Splunk Search

Using search to find user using RDP and switch identities usage

youngsuh
Contributor

What's a good way to find user who logon to RDP with one user account then user another like privilege user account.  I know the event code/id that need to be monitored. 

Here are the event code/id:

EventCode=1146 OR EventCode=1147 OR EventCode=1148 OR EventCode=1149 OR EventCode=4624 OR EventCode=4625 OR EventCode=21 OR EventCode=22 OR EventCode=23 OR EventCode=24 OR EventCode=25 OR EventCode=39 OR EventCode=40 OR EventCode=4778 OR EventCode=4779 OR EventCode=4634 OR EventCode=4647 OR EventCode=9009

Here is the guy who documented the event id/code:  https://ponderthebits.com/2018/02/windows-rdp-related-event-logs-identification-tracking-and-investi...

Which command would tell the story better?  concurrency vs streamstats vs timechart or is it combination of concurrency and timechart or am I total off?

Labels (4)
Tags (2)
1 Solution

youngsuh
Contributor

Community,

I've solve the problem with the following SPL.

source=WinEventLog:Security EventCode="4624" NOT user IN ($localuser1$*, $localuser2$*) Logon_Type="2" OR Logon_Type="10" 
| fillnull value=* Source_Network_Address 
| stats count by host Source_Network_Address Logon_Type user
| eval bar="("+count+") "+Source_Network_Address 
| eval bar_host="("+count+") "+host 
| stats list(bar) as "(#) source(s)" values(bar_host) as "(#) host(s)" list(desc) as source_desc by user Logon_Type

The key event code to monitor is 4624 and exclude local accounts.  Similar concept can be use for session monitoring for Red Hat.  Here is the SPL for that.

sourcetype="linux_secure" "Accepted Publickey" OR "session opened" OR "Accepted password" 
| stats count by host ip user app
| eval bar="("+count+") "+ip
| eval bar_host="("+count+") "+host 
| stats list(bar) as "(#) source(s)" values(bar_host) as "(#) host(s)" list(desc) as source_desc by app user

 

View solution in original post

0 Karma

youngsuh
Contributor

Community,

I've solve the problem with the following SPL.

source=WinEventLog:Security EventCode="4624" NOT user IN ($localuser1$*, $localuser2$*) Logon_Type="2" OR Logon_Type="10" 
| fillnull value=* Source_Network_Address 
| stats count by host Source_Network_Address Logon_Type user
| eval bar="("+count+") "+Source_Network_Address 
| eval bar_host="("+count+") "+host 
| stats list(bar) as "(#) source(s)" values(bar_host) as "(#) host(s)" list(desc) as source_desc by user Logon_Type

The key event code to monitor is 4624 and exclude local accounts.  Similar concept can be use for session monitoring for Red Hat.  Here is the SPL for that.

sourcetype="linux_secure" "Accepted Publickey" OR "session opened" OR "Accepted password" 
| stats count by host ip user app
| eval bar="("+count+") "+ip
| eval bar_host="("+count+") "+host 
| stats list(bar) as "(#) source(s)" values(bar_host) as "(#) host(s)" list(desc) as source_desc by app user

 

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...