Getting Data In

How to use Splunk to audit Windows processes created and the users who are running them?

chuckcoggins
Engager

Good evening,

I have been trying to figure out a way to get a list of all of the software that runs on my servers under the user Administrator.

The end goal is to disable the admin account and replace it with a bunch of specific users.

Ideally, I am going to have to figure out what services / software / backups etc etc that are run as Administrator.

Is this something Splunk can / will do for me?

I have been banging my head on this for about 2 days trying to figure out how to create scripts to do all of this with no real luck other than figuring out what services.

Thank you in advance for any help you might be able to provide me.

0 Karma
1 Solution

whrg
Motivator

If i understand correctly, you want to monitor process creation.

For Windows servers, I'm familiar with two ways of process logging.

Option 1) Windows has a built-in feature for process tracking using the Windows Event Log. The particular Event Code we are interested in is 4688: A new process has been created.

By default, process tracking is turned off. You need to enable it in the Local Security Policy or via group policies:

alt text

Next, you need to configure Splunk to monitor the Windows Event Log. Something like this via inputs.conf:

[WinEventLog://Security]
disabled = false
index = windows

Now these events should be available in Splunk:

index=windows source="WinEventLog:Security" EventCode=4688

alt text

You can see that the user (Account Name), who ran this process, got logged. (I anonymized it.)

Option 2: You install Sysmon in conjunction with Add-on for Microsoft Sysmon.

Sysmon can log a wealth of information, including process creation. I find it particularly useful that Sysmon can log the hash value for each process/program. You will also see which user runs which process. However, Sysmon is slightly more complex to setup.

View solution in original post

whrg
Motivator

If i understand correctly, you want to monitor process creation.

For Windows servers, I'm familiar with two ways of process logging.

Option 1) Windows has a built-in feature for process tracking using the Windows Event Log. The particular Event Code we are interested in is 4688: A new process has been created.

By default, process tracking is turned off. You need to enable it in the Local Security Policy or via group policies:

alt text

Next, you need to configure Splunk to monitor the Windows Event Log. Something like this via inputs.conf:

[WinEventLog://Security]
disabled = false
index = windows

Now these events should be available in Splunk:

index=windows source="WinEventLog:Security" EventCode=4688

alt text

You can see that the user (Account Name), who ran this process, got logged. (I anonymized it.)

Option 2: You install Sysmon in conjunction with Add-on for Microsoft Sysmon.

Sysmon can log a wealth of information, including process creation. I find it particularly useful that Sysmon can log the hash value for each process/program. You will also see which user runs which process. However, Sysmon is slightly more complex to setup.

chuckcoggins
Engager

Thank you so much for your help!
I should also be able to do this with EventID='4624' as well using the same steps correct?

0 Karma

whrg
Motivator

Yes, basically, the steps are the same for event code 4624 (successful login).

Again, it might be necessary to activate the according audit policy for this particular event code.

Also, I forgot to mention that you should to install the "Splunk Add-on for Microsoft Windows" on your search head so that you will get field extractions, etc.

whrg
Motivator

Which operating system is running on your servers?

0 Karma

chuckcoggins
Engager

Windows 2012R2

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...