Help on SPL for Lateral Movement?

[john-doe]

Hello Folks,

I am new with Splunk.

I am looking to build a query to detect lateral movement using Windows Service creation.

I want to check for following pattern:

EventCode 4624 followed by EventCode 4697 or 7045.

EventCode 4624 followed by EventCode 7036.

How can I write a query to detect such patterns?

[ITWhisperer]

Try something like this

<your index> EventCode=4624 OR EventCode=4697 OR EventCode=7045 OR EventCode=7036
| sort 0 _time
| streamstats global=f current=f window=2 last(EventCode) as previousEventCode by ComputerName
| where previousEventCode=4624 AND (EventCode=4697 OR EventCode=7045 OR EventCode=7036)

[jonny_doe]

Given search is unable to find the pattern. 

I tried with PsExec logs

[ITWhisperer]

If you want more help, you may have to share more information, like what your events look like, what fields do you already have extracted, what does your current search look like, what results are you currently getting? My mind-reading license was suspended last month due to a misunderstanding with an African Prince!