https://community.splunk.com/t5/Splunk-Search/Help-me-with-the-SPL/m-p/679479#M232297 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168">@ITWhisperer</a>&nbsp;,</P><P>Usecase is related to Lateral movement&nbsp;</P><P>Thanks.<BR /><BR /><BR /></P> Wed, 06 Mar 2024 16:18:14 GMT Akhanda 2024-03-06T16:18:14Z https://community.splunk.com/t5/Splunk-Search/Help-me-with-the-SPL/m-p/679455#M232286 <P>Hi,<BR />Could some one pls help me the lateral movement which&nbsp; look for a user with remote NTLM (type 3) logins on an abnormal number of destinations.</P><P>&nbsp;</P><LI-CODE lang="markup"></LI-CODE><P>&nbsp;</P><P><BR />Thanks</P> Wed, 06 Mar 2024 16:17:14 GMT https://community.splunk.com/t5/Splunk-Search/Help-me-with-the-SPL/m-p/679455#M232286 Akhanda 2024-03-06T16:17:14Z https://community.splunk.com/t5/Splunk-Search/Help-me-with-the-SPL/m-p/679458#M232287 <P>I am not sure what that ask is here</P><P>What is your concern regarding plagarism? If I rewrite this SPL and you use it, are you then not plagarising my SPL?</P><P>It is not clear what NTLM (type 3) is - could you just change the Logon_Type or LogonType part of the search to look for 3 instead of 10?</P><P>Please share some anonymised events so we can see what you are dealing with, and an indication of the expected output?</P> Mon, 04 Mar 2024 10:42:10 GMT https://community.splunk.com/t5/Splunk-Search/Help-me-with-the-SPL/m-p/679458#M232287 ITWhisperer 2024-03-04T10:42:10Z https://community.splunk.com/t5/Splunk-Search/Help-me-with-the-SPL/m-p/679479#M232297 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168">@ITWhisperer</a>&nbsp;,</P><P>Usecase is related to Lateral movement&nbsp;</P><P>Thanks.<BR /><BR /><BR /></P> Wed, 06 Mar 2024 16:18:14 GMT https://community.splunk.com/t5/Splunk-Search/Help-me-with-the-SPL/m-p/679479#M232297 Akhanda 2024-03-06T16:18:14Z https://community.splunk.com/t5/Splunk-Search/Help-me-with-the-SPL/m-p/679593#M232328 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168">@ITWhisperer</a>&nbsp;,</P><P>This above query is based on&nbsp;&nbsp;<BR /><A href="https://www.splunk.com/en_us/blog/security/active-directory-lateral-movement-detection-threat-research-release-november-2021.html" target="_blank">https://www.splunk.com/en_us/blog/security/active-directory-lateral-movement-detection-threat-research-release-november-2021.html</A><BR />if possible pls help me in making a query as per the sample event.<BR />thanks</P> Tue, 05 Mar 2024 13:44:21 GMT https://community.splunk.com/t5/Splunk-Search/Help-me-with-the-SPL/m-p/679593#M232328 Akhanda 2024-03-05T13:44:21Z https://community.splunk.com/t5/Splunk-Search/Help-me-with-the-SPL/m-p/679600#M232332 <P>Sorry, I am not a security expert.</P> Tue, 05 Mar 2024 15:10:15 GMT https://community.splunk.com/t5/Splunk-Search/Help-me-with-the-SPL/m-p/679600#M232332 ITWhisperer 2024-03-05T15:10:15Z