193 lines
20 KiB
Markdown
193 lines
20 KiB
Markdown
## Contents
|
||
|
||
## Summary
|
||
|
||
## Active Directory Searches
|
||
|
||
## Server Searches
|
||
|
||
## Account Usage Searches (user rights assignments)
|
||
|
||
## O365 / Azure Searches
|
||
|
||
Pick your search head (as of April 2023):
|
||
[https://splunk-isso.cbp.dhs.gov/](https://splunk-isso.cbp.dhs.gov/) (prod)
|
||
[https://splunk.splunk-dev.cbp.dhs.gov](https://splunk.splunk-dev.cbp.dhs.gov) (development systems / SAT)
|
||
[https://splunk-vuln.cbp.dhs.gov](https://splunk-vuln.cbp.dhs.gov) (vulnerability tracking)
|
||
|
||
Old assignments no longer valid
|
||
[https://splunk-financial.cbp.dhs.gov/](https://splunk-financial.cbp.dhs.gov/) (eliminated April 2023)
|
||
[https://splunk.cbp.dhs.gov](https://splunk.cbp.dhs.gov) (appears abandoned)
|
||
[https://aws-splunk.cbp.dhs.gov](https://aws-splunk.cbp.dhs.gov) (eliminated April 2023) (AD and member servers, desktops)
|
||
|
||
## Summary (most of these can be modified to search all records or records for a specific user or system)
|
||
|
||
| | | |
|
||
|---|---|---|
|
||
|**Description**|**Event ID**|**Sample**|
|
||
|**Logon success/failure**|4624 success <br>4625 failure|index=wineventlog source="WinEventLog:Security" EventCode IN (4624,4625) <br>\| table ComputerName, subject, _time, Security_ID, Logon_Type, Account_Domain, Account_Name, Elevated_Token <br>\| sort _time \| reverse|
|
||
|**Use of weak mapping method (certificate)**|39|index=wineventlog source="WinEventLog:System" EventCode IN (39) user=baabq19 \| table user, Certificate_Subject|
|
||
|**Logon success/failure (tailored to users)** <br>**Interactive, unlock, and RDP**|4624 success|index=wineventlog source="WinEventLog:Security" EventCode IN (4624) Logon_Type IN (2,7,10,11) Account_Name!=DWM-* Account_Name!=UMFD-* Account_Name!=SVC-* Account_Domain=AD <br>\| eval Account_Name=mvindex(Account_Name,1) \| eval Account_Domain=mvindex(Account_Domain,1) <br>\| table Account_Name, Workstation_Name, Logon_Type, Account_Domain, subject, _time|
|
||
|**Member added / removed from LOCAL group**<br><br> <br><br>Something is amiss with the desktops and remote assistance|4732 Added <br>4733 Removed <br>4735 Modified|index="wineventlog" EventCode IN (4732,4733,4735) source="WinEventLog:Security" Security_ID!=*defaultuser0 <br>\| eval Modified_By=mvindex(Security_ID,0), Account_Modified=mvindex(Security_ID,1), Group_Name=mvindex(Security_ID,2) <br>\| table EventCode, _time, Account_Modified, subject, Group_Name, Modified_By <br>\| sort _time, Account_Modified|
|
||
|**Member added/removed from DOMAIN group**|4728 Added <br>4729 Removed|index="wineventlog" EventCode IN (4728,4729) source=WinEventLog:Security Security_ID!=*defaultuser0 <br>\| eval Modified_By=mvindex(Security_ID,0), Account_Modified=mvindex(Security_ID,1), Action=if(EventCode=4728, "Add", "Remove"), Group_Name=mvindex(Security_ID,2) <br>\| table EventCode, _time, Account_Modified, Action, Group_Name, Modified_By, Keywords \| sort _time, Account_Modified|
|
||
|**Local computer user right added/removed**|4704 Assigned <br>4705 Removed|source="WinEventLog:Security" EventCode IN (4704,4705) \| table ComputerName, subject, _time, User_Right, user|
|
||
|**Security log cleared**|1102||
|
||
|**Computer object deleted/created**|4743 deleted <br>4741 added|EventCode IN (4743,4741) source=WinEventLog:Security \| table _time, Account_Name, Keywords, EventCode, DNS_Host_Name|
|
||
|**User object created (local)**<br><br> <br><br>(less defaultuser0 from imaging process)|4720|EventCode IN (4720) source=WinEventLog:Security SAM_Account_Name!=defaultuser0 <br>\| eval Account_Name=mvindex(Security_ID,0), Account_Location=mvindex(Account_Domain,1) <br>\| rename user AS User_Target Account_Name as Created_By <br>\| table _time, Account_Location, Created_By, SAM_Account_Name, Display_Name, User_Principal_Name, Keywords|
|
||
|**User object deleted (local)**<br><br> <br><br>(less defaultuser0 from imaging process)|4726|EventCode IN (4726) source=WinEventLog:Security Account_Name!=defaultuser0 <br>\| eval Account_Name=mvindex(Security_ID,0), Account_Location=mvindex(Account_Domain,1) <br>\| rename user AS User_Target Account_Name as "Deleted By" <br>\| table _time, Account_Location, User_Target, "Deleted By", Keywords|
|
||
|**AD account authentication failure**|4625 logon fail|index=wineventlog EventCode IN (4625,4740) user=XyourAccountX <br>\| eval Account_Name=mvindex(Account_Name,1) <br>\| table _time, Account_Name, Failure_Reason, Account_Name, Workstation_Name, Source_Network_Address, Logon_Process, EventCode <br>\| sort _time,Account_Name|
|
||
|**AD account lockouts** (identify computer causing lockout)<br><br> <br><br>Add Account_Name=yourAccount to narrow|4740 lockout|index=wineventlog EventCode=4740 source=WinEventLog:Security <br>\| eval Account_Name=mvindex(Account_Name,1) \| rename Caller_Computer_Name as "ComputerOrigin" <br>\| table _time, Account_Name, ComputerOrigin, EventCode, host \| dedup ComputerOrigin, Account_Name|
|
||
|**Bad password / logon failure**|4625|index=wineventlog EventCode IN (4625) \| table _time, ComputerName, Account_Name, Failure_Reason, Workstation_Name, Source_Network_Address, Authentication_Package|
|
||
|**BSOD**|1001|index=wineventlog EventCode IN (1001) source="WinEventLog:System" "SourceName=BugCheck" <br>\| table ComputerName, _time, Message <br>\| sort ComputerName, _time|
|
||
|**Shutdown/Restart**<br><br> <br><br>Any reason any way incl unexpected, MECM, user initiated, BSOD, dirty…|41 dirty <br>1001 BSOD <br>1074 user <br>6005-6006 <br>6008 random|index=wineventlog EventCode IN (41, 1001,1074,6005,6006,6008) source="WinEventLog:System" SourceName!=SNMP <br>\| table ComputerName, _time, EventCode, Message, Shutdown_Type<br><br> <br><br>**Specific Computer:** <br>index=wineventlog EventCode IN (41, 1001,1074,6005,6006,6008) source=WinEventLog:System host===TASB30A-V0061*== <br>\| table ComputerName _time Message \| sort ComputerName, _time|
|
||
|**List computers reporting to Splunk**|All Windows<br><br> <br><br>All Win Servers|\| tstats dc(host) where index=wineventlog by host<br><br> <br><br>\| tstats dc(host) where index=wineventlog where host=t* by host|
|
||
|**Process execution**|4688|index=wineventlog EventCode=4688 source="WinEventLog:Security" <br>\| eval Account_Name=if(Security_ID="NULL SID", (mvindex(Security_ID,0)), Security_ID) <br>\| table ComputerName, _time, Account_Name, New_Process_Name, Process_Command_Line, Creator_Process_Name|
|
||
|**WIP********Process & command line** <br>**(Powershell or command)** <br>**Excluding system**||index=wineventlog host=anwg01aben EventCode=4104 User!=SYSTEM \| table _time, User, ComputerName, Message <br> <br>index=wineventlog EventCode IN (4104,4688) \| table EventCode, ComputerName, Message|
|
||
|**App installed/removed**|1033 Installed <br>1034 Removed|index=wineventlog source="WinEventLog:Application" EventCode IN (1033,1034) SourceName=MsiInstaller <br>\| table ComputerName, _time, User, Message \| sort ComputerName, _time|
|
||
|**Unexpected shutdown (when sys boots again)**|6008|index=wineventlog EventCode=6008 source=WinEventLog:System host=tnwg01a* <br>\| table ComputerName _time Message \| sort ComputerName, _time|
|
||
|**GPO changed**<br><br> <br><br>(I believe) Run get-gpo -guid "{guid-here}"|5136|index=wineventlog EventCode IN (5136) source=WinEventLog:Security versionNumber <br>\| table _time, Name, Account_Name, LDAP_Display_Name, Type|
|
||
|**File system auditing** <br>(Note must have enabled auditing on file system first)|4663|index=wineventlog host=tnwg01a-v2223 LogName=Security EventCode IN (4663) <br>\| table ComputerName, _time, Security_ID, Object_Type, Object_Name, Process_Name, Accesses, EventCode, action|
|
||
|**Custom event for PIV diagnostic (NOT USED)**|3001|index=wineventlog EventCode=3003 source=WinEventLog:Application \| table Hash, DiagResults, RFC822_1, ADmailAttribute, DHSAttribute13|
|
||
|**Find computers submitting RC4 encrypted tickets** (should be using AES because capable of AES)|4769|index=wineventlog EventCode=4769 Service_Name="*$" (Ticket_Options=0x40810000 OR Ticket_Options=0x40800000 OR Ticket_Options=0x40810010) Ticket_Encryption_Type=0x17 <br>\| stats count by dest, service, service_id, Ticket_Encryption_Type, Ticket_Options|
|
||
|**Find servers lacking HIPS and/or Antivirus**||Using [https://splunk-vuln.cbp.dhs.gov](https://splunk-vuln.cbp.dhs.gov)<br><br> <br><br>\| tstats summariesonly=false latest(_time) as latestTime, latest(scoring_details.latestScan) as latestScan, latest(scoring_details.justification) as justification, latest(scoring_details.pattern_age) as pattern_age, latest(scoring_details.hips_enabled) as hips_enabled, latest(scoring_details.last_scan_time) as last_scan_time, latest(scoring_details.pattern_date) as pattern_date, latest(scoring_details.agent_type) as agent_type, latest(scoring_details.osType) as osType, latest(scoring_details.osDistro) as osDistro, latest(scoring_details.hwamApplicable) as hwamApplicable, latest(scoring_details.swamApplicable) as swamApplicable, latest(scoring_details.cmApplicable) as cmApplicable, latest(scoring_details.vmApplicable) as vmApplicable, latest(scoring_details.num_prohibited_software) as num_prohibited_software, latest(scoring_details.receivedCredScan) as receivedCredScan, latest(scoring_details.vmScore) as vmScore, latest(scoring_details.cmScore) as cmScore, latest(scoring_details.vmCriticalCVEs) as vmCriticalCVEs, latest(scoring_details.highPct) as highPct, latest(scoring_details.critPct) as critPct, latest(scoring_details.vmHighCVEs) as vmHighCVEs latest(scoring_details.vmCriticalCveIds) as vmCriticalCveIds, latest(scoring_details.vmHighCveIds) as vmHighCveIds, latest(scoring_details.repository_name) as repository_name, latest(scoring_details.deviceClass) as deviceClass from datamodel=iscm_p2.scoring_details where scoring_details.environment="Production" AND scoring_details.deviceClass="SERVER" AND (scoring_details.osType="Windows") by scoring_details.info_search_time, scoring_details.dest_host, scoring_details.domain, scoring_details.environment, scoring_details.fismaID <br>\| `drop_dm_object_name("scoring_details")` <br>\| eventstats max(info_search_time) as latestEvent by dest_host, domain, fismaID, environment <br>\| where info_search_time=latestEvent <br>\| where justification="null" <br>\| lookup cbp_fisma_systems fismaID output systemName, systemShortName, programOffice, hvamescfo as designation <br>\| eval <br>avApplicable=case(deviceClass LIKE "Server" OR deviceClass LIKE "Workstation" OR deviceClass LIKE "Non-Windows Workstation" OR deviceClass LIKE "UNKNOWN", "yes", 1==1, "no"), <br>avCompliance=case(avApplicable="yes" AND pattern_age\<=15, "pass", avApplicable="yes" AND (pattern_age\>15 OR isnull(pattern_age)), "fail"), <br>hipsCompliance=case(avApplicable="yes" AND hips_enabled="On", "pass", avApplicable="yes" AND (hips_enabled="Off" OR isnull(hips_enabled)), "fail"), <br>hips_enabled = case(avApplicable="yes" AND isnull(hips_enabled), "Off", 1==1, hips_enabled), <br>last_scan_time = case(avApplicable="yes" AND isnull(last_scan_time), "UNKNOWN", 1==1, last_scan_time), <br>pattern_date = case(avApplicable="yes" AND isnull(pattern_date), "UNKNOWN", 1==1, pattern_date), <br>pattern_age = case(avApplicable="yes" AND isnull(pattern_age), "UNKNOWN", 1==1, pattern_age), <br>agent_type = case(avApplicable="yes" AND isnull(agent_type), "UNKNOWN", 1==1, agent_type), <br>avScore = case(avApplicable="yes" AND avCompliance="pass", "50", 1==1, 0), <br>hipsScore = case(avApplicable="yes" AND hipsCompliance="pass", "50", 1==1, 0), <br>hbdScore = avScore + hipsScore, <br>osType = case(osType=0, "UNKNOWN", 1==1, osType), <br>osDistro = case(osDistro=0, "UNKNOWN", 1==1, osDistro) \| stats <br>count(eval(if(avCompliance="pass",avCompliance, null()))) as totalAvPassed, <br>count(eval(if(avCompliance="fail", avCompliance, null()))) as totalAvFailed, <br>count(eval(if(avApplicable="yes", avCompliance, null()))) as totalAvApplicable, <br>count(eval(if(hipsCompliance="pass", hipsCompliance, null()))) as totalHipsPassed, <br>count(eval(if(hipsCompliance="fail", hipsCompliance, null()))) as totalHipsFailed by osType, dest_host <br>\| eval <br>avScore = (totalAvPassed/totalAvApplicable) * 50, <br>hipsScore = (totalHipsPassed/totalAvApplicable) * 50, <br>hbdScore = avScore + hipsScore <br>\| fillnull hbdScore value=100 <br>\| fields osType, dest_host, avScore, hipsScore, hbdScore|
|
||
|**M365 Delivery Report**||index=o365 sourcetype="ms:o365:reporting:messagetrace" SenderAddress="ActiveDirectoryAdmin@cbp.dhs.gov" \| table _time, SenderAddress Status, RecipientAddress, Received, Subject|
|
||
|
||
**Others/notes**
|
||
|
||
## Active Directory
|
||
|
||
##### Domain controller successful user login
|
||
|
||
index=wineventlog source="WinEventLog:Security" EventCode=4624 user=BADFJON Workstation_Name=ADCC10AOFW
|
||
|
||
index=wineventlog source="WinEventLog:Security" EventCode=4624 user=BADFJON Workstation_Name=ADCC10AOFW | table _time user Workstation_Name
|
||
|
||
index=wineventlog source="WinEventLog:Security" EventCode=4624 user=BADFJON Workstation_Name=ADCC10AOFW | table _time user Workstation_Name Source_Network_Address dest
|
||
|
||
##### Find event 5829 (netlogon vulnerable connections):
|
||
|
||
index=wineventlog fisma_app=cds source="WinEventLog:System" EventCode=5829 | stats count by Machine_SamAccountName
|
||
|
||
##### Account lockout
|
||
|
||
index=wineventlog source="WinEventLog:Security" user=SVC-OFAM-HIRSCH-01 subject="A user account was locked out"
|
||
|
||
##### PIV logon errors due to revocation checking
|
||
|
||
index=wineventlog source="WinEventLog:System" EventCode=21 SourceName="Microsoft-Windows-Kerberos-Key-Distribution-Center" | stats count by host
|
||
|
||
##### Changes made to domain admin (or others)
|
||
|
||
source="WinEventLog:Security" (EventCode=4728 OR EventCode=4729) Group_Name="*domain admins*"
|
||
| rename src_user AS "Changed By", user AS "Target User" name as "Action Taken"
|
||
| table "Changed By" "Target User" "Action Taken" Group_Name Account_Domain _time
|
||
| sort - _time
|
||
|
||
|
||
## Server/service Queries
|
||
|
||
index=wineventlog fisma_app=cds source="WinEventLog:Security" EventCode=4624 user=baabq19 | stats count by _time user Workstation_Name
|
||
|
||
##### Determine process kicked off and who called it with command line
|
||
|
||
source="WinEventLog:Security" EventCode=4688 host=tnwg01a-v3639 | table ComputerName, _time, New_Process_Name, Process_Command_Line, New_Process_ID, Creator_Process_Name, Creator_Process_ID
|
||
|
||
##### Query specific systems to determine accounts logging on
|
||
|
||
source="WinEventLog:Security" EventCode=4624 host=tnwg01a-v3824 Security_ID!="*SYSTEM" user!="SVC-CDS-MSIDS" | table _time user Source_Network_Address dest
|
||
|
||
##### Find accounts attempting to log onto a system that lack the appropriate logon type:
|
||
|
||
source="WinEventLog:Security" EventCode=4625 Failure_Reason="The user has not been granted the requested logon type at this machine." | stats count by host,user,"Logon_Type", Source_Network_Address, EventCode
|
||
|
||
##### Great query to track where account is being used (may need to go back a month or more for infrequent use)
|
||
|
||
Account_Name="svc-MIISCBP" source="WinEventLog:Security" EventCode=4624 | table _time user Workstation_Name Source_Network_Address dest
|
||
|
||
##### Computer unlocked
|
||
|
||
index=wineventlog source="WinEventLog:Security" EventCode=4801 user=baabq19-m | stats count by ComputerName
|
||
|
||
##### Computer locked and unlocked
|
||
|
||
index=wineventlog source="WinEventLog:Security" EventCode IN (4801,4800) user=baabq19-m | stats count by host EventCode
|
||
|
||
##### Show oldest and newest event 5829
|
||
|
||
index=wineventlog fisma_app=cds source="WinEventLog:System" EventCode=5829 | stats earliest(_time) AS Earliest, latest(_time) AS Latest by Machine_SamAccountName |convert ctime(Earliest) ctime(Latest)
|
||
|
||
##### Restarted computer event (startup actually - event log started event shows it best in case it was shut down dirty)
|
||
|
||
index=wineventlog source="WinEventLog:System" EventCode=6005 | table ComputerName, _time
|
||
|
||
index=wineventlog fisma_app=cds source="WinEventLog:Security" EventCode=4624 user=svc-vat-scan | table src
|
||
|
||
##### Unexpected shutdown on server:
|
||
|
||
EventCode=6008 host=tnwg01a* | table _time host Message
|
||
|
||
##### User added to local server group (exclude a couple noisy groups)
|
||
|
||
"EventCode=4732" index=wineventlog source="WinEventLog:Security" Security_ID!="*IIS_IUSRS*" Security_ID!="*WSS_WPG*" | table _time ComputerName Security_ID
|
||
|
||
##### Products installed on server
|
||
|
||
index=wineventlog source=WinEventLog:System EventCode=19 | eval Date=strftime(_time, "%Y/%m/%d")| rex "\WKB(?\<KB\>.\d+)\W" | stats count by Date, host, KB, fisma_app
|
||
|
||
##### Windows installer INSTALLED app (Msi installer)
|
||
|
||
index=wineventlog source="WinEventLog:Application" EventCode=1033 SourceName=MsiInstaller | table ComputerName, _time, User, Message
|
||
|
||
##### Windows installer REMOVED app (Msi installer)
|
||
|
||
index=wineventlog source="WinEventLog:Application" EventCode=1034 SourceName=MsiInstaller | table ComputerName, _time, User, Message
|
||
|
||
##### NTLMv1 (version 1) use without enabling audit capability [Network security Restrict NTLM Audit NTLM authentication in this domain (Windows 10) - Windows security | Microsoft Docs](https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-audit-ntlm-authentication-in-this-domain)
|
||
|
||
source=WinEventLog:Security EventCode=4624 Package_Name__NTLM_only_="NTLM V1" user!="*ANONYMOUS LOGON" | table Package_Name__NTLM_only_ Workstation_Name Account_Name
|
||
|
||
##### Logs for a particular error in app log (example finds click 2 run office failures
|
||
|
||
index=wineventlog source="WinEventLog:Application" EventCode=1000 SourceName="Application Error" Message="*Faulting module name: VCRUNTIME140.dll*" Message="*Office*" | table ComputerName, _time, User, Message
|
||
|
||
##### SOC VAT scanning activity - use this to find the VAT scanner IP activity on a host (agentless) - agent scans probably not easy to determine
|
||
|
||
source="WinEventLog:Security" src_ip="10.162.104.*"
|
||
| stats max(_time) as lastevent min(_time) as firstevent by ComputerName
|
||
| eval lastseen=strftime(lastevent,"%Y-%m-%d %I:%M %p"), firstseen=strftime(firstevent,"%Y-%m-%d %I:%M %p")
|
||
|
||
Similar except looking for agent scans
|
||
EventCode IN (4688,4689) nessusd.exe | table _time, ComputerName, TaskCategory, Process_Name, New_Process_Name | sort _time, ComputerName
|
||
|
||
##### Process with command line run on Windows system
|
||
|
||
(the eval pipe is there to eliminate NULL SID from the results in the table/output only)
|
||
EventCode=4688 | eval Account_Name=if(Security_ID="NULL SID", (mvindex(Security_ID,0)), Security_ID) | table ComputerName, _time, Account_Name, New_Process_Name, Process_Command_Line, New_Process_ID, Creator_Process_Name, Creator_Process_ID
|
||
|
||
## Account Usage Searches (user rights assignments)
|
||
|
||
##### Query specific servers for logon event and summarize with server, user and logon type
|
||
|
||
source="WinEventLog:Security" EventCode=4624 (host=TNWG01A-V3819 OR TNWG01A-V3820 OR TNWG01A-V3821 OR TNWG01A-V3822 OR TNWG01A-V3824) user!=*$ user!=*SYSTEM | stats count by host,user,"Logon_Type"
|
||
|
||
## Office 365 / Azure
|
||
|
||
##### Changes to roles
|
||
|
||
sourcetype="o365:management:activity" "ModifiedProperties{}.OldValue"=TenantAdmins OR "ModifiedProperties{}.NewValue"=TenantAdmins
|
||
|
||
##### Query for "CRL download not allowed." [https://aws-splunk](https://aws-splunk)
|
||
|
||
index=o365 sourcetype=o365:management:activity ErrorNumber=2205013 | stats count by CreationTime, UserId, DisplayName, IsCompliantAndManaged, IsCompliant
|
||
|
||
[https://splunk-isso.cbp.dhs.gov/en-US/app/microsoft_cloud_app/search](https://splunk-isso.cbp.dhs.gov/en-US/app/microsoft_cloud_app/search)
|
||
**Sent email for a User**
|
||
index=o365 sourcetype="ms:o365:reporting:messagetrace" SenderAddress="ActiveDirectoryAdmin@cbp.dhs.gov"
|
||
|
||
**Which computers has a user logged into.**
|
||
index=WinEventLog EventCode=4624 user="cu-mal017a-i4c2" Logon_Type=2
|
||
| eval Workstation=coalesce(Workstation_Name, ComputerName)
|
||
| table _time, user, Workstation
|
||
| dedup Workstation
|
||
|
||
index=wineventlog source="WinEventLog:Security" EventCode=4624 (user="SVC-EDME-WSG-SCORCH" OR user="SVC-EDME-COMPUTER-CL" OR user="SVC-EDME-USER-CL" OR user="SVC-EDME-WSG-SYSCENT") | stats count by host,user,"Logon_Type", Source_Network_Address |