2026-04-13 09-26-14

0:11

S… Speaker 1 (2026-04-13 09-26-14)

In this video,

0:12

S… Speaker 2 (2026-04-13 09-26-14)

we're going to take a look at some of the more common types

0:16

S… Speaker 2 (2026-04-13 09-26-14)

of queries that you may use in Splunk when

0:20

S… Speaker 2 (2026-04-13 09-26-14)

performing threat hunting activities.

0:23

S… Speaker 1 (2026-04-13 09-26-14)

So, first of all,

0:24

S… Speaker 2 (2026-04-13 09-26-14)

let's remember what's important about threat hunting and the

0:28

S… Speaker 2 (2026-04-13 09-26-14)

hypothesis building and everything else like that.

0:31

S… Speaker 2 (2026-04-13 09-26-14)

All good queries you do in Splunk are going to have a purpose behind

0:35

S… Speaker 1 (2026-04-13 09-26-14)

them.

0:36

S… Speaker 2 (2026-04-13 09-26-14)

They need to be tied into your hypothesis in some manner.

0:40

S… Speaker 2 (2026-04-13 09-26-14)

You need to know what you're looking for so you can build that

0:44

S… Speaker 2 (2026-04-13 09-26-14)

effective query.

0:45

S… Speaker 2 (2026-04-13 09-26-14)

So a good example of this is,

0:49

S… Speaker 2 (2026-04-13 09-26-14)

let's say our hypothesis is that we suspect that attackers

0:53

S… Speaker 2 (2026-04-13 09-26-14)

are running some sort of malicious scripts.

0:56

S… Speaker 2 (2026-04-13 09-26-14)

from temporary folders on a workstation.

1:01

S… Speaker 2 (2026-04-13 09-26-14)

There's a number of different ways you could go about trying to

1:05

S… Speaker 2 (2026-04-13 09-26-14)

find this kind of activity during a hunt.

1:08

S… Speaker 1 (2026-04-13 09-26-14)

For example,

1:08

S… Speaker 2 (2026-04-13 09-26-14)

you could search for any sort of PowerShell script file

1:12

S… Speaker 2 (2026-04-13 09-26-14)

that is executed within a certain span of time,

1:16

S… Speaker 2 (2026-04-13 09-26-14)

whatever the threat hunt is covering.

1:19

S… Speaker 2 (2026-04-13 09-26-14)

You could also look for any non -executable files that

1:23

S… Speaker 2 (2026-04-13 09-26-14)

may be either stored or executed within any

1:28

S… Speaker 2 (2026-04-13 09-26-14)

of the temp folders on the workstation,

1:31

S… Speaker 2 (2026-04-13 09-26-14)

like C Windows temp or just the temp folder on the root of the drive.

1:36

S… Speaker 2 (2026-04-13 09-26-14)

or maybe you could look for evidence of script files being

1:40

S… Speaker 2 (2026-04-13 09-26-14)

created in a temporary folder.

1:42

S… Speaker 2 (2026-04-13 09-26-14)

So there's a few different ways you could go about carrying

1:47

S… Speaker 2 (2026-04-13 09-26-14)

out searches for this specific hypothesis.

1:51

S… Speaker 2 (2026-04-13 09-26-14)

One way isn't really going to be any more effective than the other.

1:56

S… Speaker 2 (2026-04-13 09-26-14)

until you really know exactly what the attacker's activities

2:01

S… Speaker 1 (2026-04-13 09-26-14)

have been,

2:02

S… Speaker 2 (2026-04-13 09-26-14)

but you're not going to discover that until you're actually performing those searches.

2:05

S… Speaker 1 (2026-04-13 09-26-14)

Now,

2:06

S… Speaker 2 (2026-04-13 09-26-14)

these are just a kind of few examples of some of the common queries

2:11

S… Speaker 2 (2026-04-13 09-26-14)

that we're going to go over here in a minute that can be helpful.

2:14

S… Speaker 1 (2026-04-13 09-26-14)

But again,

2:15

S… Speaker 2 (2026-04-13 09-26-14)

which queries you start with and how you progress in

2:19

S… Speaker 2 (2026-04-13 09-26-14)

your hunt and what kind of pivoting you do.

2:22

S… Speaker 2 (2026-04-13 09-26-14)

is really just going to depend on the trigger,

2:24

S… Speaker 2 (2026-04-13 09-26-14)

on the hypothesis,

2:26

S… Speaker 2 (2026-04-13 09-26-14)

and what you find throughout the hunt.

2:28

S… Speaker 2 (2026-04-13 09-26-14)

So some of the more common reasons that you'll,

2:32

S… Speaker 2 (2026-04-13 09-26-14)

you know, be looking through logs in something like Splunk,

2:36

S… Speaker 2 (2026-04-13 09-26-14)

some of the more common queries you'll build,

2:38

S… Speaker 2 (2026-04-13 09-26-14)

and we're going to take a look at all of these or majority of these here in just a minute.

2:42

S… Speaker 2 (2026-04-13 09-26-14)

So you could be making queries that are geared towards looking for

2:46

S… Speaker 2 (2026-04-13 09-26-14)

new users being created on a system,

2:49

S… Speaker 2 (2026-04-13 09-26-14)

brute force login attempts for an attacker trying to break

2:53

S… Speaker 2 (2026-04-13 09-26-14)

into accounts.

2:54

S… Speaker 2 (2026-04-13 09-26-14)

You could be looking for just unexpected outbound

2:58

S… Speaker 2 (2026-04-13 09-26-14)

network connections for something like a command and control activity.

3:02

S… Speaker 2 (2026-04-13 09-26-14)

You could be looking for any sort of suspicious power shell activity

3:06

S… Speaker 2 (2026-04-13 09-26-14)

like encoded commands.

3:08

S… Speaker 2 (2026-04-13 09-26-14)

or PowerShell being used to download files.

3:11

S… Speaker 2 (2026-04-13 09-26-14)

Both of those would definitely be considered suspicious in most environments.

3:15

S… Speaker 2 (2026-04-13 09-26-14)

And you can look for various evidence of various different types

3:19

S… Speaker 2 (2026-04-13 09-26-14)

of persistence techniques,

3:21

S… Speaker 2 (2026-04-13 09-26-14)

like suspicious scheduled tasks being created,

3:25

S… Speaker 2 (2026-04-13 09-26-14)

auto -run locations being updated with malicious scripts,

3:29

S… Speaker 2 (2026-04-13 09-26-14)

or even some services being created by the attacker.

3:33

S… Speaker 2 (2026-04-13 09-26-14)

So now let's switch over to our lab environment and

3:38

S… Speaker 2 (2026-04-13 09-26-14)

take a look at what some of these different types of searches

3:42

S… Speaker 2 (2026-04-13 09-26-14)

would look like when they're constructed using SPL

3:47

S… Speaker 2 (2026-04-13 09-26-14)

in Splunk.

3:49

S… Speaker 1 (2026-04-13 09-26-14)

All right,

3:50

S… Speaker 2 (2026-04-13 09-26-14)

we are here in our Splunk lab environment.

3:53

S… Speaker 2 (2026-04-13 09-26-14)

We got the search pulled up and I do have an

3:57

S… Speaker 2 (2026-04-13 09-26-14)

appropriate time frame sent here.

3:59

S… Speaker 2 (2026-04-13 09-26-14)

So we make sure we have the correct dates we're looking for.

4:03

S… Speaker 2 (2026-04-13 09-26-14)

First thing we're going to take a look at is evidence of a new

4:07

S… Speaker 2 (2026-04-13 09-26-14)

user being created.

4:08

S… Speaker 2 (2026-04-13 09-26-14)

So we're going to remember to do our index as always.

4:12

S… Speaker 2 (2026-04-13 09-26-14)

And we need to look for a specific

4:16

S… Speaker 1 (2026-04-13 09-26-14)

event.

4:17

S… Speaker 2 (2026-04-13 09-26-14)

code or event ID.

4:19

S… Speaker 2 (2026-04-13 09-26-14)

So event ID 4720 is what is tied to

4:23

S… Speaker 2 (2026-04-13 09-26-14)

a new user creation.

4:25

S… Speaker 1 (2026-04-13 09-26-14)

So first of all,

4:26

S… Speaker 2 (2026-04-13 09-26-14)

we're going to specify a source just to kind of narrow down

4:30

S… Speaker 2 (2026-04-13 09-26-14)

the scope of where we're looking.

4:32

S… Speaker 2 (2026-04-13 09-26-14)

So we're going to tell it,

4:33

S… Speaker 2 (2026-04-13 09-26-14)

we're going to say we're looking in the source of win event log.

4:37

S… Speaker 2 (2026-04-13 09-26-14)

In the security log,

4:39

S… Speaker 2 (2026-04-13 09-26-14)

this basically tells Splunk to look at these types of events only.

4:43

S… Speaker 1 (2026-04-13 09-26-14)

And again,

4:44

S… Speaker 2 (2026-04-13 09-26-14)

we are looking for a specific event ID of 4720,

4:50

S… Speaker 2 (2026-04-13 09-26-14)

which gives us results for new users created.

4:54

S… Speaker 2 (2026-04-13 09-26-14)

So this is a very common query you may

4:58

S… Speaker 2 (2026-04-13 09-26-14)

run in...

5:00

S… Speaker 2 (2026-04-13 09-26-14)

hunting again depending on what it is you're hunting for but

5:04

S… Speaker 2 (2026-04-13 09-26-14)

we see we do have a result here and we have an account

5:08

S… Speaker 2 (2026-04-13 09-26-14)

created that we can see right here.

5:11

S… Speaker 2 (2026-04-13 09-26-14)

We see the account was created by the sysadmin

5:16

S… Speaker 2 (2026-04-13 09-26-14)

user and the account that was created is the shadow

5:21

S… Speaker 2 (2026-04-13 09-26-14)

user right there so we can see we do have results from this

5:25

S… Speaker 1 (2026-04-13 09-26-14)

query.

5:26

S… Speaker 2 (2026-04-13 09-26-14)

So again a very useful query to run if we are looking for

5:30

S… Speaker 2 (2026-04-13 09-26-14)

new user creations

5:32

S… Speaker 2 (2026-04-13 09-26-14)

So the next one we're going to look for is,

5:34

S… Speaker 2 (2026-04-13 09-26-14)

let's take a look and see what we can find as far as brute force

5:38

S… Speaker 2 (2026-04-13 09-26-14)

attempts.

5:39

S… Speaker 2 (2026-04-13 09-26-14)

So there's kind of two phases to,

5:42

S… Speaker 2 (2026-04-13 09-26-14)

or two indicators in the logs that we want to look for.

5:47

S… Speaker 2 (2026-04-13 09-26-14)

A brute force attempt usually is going to have a number of failed logins,

5:51

S… Speaker 2 (2026-04-13 09-26-14)

followed by typically at least one successful login,

5:56

S… Speaker 2 (2026-04-13 09-26-14)

usually within a short period of time.

5:58

S… Speaker 2 (2026-04-13 09-26-14)

So what we can do is we can look for event code 4625,

6:03

S… Speaker 2 (2026-04-13 09-26-14)

and this will show us

6:07

S… Speaker 2 (2026-04-13 09-26-14)

specific logins for failed

6:13

S… Speaker 1 (2026-04-13 09-26-14)

logins.

6:14

S… Speaker 2 (2026-04-13 09-26-14)

So we have an account failed to log in right here,

6:18

S… Speaker 2 (2026-04-13 09-26-14)

and we can see that this is,

6:21

S… Speaker 2 (2026-04-13 09-26-14)

let's scroll and find the user account.

6:27

S… Speaker 1 (2026-04-13 09-26-14)

There we go.

6:27

S… Speaker 2 (2026-04-13 09-26-14)

The user account is the administrator account.

6:30

S… Speaker 2 (2026-04-13 09-26-14)

Now, if we look at the number of results here,

6:32

S… Speaker 2 (2026-04-13 09-26-14)

we have 21 results.

6:34

S… Speaker 1 (2026-04-13 09-26-14)

There's,

6:35

S… Speaker 2 (2026-04-13 09-26-14)

you know, this could take a little while to search through each of these individually.

6:38

S… Speaker 2 (2026-04-13 09-26-14)

So there's a few different ways we can make this a little easier to

6:42

S… Speaker 1 (2026-04-13 09-26-14)

look at.

6:43

S… Speaker 2 (2026-04-13 09-26-14)

So one, we can scroll through here and look at the account names under interesting fields

6:47

S… Speaker 2 (2026-04-13 09-26-14)

to see what our results are.

6:49

S… Speaker 2 (2026-04-13 09-26-14)

So we have 21 that don't have a username listed on it.

6:53

S… Speaker 1 (2026-04-13 09-26-14)

We have 20.

6:56

S… Speaker 2 (2026-04-13 09-26-14)

for sysadmin and one for administrators.

7:00

S… Speaker 2 (2026-04-13 09-26-14)

It just happened the one I selected was the administrator,

7:03

S… Speaker 2 (2026-04-13 09-26-14)

the only administrator.

7:04

S… Speaker 2 (2026-04-13 09-26-14)

So we have 20 failed logins for sysadmin,

7:08

S… Speaker 2 (2026-04-13 09-26-14)

and then the the dash right here for the total of 21 is indicating that

7:12

S… Speaker 2 (2026-04-13 09-26-14)

the source account was unknown.

7:15

S… Speaker 2 (2026-04-13 09-26-14)

We have two accounts there that have failed logins.

7:19

S… Speaker 2 (2026-04-13 09-26-14)

We can then repeat the search to look for event ID 4624

7:23

S… Speaker 2 (2026-04-13 09-26-14)

for successful logins,

7:25

S… Speaker 2 (2026-04-13 09-26-14)

or we can use kind of the power of these

7:29

S… Speaker 2 (2026-04-13 09-26-14)

Splunk queries to make this a little bit easier.

7:33

S… Speaker 2 (2026-04-13 09-26-14)

So let's look for both failed

7:37

S… Speaker 2 (2026-04-13 09-26-14)

logins and successful logins at the same time.

7:42

S… Speaker 2 (2026-04-13 09-26-14)

So we're going to do event code 4625 and 4624.

7:47

S… Speaker 2 (2026-04-13 09-26-14)

So we're using Boolean in here,

7:49

S… Speaker 2 (2026-04-13 09-26-14)

and we are grouping to say we're looking for both of those.

7:53

S… Speaker 1 (2026-04-13 09-26-14)

Now,

7:54

S… Speaker 2 (2026-04-13 09-26-14)

what we're going to do here is use some of the commands built into Splunk,

7:58

S… Speaker 2 (2026-04-13 09-26-14)

specifically the stats count and eval.

8:01

S… Speaker 2 (2026-04-13 09-26-14)

And we'll go over what a couple of these do here in just a minute,

8:05

S… Speaker 2 (2026-04-13 09-26-14)

but let me get this typed out.

8:07

S… Speaker 2 (2026-04-13 09-26-14)

So we're going to pipe this into the stats command.

8:11

S… Speaker 2 (2026-04-13 09-26-14)

Now, basically what we want to do is we want to count the number of failed

8:15

S… Speaker 2 (2026-04-13 09-26-14)

logins and the number of successful logins so that

8:19

S… Speaker 2 (2026-04-13 09-26-14)

we can also add some logic into it as well

8:23

S… Speaker 2 (2026-04-13 09-26-14)

and only show the number of logins that are meeting

8:27

S… Speaker 2 (2026-04-13 09-26-14)

specific criteria.

8:29

S… Speaker 2 (2026-04-13 09-26-14)

So first,

8:30

S… Speaker 2 (2026-04-13 09-26-14)

we're going to count both of these.

8:32

S… Speaker 2 (2026-04-13 09-26-14)

We're going to count both the failed events and the successful events.

8:35

S… Speaker 2 (2026-04-13 09-26-14)

We're also going to use the eval command here.

8:40

S… Speaker 2 (2026-04-13 09-26-14)

This is going to kind of just perform some additional

8:44

S… Speaker 2 (2026-04-13 09-26-14)

logic on the event codes themselves to label

8:48

S… Speaker 2 (2026-04-13 09-26-14)

them in a different field.

8:50

S… Speaker 2 (2026-04-13 09-26-14)

So we are going to count,

8:53

S… Speaker 2 (2026-04-13 09-26-14)

and we are going to perform an eval on event code 4625,

8:58

S… Speaker 2 (2026-04-13 09-26-14)

and we are going to label that as

9:03

S… Speaker 2 (2026-04-13 09-26-14)

failure.

9:04

S… Speaker 2 (2026-04-13 09-26-14)

And then we are going to do the same thing on the

9:08

S… Speaker 1 (2026-04-13 09-26-14)

other.

9:09

S… Speaker 2 (2026-04-13 09-26-14)

event ID as well,

9:11

S… Speaker 2 (2026-04-13 09-26-14)

if I can spell event properly.

9:14

S… Speaker 2 (2026-04-13 09-26-14)

We'll do that on 4624,

9:16

S… Speaker 2 (2026-04-13 09-26-14)

and we'll label that as success.

9:20

S… Speaker 1 (2026-04-13 09-26-14)

Now,

9:22

S… Speaker 2 (2026-04-13 09-26-14)

we also want to group these because we want to see what

9:26

S… Speaker 2 (2026-04-13 09-26-14)

computer the logins are failing on,

9:29

S… Speaker 2 (2026-04-13 09-26-14)

what device they're failing on.

9:31

S… Speaker 2 (2026-04-13 09-26-14)

So we're going to group these by,

9:33

S… Speaker 2 (2026-04-13 09-26-14)

or at least,

9:34

S… Speaker 2 (2026-04-13 09-26-14)

you know, sort order group by account name and computer

9:38

S… Speaker 1 (2026-04-13 09-26-14)

name.

9:39

S… Speaker 2 (2026-04-13 09-26-14)

So we're going to do the by right here to basically

9:43

S… Speaker 2 (2026-04-13 09-26-14)

tell the stats command how we're grouping these.

9:48

S… Speaker 2 (2026-04-13 09-26-14)

So we're going to go with computer name and then

9:52

S… Speaker 2 (2026-04-13 09-26-14)

account name.

9:53

S… Speaker 2 (2026-04-13 09-26-14)

We're going to do another pipe because we

9:57

S… Speaker 2 (2026-04-13 09-26-14)

want to take the counting we're doing.

10:00

S… Speaker 2 (2026-04-13 09-26-14)

here, and we want to add some additional criteria.

10:03

S… Speaker 2 (2026-04-13 09-26-14)

So we can use the where command,

10:05

S… Speaker 2 (2026-04-13 09-26-14)

and we want to say where we have more

10:09

S… Speaker 1 (2026-04-13 09-26-14)

than five failures,

10:11

S… Speaker 2 (2026-04-13 09-26-14)

so failure greater than five,

10:13

S… Speaker 2 (2026-04-13 09-26-14)

and more than one success.

10:17

S… Speaker 1 (2026-04-13 09-26-14)

Excuse me,

10:18

S… Speaker 2 (2026-04-13 09-26-14)

more than zero successes,

10:20

S… Speaker 2 (2026-04-13 09-26-14)

at least one success.

10:21

S… Speaker 1 (2026-04-13 09-26-14)

However,

10:22

S… Speaker 2 (2026-04-13 09-26-14)

I also need to spell success properly.

10:27

S… Speaker 2 (2026-04-13 09-26-14)

So we want more than five failed logins and at least one

10:31

S… Speaker 2 (2026-04-13 09-26-14)

successful login for these accounts.

10:33

S… Speaker 2 (2026-04-13 09-26-14)

Now we could do this and get some kind of raw looking information,

10:38

S… Speaker 2 (2026-04-13 09-26-14)

but the next thing we're going to do,

10:39

S… Speaker 2 (2026-04-13 09-26-14)

you can see how you can get very complicated search queries.

10:43

S… Speaker 2 (2026-04-13 09-26-14)

The next thing we're going to do is just make this information look a

10:47

S… Speaker 1 (2026-04-13 09-26-14)

little prettier.

10:48

S… Speaker 2 (2026-04-13 09-26-14)

So we're going to put it all into a table.

10:51

S… Speaker 2 (2026-04-13 09-26-14)

We're going to use the built -in time indicator in Splunk.

10:54

S… Speaker 2 (2026-04-13 09-26-14)

And then we're going to use just some of the information

10:59

S… Speaker 1 (2026-04-13 09-26-14)

we've already grabbed.

11:00

S… Speaker 2 (2026-04-13 09-26-14)

So we're going to take the account name,

11:02

S… Speaker 1 (2026-04-13 09-26-14)

spell it right,

11:04

S… Speaker 2 (2026-04-13 09-26-14)

and we're going to take the number of successes and the number of

11:08

S… Speaker 1 (2026-04-13 09-26-14)

failures.

11:09

S… Speaker 2 (2026-04-13 09-26-14)

And we're going to have it group all of that into a table.

11:14

S… Speaker 1 (2026-04-13 09-26-14)

So just to recap here,

11:15

S… Speaker 2 (2026-04-13 09-26-14)

we are searching for both failed and successful logins

11:19

S… Speaker 2 (2026-04-13 09-26-14)

with both event IDs.

11:21

S… Speaker 2 (2026-04-13 09-26-14)

And then we are essentially counting how many failures

11:25

S… Speaker 1 (2026-04-13 09-26-14)

we have,

11:25

S… Speaker 2 (2026-04-13 09-26-14)

how many successes we have,

11:27

S… Speaker 2 (2026-04-13 09-26-14)

and reformatting that into a different field called success and

11:32

S… Speaker 1 (2026-04-13 09-26-14)

failure.

11:32

S… Speaker 2 (2026-04-13 09-26-14)

And then we are going to be grouping those by computer name and account

11:36

S… Speaker 1 (2026-04-13 09-26-14)

name.

11:37

S… Speaker 2 (2026-04-13 09-26-14)

Then we're taking that data and saying only show us the results

11:41

S… Speaker 2 (2026-04-13 09-26-14)

where there's more than five failures and more than zero

11:45

S… Speaker 2 (2026-04-13 09-26-14)

successes.

11:46

S… Speaker 2 (2026-04-13 09-26-14)

So at least five or at least six failures and at least

11:50

S… Speaker 2 (2026-04-13 09-26-14)

one success on that account because that is the indicator

11:54

S… Speaker 2 (2026-04-13 09-26-14)

of a brute force attack.

11:56

S… Speaker 2 (2026-04-13 09-26-14)

Several failed logins followed by at least one successful

12:01

S… Speaker 1 (2026-04-13 09-26-14)

login.

12:01

S… Speaker 2 (2026-04-13 09-26-14)

And then we're formatting it into a pretty table.

12:04

S… Speaker 2 (2026-04-13 09-26-14)

Now, we see there are no results found.

12:08

S… Speaker 2 (2026-04-13 09-26-14)

Let's take a look at our query and see exactly what we have done

12:12

S… Speaker 1 (2026-04-13 09-26-14)

here.

12:12

S… Speaker 2 (2026-04-13 09-26-14)

Now, a lot of things in Splunk are case sensitive.

12:15

S… Speaker 2 (2026-04-13 09-26-14)

So we see we have listed failure here and success capitalized,

12:20

S… Speaker 1 (2026-04-13 09-26-14)

but I have not in my where statement.

12:22

S… Speaker 2 (2026-04-13 09-26-14)

So let's see if that's our issue.

12:24

S… Speaker 2 (2026-04-13 09-26-14)

Go over to success,

12:26

S… Speaker 1 (2026-04-13 09-26-14)

change the capitalization of that.

12:29

S… Speaker 1 (2026-04-13 09-26-14)

And that was our issue right here.

12:32

S… Speaker 1 (2026-04-13 09-26-14)

Now we see another issue here,

12:34

S… Speaker 2 (2026-04-13 09-26-14)

and this is just coming from me typing too quickly and trying to talk at the same time.

12:38

S… Speaker 1 (2026-04-13 09-26-14)

We have an underscore in account name here.

12:41

S… Speaker 1 (2026-04-13 09-26-14)

No underscore in account name here.

12:44

S… Speaker 2 (2026-04-13 09-26-14)

I know just from looking in Splunk that the field

12:48

S… Speaker 2 (2026-04-13 09-26-14)

does have an underscore in it.

12:50

S… Speaker 1 (2026-04-13 09-26-14)

Let's fix that.

12:51

S… Speaker 2 (2026-04-13 09-26-14)

Now we have the username.

12:54

S… Speaker 2 (2026-04-13 09-26-14)

So we can see right here that the sysadmin account,

12:59

S… Speaker 2 (2026-04-13 09-26-14)

had 20 failures associated with it,

13:02

S… Speaker 2 (2026-04-13 09-26-14)

and then three successes.

13:05

S… Speaker 2 (2026-04-13 09-26-14)

This is a good indicator of a brute force

13:09

S… Speaker 1 (2026-04-13 09-26-14)

attack.

13:10

S… Speaker 2 (2026-04-13 09-26-14)

Multiple failed logins followed by at least one

13:14

S… Speaker 2 (2026-04-13 09-26-14)

successful login.

13:16

S… Speaker 1 (2026-04-13 09-26-14)

So you can see,

13:17

S… Speaker 2 (2026-04-13 09-26-14)

you can do this individually.

13:19

S… Speaker 2 (2026-04-13 09-26-14)

You can search for just failed logins and then just successful

13:24

S… Speaker 2 (2026-04-13 09-26-14)

logins and compare those manually.

13:26

S… Speaker 2 (2026-04-13 09-26-14)

Or you can use the capabilities built into these Splunk

13:30

S… Speaker 2 (2026-04-13 09-26-14)

commands and make kind of a complicated search here.

13:34

S… Speaker 1 (2026-04-13 09-26-14)

That shows you all of the information at a glance.

13:38

S… Speaker 2 (2026-04-13 09-26-14)

And then you can save this if you want to so that you,

13:41

S… Speaker 1 (2026-04-13 09-26-14)

you know, have it.

13:42

S… Speaker 2 (2026-04-13 09-26-14)

You can just copy and paste in very easily.

13:45

S… Speaker 2 (2026-04-13 09-26-14)

Or you can also go in here and save as.

13:49

S… Speaker 1 (2026-04-13 09-26-14)

You can create reports.

13:50

S… Speaker 2 (2026-04-13 09-26-14)

You can make a dashboard out of this so that you can quickly revisit

13:54

S… Speaker 2 (2026-04-13 09-26-14)

it when needed.

13:56

S… Speaker 2 (2026-04-13 09-26-14)

So let's take a look at another query.

14:00

S… Speaker 2 (2026-04-13 09-26-14)

So we're going to clear all this out.

14:02

S… Speaker 2 (2026-04-13 09-26-14)

The next one I want to take a look at is going to be unexpected network connections.

14:06

S… Speaker 2 (2026-04-13 09-26-14)

And this is where we're going to use some of the Sysmon

14:11

S… Speaker 1 (2026-04-13 09-26-14)

event logging.

14:11

S… Speaker 2 (2026-04-13 09-26-14)

So we'll make sure we have our index in here.

14:13

S… Speaker 1 (2026-04-13 09-26-14)

Always remember to have your index.

14:15

S… Speaker 2 (2026-04-13 09-26-14)

And then we're going to search for event

14:19

S… Speaker 1 (2026-04-13 09-26-14)

code three.

14:20

S… Speaker 1 (2026-04-13 09-26-14)

Make sure I capitalize that right.

14:22

S… Speaker 1 (2026-04-13 09-26-14)

I did.

14:22

S… Speaker 1 (2026-04-13 09-26-14)

So this is going to give us

14:25

S… Speaker 2 (2026-04-13 09-26-14)

all of the network connectivity logged,

14:28

S… Speaker 2 (2026-04-13 09-26-14)

and we have 33 results here.

14:31

S… Speaker 2 (2026-04-13 09-26-14)

It can be a little difficult to go

14:35

S… Speaker 1 (2026-04-13 09-26-14)

through and look at all this,

14:36

S… Speaker 2 (2026-04-13 09-26-14)

especially if we're looking for specific indicators like suspicious IP

14:41

S… Speaker 2 (2026-04-13 09-26-14)

addresses or anything like that.

14:43

S… Speaker 1 (2026-04-13 09-26-14)

So again,

14:44

S… Speaker 2 (2026-04-13 09-26-14)

let's just make this data a little easier to digest.

14:49

S… Speaker 2 (2026-04-13 09-26-14)

So we're going to put it into a table again.

14:52

S… Speaker 2 (2026-04-13 09-26-14)

We're going to take a look at several fields.

14:54

S… Speaker 2 (2026-04-13 09-26-14)

We want to see the computer name of where the network connection came from.

14:57

S… Speaker 2 (2026-04-13 09-26-14)

We want to see the IP address.

15:00

S… Speaker 2 (2026-04-13 09-26-14)

of that machine.

15:00

S… Speaker 2 (2026-04-13 09-26-14)

And in the Splunk fields here,

15:03

S… Speaker 2 (2026-04-13 09-26-14)

the P in IP is not capitalized,

15:06

S… Speaker 2 (2026-04-13 09-26-14)

at least for source and destination IPs.

15:08

S… Speaker 2 (2026-04-13 09-26-14)

We're going to take a look at the destination IP as well,

15:12

S… Speaker 2 (2026-04-13 09-26-14)

making sure I spelled that right.

15:13

S… Speaker 2 (2026-04-13 09-26-14)

And we're going to look at the destination host

15:18

S… Speaker 1 (2026-04-13 09-26-14)

name as well,

15:19

S… Speaker 2 (2026-04-13 09-26-14)

just if there is any.

15:20

S… Speaker 2 (2026-04-13 09-26-14)

There may not be a destination host name if the network

15:25

S… Speaker 2 (2026-04-13 09-26-14)

connection wasn't initiated using a domain name.

15:28

S… Speaker 2 (2026-04-13 09-26-14)

And then we're going to look at the destination port,

15:32

S… Speaker 2 (2026-04-13 09-26-14)

where the connection was going to.

15:35

S… Speaker 2 (2026-04-13 09-26-14)

And then don't forget that Sysmon with event code 3

15:39

S… Speaker 2 (2026-04-13 09-26-14)

looking at network connections can also look at the name of the process,

15:43

S… Speaker 2 (2026-04-13 09-26-14)

or also known as image,

15:45

S… Speaker 2 (2026-04-13 09-26-14)

that initiated the connection.

15:47

S… Speaker 1 (2026-04-13 09-26-14)

So basically,

15:48

S… Speaker 2 (2026-04-13 09-26-14)

we're taking these results that we have already found,

15:52

S… Speaker 2 (2026-04-13 09-26-14)

and all we're doing with this is just formatting them to be

15:56

S… Speaker 2 (2026-04-13 09-26-14)

easier to read and to see a lot of the data much

16:00

S… Speaker 1 (2026-04-13 09-26-14)

easier.

16:01

S… Speaker 2 (2026-04-13 09-26-14)

And we can see our time,

16:02

S… Speaker 2 (2026-04-13 09-26-14)

we can see the computer name.

16:04

S… Speaker 2 (2026-04-13 09-26-14)

source and destination IPs,

16:06

S… Speaker 2 (2026-04-13 09-26-14)

again, don't see host names here,

16:08

S… Speaker 2 (2026-04-13 09-26-14)

and we see several the destination ports as well.

16:11

S… Speaker 2 (2026-04-13 09-26-14)

And one thing that is already jumping out at me

16:15

S… Speaker 2 (2026-04-13 09-26-14)

is this connection right here.

16:19

S… Speaker 2 (2026-04-13 09-26-14)

I know I just circled many different ones,

16:22

S… Speaker 2 (2026-04-13 09-26-14)

but I'm talking about PowerShell specifically.

16:24

S… Speaker 2 (2026-04-13 09-26-14)

We see PowerShell reaching out to a network

16:28

S… Speaker 2 (2026-04-13 09-26-14)

connection on port 8000.

16:31

S… Speaker 2 (2026-04-13 09-26-14)

That is a bit suspicious.

16:33

S… Speaker 2 (2026-04-13 09-26-14)

So that would be one of the first things I'd start investigating and pivoting

16:37

S… Speaker 2 (2026-04-13 09-26-14)

the hunt from there.

16:40

S… Speaker 2 (2026-04-13 09-26-14)

We can keep scrolling down.

16:41

S… Speaker 2 (2026-04-13 09-26-14)

We see service host reaching out.

16:43

S… Speaker 2 (2026-04-13 09-26-14)

And then we also see we have a second page right here.

16:47

S… Speaker 2 (2026-04-13 09-26-14)

We can also just display more results per page if we wanted to.

16:50

S… Speaker 2 (2026-04-13 09-26-14)

A number of different ways we can go about that.

16:52

S… Speaker 2 (2026-04-13 09-26-14)

We have more PowerShell connections on several other additional

16:57

S… Speaker 1 (2026-04-13 09-26-14)

ports as well.

16:58

S… Speaker 2 (2026-04-13 09-26-14)

So we do have some suspicious network activity going

17:02

S… Speaker 2 (2026-04-13 09-26-14)

on on at least the SecLogs machine here.

17:06

S… Speaker 2 (2026-04-13 09-26-14)

And then we'll go back up to our first page.

17:09

S… Speaker 2 (2026-04-13 09-26-14)

And the client machine.

17:11

S… Speaker 2 (2026-04-13 09-26-14)

So we have a couple of machines that are exhibiting some suspicious

17:15

S… Speaker 2 (2026-04-13 09-26-14)

network activity.

17:17

S… Speaker 2 (2026-04-13 09-26-14)

And we can see all of that on one screen or at least,

17:20

S… Speaker 2 (2026-04-13 09-26-14)

you know, two pages of one screen just by formatting everything into

17:24

S… Speaker 2 (2026-04-13 09-26-14)

a table to make it easy to look at.

17:28

S… Speaker 2 (2026-04-13 09-26-14)

So let's take a look at some PowerShell stuff now.

17:32

S… Speaker 2 (2026-04-13 09-26-14)

First thing we're going to look at is encoded PowerShell commands.

17:37

S… Speaker 2 (2026-04-13 09-26-14)

Let's see if we have any evidence of those.

17:40

S… Speaker 2 (2026-04-13 09-26-14)

So we're going to look for event ID 4104,

17:44

S… Speaker 2 (2026-04-13 09-26-14)

equals there.

17:46

S… Speaker 2 (2026-04-13 09-26-14)

And then we are going to use

17:50

S… Speaker 2 (2026-04-13 09-26-14)

another different command in Splunk known as the search command.

17:54

S… Speaker 2 (2026-04-13 09-26-14)

This is going to search a specific field.

17:57

S… Speaker 1 (2026-04-13 09-26-14)

And in this case,

17:58

S… Speaker 2 (2026-04-13 09-26-14)

we want to look at the message field.

18:00

S… Speaker 2 (2026-04-13 09-26-14)

And let's go back a step to show you why we

18:05

S… Speaker 2 (2026-04-13 09-26-14)

are looking at the message field.

18:06

S… Speaker 2 (2026-04-13 09-26-14)

So let's expand any number of any one of these and

18:11

S… Speaker 2 (2026-04-13 09-26-14)

scroll not quite as much.

18:13

S… Speaker 2 (2026-04-13 09-26-14)

We see we have a message field right here.

18:16

S… Speaker 2 (2026-04-13 09-26-14)

And this is going to be where our information

18:20

S… Speaker 2 (2026-04-13 09-26-14)

is for the encoding.

18:22

S… Speaker 2 (2026-04-13 09-26-14)

This will be the field that shows us.

18:25

S… Speaker 2 (2026-04-13 09-26-14)

what PowerShell command was executed.

18:27

S… Speaker 2 (2026-04-13 09-26-14)

And you can see this looks like a built

18:31

S… Speaker 2 (2026-04-13 09-26-14)

-in command.

18:32

S… Speaker 2 (2026-04-13 09-26-14)

Let's instead see if we can see anything easily

18:36

S… Speaker 3 (2026-04-13 09-26-14)

here.

18:38

S… Speaker 2 (2026-04-13 09-26-14)

Yeah, so we can see some information here.

18:41

S… Speaker 2 (2026-04-13 09-26-14)

We see a PowerShell script being executed.

18:43

S… Speaker 2 (2026-04-13 09-26-14)

We see what looks like potentially malicious activity.

18:47

S… Speaker 2 (2026-04-13 09-26-14)

This, I can tell you right here,

18:49

S… Speaker 2 (2026-04-13 09-26-14)

looks to be evidence of Mimi Cats running.

18:51

S… Speaker 2 (2026-04-13 09-26-14)

So you can see this is where we want to search

18:55

S… Speaker 2 (2026-04-13 09-26-14)

for information in the PowerShell command itself

19:00

S… Speaker 2 (2026-04-13 09-26-14)

that the attacker may have entered.

19:01

S… Speaker 2 (2026-04-13 09-26-14)

So we're going to search that field by using search.

19:06

S… Speaker 2 (2026-04-13 09-26-14)

in the message field.

19:07

S… Speaker 1 (2026-04-13 09-26-14)

And in this case,

19:08

S… Speaker 2 (2026-04-13 09-26-14)

because we're searching for encoded PowerShell commands,

19:11

S… Speaker 2 (2026-04-13 09-26-14)

we are just going to search for the word encoded.

19:14

S… Speaker 1 (2026-04-13 09-26-14)

Now,

19:14

S… Speaker 2 (2026-04-13 09-26-14)

because the word encoded will appear somewhere in the message field,

19:18

S… Speaker 2 (2026-04-13 09-26-14)

not at the beginning and not at the end,

19:20

S… Speaker 2 (2026-04-13 09-26-14)

we're going to put an asterisk at the beginning and the end of the word

19:24

S… Speaker 2 (2026-04-13 09-26-14)

encoded to indicate wildcards.

19:27

S… Speaker 2 (2026-04-13 09-26-14)

So any text before and any text after,

19:30

S… Speaker 2 (2026-04-13 09-26-14)

but basically we're saying the message field has to contain the

19:34

S… Speaker 2 (2026-04-13 09-26-14)

word encoded.

19:36

S… Speaker 2 (2026-04-13 09-26-14)

And we have no results there,

19:38

S… Speaker 2 (2026-04-13 09-26-14)

which is fine.

19:39

S… Speaker 2 (2026-04-13 09-26-14)

That's not an issue.

19:41

S… Speaker 2 (2026-04-13 09-26-14)

Maybe there wasn't any.

19:43

S… Speaker 2 (2026-04-13 09-26-14)

Just making sure I spelled encoded right,

19:47

S… Speaker 2 (2026-04-13 09-26-14)

it appears I did.

19:48

S… Speaker 2 (2026-04-13 09-26-14)

Yeah, you're not always going to find results from any of your searches,

19:52

S… Speaker 2 (2026-04-13 09-26-14)

and that's not a problem.

19:54

S… Speaker 2 (2026-04-13 09-26-14)

Let's do a different PowerShell search now.

19:58

S… Speaker 2 (2026-04-13 09-26-14)

Let's see if there's any evidence of any.

20:00

S… Speaker 1 (2026-04-13 09-26-14)

downloads in PowerShell.

20:01

S… Speaker 2 (2026-04-13 09-26-14)

And remember,

20:02

S… Speaker 1 (2026-04-13 09-26-14)

the most common method you're going to see an attacker use

20:07

S… Speaker 1 (2026-04-13 09-26-14)

is going to be the invoke web request.

20:10

S… Speaker 1 (2026-04-13 09-26-14)

So we're going to do another search,

20:12

S… Speaker 1 (2026-04-13 09-26-14)

and we're going to do invoke web request somewhere in

20:16

S… Speaker 1 (2026-04-13 09-26-14)

the message block.

20:17

S… Speaker 1 (2026-04-13 09-26-14)

So you can see we kept the rest of our query here.

20:19

S… Speaker 1 (2026-04-13 09-26-14)

We are also going to search the

20:24

S… Speaker 2 (2026-04-13 09-26-14)

message field.

20:27

S… Speaker 2 (2026-04-13 09-26-14)

with the Boolean of OR there,

20:30

S… Speaker 1 (2026-04-13 09-26-14)

we want to search for the shorthand of IWR.

20:34

S… Speaker 2 (2026-04-13 09-26-14)

to get everything in quotes.

20:36

S… Speaker 1 (2026-04-13 09-26-14)

And we're also going to search because we're looking for really just any download

20:41

S… Speaker 1 (2026-04-13 09-26-14)

or suspicious.

20:42

S… Speaker 1 (2026-04-13 09-26-14)

There is another way the attackers can do this,

20:44

S… Speaker 1 (2026-04-13 09-26-14)

and this is with the invoke expression.

20:47

S… Speaker 1 (2026-04-13 09-26-14)

For those purposes,

20:48

S… Speaker 1 (2026-04-13 09-26-14)

we're just going to search for the shorthand version of it.

20:51

S… Speaker 1 (2026-04-13 09-26-14)

So we're searching the message field for invoke web

20:55

S… Speaker 1 (2026-04-13 09-26-14)

request somewhere in it,

20:57

S… Speaker 1 (2026-04-13 09-26-14)

the shorthand of that IWR or IEX.

21:01

S… Speaker 2 (2026-04-13 09-26-14)

in the message field,

21:04

S… Speaker 1 (2026-04-13 09-26-14)

and we see we do have two results for this query.

21:07

S… Speaker 1 (2026-04-13 09-26-14)

Much easier to look through these individually.

21:10

S… Speaker 1 (2026-04-13 09-26-14)

So we see a download string getting

21:14

S… Speaker 1 (2026-04-13 09-26-14)

a PowerView PS1 file,

21:17

S… Speaker 1 (2026-04-13 09-26-14)

so we can see that they are attempting to download,

21:20

S… Speaker 1 (2026-04-13 09-26-14)

and this was done through the IEX,

21:22

S… Speaker 1 (2026-04-13 09-26-14)

invoke expression,

21:23

S… Speaker 2 (2026-04-13 09-26-14)

which is why we have results for this.

21:26

S… Speaker 1 (2026-04-13 09-26-14)

So this is PowerShell being used to download a script.

21:31

S… Speaker 1 (2026-04-13 09-26-14)

PowerView being malicious for most enterprises.

21:35

S… Speaker 1 (2026-04-13 09-26-14)

And we can check our second one.

21:38

S… Speaker 1 (2026-04-13 09-26-14)

This time we have invokeWebRequest spelled out.

21:41

S… Speaker 1 (2026-04-13 09-26-14)

And we see the URI,

21:44

S… Speaker 1 (2026-04-13 09-26-14)

the address.

21:45

S… Speaker 1 (2026-04-13 09-26-14)

This is an executable being downloaded.

21:47

S… Speaker 1 (2026-04-13 09-26-14)

So we can see we do have good results from that

21:51

S… Speaker 1 (2026-04-13 09-26-14)

one as well.

21:54

S… Speaker 2 (2026-04-13 09-26-14)

All right,

21:54

S… Speaker 1 (2026-04-13 09-26-14)

two more common queries we want to take a look at.

21:58

S… Speaker 2 (2026-04-13 09-26-14)

Next one is going to be if there's any,

22:00

S… Speaker 1 (2026-04-13 09-26-14)

we're looking for any malicious scheduled tasks that might be created.

22:04

S… Speaker 2 (2026-04-13 09-26-14)

Now, remember,

22:05

S… Speaker 1 (2026-04-13 09-26-14)

there are two event codes that can be generated,

22:09

S… Speaker 1 (2026-04-13 09-26-14)

or event IDs that can be generated with new scheduled

22:14

S… Speaker 1 (2026-04-13 09-26-14)

tasks.

22:15

S… Speaker 1 (2026-04-13 09-26-14)

That's 7045 or 4698.

22:19

S… Speaker 1 (2026-04-13 09-26-14)

So let's take a look at...

22:22

S… Speaker 1 (2026-04-13 09-26-14)

Event code 7045,

22:26

S… Speaker 1 (2026-04-13 09-26-14)

and we're going to also search

22:30

S… Speaker 1 (2026-04-13 09-26-14)

for event code 4698,

22:35

S… Speaker 2 (2026-04-13 09-26-14)

as it

22:48

S… Speaker 1 (2026-04-13 09-26-14)

appears I have an unstable network connection,

22:50

S… Speaker 1 (2026-04-13 09-26-14)

but that seems to be fine now.

22:52

S… Speaker 1 (2026-04-13 09-26-14)

So, event code 4698

22:56

S… Speaker 1 (2026-04-13 09-26-14)

as well.

22:58

S… Speaker 1 (2026-04-13 09-26-14)

So we're going to search for those two to see if there's any evidence of any scheduled

23:03

S… Speaker 1 (2026-04-13 09-26-14)

tasks being created.

23:04

S… Speaker 1 (2026-04-13 09-26-14)

So event code 4698,

23:07

S… Speaker 1 (2026-04-13 09-26-14)

except I didn't type 4698.

23:11

S… Speaker 1 (2026-04-13 09-26-14)

I typed 4968.

23:13

S… Speaker 1 (2026-04-13 09-26-14)

Let's fix that.

23:14

S… Speaker 1 (2026-04-13 09-26-14)

4698.

23:17

S… Speaker 1 (2026-04-13 09-26-14)

And 70,

23:18

S… Speaker 2 (2026-04-13 09-26-14)

45.

23:19

S… Speaker 1 (2026-04-13 09-26-14)

So no evidence of either of those,

23:21

S… Speaker 1 (2026-04-13 09-26-14)

which is fine.

23:22

S… Speaker 1 (2026-04-13 09-26-14)

Again, you're not always going to find results for

23:27

S… Speaker 1 (2026-04-13 09-26-14)

anything you're searching for.

23:28

S… Speaker 1 (2026-04-13 09-26-14)

It really just depends.

23:32

S… Speaker 1 (2026-04-13 09-26-14)

And the last one I want to search for,

23:34

S… Speaker 1 (2026-04-13 09-26-14)

we're going to switch our Splunk environments really quick to search on a different

23:38

S… Speaker 1 (2026-04-13 09-26-14)

one.

23:39

S… Speaker 1 (2026-04-13 09-26-14)

We're going to look for evidence of malicious services being

23:43

S… Speaker 2 (2026-04-13 09-26-14)

created.

23:43

S… Speaker 1 (2026-04-13 09-26-14)

Now, there's a few different ways you can do this.

23:45

S… Speaker 1 (2026-04-13 09-26-14)

There's event IDs you can use,

23:47

S… Speaker 1 (2026-04-13 09-26-14)

and there are also registry keys

23:51

S… Speaker 1 (2026-04-13 09-26-14)

that can be created.

23:52

S… Speaker 1 (2026-04-13 09-26-14)

We're going to use the registry method here.

23:55

S… Speaker 1 (2026-04-13 09-26-14)

So we're going to look in our ECTHP.

23:57

S… Speaker 1 (2026-04-13 09-26-14)

Spelled that right.

23:58

S… Speaker 1 (2026-04-13 09-26-14)

Good. We're going to look in ECTHP.

24:01

S… Speaker 1 (2026-04-13 09-26-14)

And we are going to look for event code 12,

24:05

S… Speaker 1 (2026-04-13 09-26-14)

which is a new registry created.

24:06

S… Speaker 1 (2026-04-13 09-26-14)

We have a specific host

24:11

S… Speaker 1 (2026-04-13 09-26-14)

this time that we're looking for that we suspect may

24:15

S… Speaker 1 (2026-04-13 09-26-14)

have the service created

24:19

S… Speaker 1 (2026-04-13 09-26-14)

on it.

24:20

S… Speaker 1 (2026-04-13 09-26-14)

And we are going to look for a specific

24:24

S… Speaker 1 (2026-04-13 09-26-14)

type of event this time.

24:27

S… Speaker 2 (2026-04-13 09-26-14)

Because remember,

24:28

S… Speaker 1 (2026-04-13 09-26-14)

event code 12 can be a couple of different.

24:31

S… Speaker 1 (2026-04-13 09-26-14)

We're going to look for specifically a registry key was

24:36

S… Speaker 1 (2026-04-13 09-26-14)

created in a specific location.

24:40

S… Speaker 2 (2026-04-13 09-26-14)

That was not a word.

24:41

S… Speaker 1 (2026-04-13 09-26-14)

Target object.

24:43

S… Speaker 1 (2026-04-13 09-26-14)

And we are going to specify the registry key

2026-04-13 09-26-14

Crynodeb

Gofyn i AI Am Y Trawssgrifiad Yma