Splunk Search

File Deletion search query

mailmetoramu
Explorer

Hi All,

Actually in one of my server, some files has been deleted from the file path C\Windows\Systems32\drivers\etc\hosts.

Under the hosts, the file has been completely deleted by someone, need to investigate on that.

Can anyone tell me exact query i need to type in search head to fetch the logs from splunk from this particular directory.

Thanks,

Ramu.R

Tags (1)
0 Karma

iamarkaprabha
Contributor

If your windows AD data is coming into splunk indexes, then you can identify who has deleted it most probably

adonio
Ultra Champion

i think it will be good to double check, without proper auditing rules enabled on the directory or file prior to deletion, imho widows will not log the file deletion.

0 Karma

mailmetoramu
Explorer

All proper rules has been enabled perfectly. Just mention only the required query instead of posting links for articles, i have already gone through 100s of link like these, then only i came here for answer.

0 Karma

adonio
Ultra Champion

in that case, look for ... EventCode=4656 ... <file name> ...

0 Karma

mailmetoramu
Explorer

Hi Adonio,

Can you paste the complete query here

0 Karma

mailmetoramu
Explorer

Hi All,

Lets make my question as below :

Hostname : abc123

File Path : C\Windows\System32\drivers\etc\hosts

Under the hosts, the file has been completely deleted by someone. Can anyone tell me exact query for this scenario.

Thanks,

Ramu.R

0 Karma

iamarkaprabha
Contributor

I think it will log those info. The event code for file deletion is 4656 .
Please refer to the below links for more information.

https://www.netwrix.com/how_to_detect_who_deleted_file.html
https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4656

0 Karma

ddrillic
Ultra Champion

Can you please try? index=* source="C:\\Windows\\Systems32\\drivers\\etc\\hosts.*"

0 Karma

adonio
Ultra Champion

are you pulling that data into splunk?
to find deletions or file modifications, you will have to enable auditing on that particular directory / file
this is being done on the windows (OS) side. also, you will have to pull and bring windows security event logs to splunk

0 Karma

mailmetoramu
Explorer

Hi ddrillic,

Its not working actually, moreover i did not see the host name mentioned in your query.

Thanks,

Ramu.R

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...