Splunk Search

Help on SPL for Lateral Movement?

john-doe
Engager

Hello Folks,

I am new with Splunk.

I am looking to build a query to detect lateral movement using Windows Service creation.

I want to check for following pattern:

EventCode 4624 followed by EventCode 4697 or 7045.

EventCode 4624 followed by EventCode 7036.

How can I write a query to detect such patterns?

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

<your index> EventCode=4624 OR EventCode=4697 OR EventCode=7045 OR EventCode=7036
| sort 0 _time
| streamstats global=f current=f window=2 last(EventCode) as previousEventCode by ComputerName
| where previousEventCode=4624 AND (EventCode=4697 OR EventCode=7045 OR EventCode=7036)
0 Karma

jonny_doe
New Member

Given search is unable to find the pattern. 

I tried with PsExec logs

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

If you want more help, you may have to share more information, like what your events look like, what fields do you already have extracted, what does your current search look like, what results are you currently getting? My mind-reading license was suspended last month due to a misunderstanding with an African Prince!

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...