analyzing-windows-event-logs-in-splunk

在 Splunk 中分析 Windows 事件日志

何时使用

在以下情况下使用此技能：

• SOC 分析师调查与 Windows 身份验证、进程执行或 AD 变更相关的告警
• 检测工程师为基于 Windows 的威胁检测构建 SPL 查询
• 事件响应人员需要 Windows 终端或域控制器活动的取证时间线
• 定期威胁狩猎针对 Windows 特有的 ATT&CK 技术

请勿使用于 Linux/macOS 终端分析或仅涉及网络的调查。

前提条件

• 已摄入 Windows 事件日志数据的 Splunk（sourcetype WinEventLog:Security、WinEventLog:System、XmlWinEventLog:Microsoft-Windows-Sysmon/Operational）
• 在终端上部署了 Sysmon，并采用 SwiftOnSecurity 或 Olaf Hartong 配置
• 为 Endpoint 和 Authentication 数据模型启用 CIM 数据模型加速
• 了解 Windows 安全事件 ID 和 Sysmon 事件类型

工作流

步骤 1：身份验证攻击检测

暴力破解检测（EventCode 4625 — 登录失败）：

index=wineventlog sourcetype="WinEventLog:Security" EventCode=4625
| stats count, dc(TargetUserName) AS unique_users, values(TargetUserName) AS targeted_users
  by src_ip, Logon_Type, Status
| where count > 20
| eval attack_type = case(
    Logon_Type=3, "Network Brute Force",
    Logon_Type=10, "RDP Brute Force",
    Logon_Type=2, "Interactive Brute Force",
    1=1, "Other"
  )
| eval status_meaning = case(
    Status="0xc000006d", "Bad Username or Password",
    Status="0xc000006a", "Incorrect Password (valid user)",
    Status="0xc0000234", "Account Locked Out",
    Status="0xc0000072", "Account Disabled",
    1=1, Status
  )
| sort - count
| table src_ip, attack_type, status_meaning, count, unique_users, targeted_users

密码喷洒检测：

index=wineventlog sourcetype="WinEventLog:Security" EventCode=4625 Logon_Type=3
| bin _time span=10m
| stats dc(TargetUserName) AS unique_users, count AS total_attempts,
  values(TargetUserName) AS users_targeted by src_ip, _time
| where unique_users > 10 AND total_attempts < unique_users * 3
| eval spray_confidence = if(unique_users > 25, "HIGH", "MEDIUM")

多次失败后成功登录（失陷指标）：

index=wineventlog sourcetype="WinEventLog:Security"
(EventCode=4625 OR EventCode=4624) src_ip!="127.0.0.1"
| sort _time
| stats earliest(_time) AS first_seen, latest(_time) AS last_seen,
  sum(eval(if(EventCode=4625,1,0))) AS failures,
  sum(eval(if(EventCode=4624,1,0))) AS successes
  by src_ip, TargetUserName, ComputerName
| where failures > 10 AND successes > 0
| eval time_to_success = round((last_seen - first_seen)/60, 1)
| sort - failures

步骤 2：权限提升检测

创建新管理员账户（T1136.001）：

index=wineventlog sourcetype="WinEventLog:Security" EventCode=4720
| join TargetUserName type=left [
    search index=wineventlog EventCode=4732 TargetUserName="Administrators"
    | rename MemberName AS TargetUserName
  ]
| table _time, SubjectUserName, TargetUserName, ComputerName
| eval alert = "New account created and added to Administrators group"

分配特殊权限（EventCode 4672）：

index=wineventlog sourcetype="WinEventLog:Security" EventCode=4672
SubjectUserName!="SYSTEM" SubjectUserName!="LOCAL SERVICE" SubjectUserName!="NETWORK SERVICE"
| stats count, values(PrivilegeList) AS privileges by SubjectUserName, ComputerName
| where count > 0
| search privileges IN ("SeDebugPrivilege", "SeTcbPrivilege", "SeBackupPrivilege",
  "SeRestorePrivilege", "SeAssignPrimaryTokenPrivilege")

令牌操纵检测（T1134）：

index=sysmon EventCode=10 TargetImage="*\\lsass.exe"
GrantedAccess IN ("0x1010", "0x1038", "0x1fffff", "0x40")
| stats count by SourceImage, SourceUser, Computer, GrantedAccess
| where NOT match(SourceImage, "(svchost|csrss|wininit|MsMpEng|CrowdStrike)")
| sort - count

步骤 3：持久化机制检测

创建计划任务（T1053.005）：

index=wineventlog (sourcetype="WinEventLog:Security" EventCode=4698)
  OR (sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
      Image="*\\schtasks.exe")
| eval task_info = coalesce(TaskContent, CommandLine)
| search task_info="*powershell*" OR task_info="*cmd*" OR task_info="*http*" OR task_info="*\\Temp\\*"
| table _time, Computer, SubjectUserName, TaskName, task_info

修改注册表 Run 键（T1547.001）：

index=sysmon EventCode=13
TargetObject IN (
  "*\\CurrentVersion\\Run\\*",
  "*\\CurrentVersion\\RunOnce\\*",
  "*\\CurrentVersion\\RunServices\\*",
  "*\\Explorer\\Shell Folders\\*"
)
| stats count by Computer, Image, TargetObject, Details
| where NOT match(Image, "(explorer\.exe|msiexec\.exe|setup\.exe)")
| sort - count

WMI 事件订阅（T1546.003）：

index=sysmon EventCode=20 OR EventCode=21
| stats count by Computer, Operation, Consumer, EventNamespace
| where count > 0

步骤 4：横向移动检测

远程服务利用（T1021.002 — SMB/Windows 管理共享）：

index=wineventlog sourcetype="WinEventLog:Security" EventCode=4624 Logon_Type=3
| stats dc(ComputerName) AS unique_destinations, values(ComputerName) AS targets
  by src_ip, TargetUserName
| where unique_destinations > 3
| sort - unique_destinations
| table src_ip, TargetUserName, unique_destinations, targets

PsExec 检测（T1021.002）：

index=sysmon EventCode=1
(Image="*\\psexec.exe" OR Image="*\\psexesvc.exe"
 OR ParentImage="*\\psexesvc.exe"
 OR OriginalFileName="psexec.c")
| table _time, Computer, User, ParentImage, Image, CommandLine

RDP 横向移动（T1021.001）：

index=wineventlog sourcetype="WinEventLog:Security" EventCode=4624 Logon_Type=10
| stats count, dc(ComputerName) AS rdp_targets, values(ComputerName) AS destinations
  by src_ip, TargetUserName
| where rdp_targets > 2
| sort - rdp_targets

步骤 5：构建取证时间线

为受失陷主机创建全面的时间线：

(index=wineventlog OR index=sysmon) Computer="WORKSTATION-042"
earliest="2024-03-14T00:00:00" latest="2024-03-16T00:00:00"
| eval event_description = case(
    EventCode=4624, "Logon: ".TargetUserName." (Type ".Logon_Type.")",
    EventCode=4625, "Failed Logon: ".TargetUserName,
    EventCode=4688 OR (sourcetype="XmlWinEventLog:*Sysmon*" AND EventCode=1),
      "Process: ".Image." CMD: ".CommandLine,
    EventCode=4698, "Scheduled Task: ".TaskName,
    EventCode=3, "Network: ".DestinationIp.":".DestinationPort,
    EventCode=11, "File Created: ".TargetFilename,
    EventCode=13, "Registry: ".TargetObject,
    1=1, "Event ".EventCode
  )
| sort _time
| table _time, EventCode, event_description, User, src_ip

步骤 6：创建用于富化的查找表

为 Windows 事件 ID 上下文构建参考查找表：

| inputlookup windows_eventcode_lookup.csv
| table EventCode, Description, ATT_CK_Technique, Severity

如果查找表不存在，请创建它：

EventCode,Description,ATT_CK_Technique,Severity
4624,Successful Logon,T1078,Informational
4625,Failed Logon,T1110,Low
4648,Explicit Credential Logon,T1078,Medium
4672,Special Privileges Assigned,T1134,Medium
4688,New Process Created,T1059,Informational
4698,Scheduled Task Created,T1053.005,Medium
4720,User Account Created,T1136.001,High
4732,Member Added to Security Group,T1098,High
4768,Kerberos TGT Requested,T1558,Informational
4769,Kerberos Service Ticket,T1558.003,Low
4771,Kerberos Pre-Auth Failed,T1110,Low

关键概念

术语	定义
EventCode 4624	成功登录事件 — Logon_Type 2（交互式）、3（网络）、10（RDP）、7（解锁）
EventCode 4625	登录失败事件 — Status 代码指示失败原因（密码错误、账户锁定、已禁用）
Sysmon EventCode 1	进程创建，包含完整命令行、父进程和哈希信息
Sysmon EventCode 3	由进程发起的网络连接 — 源/目标 IP、端口和进程上下文
Logon Type 3	网络登录（SMB、WMI、PowerShell Remoting）— 横向移动的关键指标
Logon Type 10	通过 RDP/Terminal Services 进行的远程交互式登录

工具与系统

• Splunk Enterprise：具有 SPL 查询引擎的 SIEM 平台，用于 Windows 事件日志分析和关联
• Sysmon (System Monitor)：Microsoft Sysinternals 工具，提供详细的进程、网络和文件活动日志记录
• Splunk CIM：通用信息模型，将 Windows 事件映射到规范化字段，以便进行跨源查询
• Windows Event Forwarding (WEF)：Windows 内置机制，用于将事件日志集中到收集器服务器

常见场景

• Kerberoasting（T1558.003）：检测加密类型为 0x17（RC4）的 EventCode 4769，针对非标准服务账户
• DCSync（T1003.006）：检测来自非 DC 来源、带有 DS-Replication-Get-Changes 的 EventCode 4662
• 黄金票据（T1558.001）：检测具有异常票据属性（生命周期过长、非标准加密）的 EventCode 4769
• 哈希传递（T1550.002）：检测来自意外来源、使用 NTLM 身份验证的 EventCode 4624 Logon_Type 3
• DLL 侧加载（T1574.002）：Sysmon EventCode 7 显示合法进程加载了未签名的 DLL

输出格式

WINDOWS EVENT LOG ANALYSIS — HOST: WORKSTATION-042
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Period:     2024-03-14 to 2024-03-15
Events:     12,847 total (Security: 9,231 | Sysmon: 3,616)

Authentication Summary:
  Successful Logons (4624):    487 (Type 3: 312, Type 10: 45, Type 2: 130)
  Failed Logons (4625):        847 (from 192.168.1.105 — BRUTE FORCE)
  Explicit Creds (4648):       12

Suspicious Findings:
  [HIGH]   847 failed logons followed by success at 14:35 from 192.168.1.105
  [HIGH]   New user "backdoor_admin" created (4720) at 14:38
  [HIGH]   User added to Administrators group (4732) at 14:38
  [MEDIUM] schtasks.exe creating persistence task at 14:42
  [MEDIUM] PowerShell encoded command execution at 14:45

ATT&CK Mapping:
  T1110.001 — Password Guessing (847 failed logons)
  T1136.001 — Local Account Creation (backdoor_admin)
  T1053.005 — Scheduled Task (persistence)
  T1059.001 — PowerShell (encoded execution)