Analyzing Windows Event Logs In Splunk
Analyzes Windows Security, System, and Sysmon event logs in Splunk to detect...
Install
npx skills add AgentFlocks/flocks --skill analyzing-windows-event-logs-in-splunk -g -a claude-code -y- Repository
- AgentFlocks/flocks504
- Category
- Security
- Updated
- 5d ago
- License
- Apache-2.0
- Context cost
- Mediumabout 2,579 tokens
- Runs scripts
- Yes, review before use
What it does
Analyzes Windows Security, System, and Sysmon event logs in Splunk to detect authentication attacks, privilege escalation, persistence mechanisms, and lateral movement using SPL queries mapped to MITRE ATT&CK techniques. Use when SOC analysts need to investigate Windows-based threats, build detection queries, or perform forensic timeline analysis of Windows endpoints and domain controllers.
Analyzing Windows Event Logs in Splunk
When to Use
Use this skill when:
- SOC analysts investigate alerts related to Windows authentication, process execution, or AD changes
- Detection engineers build SPL queries for Windows-based threat detection
- Incident responders need forensic timelines of Windows endpoint or domain controller activity
- Periodic threat hunting targets Windows-specific ATT&CK techniques
Do not use for Linux/macOS endpoint analysis or network-only investigations.
Prerequisites
- Splunk with Windows Event Log data ingested (sourcetype
WinEventLog:Security,WinEventLog:System,XmlWinEventLog:Microsoft-Windows-Sysmon/Operational) - Sysmon deployed on endpoints with SwiftOnSecurity or Olaf Hartong configuration
- CIM data model acceleration for Endpoint and Authentication data models
- Knowledge of Windows Security Event IDs and Sysmon event types
Workflow
Step 1: Authentication Attack Detection
Brute Force Detection (EventCode 4625, Failed Logon):
index=wineventlog sourcetype="WinEventLog:Security" EventCode=4625
| stats count, dc(TargetUserName) AS unique_users, values(TargetUserName) AS targeted_users
by src_ip, Logon_Type, Status
| where count > 20
| eval attack_type = case(
Logon_Type=3, "Network Brute Force",
Logon_Type=10, "RDP Brute Force",
Logon_Type=2, "Interactive Brute Force",
1=1, "Other"
)
| eval status_meaning = case(
Status="0xc000006d", "Bad Username or Password",
Status="0xc000006a", "Incorrect Password (valid user)",
Status="0xc0000234", "Account Locked Out",
Status="0xc0000072", "Account Disabled",
1=1, Status
)
| sort - count
| table src_ip, attack_type, status_meaning, count, unique_users, targeted_users
