Splunk Search

Search for Suspicious Logon Behavior

Explorer

Hello there. I want to build a query that alerts off when a single source IP or source computer is attempting to logon to multiple computers (Event Code's 4624 and 4625). How can I go about this?

I tried with the search below but its not differentiating single to many logon attempts, it is returning also single to single attempts which is not what I want.

 

 

index=windows-logs (EventCode=4624 OR EventCode=4625) srcip=* src!=10.1.2.23 
| top AccountName, srcip limit=0 countfield="Total" showperc=f 
| where Total > 20 
| rename srcip AS "Source IP Performing Remote Login Attempts"

 

 

Tags (1)
0 Karma
1 Solution

Communicator

Something like this?

index=windows-logs (EventCode=4624 OR EventCode=4625) srcip=* NOT src="10.1.2.23" 
| stats dc(host) AS hosts by AccountName
| where hosts > 20 
| rename src_ip AS "Source IP Performing Remote Login Attempts"

View solution in original post

0 Karma

Communicator

Something like this?

index=windows-logs (EventCode=4624 OR EventCode=4625) srcip=* NOT src="10.1.2.23" 
| stats dc(host) AS hosts by AccountName
| where hosts > 20 
| rename src_ip AS "Source IP Performing Remote Login Attempts"

View solution in original post

0 Karma

Explorer

Hello Marty. A couple of things I found when doing a test vulnerability scan which would mimic the type of behavior I want to alert on (a single IP scanning multiple IPs). I found the the remote systems attempting to be accessed show up under the field name "dest" and that the source ip of the scanner attempting to connect is under the field name "SourceNetworkAddress". I modified your sytax below - does it look right because I am getting zero results?

index=windows-logs (EventCode=4624 OR EventCode=4625) SourceNetworkAddress=* NOT src="10.1.2.23"
| stats dc(dest) AS dest by SourceNetworkAddress
| where dest > 20

0 Karma

Explorer

Actually I had a typo in my index. I think your recommendation will get me going in the right direction. I am going to keep testing with it though. Thanks!!

0 Karma

Explorer

@martynoconnor If I wanted to build a similar search - except this time I want to alert off a certain username trying to log on to multiple computers how would I do that? Let's say the usernames I am interested in are Administrator and Root...

0 Karma

Communicator

If the usernames are important, then add them in as key=value pairs before the first pipe, and then as a second by clause for the stats(dc). Something like this:

index=windows-logs (EventCode=4624 OR EventCode=4625) SourceNetworkAddress=* NOT src="10.1.2.23" (user=Administrator OR user=root)
| stats dc(dest) AS dest by SourceNetworkAddress user
| where dest > 20

0 Karma

Explorer

You rock that worked too!

0 Karma