Splunk Search

Using search to find user using RDP and switch identities usage

youngsuh
Contributor

What's a good way to find user who logon to RDP with one user account then user another like privilege user account.  I know the event code/id that need to be monitored. 

Here are the event code/id:

EventCode=1146 OR EventCode=1147 OR EventCode=1148 OR EventCode=1149 OR EventCode=4624 OR EventCode=4625 OR EventCode=21 OR EventCode=22 OR EventCode=23 OR EventCode=24 OR EventCode=25 OR EventCode=39 OR EventCode=40 OR EventCode=4778 OR EventCode=4779 OR EventCode=4634 OR EventCode=4647 OR EventCode=9009

Here is the guy who documented the event id/code:  https://ponderthebits.com/2018/02/windows-rdp-related-event-logs-identification-tracking-and-investi...

Which command would tell the story better?  concurrency vs streamstats vs timechart or is it combination of concurrency and timechart or am I total off?

Labels (4)
Tags (2)
1 Solution

youngsuh
Contributor

Community,

I've solve the problem with the following SPL.

source=WinEventLog:Security EventCode="4624" NOT user IN ($localuser1$*, $localuser2$*) Logon_Type="2" OR Logon_Type="10" 
| fillnull value=* Source_Network_Address 
| stats count by host Source_Network_Address Logon_Type user
| eval bar="("+count+") "+Source_Network_Address 
| eval bar_host="("+count+") "+host 
| stats list(bar) as "(#) source(s)" values(bar_host) as "(#) host(s)" list(desc) as source_desc by user Logon_Type

The key event code to monitor is 4624 and exclude local accounts.  Similar concept can be use for session monitoring for Red Hat.  Here is the SPL for that.

sourcetype="linux_secure" "Accepted Publickey" OR "session opened" OR "Accepted password" 
| stats count by host ip user app
| eval bar="("+count+") "+ip
| eval bar_host="("+count+") "+host 
| stats list(bar) as "(#) source(s)" values(bar_host) as "(#) host(s)" list(desc) as source_desc by app user

 

View solution in original post

0 Karma

youngsuh
Contributor

Community,

I've solve the problem with the following SPL.

source=WinEventLog:Security EventCode="4624" NOT user IN ($localuser1$*, $localuser2$*) Logon_Type="2" OR Logon_Type="10" 
| fillnull value=* Source_Network_Address 
| stats count by host Source_Network_Address Logon_Type user
| eval bar="("+count+") "+Source_Network_Address 
| eval bar_host="("+count+") "+host 
| stats list(bar) as "(#) source(s)" values(bar_host) as "(#) host(s)" list(desc) as source_desc by user Logon_Type

The key event code to monitor is 4624 and exclude local accounts.  Similar concept can be use for session monitoring for Red Hat.  Here is the SPL for that.

sourcetype="linux_secure" "Accepted Publickey" OR "session opened" OR "Accepted password" 
| stats count by host ip user app
| eval bar="("+count+") "+ip
| eval bar_host="("+count+") "+host 
| stats list(bar) as "(#) source(s)" values(bar_host) as "(#) host(s)" list(desc) as source_desc by app user

 

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...