Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: File Deletion search query
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
File Deletion search query
Hi All,
Actually in one of my server, some files has been deleted from the file path C\Windows\Systems32\drivers\etc\hosts.
Under the hosts, the file has been completely deleted by someone, need to investigate on that.
Can anyone tell me exact query i need to type in search head to fetch the logs from splunk from this particular directory.
Thanks,
Ramu.R
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If your windows AD data is coming into splunk indexes, then you can identify who has deleted it most probably
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
i think it will be good to double check, without proper auditing rules enabled on the directory or file prior to deletion, imho widows will not log the file deletion.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
All proper rules has been enabled perfectly. Just mention only the required query instead of posting links for articles, i have already gone through 100s of link like these, then only i came here for answer.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
in that case, look for ... EventCode=4656 ... <file name> ...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Adonio,
Can you paste the complete query here
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi All,
Lets make my question as below :
Hostname : abc123
File Path : C\Windows\System32\drivers\etc\hosts
Under the hosts, the file has been completely deleted by someone. Can anyone tell me exact query for this scenario.
Thanks,
Ramu.R
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I think it will log those info. The event code for file deletion is 4656 .
Please refer to the below links for more information.
https://www.netwrix.com/how_to_detect_who_deleted_file.html
https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4656
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can you please try? index=* source="C:\\Windows\\Systems32\\drivers\\etc\\hosts.*"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
are you pulling that data into splunk?
to find deletions or file modifications, you will have to enable auditing on that particular directory / file
this is being done on the windows (OS) side. also, you will have to pull and bring windows security event logs to splunk
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi ddrillic,
Its not working actually, moreover i did not see the host name mentioned in your query.
Thanks,
Ramu.R
Fastest way to demo Observability
September Community Champions: A Shoutout to Our Contributors!
Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps
