Splunk Search

dnsrequest url or query help

New Member

Hi Splunk community,

I am trying to determine the impact of removing Adobe Flash from our environment.

I have done basic search and the results returned are much higher than expected. This would most probably be because staff are accessing external content as well as internally hosted.

Is it possible to have a query that tells me which url has invoked flash player?

I have tried:

event_simpleName=ProcessRollup* FileName=FlashUtil*_ActiveX.exe



The query returns, hostname, timestamp of execution, username, and others but i don't get the dns requests or url that invoked flash player. 

So far to get around this I do another separate search (query) on the host, based on the timestamp (of the results of above query) looking up the dns request.

Example result:

Domainname: host: user: filename: commandline:

ssl.gstatic.com computer123 user123 iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" https://docs.google.com/spreadsheets/z/xyz/edit?usp=drive_web

Most DNS requests are within fraction of the second or +1 second.

Finding a computer with useful data is a draw of the luck and very time consuming.

Is anyone able to help with the above query?

I am trying to have on query that gives me hostname, username, timestamp, app e.g.  FlashUtil*_ActiveX.exe and dns request or url, or commandline.


We use crowdstrike for end-point protection and the logs are feed to splunk by the crowdstrike agent.



Labels (2)
Tags (2)
0 Karma

New Member

Hi tscroggins,

No proxies used - but our Crowdstrike agent collects detailed activity information, and exports logs to splunk. dns request; network connection, log on user, process running, etc.. being captured 

0 Karma



I've not done this with Flash specifically, but I recommend asking your vendor to suggest or provide methods of logging access to Flash content as an indicator of compromise.

I mentioned proxies because they're often configured to re-encrypt traffic for inspection and logging.

0 Karma



If you use proxies and can log response content types, you could look for e.g. application/x-shockwave-flash or other Flash related content types.

0 Karma
Get Updates on the Splunk Community!

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...

Cloud Platform | Discontinuing support for TLS version 1.0 and 1.1

Overview Transport Layer Security (TLS) is a security communications protocol that lets two computers, ...

New Customer Testimonials

Enterprises of all sizes and across different industries are accelerating cloud adoption by migrating ...