Hey, Thank you ill give this a shot 🙂 ... View more

exactly as yours pal ... View more

still the same i'm afraid no results... very much appreciate your assistance though 🙂 ... View more

Hey guys, Thanks for the advice, still not working im afraid, I can see that it works on Regex101 also managed to get it working on Regex101 with ^[a-zA-Z]+:[\s[a-z]+\s[a-z]+$ When its thrown into Splunk it still doesn't work, I swappped the [ ] for ( ) too as [ ] dont work in Splunk.... Ill keep trying 🙂 Cheers ... View more

Hey Cusello, you would think so right but that brings back no results for me at all, however if I do a ("CommandLine:" AND "net" AND "share" that will bring back some results as shown below however it brings back events that just contain either 1 or 2 of the other words where all I really want to see is events containing the exact match of "CommandLine: net share" Dont worry the below systems are throw away lab systems so no corp data is available Time Event 1/21/19 1:48:09.000 PM 01/21/2019 01:48:09 PM LogName=Microsoft-Windows-Sysmon/Operational SourceName=Microsoft-Windows-Sysmon EventCode=1 EventType=4 Type=Information ComputerName=DC01.PurpleHaze.local User=NOT_TRANSLATED Sid=S-1-5-18 SidType=0 TaskCategory=Process Create (rule: ProcessCreate) OpCode=Info RecordNumber=431111 Keywords=None Message=Process Create: RuleName: UtcTime: 2019-01-21 13:48:09.340 ProcessGuid: {834924C0-CD99-5C45-0000-0010B3DAC700} ProcessId: 4680 Image: C:\Windows\SysWOW64\net1.exe FileVersion: 10.0.14393.0 (rs1_release.160715-1616) Description: Net Command Product: Microsoft® Windows® Operating System Company: Microsoft Corporation CommandLine: C:\Windows\system32\net1 share CurrentDirectory: C:\Windows\system32\ User: NT AUTHORITY\SYSTEM LogonGuid: {834924C0-3E0A-5C40-0000-0020E7030000} LogonId: 0x3E7 TerminalSessionId: 0 IntegrityLevel: System Hashes: SHA1=382169595D5BBEB535C4575B3EC8CC7E5E933115 ParentProcessGuid: {834924C0-CD99-5C45-0000-00100FDAC700} ParentProcessId: 1540 ParentImage: C:\Windows\SysWOW64\net.exe ParentCommandLine: net share Collapse CommandLine = C:\Windows\system32\net1 share host = DC01 source = WinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype = WinEventLog:Microsoft-Windows-Sysmon/Operational 1/21/19 1:48:09.000 PM 01/21/2019 01:48:09 PM LogName=Microsoft-Windows-Sysmon/Operational SourceName=Microsoft-Windows-Sysmon EventCode=1 EventType=4 Type=Information ComputerName=DC01.PurpleHaze.local User=NOT_TRANSLATED Sid=S-1-5-18 SidType=0 TaskCategory=Process Create (rule: ProcessCreate) OpCode=Info RecordNumber=431110 Keywords=None Message=Process Create: RuleName: UtcTime: 2019-01-21 13:48:09.330 ProcessGuid: {834924C0-CD99-5C45-0000-00100FDAC700} ProcessId: 1540 Image: C:\Windows\SysWOW64\net.exe FileVersion: 10.0.14393.0 (rs1_release.160715-1616) Description: Net Command Product: Microsoft® Windows® Operating System Company: Microsoft Corporation CommandLine: net share CurrentDirectory: C:\Windows\system32\ User: NT AUTHORITY\SYSTEM LogonGuid: {834924C0-3E0A-5C40-0000-0020E7030000} LogonId: 0x3E7 TerminalSessionId: 0 IntegrityLevel: System Hashes: SHA1=B160F4462A4728BEC8FA053B99709622A4B4DD20 ParentProcessGuid: {834924C0-C9D7-5C45-0000-0010FCA2C500} ParentProcessId: 3064 ParentImage: C:\Windows\SysWOW64\cmd.exe ParentCommandLine: C:\Windows\system32\cmd.exe Collapse CommandLine = net share host = DC01 source = WinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype = WinEventLog:Microsoft-Windows-Sysmon/Operational ... View more

Nah all the info above is fiction, all just test data in a test lab 🙂 ill give it some further time today, thank you. ... View more

okay, so this populates now - index=main EventCode=4625 | head 150 | table _time,Workstation_Name,Account_Name,Keywords,Failure_Reason looks like this - _time Workstation_Name Account_Name Keywords Failure_Reason 2018-12-03 15:53:52 DC01 Archie Pollitt Audit Failure Unknown user name or bad password. 2018-12-03 15:53:52 DC01 Bernard Hires Audit Failure Unknown user name or bad password. 2018-12-03 15:53:52 DC01 Serafina Alleman Audit Failure Unknown user name or bad password. 2018-12-03 15:53:52 DC01 Carmon Summitt Audit Failure Unknown user name or bad password. 2018-12-03 15:53:52 DC01 Ashly Prophet Audit Failure Unknown user name or bad password. 2018-12-03 15:53:52 DC01 Treena Mickel Audit Failure Unknown user name or bad password. 2018-12-03 15:53:52 DC01 Gino Kellar Audit Failure Unknown user name or bad password. 2018-12-03 15:53:52 DC01 Nina Maddalena Audit Failure Unknown user name or bad password. ... View more

so index=main EventCode=4625 | head 100 | table _time,tag,action,user,src displays a nice looking table with only the _time column populated ... View more

Hey, that doesnt seem to work for me - this is one of the events - 2/03/2018 03:23:31 PM LogName=Security SourceName=Microsoft Windows security auditing. EventCode=4625 EventType=0 Type=Information ComputerName=DC01.PurpleHaze.local TaskCategory=Logon OpCode=Info RecordNumber=1204537 Keywords=Audit Failure Message=An account failed to log on. Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Logon Type: 3 Account For Which Logon Failed: Security ID: S-1-0-0 Account Name: Adam Rogers Account Domain: Failure Information: Failure Reason: Unknown user name or bad password. Status: 0xC000006D Sub Status: 0xC0000064 Process Information: Caller Process ID: 0x0 Caller Process Name: - Network Information: Workstation Name: DC01 Source Network Address: fe80::425:8ae2:c951:d1c8 Source Port: 63891 Detailed Authentication Information: Logon Process: NtLmSsp Authentication Package: NTLM Transited Services: - Package Name (NTLM only): - Key Length: 0 ... View more

thank you, ill give it go and feedback 🙂 ... View more

Cheers, this worked for me, slight amendment on the cmds as my test box is Windows not Linux ... View more

A little more info on this, so I can use the key_path value which sort of works as it logs the changes I need however it also opens to floodgates for some reason to a bunch of other keys in various hives, not limited to HKLM So I could write a query and create dashboards for what I actually need however, the license usage is being taken up by events I don't wish to be logging. I did some digging around the CurrentControlSet path and it seems to work like a VIP / loadbalancer in that it points to ControlSet001 or ControlSet002 and potentially even ControlSet003 as these are like backups to the CurrentControlSet. So if anyone has any other ideas on this i'm happy to listen, my current setup is - [WinRegMon://Registry11] proc = . key_path = "\REGISTRY\MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\LSA\Notification Packages" type = create|delete|set|rename index = main ... View more

Hey, I've tried with an _ and it brings back some surprising results, so the key I wish to monitor is not monitored however what seems to be a replication of the key is monitored along with a whole host of other items. Its defiantly got me scratching my head HKLM\System\ControlSet001\Control\Lsa\Notofication Packages is now being picked up ??? ... View more

Sure, So as in the example above if the Administrator account was making a connection out the proxy every 5 seconds then I want to see results for that ( I would also build an alert of the search ) I guess the results would show 1000s of lines looking exactly the same with a time stamp each one being 5 seconds apart and the event being somthing like - GET http://somesite.com/ blah blah SomeDomain\Administrator blah blah xxx.xxx.xxx.xxx (Unknown Attackers IP) You wouldn't normally expect to see a connection to the internet from your Administrator account so this would be strange behavior, my goal would be that if this was to happen and the connection was up and down constantly with the same values of every 5 seconds or 10 or whatever we would want to be notified, we would want to know the system that its originating from and we could then go off and complete investigation / remediation be it terminating the connection or whatever was warranted. I guess for context maybe one of the other searches and or investigations we would do is check if the originating IP is a users workstation or back end system etc etc just to build up a picture of whats going on. Again if the system was a sales rep, you would expect the admin account to be pinging out There's nothing I can really share with you from Cobalt Strike as that's just the tool that would send the attacks from an off site location. ... View more

For what its worth as I can see this post is old, you could try this - EventCode=4625 | stats count by Account_Name, Workstation_Name, Failure_Reason, Source_Network_Address | search count>5 I have posted this as there are a few similar Splunk answers knocking around but none seemed to work for me or quite gave me what I needed, this will show failed logon attempts over 5 attempts ... View more

Thank you i'll take a look at this option. 🙂 ... View more

Hi, It's not that I cant define multiple stanzas its more a case that I would like to keep the config files small and tidy, call it OCD !!! As for what I'm trying to do, I'm looking at creating a config file that will log everything needed for every type of attack based off of the Mitre Table attack vectors so the config files will be quite comprehensive, this will then be distributed over all the systems so I just want to keep it as simple and tidy as possible. ... View more

Hi, Can you advise how you can monitor multiple Reg Keys in the same stanza ? Thank you ... View more