Splunk Search

Using stolen or forged user tickets (TGT)

Dustem
Explorer

hi guys, I want to detect a service ticket request (Windows event code 4769) and one of the following corresponding events does not appear before the service ticket request:
1. User Ticket (TGT) request, Windows event code 4768.
2. Ticket renewal request, Windows event code 4770.

0 Karma

Dustem
Explorer

I want to search for a user with 4769 events over a continuous period, but the user has no 4768 or 4770 events during that time, instead of 4769 and no 4768 or 4770 users.

0 Karma

Dustem
Explorer

Not during this period, but the user did not have 4768 or 4770 events prior to this period.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Dustem,

let me understand: 4768 or 4770 should be before the 4769 and you want an alert if tey are missing or tey aren't before, is is correct?

Ciao.

Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Dustem,

let me understand: you want to discover if, in one time period, there was a Windows EventCode=4769 but not a Windows EventCode=4770, is it correct?

I suppose that you have a common ID to correlate the events.

If this is your requirement, you could try something like this:

index=wineventlog EventCode IN (4769,4770)
| stats dc(EventCode) AS EventCode_count BY TGT_Id
| where EventCode_count=1

Cioao.

Giuseppe

 

0 Karma

Dustem
Explorer

Hi gcusello,

My description may not be accurate.

I want to detect eventcode=4769 and  then detect whether the user of this event(eventcode=4769) has eventcode=4768 or eventcode=4770 before it.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Dustem,

the approach is the same:

index=wineventlog EventCode IN (4768,4769,4770)
| stats 
   dc(EventCode) AS EventCode_count 
   values(EventCode) AS EventCode 
   BY user
| where EventCode_count=1 AND EventCode=4769

in this way you have the users where there's the EventCode 4769 but not one of the others.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...

Stay Connected: Your Guide to October Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...