dnsrequest url or query help

[tod_s]

Hi Splunk community,

I am trying to determine the impact of removing Adobe Flash from our environment.

I have done basic search and the results returned are much higher than expected. This would most probably be because staff are accessing external content as well as internally hosted.

Is it possible to have a query that tells me which url has invoked flash player?

I have tried:

event_simpleName=ProcessRollup* FileName=FlashUtil*_ActiveX.exe

and

FileName=Flash*.ocx

The query returns, hostname, timestamp of execution, username, and others but i don't get the dns requests or url that invoked flash player. 

So far to get around this I do another separate search (query) on the host, based on the timestamp (of the results of above query) looking up the dns request.

Example result:

Domainname: host: user: filename: commandline:

ssl.gstatic.com computer123 user123 iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" https://docs.google.com/spreadsheets/z/xyz/edit?usp=drive_web

Most DNS requests are within fraction of the second or +1 second.

Finding a computer with useful data is a draw of the luck and very time consuming.

Is anyone able to help with the above query?

I am trying to have on query that gives me hostname, username, timestamp, app e.g.  FlashUtil*_ActiveX.exe and dns request or url, or commandline.

We use crowdstrike for end-point protection and the logs are feed to splunk by the crowdstrike agent.

[tod_s]

Hi tscroggins,

No proxies used - but our Crowdstrike agent collects detailed activity information, and exports logs to splunk. dns request; network connection, log on user, process running, etc.. being captured 

[tscroggins]

@tod_s 

I've not done this with Flash specifically, but I recommend asking your vendor to suggest or provide methods of logging access to Flash content as an indicator of compromise.

I mentioned proxies because they're often configured to re-encrypt traffic for inspection and logging.

[tscroggins]

@tod_s 

If you use proxies and can log response content types, you could look for e.g. application/x-shockwave-flash or other Flash related content types.