topic Re: How to extract data from Microsoft Event Code 4656 (Failed Object Access) ? in Splunk Search

How to extract data from Microsoft Event Code 4656 (Failed Object Access) ?

jbala1 — Tue, 29 Sep 2020 16:29:43 GMT

I'm reviewing Microsoft Event Code 4656 (Failed Object Access) but when I try to audit Accesses or Access Reasons, Splunk will only return the first event in that field (In this situation it's DELETE). I'm trying to find a way to table all results to see everything in that field (i.e. Read Control, Write DAC, Synchronize, ReadData, WriteData too) Not just DELETE.

I've tried mvindex, stats list(Accesses), stats values(Accesses)...but the results always return the first result. I was thinking maybe I have to write a regular expression to list everything between Accesses: to Access Reasons:, AND Access Reasons: to Access Masks:

Any information you can provide me would be appreciated because right now I'm stuck.

Index=winevents sourcetype=wineventlog:security EventCode=4656
| "this is where I'm stuck"
| table user, host, Object_Name, Access_Reasons

Accesses: DELETE
READ_CONTROL
WRITE_DAC
SYNCHRONIZE
ReadData (or ListDirectory)
WriteData (or AddFile)
ReadEA
WriteEA
ReadAttributes
WriteAttributes

Access Reasons: DELETE: Unknown or unchecked
READ_CONTROL: Unknown or unchecked
WRITE_DAC: Unknown or unchecked
SYNCHRONIZE: Unknown or unchecked
ReadData (or ListDirectory): Unknown or unchecked
WriteData (or AddFile): Unknown or unchecked
ReadEA: Unknown or unchecked
WriteEA: Unknown or unchecked
ReadAttributes: Unknown or unchecked
WriteAttributes: Unknown or unchecked

Access Mask:

Re: How to extract data from Microsoft Event Code 4656 (Failed Object Access) ?

cpetterborg — Thu, 26 Oct 2017 21:59:18 GMT

Using the data that you provided, this is an example of the rex command(s) that will extract the information that you want (I believe):

| makeresults 
|eval raw="Accesses: DELETE
READ_CONTROL
WRITE_DAC
SYNCHRONIZE
ReadData (or ListDirectory)
WriteData (or AddFile)
ReadEA
WriteEA
ReadAttributes
WriteAttributes

Access Reasons: DELETE: Unknown or unchecked
READ_CONTROL: Unknown or unchecked
WRITE_DAC: Unknown or unchecked
SYNCHRONIZE: Unknown or unchecked
ReadData (or ListDirectory): Unknown or unchecked
WriteData (or AddFile): Unknown or unchecked
ReadEA: Unknown or unchecked
WriteEA: Unknown or unchecked
ReadAttributes: Unknown or unchecked
WriteAttributes: Unknown or unchecked

Access Mask:" 
| rex field=raw "Accesses:\s(?P<accesses>[\s\S]*?)\s+Access Reasons:(?P<reasons>[\s\S]*?)\s+Access Mask:" 
| rex field=accesses max_match=0 "(?P<accesseslist>.+)" 
| rex field=reasons max_match=0 "(?P<reasonslist>.+)"

The only lines that you probably need to worry about at the last three rex commands. They extract the data into the fields, which are further separated into a multi-valued set of fields by the last two rex commands.

Hopefully this is what you want, but please comment if there is something else that you need.

Re: How to extract data from Microsoft Event Code 4656 (Failed Object Access) ?

jbala1 — Fri, 27 Oct 2017 13:32:31 GMT

Thank you for your assistance. It worked!!!!