topic dnsrequest url or query help in Splunk Search

dnsrequest url or query help

tod_s — Sat, 20 Feb 2021 22:36:00 GMT

Hi Splunk community,

I am trying to determine the impact of removing Adobe Flash from our environment.

I have done basic search and the results returned are much higher than expected. This would most probably be because staff are accessing external content as well as internally hosted.

Is it possible to have a query that tells me which url has invoked flash player?

I have tried:

event_simpleName=ProcessRollup* FileName=FlashUtil*_ActiveX.exe

and

FileName=Flash*.ocx

The query returns, hostname, timestamp of execution, username, and others but i don't get the dns requests or url that invoked flash player.

So far to get around this I do another separate search (query) on the host, based on the timestamp (of the results of above query) looking up the dns request.

Example result:

Domainname: host: user: filename: commandline:

ssl.gstatic.com computer123 user123 iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" https://docs.google.com/spreadsheets/z/xyz/edit?usp=drive_web

Most DNS requests are within fraction of the second or +1 second.

Finding a computer with useful data is a draw of the luck and very time consuming.

Is anyone able to help with the above query?

I am trying to have on query that gives me hostname, username, timestamp, app e.g. FlashUtil*_ActiveX.exe and dns request or url, or commandline.

We use crowdstrike for end-point protection and the logs are feed to splunk by the crowdstrike agent.

Re: dnsrequest url or query help

tscroggins — Sun, 21 Feb 2021 01:27:36 GMT

@tod_s

If you use proxies and can log response content types, you could look for e.g. application/x-shockwave-flash or other Flash related content types.

Re: dnsrequest url or query help

tod_s — Mon, 22 Feb 2021 22:32:07 GMT

Hi tscroggins,

No proxies used - but our Crowdstrike agent collects detailed activity information, and exports logs to splunk. dns request; network connection, log on user, process running, etc.. being captured

Re: dnsrequest url or query help

tscroggins — Tue, 23 Feb 2021 03:28:06 GMT

@tod_s

I've not done this with Flash specifically, but I recommend asking your vendor to suggest or provide methods of logging access to Flash content as an indicator of compromise.

I mentioned proxies because they're often configured to re-encrypt traffic for inspection and logging.