topic Windows File System Auditing in Getting Data In

Windows File System Auditing

jdoles — Fri, 24 Dec 2010 00:12:55 GMT

I'm attempting to reports & alert on file changes/deletes using Windows Object Access/File System auditing. I see the events coming through Splunk, but I'm struggling to get the events from Windows 2003 & Windows 2008 to show up in one saved search since the EventCode is different. I just need to show events from user accounts that are not service/SYSTEM.

I saw where I may be able to use transactions, so I built the query below.

index="testindex" sourcetype="WinEventLog:Security" | transaction EventCode maxspan=1m maxpause=30 | where (CategoryString="Object Access" OR TaskCategory="File System") AND LIKE (Message, "%WriteData%") AND NOT LIKE (User, "SYSTEM") AND NOT LIKE (Message, "%Account Name:%SYSTEM%")

It seems to work somewhat. Admittedly I don't fully understand transactions. Any help is appreciated. Splunk 4.1.6 on Windows Server 2008.

Re: Windows File System Auditing

southeringtonp — Fri, 24 Dec 2010 02:22:15 GMT

In places where Win2008 event codes are different from Win2003, it's usually just by an offset of 4096. You just need to create a new field that has the equivalent codes for comparison.

Also, try to filter out as much as possible in your initial search string instead of using where. Doing so is almost always a good idea, but can make a particularly big difference when using transaction.

Something like:

index="testindex" sourcetype"WinEventLog:Security"
CategoryString="Object Access" OR TaskCategory="File System"
"*WriteData*" NOT User="System" NOT "Account Name: SYSTEM"
| eval ComparisonCode=if(EventCode<4096, EventCode+4096, EventCode)
| transaction maxspan=1m maxpause=30 ComparisonCode

Re: Windows File System Auditing

jdoles — Mon, 27 Dec 2010 20:52:56 GMT

Excellent! I never made the connection regarding the offset. The search string was a huge help.
Thanks again for the help.

Re: Windows File System Auditing

mcronkrite — Tue, 23 Sep 2014 11:21:26 GMT

On newer systems EventCode 560 is the key.
Check out these links:
http://blogs.splunk.com/2013/07/08/audit-file-access-and-change-in-windows/

http://www.intelliadmin.com/index.php/2008/03/use-auditing-to-track-who-deleted-your-files/

http://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=560

http://social.technet.microsoft.com/forums/windowsserver/en-US/ed94f9ca-586a-44a2-a6fc-03a97a8ae8ab/start-audit-logs-on-the-server-for-deleted-files