Getting Data In

Show results only when EventCodes occur in a specific sequence

Path Finder

I'm attempting to find events when EventCodes occur in 1, 3, 13, then 4689. (Detection of psexec via windows logs). Here is what I've come up with:

index=windows (EventCode=1 OR EventCode=3 OR EventCode=13 OR EventCode=4689)
 | streamstats count(eval(EventCode="1" OR EventCode="3" OR EventCode="13" OR EventCode=4689)) AS sessionID BY host
 | transaction host startswith=1 endswith=4689

The problem is the search takes forever to complete and either we don't have any psexec running in the environment or the search isn't correct. Can someone take a look at the logic to determine if I'm on the right path, if this returns any results, & if there is a better way to search for this? Thank you in advance!

0 Karma

Champion

if you remove everything after the first pipe , is the search executing for just index=windows (EventCode=1 OR EventCode=3 OR EventCode=13 OR EventCode=4689) ?
if that is taking too long , can you try these 2 options?
index=windows |fields EventCode|where (EventCode=1 OR EventCode=3 OR EventCode=13 OR EventCode=4689)
OR
index=windows EventCode=|where (EventCode=1 OR EventCode=3 OR EventCode=13 OR EventCode=4689)

does it make a difference?

0 Karma

Path Finder

The portion that takes a long time is
| transaction host startswith=1 endswith=4689

0 Karma

Champion

hi @wgawhh5hbnht
can you post a sample event? your command looks ok I am reasonably sure the event structure is different from what I am visualising atm.
PS - One tongue twister of a username 🙂 🙂

0 Karma