Splunk Search

How do you find a search that finds open windows locked-screen sessions?

ShaunBaker
Path Finder

Trying to figure out a string to find open windows locked-screen sessions

Monitored all security events when doing a log on, full log-off and locked screen
4624 logon (type7 = logon from a locked screen)
4624 logon (type 2 = full logon when no active session running)

4634 = locked screen
4647 = full log off

4673 = privileged service called – this one is interesting, there is a 4673 heart beat on the machine that has a locked screen user session.

Doing the below

Index=winevents EventCode=4624 OR EventCode=4634
| transaction host startswith=EventCode=4624 endswith=EventCode=4634
| table what you want

Problem with the above — it finds the log-on and then locked screen events, but it isn't catching after that event. Then user logged on again, then fully logged out — so you see, every time someone did a log on and locked screen — even if they later logged in yet again and the legit logged off cleaning the situation.

This is where maybe that 4673 event ID is of value?

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...