Splunk Search

Using search to find user using RDP and switch identities usage

youngsuh
Contributor

What's a good way to find user who logon to RDP with one user account then user another like privilege user account.  I know the event code/id that need to be monitored. 

Here are the event code/id:

EventCode=1146 OR EventCode=1147 OR EventCode=1148 OR EventCode=1149 OR EventCode=4624 OR EventCode=4625 OR EventCode=21 OR EventCode=22 OR EventCode=23 OR EventCode=24 OR EventCode=25 OR EventCode=39 OR EventCode=40 OR EventCode=4778 OR EventCode=4779 OR EventCode=4634 OR EventCode=4647 OR EventCode=9009

Here is the guy who documented the event id/code:  https://ponderthebits.com/2018/02/windows-rdp-related-event-logs-identification-tracking-and-investi...

Which command would tell the story better?  concurrency vs streamstats vs timechart or is it combination of concurrency and timechart or am I total off?

Labels (4)
Tags (2)
1 Solution

youngsuh
Contributor

Community,

I've solve the problem with the following SPL.

source=WinEventLog:Security EventCode="4624" NOT user IN ($localuser1$*, $localuser2$*) Logon_Type="2" OR Logon_Type="10" 
| fillnull value=* Source_Network_Address 
| stats count by host Source_Network_Address Logon_Type user
| eval bar="("+count+") "+Source_Network_Address 
| eval bar_host="("+count+") "+host 
| stats list(bar) as "(#) source(s)" values(bar_host) as "(#) host(s)" list(desc) as source_desc by user Logon_Type

The key event code to monitor is 4624 and exclude local accounts.  Similar concept can be use for session monitoring for Red Hat.  Here is the SPL for that.

sourcetype="linux_secure" "Accepted Publickey" OR "session opened" OR "Accepted password" 
| stats count by host ip user app
| eval bar="("+count+") "+ip
| eval bar_host="("+count+") "+host 
| stats list(bar) as "(#) source(s)" values(bar_host) as "(#) host(s)" list(desc) as source_desc by app user

 

View solution in original post

0 Karma

youngsuh
Contributor

Community,

I've solve the problem with the following SPL.

source=WinEventLog:Security EventCode="4624" NOT user IN ($localuser1$*, $localuser2$*) Logon_Type="2" OR Logon_Type="10" 
| fillnull value=* Source_Network_Address 
| stats count by host Source_Network_Address Logon_Type user
| eval bar="("+count+") "+Source_Network_Address 
| eval bar_host="("+count+") "+host 
| stats list(bar) as "(#) source(s)" values(bar_host) as "(#) host(s)" list(desc) as source_desc by user Logon_Type

The key event code to monitor is 4624 and exclude local accounts.  Similar concept can be use for session monitoring for Red Hat.  Here is the SPL for that.

sourcetype="linux_secure" "Accepted Publickey" OR "session opened" OR "Accepted password" 
| stats count by host ip user app
| eval bar="("+count+") "+ip
| eval bar_host="("+count+") "+host 
| stats list(bar) as "(#) source(s)" values(bar_host) as "(#) host(s)" list(desc) as source_desc by app user

 

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...