Using search to find user using RDP and switch identities usage

[youngsuh]

What's a good way to find user who logon to RDP with one user account then user another like privilege user account.  I know the event code/id that need to be monitored. 

Here are the event code/id:

EventCode=1146 OR EventCode=1147 OR EventCode=1148 OR EventCode=1149 OR EventCode=4624 OR EventCode=4625 OR EventCode=21 OR EventCode=22 OR EventCode=23 OR EventCode=24 OR EventCode=25 OR EventCode=39 OR EventCode=40 OR EventCode=4778 OR EventCode=4779 OR EventCode=4634 OR EventCode=4647 OR EventCode=9009

Here is the guy who documented the event id/code:  https://ponderthebits.com/2018/02/windows-rdp-related-event-logs-identification-tracking-and-investi...

Which command would tell the story better?  concurrency vs streamstats vs timechart or is it combination of concurrency and timechart or am I total off?

[youngsuh · Accepted solution]

Community,

I've solve the problem with the following SPL.

source=WinEventLog:Security EventCode="4624" NOT user IN ($localuser1$*, $localuser2$*) Logon_Type="2" OR Logon_Type="10" 
| fillnull value=* Source_Network_Address 
| stats count by host Source_Network_Address Logon_Type user
| eval bar="("+count+") "+Source_Network_Address 
| eval bar_host="("+count+") "+host 
| stats list(bar) as "(#) source(s)" values(bar_host) as "(#) host(s)" list(desc) as source_desc by user Logon_Type

The key event code to monitor is 4624 and exclude local accounts.  Similar concept can be use for session monitoring for Red Hat.  Here is the SPL for that.

sourcetype="linux_secure" "Accepted Publickey" OR "session opened" OR "Accepted password" 
| stats count by host ip user app
| eval bar="("+count+") "+ip
| eval bar_host="("+count+") "+host 
| stats list(bar) as "(#) source(s)" values(bar_host) as "(#) host(s)" list(desc) as source_desc by app user