Help with Splunk Query to detect unusual logons to different computers

chriscioffi88 — Tue, 26 Mar 2019 10:20:47 GMT

Good morning,

I am wondering what commands that I can use in order to detect a user account logging into a machine that is different from the norm.

Use case:

jbloggs usually logs into Computer A,
jbloggs logs into Computer B (which has never been accessed by this account before)

Any help will be greatly appreciated

Thanks in advance.

Re: Help with Splunk Query to detect unusual logons to different computers

lakshman239 — Tue, 29 Sep 2020 23:53:11 GMT

The search depends on the data from your source. Assuming, you are looking at windows events from endpoints [ local computer], you can look at EventCode=4624 and it will give you the computer user is loging in and user id. So you could create a search something like index=your_index_name EventCode=4624 | table _time, user, Workstation_Name that could get you started.

Alternatively, if you have the data in Authentication datamodel, that can be used as well.

https://answers.splunk.com/answers/127012/how-can-i-use-windows-events-to-monitor-logon-sessions.html
https://gosplunk.com/user-logon-session-duration/
https://www.ultimatewindowssecurity.com/blog/default.aspx?p=26180f8b-42a6-49a2-949d-ac44494353cb

topic Help with Splunk Query to detect unusual logons to different computers in Splunk Search

Help with Splunk Query to detect unusual logons to different computers

Re: Help with Splunk Query to detect unusual logons to different computers