Splunk Search

Using stolen or forged user tickets (TGT)

Dustem
Explorer

hi guys, I want to detect a service ticket request (Windows event code 4769) and one of the following corresponding events does not appear before the service ticket request:
1. User Ticket (TGT) request, Windows event code 4768.
2. Ticket renewal request, Windows event code 4770.

Labels (1)
0 Karma

Dustem
Explorer

I want to search for a user with 4769 events over a continuous period, but the user has no 4768 or 4770 events during that time, instead of 4769 and no 4768 or 4770 users.

0 Karma

Dustem
Explorer

Not during this period, but the user did not have 4768 or 4770 events prior to this period.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Dustem,

let me understand: 4768 or 4770 should be before the 4769 and you want an alert if tey are missing or tey aren't before, is is correct?

Ciao.

Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Dustem,

let me understand: you want to discover if, in one time period, there was a Windows EventCode=4769 but not a Windows EventCode=4770, is it correct?

I suppose that you have a common ID to correlate the events.

If this is your requirement, you could try something like this:

index=wineventlog EventCode IN (4769,4770)
| stats dc(EventCode) AS EventCode_count BY TGT_Id
| where EventCode_count=1

Cioao.

Giuseppe

 

0 Karma

Dustem
Explorer

Hi gcusello,

My description may not be accurate.

I want to detect eventcode=4769 and  then detect whether the user of this event(eventcode=4769) has eventcode=4768 or eventcode=4770 before it.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Dustem,

the approach is the same:

index=wineventlog EventCode IN (4768,4769,4770)
| stats 
   dc(EventCode) AS EventCode_count 
   values(EventCode) AS EventCode 
   BY user
| where EventCode_count=1 AND EventCode=4769

in this way you have the users where there's the EventCode 4769 but not one of the others.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...