topic Re: File Deletion search query in Splunk Search

File Deletion search query

mailmetoramu — Thu, 11 Oct 2018 14:40:01 GMT

Hi All,

Actually in one of my server, some files has been deleted from the file path C\Windows\Systems32\drivers\etc\hosts.

Under the hosts, the file has been completely deleted by someone, need to investigate on that.

Can anyone tell me exact query i need to type in search head to fetch the logs from splunk from this particular directory.

Thanks,

Ramu.R

Re: File Deletion search query

ddrillic — Thu, 11 Oct 2018 14:53:34 GMT

Can you please try? index=* source="C:\\Windows\\Systems32\\drivers\\etc\\hosts.*"

Re: File Deletion search query

adonio — Thu, 11 Oct 2018 15:09:49 GMT

are you pulling that data into splunk?
to find deletions or file modifications, you will have to enable auditing on that particular directory / file
this is being done on the windows (OS) side. also, you will have to pull and bring windows security event logs to splunk

Re: File Deletion search query

iamarkaprabha — Thu, 11 Oct 2018 15:25:53 GMT

If your windows AD data is coming into splunk indexes, then you can identify who has deleted it most probably

Re: File Deletion search query

adonio — Thu, 11 Oct 2018 15:31:46 GMT

i think it will be good to double check, without proper auditing rules enabled on the directory or file prior to deletion, imho widows will not log the file deletion.

Re: File Deletion search query

iamarkaprabha — Thu, 11 Oct 2018 15:52:15 GMT

I think it will log those info. The event code for file deletion is 4656 .
Please refer to the below links for more information.

https://www.netwrix.com/how_to_detect_who_deleted_file.html
https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4656

Re: File Deletion search query

mailmetoramu — Thu, 11 Oct 2018 16:04:18 GMT

Hi ddrillic,

Its not working actually, moreover i did not see the host name mentioned in your query.

Thanks,

Ramu.R

Re: File Deletion search query

mailmetoramu — Thu, 11 Oct 2018 16:07:09 GMT

All proper rules has been enabled perfectly. Just mention only the required query instead of posting links for articles, i have already gone through 100s of link like these, then only i came here for answer.

Re: File Deletion search query

adonio — Thu, 11 Oct 2018 16:13:54 GMT

in that case, look for ... EventCode=4656 ... <file name> ...

Re: File Deletion search query

mailmetoramu — Thu, 11 Oct 2018 16:18:45 GMT

Hi Adonio,

Can you paste the complete query here

Re: File Deletion search query

mailmetoramu — Fri, 12 Oct 2018 14:34:20 GMT

Hi All,

Lets make my question as below :

Hostname : abc123

File Path : C\Windows\System32\drivers\etc\hosts

Under the hosts, the file has been completely deleted by someone. Can anyone tell me exact query for this scenario.

Thanks,

Ramu.R