### Query specific systems to determine accounts logging on

source="WinEventLog:Security" EventCode=4624 host=tnwg01a-v3824 Security_ID!="*SYSTEM" user!="SVC-CDS-MSIDS" | table _time user Source_Network_Address dest
 
##### Find accounts attempting to log onto a system that lack the appropriate logon type:

source="WinEventLog:Security" EventCode=4625 Failure_Reason="The user has not been granted the requested logon type at this machine." | stats count by host,user,"Logon_Type", Source_Network_Address, EventCode
 
##### Great query to track where account is being used (may need to go back a month or more for infrequent use)

Account_Name="svc-MIISCBP" source="WinEventLog:Security" EventCode=4624 | table _time user Workstation_Name Source_Network_Address dest
 
##### Computer unlocked

index=wineventlog source="WinEventLog:Security" EventCode=4801 user=baabq19-m | stats count by ComputerName
 
##### Computer locked and unlocked

index=wineventlog source="WinEventLog:Security" EventCode IN (4801,4800) user=baabq19-m | stats count by host EventCode
 
##### Show oldest and newest event 5829

index=wineventlog fisma_app=cds source="WinEventLog:System" EventCode=5829 | stats earliest(_time) AS Earliest, latest(_time) AS Latest by Machine_SamAccountName |convert ctime(Earliest) ctime(Latest)
 
##### Restarted computer event (startup actually - event log started event shows it best in case it was shut down dirty)

index=wineventlog source="WinEventLog:System" EventCode=6005 | table ComputerName, _time
 
index=wineventlog fisma_app=cds source="WinEventLog:Security" EventCode=4624 user=svc-vat-scan | table src
 
##### Unexpected shutdown on server:

EventCode=6008 host=tnwg01a* | table _time host Message
 
##### User added to local server group (exclude a couple noisy groups)

"EventCode=4732" index=wineventlog source="WinEventLog:Security" Security_ID!="*IIS_IUSRS*" Security_ID!="*WSS_WPG*" | table _time ComputerName Security_ID
 
##### Products installed on server

index=wineventlog source=WinEventLog:System EventCode=19 | eval Date=strftime(_time, "%Y/%m/%d")| rex "\WKB(?\<KB\>.\d+)\W" | stats count by Date, host, KB, fisma_app
 
##### Windows installer INSTALLED app (Msi installer)

index=wineventlog source="WinEventLog:Application" EventCode=1033 SourceName=MsiInstaller | table ComputerName, _time, User, Message
 
##### Windows installer REMOVED app (Msi installer)

index=wineventlog source="WinEventLog:Application" EventCode=1034 SourceName=MsiInstaller | table ComputerName, _time, User, Message
 
##### NTLMv1 (version 1) use without enabling audit capability [Network security Restrict NTLM Audit NTLM authentication in this domain (Windows 10) - Windows security | Microsoft Docs](https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-audit-ntlm-authentication-in-this-domain)

source=WinEventLog:Security EventCode=4624 Package_Name__NTLM_only_="NTLM V1" user!="*ANONYMOUS LOGON" | table Package_Name__NTLM_only_ Workstation_Name Account_Name
 
##### Logs for a particular error in app log (example finds click 2 run office failures

index=wineventlog source="WinEventLog:Application" EventCode=1000 SourceName="Application Error" Message="*Faulting module name: VCRUNTIME140.dll*" Message="*Office*" | table ComputerName, _time, User, Message
 
##### SOC VAT scanning activity - use this to find the VAT scanner IP activity on a host (agentless) - agent scans probably not easy to determine

source="WinEventLog:Security" src_ip="10.162.104.*"  
| stats max(_time) as lastevent min(_time) as firstevent by ComputerName  
| eval lastseen=strftime(lastevent,"%Y-%m-%d %I:%M %p"), firstseen=strftime(firstevent,"%Y-%m-%d %I:%M %p")
 
Similar except looking for agent scans  
EventCode IN (4688,4689) nessusd.exe | table _time, ComputerName, TaskCategory, Process_Name, New_Process_Name | sort _time, ComputerName
 
##### Process with command line run on Windows system

(the eval pipe is there to eliminate NULL SID from the results in the table/output only)  
EventCode=4688 | eval Account_Name=if(Security_ID="NULL SID", (mvindex(Security_ID,0)), Security_ID) | table ComputerName, _time, Account_Name, New_Process_Name, Process_Command_Line, New_Process_ID, Creator_Process_Name, Creator_Process_ID
 
## Account Usage Searches (user rights assignments)
 
##### Query specific servers for logon event and summarize with server, user and logon type

source="WinEventLog:Security" EventCode=4624 (host=TNWG01A-V3819 OR TNWG01A-V3820 OR TNWG01A-V3821 OR TNWG01A-V3822 OR TNWG01A-V3824) user!=*$ user!=*SYSTEM | stats count by host,user,"Logon_Type"
 
## Office 365 / Azure
 
##### Changes to roles

sourcetype="o365:management:activity" "ModifiedProperties{}.OldValue"=TenantAdmins OR "ModifiedProperties{}.NewValue"=TenantAdmins
 
##### Query for "CRL download not allowed." [https://aws-splunk](https://aws-splunk)

index=o365 sourcetype=o365:management:activity ErrorNumber=2205013 | stats count by CreationTime, UserId, DisplayName, IsCompliantAndManaged, IsCompliant
 
[https://splunk-isso.cbp.dhs.gov/en-US/app/microsoft_cloud_app/search](https://splunk-isso.cbp.dhs.gov/en-US/app/microsoft_cloud_app/search)  
**Sent email for a User**  
index=o365 sourcetype="ms:o365:reporting:messagetrace" SenderAddress="ActiveDirectoryAdmin@cbp.dhs.gov"
 
**Which computers has a user logged into.**  
index=WinEventLog EventCode=4624 user="cu-mal017a-i4c2" Logon_Type=2  
| eval Workstation=coalesce(Workstation_Name, ComputerName)  
| table _time, user, Workstation  
| dedup Workstation