Index based search for user being added to multiple windows groups?

[john-doe]

Hello Folks,

Needed help with index based search for any user being added to multiple windows groups (preferably more then count of 5) in a time span of 15 mins .

Thank you

[gcusello]

Hi @john-doe,

at first, you have to check if your Domain Controller is logging EventCodes 4728 (A member was added to a security-enabled global group) and 4732 (A member was added to a security-enabled local group) and you're taking these EventCodes in your Splunk.

If yes, you can run a simple search like the following:

index=wineventlog EventCode IN (4728,4732)
| stats count dc(ComputerName) AS ComputerName_count BY user
| where ComputerName_count>1

Obviously you can choose a different threeshold in the last row.

Ciao.

Giuseppe

[john-doe]

Thanks @gcusello

I think your query will give me user added in particular groups on distinct hosts.

For checking if a user was added in multiple groups in15 min time span how can I modify your query ?  How can I use span or maxspan ?

I was working on something like this below. Not sure how to add the time factor check in there..

index=windows EventCode IN ("4728", "4756", "4732") Subject_Account_Name !="*$" | stats count values(Group_Name) by Subject_Account_Name, Member_Security_ID | where count >= 20 

[gcusello · Accepted solution]

Hi @john-doe,

you can add the time factor:

if you want an alert: defining the time monitoring period, e.g. every 15 minutes using the search you shared.

if instead you want to trace the distinct count of Subject_Accoun_Names registered in more groups, depending on time (e.g. every hour), you could use:

index=windows EventCode IN ("4728", "4756", "4732") Subject_Account_Name !="*$" 
| bin span=1h _time
| chart dc(Group_Name) AS Group_Name_count BY _time Subject_Account_Name 
| where Group_Name_count>= 20 

Ciao.

Giuseppe