Splunk Enterprise Security

Splunk + Crowdstrike (DnsRequest+ImageFileName join)

splunkb0y
New Member

Hello,

I got this query from Crowdstrike Documentation https[://]www[.]crowdstrike[. ]com/blog/tech-center/hunt-threat-activity-falcon-endpoint-protection/

Under "Events App: Step-By-Step Procedure" Step no. 4, there is this query:

aid=* event_simpleName="DnsRequest" | rename ContextProcessId as TargetProcessId | join TargetProcessId [search aid=* event_simpleName="ProcessRollup2" ImageFileName="*notepad.exe"] | table ImageFileName DomainName

Individually, the main search or the sub search works fine. If I join them like in the above and change notepad.exe to *chrome.exe, I am able to see all DnsRequests events from chrome.exe process. But if I only say ImageFileName=".exe" in the subset, the resulting table has the correct DomainName column but the ImageFileName column contains only a single process (.e,.g \Device\HarddiskVolume2\Program Files\AppSense\Performance Manager\Agent\PmAgentAssist.exe). How come the search is only picking up this one process "pmAgentAssist.exe"?

Any idea how to solve this? My goal is to locate all DNS requests made in all machines and determine the process/programs which sent the requests.

0 Karma

swebb07g
Path Finder

The explanation for this is that there is a limit on how many results can be returned in a sub-search (right-side of a join). I believe 50k results is the limit. So try to make sure your search is as narrow as possible.

0 Karma

splunkb0y
New Member

typo, ImageFileName=".exe" should be "ImageFileName="*.exe"

0 Karma

slw07gdev
Explorer

I'm experiencing the same issue. Did you ever find a solution?

I can say (not sure when this changed) that TargetProcessId and ContextProcessId are now TargetProcessId_decimal and ContextProcessId_decimal.

0 Karma

splunkb0y
New Member

Actually, this is the ImageFileName I get, if I don't specify a ComputerName on both Main and Sub search:
\Device\HarddiskVolume2\Windows\System32\dllhost.exe

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...