How to search for Windows event followed by another Windows event?

[Mckechnie]

I am trying to create a search which looks for an EventCode 4624 followed by another EventCode 4625 from same user, if someone could assist that would be fantastic. Having a read into Multisearch, join etc. Attempted transaction but appears to be slow

index=dirsvcs_seceventlogs source="wineventlog:security" EventCode=4625
[ search source="wineventlog:security" EventCode=4624
| table cs_username EventCode]
| stats count, distinct_count(cs_username), values(cs_username) by EventCode

[gcusello]

Hi @Mckechnie,

you want to identify a brute force attach, there are many samples of this Use Case in the Splunk Security Essentials App (https://splunkbase.splunk.com/app/3435), but anyway, you could run something like this:

index=dirsvcs_seceventlogs source="wineventlog:security" (EventCode=4625 OR EventCode=4624)
| stats 
   count(eval(EventCode="4624")) AS logins 
   count(eval(EventCode="4625")) AS logfails
   BY host cs_username
| where logfails>10

the final where command is the threshold that you can configure.

Eventually, you can configure if the brute force failed or reached adding a filter on "logins"

Ciao.

Giuseppe