20 KiB
Contents
Summary
Active Directory Searches
Server Searches
Account Usage Searches (user rights assignments)
O365 / Azure Searches
Pick your search head (as of April 2023):
https://splunk-isso.cbp.dhs.gov/ (prod)
https://splunk.splunk-dev.cbp.dhs.gov (development systems / SAT)
https://splunk-vuln.cbp.dhs.gov (vulnerability tracking)
Old assignments no longer valid
https://splunk-financial.cbp.dhs.gov/ (eliminated April 2023)
https://splunk.cbp.dhs.gov (appears abandoned)
https://aws-splunk.cbp.dhs.gov (eliminated April 2023) (AD and member servers, desktops)
Summary (most of these can be modified to search all records or records for a specific user or system)
| Description | Event ID | Sample |
| Logon success/failure | 4624 success 4625 failure |
index=wineventlog source="WinEventLog:Security" EventCode IN (4624,4625) | table ComputerName, subject, _time, Security_ID, Logon_Type, Account_Domain, Account_Name, Elevated_Token | sort _time | reverse |
| Use of weak mapping method (certificate) | 39 | index=wineventlog source="WinEventLog:System" EventCode IN (39) user=baabq19 | table user, Certificate_Subject |
| Logon success/failure (tailored to users) Interactive, unlock, and RDP |
4624 success | index=wineventlog source="WinEventLog:Security" EventCode IN (4624) Logon_Type IN (2,7,10,11) Account_Name!=DWM-* Account_Name!=UMFD-* Account_Name!=SVC-* Account_Domain=AD | eval Account_Name=mvindex(Account_Name,1) | eval Account_Domain=mvindex(Account_Domain,1) | table Account_Name, Workstation_Name, Logon_Type, Account_Domain, subject, _time |
| Member added / removed from LOCAL group Something is amiss with the desktops and remote assistance |
4732 Added 4733 Removed 4735 Modified |
index="wineventlog" EventCode IN (4732,4733,4735) source="WinEventLog:Security" Security_ID!=*defaultuser0 | eval Modified_By=mvindex(Security_ID,0), Account_Modified=mvindex(Security_ID,1), Group_Name=mvindex(Security_ID,2) | table EventCode, _time, Account_Modified, subject, Group_Name, Modified_By | sort _time, Account_Modified |
| Member added/removed from DOMAIN group | 4728 Added 4729 Removed |
index="wineventlog" EventCode IN (4728,4729) source=WinEventLog:Security Security_ID!=*defaultuser0 | eval Modified_By=mvindex(Security_ID,0), Account_Modified=mvindex(Security_ID,1), Action=if(EventCode=4728, "Add", "Remove"), Group_Name=mvindex(Security_ID,2) | table EventCode, _time, Account_Modified, Action, Group_Name, Modified_By, Keywords | sort _time, Account_Modified |
| Local computer user right added/removed | 4704 Assigned 4705 Removed |
source="WinEventLog:Security" EventCode IN (4704,4705) | table ComputerName, subject, _time, User_Right, user |
| Security log cleared | 1102 | |
| Computer object deleted/created | 4743 deleted 4741 added |
EventCode IN (4743,4741) source=WinEventLog:Security | table _time, Account_Name, Keywords, EventCode, DNS_Host_Name |
| User object created (local) (less defaultuser0 from imaging process) |
4720 | EventCode IN (4720) source=WinEventLog:Security SAM_Account_Name!=defaultuser0 | eval Account_Name=mvindex(Security_ID,0), Account_Location=mvindex(Account_Domain,1) | rename user AS User_Target Account_Name as Created_By | table _time, Account_Location, Created_By, SAM_Account_Name, Display_Name, User_Principal_Name, Keywords |
| User object deleted (local) (less defaultuser0 from imaging process) |
4726 | EventCode IN (4726) source=WinEventLog:Security Account_Name!=defaultuser0 | eval Account_Name=mvindex(Security_ID,0), Account_Location=mvindex(Account_Domain,1) | rename user AS User_Target Account_Name as "Deleted By" | table _time, Account_Location, User_Target, "Deleted By", Keywords |
| AD account authentication failure | 4625 logon fail | index=wineventlog EventCode IN (4625,4740) user=XyourAccountX | eval Account_Name=mvindex(Account_Name,1) | table _time, Account_Name, Failure_Reason, Account_Name, Workstation_Name, Source_Network_Address, Logon_Process, EventCode | sort _time,Account_Name |
| AD account lockouts (identify computer causing lockout) Add Account_Name=yourAccount to narrow |
4740 lockout | index=wineventlog EventCode=4740 source=WinEventLog:Security | eval Account_Name=mvindex(Account_Name,1) | rename Caller_Computer_Name as "ComputerOrigin" | table _time, Account_Name, ComputerOrigin, EventCode, host | dedup ComputerOrigin, Account_Name |
| Bad password / logon failure | 4625 | index=wineventlog EventCode IN (4625) | table _time, ComputerName, Account_Name, Failure_Reason, Workstation_Name, Source_Network_Address, Authentication_Package |
| BSOD | 1001 | index=wineventlog EventCode IN (1001) source="WinEventLog:System" "SourceName=BugCheck" | table ComputerName, _time, Message | sort ComputerName, _time |
| Shutdown/Restart Any reason any way incl unexpected, MECM, user initiated, BSOD, dirty… |
41 dirty 1001 BSOD 1074 user 6005-6006 6008 random |
index=wineventlog EventCode IN (41, 1001,1074,6005,6006,6008) source="WinEventLog:System" SourceName!=SNMP | table ComputerName, _time, EventCode, Message, Shutdown_Type Specific Computer: index=wineventlog EventCode IN (41, 1001,1074,6005,6006,6008) source=WinEventLog:System host===TASB30A-V0061*== | table ComputerName _time Message | sort ComputerName, _time |
| List computers reporting to Splunk | All Windows All Win Servers |
| tstats dc(host) where index=wineventlog by host | tstats dc(host) where index=wineventlog where host=t* by host |
| Process execution | 4688 | index=wineventlog EventCode=4688 source="WinEventLog:Security" | eval Account_Name=if(Security_ID="NULL SID", (mvindex(Security_ID,0)), Security_ID) | table ComputerName, _time, Account_Name, New_Process_Name, Process_Command_Line, Creator_Process_Name |
| WIP****Process & command line (Powershell or command) Excluding system |
index=wineventlog host=anwg01aben EventCode=4104 User!=SYSTEM | table _time, User, ComputerName, Message index=wineventlog EventCode IN (4104,4688) | table EventCode, ComputerName, Message |
|
| App installed/removed | 1033 Installed 1034 Removed |
index=wineventlog source="WinEventLog:Application" EventCode IN (1033,1034) SourceName=MsiInstaller | table ComputerName, _time, User, Message | sort ComputerName, _time |
| Unexpected shutdown (when sys boots again) | 6008 | index=wineventlog EventCode=6008 source=WinEventLog:System host=tnwg01a* | table ComputerName _time Message | sort ComputerName, _time |
| GPO changed (I believe) Run get-gpo -guid "{guid-here}" |
5136 | index=wineventlog EventCode IN (5136) source=WinEventLog:Security versionNumber | table _time, Name, Account_Name, LDAP_Display_Name, Type |
| File system auditing (Note must have enabled auditing on file system first) |
4663 | index=wineventlog host=tnwg01a-v2223 LogName=Security EventCode IN (4663) | table ComputerName, _time, Security_ID, Object_Type, Object_Name, Process_Name, Accesses, EventCode, action |
| Custom event for PIV diagnostic (NOT USED) | 3001 | index=wineventlog EventCode=3003 source=WinEventLog:Application | table Hash, DiagResults, RFC822_1, ADmailAttribute, DHSAttribute13 |
| Find computers submitting RC4 encrypted tickets (should be using AES because capable of AES) | 4769 | index=wineventlog EventCode=4769 Service_Name="*$" (Ticket_Options=0x40810000 OR Ticket_Options=0x40800000 OR Ticket_Options=0x40810010) Ticket_Encryption_Type=0x17 | stats count by dest, service, service_id, Ticket_Encryption_Type, Ticket_Options |
| Find servers lacking HIPS and/or Antivirus | Using https://splunk-vuln.cbp.dhs.gov | tstats summariesonly=false latest(_time) as latestTime, latest(scoring_details.latestScan) as latestScan, latest(scoring_details.justification) as justification, latest(scoring_details.pattern_age) as pattern_age, latest(scoring_details.hips_enabled) as hips_enabled, latest(scoring_details.last_scan_time) as last_scan_time, latest(scoring_details.pattern_date) as pattern_date, latest(scoring_details.agent_type) as agent_type, latest(scoring_details.osType) as osType, latest(scoring_details.osDistro) as osDistro, latest(scoring_details.hwamApplicable) as hwamApplicable, latest(scoring_details.swamApplicable) as swamApplicable, latest(scoring_details.cmApplicable) as cmApplicable, latest(scoring_details.vmApplicable) as vmApplicable, latest(scoring_details.num_prohibited_software) as num_prohibited_software, latest(scoring_details.receivedCredScan) as receivedCredScan, latest(scoring_details.vmScore) as vmScore, latest(scoring_details.cmScore) as cmScore, latest(scoring_details.vmCriticalCVEs) as vmCriticalCVEs, latest(scoring_details.highPct) as highPct, latest(scoring_details.critPct) as critPct, latest(scoring_details.vmHighCVEs) as vmHighCVEs latest(scoring_details.vmCriticalCveIds) as vmCriticalCveIds, latest(scoring_details.vmHighCveIds) as vmHighCveIds, latest(scoring_details.repository_name) as repository_name, latest(scoring_details.deviceClass) as deviceClass from datamodel=iscm_p2.scoring_details where scoring_details.environment="Production" AND scoring_details.deviceClass="SERVER" AND (scoring_details.osType="Windows") by scoring_details.info_search_time, scoring_details.dest_host, scoring_details.domain, scoring_details.environment, scoring_details.fismaID | drop_dm_object_name("scoring_details") | eventstats max(info_search_time) as latestEvent by dest_host, domain, fismaID, environment | where info_search_time=latestEvent | where justification="null" | lookup cbp_fisma_systems fismaID output systemName, systemShortName, programOffice, hvamescfo as designation | eval avApplicable=case(deviceClass LIKE "Server" OR deviceClass LIKE "Workstation" OR deviceClass LIKE "Non-Windows Workstation" OR deviceClass LIKE "UNKNOWN", "yes", 1==1, "no"), avCompliance=case(avApplicable="yes" AND pattern_age<=15, "pass", avApplicable="yes" AND (pattern_age>15 OR isnull(pattern_age)), "fail"), hipsCompliance=case(avApplicable="yes" AND hips_enabled="On", "pass", avApplicable="yes" AND (hips_enabled="Off" OR isnull(hips_enabled)), "fail"), hips_enabled = case(avApplicable="yes" AND isnull(hips_enabled), "Off", 1==1, hips_enabled), last_scan_time = case(avApplicable="yes" AND isnull(last_scan_time), "UNKNOWN", 1==1, last_scan_time), pattern_date = case(avApplicable="yes" AND isnull(pattern_date), "UNKNOWN", 1==1, pattern_date), pattern_age = case(avApplicable="yes" AND isnull(pattern_age), "UNKNOWN", 1==1, pattern_age), agent_type = case(avApplicable="yes" AND isnull(agent_type), "UNKNOWN", 1==1, agent_type), avScore = case(avApplicable="yes" AND avCompliance="pass", "50", 1==1, 0), hipsScore = case(avApplicable="yes" AND hipsCompliance="pass", "50", 1==1, 0), hbdScore = avScore + hipsScore, osType = case(osType=0, "UNKNOWN", 1==1, osType), osDistro = case(osDistro=0, "UNKNOWN", 1==1, osDistro) | stats count(eval(if(avCompliance="pass",avCompliance, null()))) as totalAvPassed, count(eval(if(avCompliance="fail", avCompliance, null()))) as totalAvFailed, count(eval(if(avApplicable="yes", avCompliance, null()))) as totalAvApplicable, count(eval(if(hipsCompliance="pass", hipsCompliance, null()))) as totalHipsPassed, count(eval(if(hipsCompliance="fail", hipsCompliance, null()))) as totalHipsFailed by osType, dest_host | eval avScore = (totalAvPassed/totalAvApplicable) * 50, hipsScore = (totalHipsPassed/totalAvApplicable) * 50, hbdScore = avScore + hipsScore | fillnull hbdScore value=100 | fields osType, dest_host, avScore, hipsScore, hbdScore |
|
| M365 Delivery Report | index=o365 sourcetype="ms:o365:reporting:messagetrace" SenderAddress="ActiveDirectoryAdmin@cbp.dhs.gov" | table _time, SenderAddress Status, RecipientAddress, Received, Subject |
Others/notes
Active Directory
Domain controller successful user login
index=wineventlog source="WinEventLog:Security" EventCode=4624 user=BADFJON Workstation_Name=ADCC10AOFW
index=wineventlog source="WinEventLog:Security" EventCode=4624 user=BADFJON Workstation_Name=ADCC10AOFW | table _time user Workstation_Name
index=wineventlog source="WinEventLog:Security" EventCode=4624 user=BADFJON Workstation_Name=ADCC10AOFW | table _time user Workstation_Name Source_Network_Address dest
Find event 5829 (netlogon vulnerable connections):
index=wineventlog fisma_app=cds source="WinEventLog:System" EventCode=5829 | stats count by Machine_SamAccountName
Account lockout
index=wineventlog source="WinEventLog:Security" user=SVC-OFAM-HIRSCH-01 subject="A user account was locked out"
PIV logon errors due to revocation checking
index=wineventlog source="WinEventLog:System" EventCode=21 SourceName="Microsoft-Windows-Kerberos-Key-Distribution-Center" | stats count by host
Changes made to domain admin (or others)
source="WinEventLog:Security" (EventCode=4728 OR EventCode=4729) Group_Name="domain admins"
| rename src_user AS "Changed By", user AS "Target User" name as "Action Taken"
| table "Changed By" "Target User" "Action Taken" Group_Name Account_Domain _time
| sort - _time
Server/service Queries
index=wineventlog fisma_app=cds source="WinEventLog:Security" EventCode=4624 user=baabq19 | stats count by _time user Workstation_Name
Determine process kicked off and who called it with command line
source="WinEventLog:Security" EventCode=4688 host=tnwg01a-v3639 | table ComputerName, _time, New_Process_Name, Process_Command_Line, New_Process_ID, Creator_Process_Name, Creator_Process_ID
Query specific systems to determine accounts logging on
source="WinEventLog:Security" EventCode=4624 host=tnwg01a-v3824 Security_ID!="*SYSTEM" user!="SVC-CDS-MSIDS" | table _time user Source_Network_Address dest
Find accounts attempting to log onto a system that lack the appropriate logon type:
source="WinEventLog:Security" EventCode=4625 Failure_Reason="The user has not been granted the requested logon type at this machine." | stats count by host,user,"Logon_Type", Source_Network_Address, EventCode
Great query to track where account is being used (may need to go back a month or more for infrequent use)
Account_Name="svc-MIISCBP" source="WinEventLog:Security" EventCode=4624 | table _time user Workstation_Name Source_Network_Address dest
Computer unlocked
index=wineventlog source="WinEventLog:Security" EventCode=4801 user=baabq19-m | stats count by ComputerName
Computer locked and unlocked
index=wineventlog source="WinEventLog:Security" EventCode IN (4801,4800) user=baabq19-m | stats count by host EventCode
Show oldest and newest event 5829
index=wineventlog fisma_app=cds source="WinEventLog:System" EventCode=5829 | stats earliest(_time) AS Earliest, latest(_time) AS Latest by Machine_SamAccountName |convert ctime(Earliest) ctime(Latest)
Restarted computer event (startup actually - event log started event shows it best in case it was shut down dirty)
index=wineventlog source="WinEventLog:System" EventCode=6005 | table ComputerName, _time
index=wineventlog fisma_app=cds source="WinEventLog:Security" EventCode=4624 user=svc-vat-scan | table src
Unexpected shutdown on server:
EventCode=6008 host=tnwg01a* | table _time host Message
User added to local server group (exclude a couple noisy groups)
"EventCode=4732" index=wineventlog source="WinEventLog:Security" Security_ID!="IIS_IUSRS" Security_ID!="WSS_WPG" | table _time ComputerName Security_ID
Products installed on server
index=wineventlog source=WinEventLog:System EventCode=19 | eval Date=strftime(_time, "%Y/%m/%d")| rex "\WKB(?<KB>.\d+)\W" | stats count by Date, host, KB, fisma_app
Windows installer INSTALLED app (Msi installer)
index=wineventlog source="WinEventLog:Application" EventCode=1033 SourceName=MsiInstaller | table ComputerName, _time, User, Message
Windows installer REMOVED app (Msi installer)
index=wineventlog source="WinEventLog:Application" EventCode=1034 SourceName=MsiInstaller | table ComputerName, _time, User, Message
NTLMv1 (version 1) use without enabling audit capability Network security Restrict NTLM Audit NTLM authentication in this domain (Windows 10) - Windows security | Microsoft Docs
source=WinEventLog:Security EventCode=4624 Package_Name__NTLM_only_="NTLM V1" user!="*ANONYMOUS LOGON" | table Package_Name__NTLM_only_ Workstation_Name Account_Name
Logs for a particular error in app log (example finds click 2 run office failures
index=wineventlog source="WinEventLog:Application" EventCode=1000 SourceName="Application Error" Message="Faulting module name: VCRUNTIME140.dll" Message="Office" | table ComputerName, _time, User, Message
SOC VAT scanning activity - use this to find the VAT scanner IP activity on a host (agentless) - agent scans probably not easy to determine
source="WinEventLog:Security" src_ip="10.162.104.*"
| stats max(_time) as lastevent min(_time) as firstevent by ComputerName
| eval lastseen=strftime(lastevent,"%Y-%m-%d %I:%M %p"), firstseen=strftime(firstevent,"%Y-%m-%d %I:%M %p")
Similar except looking for agent scans
EventCode IN (4688,4689) nessusd.exe | table _time, ComputerName, TaskCategory, Process_Name, New_Process_Name | sort _time, ComputerName
Process with command line run on Windows system
(the eval pipe is there to eliminate NULL SID from the results in the table/output only)
EventCode=4688 | eval Account_Name=if(Security_ID="NULL SID", (mvindex(Security_ID,0)), Security_ID) | table ComputerName, _time, Account_Name, New_Process_Name, Process_Command_Line, New_Process_ID, Creator_Process_Name, Creator_Process_ID
Account Usage Searches (user rights assignments)
Query specific servers for logon event and summarize with server, user and logon type
source="WinEventLog:Security" EventCode=4624 (host=TNWG01A-V3819 OR TNWG01A-V3820 OR TNWG01A-V3821 OR TNWG01A-V3822 OR TNWG01A-V3824) user!=*$ user!=*SYSTEM | stats count by host,user,"Logon_Type"
Office 365 / Azure
Changes to roles
sourcetype="o365:management:activity" "ModifiedProperties{}.OldValue"=TenantAdmins OR "ModifiedProperties{}.NewValue"=TenantAdmins
Query for "CRL download not allowed." https://aws-splunk
index=o365 sourcetype=o365:management:activity ErrorNumber=2205013 | stats count by CreationTime, UserId, DisplayName, IsCompliantAndManaged, IsCompliant
https://splunk-isso.cbp.dhs.gov/en-US/app/microsoft_cloud_app/search
Sent email for a User
index=o365 sourcetype="ms:o365:reporting:messagetrace" SenderAddress="ActiveDirectoryAdmin@cbp.dhs.gov"
Which computers has a user logged into.
index=WinEventLog EventCode=4624 user="cu-mal017a-i4c2" Logon_Type=2
| eval Workstation=coalesce(Workstation_Name, ComputerName)
| table _time, user, Workstation
| dedup Workstation