Getting Data In

How to use Splunk to audit Windows processes created and the users who are running them?

chuckcoggins
Engager

Good evening,

I have been trying to figure out a way to get a list of all of the software that runs on my servers under the user Administrator.

The end goal is to disable the admin account and replace it with a bunch of specific users.

Ideally, I am going to have to figure out what services / software / backups etc etc that are run as Administrator.

Is this something Splunk can / will do for me?

I have been banging my head on this for about 2 days trying to figure out how to create scripts to do all of this with no real luck other than figuring out what services.

Thank you in advance for any help you might be able to provide me.

0 Karma
1 Solution

whrg
Motivator

If i understand correctly, you want to monitor process creation.

For Windows servers, I'm familiar with two ways of process logging.

Option 1) Windows has a built-in feature for process tracking using the Windows Event Log. The particular Event Code we are interested in is 4688: A new process has been created.

By default, process tracking is turned off. You need to enable it in the Local Security Policy or via group policies:

alt text

Next, you need to configure Splunk to monitor the Windows Event Log. Something like this via inputs.conf:

[WinEventLog://Security]
disabled = false
index = windows

Now these events should be available in Splunk:

index=windows source="WinEventLog:Security" EventCode=4688

alt text

You can see that the user (Account Name), who ran this process, got logged. (I anonymized it.)

Option 2: You install Sysmon in conjunction with Add-on for Microsoft Sysmon.

Sysmon can log a wealth of information, including process creation. I find it particularly useful that Sysmon can log the hash value for each process/program. You will also see which user runs which process. However, Sysmon is slightly more complex to setup.

View solution in original post

whrg
Motivator

If i understand correctly, you want to monitor process creation.

For Windows servers, I'm familiar with two ways of process logging.

Option 1) Windows has a built-in feature for process tracking using the Windows Event Log. The particular Event Code we are interested in is 4688: A new process has been created.

By default, process tracking is turned off. You need to enable it in the Local Security Policy or via group policies:

alt text

Next, you need to configure Splunk to monitor the Windows Event Log. Something like this via inputs.conf:

[WinEventLog://Security]
disabled = false
index = windows

Now these events should be available in Splunk:

index=windows source="WinEventLog:Security" EventCode=4688

alt text

You can see that the user (Account Name), who ran this process, got logged. (I anonymized it.)

Option 2: You install Sysmon in conjunction with Add-on for Microsoft Sysmon.

Sysmon can log a wealth of information, including process creation. I find it particularly useful that Sysmon can log the hash value for each process/program. You will also see which user runs which process. However, Sysmon is slightly more complex to setup.

chuckcoggins
Engager

Thank you so much for your help!
I should also be able to do this with EventID='4624' as well using the same steps correct?

0 Karma

whrg
Motivator

Yes, basically, the steps are the same for event code 4624 (successful login).

Again, it might be necessary to activate the according audit policy for this particular event code.

Also, I forgot to mention that you should to install the "Splunk Add-on for Microsoft Windows" on your search head so that you will get field extractions, etc.

whrg
Motivator

Which operating system is running on your servers?

0 Karma

chuckcoggins
Engager

Windows 2012R2

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...