splunk universal forwarder download for windows

The process path of both the Outlook and Excel executables.The parent process was indeed Outlook.exe.This gives us some good information to track. | table parent_process_name parent_process_id parent_process_path process_path These fields could help us explore a bit further and confirm that processes are running from expected locations. Using the previous search, we can use the table command again to display more fields such as: We can see that wallylambic was the user, the process ID is 6416, and the command line shows Excel.exe opening the spreadsheet from what looks to be Outlook, but we need to explore further to confirm this.Īlso, we are not certain if anything happened after the spreadsheet was opened. | table _time host user ProcessId CommandLineĪ single process creation event referencing “ Salaries.xls” was returned from our search. Index=main source='xmlwineventlog:microsoft-windows-sysmon/operational' EventCode=1 I then add the fields I mentioned above to include in my table.If you would like, feel free to include as many others as you see fit. You can define your CommandLine field search in the first search block, but here I use a separate search command for clarity, and to get you ready for using it in this fashion later on. This search uses the main index, a source (not sourcetype!) for Sysmon data, and EventCode=1 to return process creation events. The full command line that triggered the process.I’m going to use the SPL command table, to “table”.: And as much as Brick Tamland Loves Lamp, I love table even more. To start, we can look to see if the spreadsheet filename, “ Salaries.xls”, has been observed in any EventCode 1 events in Sysmon. If it has, we’d also like to know what has transpired.

In this example, let’s assume we have a known malicious spreadsheet in our environment, and we want to understand if it’s been opened. Now that we’ve gotten the prerequisites out of the way, let’s start hunting. Windows Security Event Logs with Event ID 4688 and include command line in process creation eventsīoth of these data sources work, but I’m going to concentrate on Sysmon EventCode=1 data for this blog, as it lends itself quite well to a utility I show you further down.Sysmon with Event Code 1 enabled ( SwiftOnSecurity or Olaf Hartong’s Sysmon configs are both good places to start).There are two very good types of data for capturing new process creation events: Once I’ve got the appropriate add-ons installed, I need to configure the Windows endpoints to capture the process-related events. The two Splunk add-ons I’m using, on top of the Windows Universal Forwarder, to capture this data are: I will stick to Windows for this particular blog, but will endeavor to revisit it for other operating systems in the future. To hunt for these relationships, we must first begin by ingesting the right data. (Part of our Threat Hunting with Splunk series, we've updated this article recently to maximize your value.) Pre-requisites The app helps with what you have found in your searches. So, in this tutorial, I’ll show you how to use the pstree command and the PSTree app to help you look through all the processes you have to investigate. Splunk does a great job of ingesting process data, allowing you to search and correlate, but it can be challenging to visualize parent/child relationships for this data, especially spanning multiple generations. In the heat of battle, you may miss one item that could have led you to something interesting. This can be a very time-consuming and frustrating task if you try to brute force things by copy-pasting parent and child process IDs over and over again.

You want to trace the activity or relationships of a particular process. You may frequently find yourself in the middle of a security incident, or combing through your data looking for signs of malicious activity.

Splunk universal forwarder download for windows