Splunk Search

dnsrequest url or query help

tod_s
New Member

Hi Splunk community,

I am trying to determine the impact of removing Adobe Flash from our environment.

I have done basic search and the results returned are much higher than expected. This would most probably be because staff are accessing external content as well as internally hosted.

Is it possible to have a query that tells me which url has invoked flash player?

I have tried:

event_simpleName=ProcessRollup* FileName=FlashUtil*_ActiveX.exe

and

FileName=Flash*.ocx

The query returns, hostname, timestamp of execution, username, and others but i don't get the dns requests or url that invoked flash player. 

So far to get around this I do another separate search (query) on the host, based on the timestamp (of the results of above query) looking up the dns request.

Example result:

Domainname: host: user: filename: commandline:

ssl.gstatic.com computer123 user123 iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" https://docs.google.com/spreadsheets/z/xyz/edit?usp=drive_web

Most DNS requests are within fraction of the second or +1 second.

Finding a computer with useful data is a draw of the luck and very time consuming.

Is anyone able to help with the above query?

I am trying to have on query that gives me hostname, username, timestamp, app e.g.  FlashUtil*_ActiveX.exe and dns request or url, or commandline.

 

We use crowdstrike for end-point protection and the logs are feed to splunk by the crowdstrike agent.

 

 

Labels (2)
Tags (2)
0 Karma

tod_s
New Member

Hi tscroggins,

No proxies used - but our Crowdstrike agent collects detailed activity information, and exports logs to splunk. dns request; network connection, log on user, process running, etc.. being captured 

0 Karma

tscroggins
Influencer

@tod_s 

I've not done this with Flash specifically, but I recommend asking your vendor to suggest or provide methods of logging access to Flash content as an indicator of compromise.

I mentioned proxies because they're often configured to re-encrypt traffic for inspection and logging.

0 Karma

tscroggins
Influencer

@tod_s 

If you use proxies and can log response content types, you could look for e.g. application/x-shockwave-flash or other Flash related content types.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...