Getting Data In
Highlighted

How to use Splunk to audit Windows processes created and the users who are running them?

Engager

Good evening,

I have been trying to figure out a way to get a list of all of the software that runs on my servers under the user Administrator.

The end goal is to disable the admin account and replace it with a bunch of specific users.

Ideally, I am going to have to figure out what services / software / backups etc etc that are run as Administrator.

Is this something Splunk can / will do for me?

I have been banging my head on this for about 2 days trying to figure out how to create scripts to do all of this with no real luck other than figuring out what services.

Thank you in advance for any help you might be able to provide me.

0 Karma
Highlighted

Re: How to use Splunk to audit Windows processes created and the users who are running them?

Motivator

Which operating system is running on your servers?

0 Karma
Highlighted

Re: How to use Splunk to audit Windows processes created and the users who are running them?

Engager

Windows 2012R2

0 Karma
Highlighted

Re: How to use Splunk to audit Windows processes created and the users who are running them?

Motivator

If i understand correctly, you want to monitor process creation.

For Windows servers, I'm familiar with two ways of process logging.

Option 1) Windows has a built-in feature for process tracking using the Windows Event Log. The particular Event Code we are interested in is 4688: A new process has been created.

By default, process tracking is turned off. You need to enable it in the Local Security Policy or via group policies:

alt text

Next, you need to configure Splunk to monitor the Windows Event Log. Something like this via inputs.conf:

[WinEventLog://Security]
disabled = false
index = windows

Now these events should be available in Splunk:

index=windows source="WinEventLog:Security" EventCode=4688

alt text

You can see that the user (Account Name), who ran this process, got logged. (I anonymized it.)

Option 2: You install Sysmon in conjunction with Add-on for Microsoft Sysmon.

Sysmon can log a wealth of information, including process creation. I find it particularly useful that Sysmon can log the hash value for each process/program. You will also see which user runs which process. However, Sysmon is slightly more complex to setup.

View solution in original post

Highlighted

Re: How to use Splunk to audit Windows processes created and the users who are running them?

Engager

Thank you so much for your help!
I should also be able to do this with EventID='4624' as well using the same steps correct?

0 Karma
Highlighted

Re: How to use Splunk to audit Windows processes created and the users who are running them?

Motivator

Yes, basically, the steps are the same for event code 4624 (successful login).

Again, it might be necessary to activate the according audit policy for this particular event code.

Also, I forgot to mention that you should to install the "Splunk Add-on for Microsoft Windows" on your search head so that you will get field extractions, etc.