analyzing-windows-event-logs-in-splunk

# Analyzing Windows Event Logs in Splunk ## When to Use Use this skill when: - SOC analysts investigate alerts related to Windows authentication, process execution, or AD changes - Detection engineers build SPL queries for Windows-based threat detection - Incident responders need forensic timelines of Windows endpoint or domain controller activity - Periodic threat hunting targets Windows-specific ATT&CK techniques **Do not use** for Linux/macOS endpoint analysis or network-only investigations. ## Prerequisites - Splunk with Windows Event Log data ingested (sourcetype `WinEventLog:Security`, `WinEventLog:System`, `XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`) - Sysmon deployed on endpoints with SwiftOnSecurity or Olaf Hartong configuration - CIM data model acceleration for Endpoint and Authentication data models - Knowledge of Windows Security Event IDs and Sysmon event types ## Workflow ### Step 1: Authentication Attack Detection **Brute Force Detection (EventCode 4625 — Failed Logon):** ```spl index=wineventlog sourcetype="WinEventLog:Security" EventCode=4625 | stats count, dc(TargetUserName) AS unique_users, values(TargetUserName) AS targeted_users by src_ip, Logon_Type, Status | where count > 20 | eval attack_type = case( Logon_Type=3, "Network Brute Force", Logon_Type=10, "RDP Brute Force", Logon_Type=2, "Interactive Brute Force", 1=1, "Other" ) | eval status_meaning = case( Status="0xc000006d", "Bad Username or Password", Stat...