How to use Splunk to audit Windows processes created and the users who are running them?

[chuckcoggins]

Good evening,

I have been trying to figure out a way to get a list of all of the software that runs on my servers under the user Administrator.

The end goal is to disable the admin account and replace it with a bunch of specific users.

Ideally, I am going to have to figure out what services / software / backups etc etc that are run as Administrator.

Is this something Splunk can / will do for me?

I have been banging my head on this for about 2 days trying to figure out how to create scripts to do all of this with no real luck other than figuring out what services.

Thank you in advance for any help you might be able to provide me.

[whrg · Accepted solution]

If i understand correctly, you want to monitor process creation.

For Windows servers, I'm familiar with two ways of process logging.

Option 1) Windows has a built-in feature for process tracking using the Windows Event Log. The particular Event Code we are interested in is 4688: A new process has been created.

By default, process tracking is turned off. You need to enable it in the Local Security Policy or via group policies:

Next, you need to configure Splunk to monitor the Windows Event Log. Something like this via inputs.conf:

[WinEventLog://Security]
disabled = false
index = windows

Now these events should be available in Splunk:

index=windows source="WinEventLog:Security" EventCode=4688

You can see that the user (Account Name), who ran this process, got logged. (I anonymized it.)

Option 2: You install Sysmon in conjunction with Add-on for Microsoft Sysmon.

Sysmon can log a wealth of information, including process creation. I find it particularly useful that Sysmon can log the hash value for each process/program. You will also see which user runs which process. However, Sysmon is slightly more complex to setup.

[chuckcoggins]

Thank you so much for your help!
I should also be able to do this with EventID='4624' as well using the same steps correct?

[whrg]

Yes, basically, the steps are the same for event code 4624 (successful login).

Again, it might be necessary to activate the according audit policy for this particular event code.

Also, I forgot to mention that you should to install the "Splunk Add-on for Microsoft Windows" on your search head so that you will get field extractions, etc.

[whrg]

Which operating system is running on your servers?

[chuckcoggins]

Windows 2012R2