Splunk Search

Check for event that has not changed for X days

Branden
Builder

Hello.

I'm struggling with a query. We want to search Windows Event logs for accounts whose passwords have not been changed (by admins) for more than 700 days. I have created a query that informs me of when a password was changed:

 index=main host=*DC* EventCode=4724 | eval Modifier = mvindex(Account_Name, 0) | eval User_Name = mvindex(Account_Name, 1) | rename Group_Name AS Modified_Group | table _time Modifier User_Name

But I do not know how to get Splunk to check for a password that has NOT been changed for over X days. Is this even possible?

Thank you in advance for your help.

0 Karma
1 Solution

ololdach
Builder

Hi Branden,

I think the answer is quite easy, but not what you expect:
- Install the SA-ldapsearch (Splunk Supporting Add On for Active Directory) https://splunkbase.splunk.com/app/1151/
- do an LDAP-Search on your tree and look for (objectClass=shadowAccount) and the field shadowLastChange (date of last password change)

Hope it helps
Oliver

View solution in original post

ololdach
Builder

Hi Branden,

I think the answer is quite easy, but not what you expect:
- Install the SA-ldapsearch (Splunk Supporting Add On for Active Directory) https://splunkbase.splunk.com/app/1151/
- do an LDAP-Search on your tree and look for (objectClass=shadowAccount) and the field shadowLastChange (date of last password change)

Hope it helps
Oliver

Branden
Builder

Thank you for your response. We have an AD environment and a separate LDAP environment (running on Linux). Your solution would work for our LDAP logs, but for AD all I have to go by are the Windows Event Logs.

0 Karma

ololdach
Builder

Hi Branden, the solution works fine with AD, provided you get a read-only AD user set up in your AD domain. If you can't get access, though, this page tells you the right messages to get into splunk and look for: https://blogs.manageengine.com/active-directory/2018/08/23/monitoring-service-account-password-chang...
Best
Oliver

0 Karma

Branden
Builder

You were absolutely right. I misunderstood what you were saying.
I worked with one of our admins and we have the query working. You're right - it's quite an easy solution. Thank you very much!

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...