[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6ADTXY3MMSZXS0YSBSKQ6YD":3,"skill-same:01M6ADTXY3MMSZXS0YSBSKQ6YD":111},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":42,"linkOnly":43,"markdownContent":44,"markdownBody":45,"frontMatter":46,"refName":70,"commitSha":71,"skillDirectory":72,"forksCount":73,"repositoryHtmlUrl":74,"repositoryHomepageUrl":75,"ownerHtmlUrl":76,"ownerBlogUrl":77,"ownerDescription":78,"updatedAt":79,"install":80,"resources":93},"01M6ADTXY3MMSZXS0YSBSKQ6YD","analyzing-windows-event-logs-in-splunk",null,"Analyzes Windows Security, System, and Sysmon event logs in Splunk to detect authentication attacks, privilege escalation, persistence mechanisms, and lateral movement using SPL queries mapped to MITRE ATT&CK techniques. Use when SOC analysts need to investigate Windows-based threats, build detection queries, or perform forensic timeline analysis of Windows endpoints and domain controllers.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36146,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-windows-event-logs-in-splunk\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41],"analyzing windows event logs in splunk","windows","logs","analyzing","splunk","mitre-attack","event-logs","sysmon","windows-events","SPL","soc","directory","active-directory","persistence","authentication","cybersecurity","policy","security","2026-11-10 10:12:30",false,"---\nname: analyzing-windows-event-logs-in-splunk\ndescription: 'Analyzes Windows Security, System, and Sysmon event logs in Splunk to\n  detect authentication attacks, privilege escalation, persistence mechanisms, and\n  lateral movement using SPL queries mapped to MITRE ATT&CK techniques. Use when SOC\n  analysts need to investigate Windows-based threats, build detection queries, or\n  perform forensic timeline analysis of Windows endpoints and domain controllers.\n\n  '\ndomain: cybersecurity\nsubdomain: soc-operations\ntags:\n- soc\n- splunk\n- windows-events\n- sysmon\n- event-logs\n- mitre-attack\n- active-directory\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nd3fend_techniques:\n- Restore Access\n- Password Authentication\n- Biometric Authentication\n- Strong Password Policy\n- Restore User Account Access\nnist_csf:\n- DE.CM-01\n- DE.AE-02\n- RS.MA-01\n- DE.AE-06\nmitre_attack:\n- T1110\n- T1053.005\n- T1547.001\n- T1021.002\n- T1558.003\n- T1003.006\n---\n# Analyzing Windows Event Logs in Splunk\n\n## When to Use\n\nUse this skill when:\n- SOC analysts investigate alerts related to Windows authentication, process execution, or AD changes\n- Detection engineers build SPL queries for Windows-based threat detection\n- Incident responders need forensic timelines of Windows endpoint or domain controller activity\n- Periodic threat hunting targets Windows-specific ATT&CK techniques\n\n**Do not use** for Linux\u002FmacOS endpoint analysis or network-only investigations.\n\n## Prerequisites\n\n- Splunk with Windows Event Log data ingested (sourcetype `WinEventLog:Security`, `WinEventLog:System`, `XmlWinEventLog:Microsoft-Windows-Sysmon\u002FOperational`)\n- Sysmon deployed on endpoints with SwiftOnSecurity or Olaf Hartong configuration\n- CIM data model acceleration for Endpoint and Authentication data models\n- Knowledge of Windows Security Event IDs and Sysmon event types\n\n## Workflow\n\n### Step 1: Authentication Attack Detection\n\n**Brute Force Detection (EventCode 4625 — Failed Logon):**\n```spl\nindex=wineventlog sourcetype=\"WinEventLog:Security\" EventCode=4625\n| stats count, dc(TargetUserName) AS unique_users, values(TargetUserName) AS targeted_users\n  by src_ip, Logon_Type, Status\n| where count > 20\n| eval attack_type = case(\n    Logon_Type=3, \"Network Brute Force\",\n    Logon_Type=10, \"RDP Brute Force\",\n    Logon_Type=2, \"Interactive Brute Force\",\n    1=1, \"Other\"\n  )\n| eval status_meaning = case(\n    Status=\"0xc000006d\", \"Bad Username or Password\",\n    Status=\"0xc000006a\", \"Incorrect Password (valid user)\",\n    Status=\"0xc0000234\", \"Account Locked Out\",\n    Status=\"0xc0000072\", \"Account Disabled\",\n    1=1, Status\n  )\n| sort - count\n| table src_ip, attack_type, status_meaning, count, unique_users, targeted_users\n```\n\n**Password Spray Detection:**\n```spl\nindex=wineventlog sourcetype=\"WinEventLog:Security\" EventCode=4625 Logon_Type=3\n| bin _time span=10m\n| stats dc(TargetUserName) AS unique_users, count AS total_attempts,\n  values(TargetUserName) AS users_targeted by src_ip, _time\n| where unique_users > 10 AND total_attempts \u003C unique_users * 3\n| eval spray_confidence = if(unique_users > 25, \"HIGH\", \"MEDIUM\")\n```\n\n**Successful Logon After Failures (Compromise Indicator):**\n```spl\nindex=wineventlog sourcetype=\"WinEventLog:Security\"\n(EventCode=4625 OR EventCode=4624) src_ip!=\"127.0.0.1\"\n| sort _time\n| stats earliest(_time) AS first_seen, latest(_time) AS last_seen,\n  sum(eval(if(EventCode=4625,1,0))) AS failures,\n  sum(eval(if(EventCode=4624,1,0))) AS successes\n  by src_ip, TargetUserName, ComputerName\n| where failures > 10 AND successes > 0\n| eval time_to_success = round((last_seen - first_seen)\u002F60, 1)\n| sort - failures\n```\n\n### Step 2: Privilege Escalation Detection\n\n**New Admin Account Created (T1136.001):**\n```spl\nindex=wineventlog sourcetype=\"WinEventLog:Security\" EventCode=4720\n| join TargetUserName type=left [\n    search index=wineventlog EventCode=4732 TargetUserName=\"Administrators\"\n    | rename MemberName AS TargetUserName\n  ]\n| table _time, SubjectUserName, TargetUserName, ComputerName\n| eval alert = \"New account created and added to Administrators group\"\n```\n\n**Special Privileges Assigned (EventCode 4672):**\n```spl\nindex=wineventlog sourcetype=\"WinEventLog:Security\" EventCode=4672\nSubjectUserName!=\"SYSTEM\" SubjectUserName!=\"LOCAL SERVICE\" SubjectUserName!=\"NETWORK SERVICE\"\n| stats count, values(PrivilegeList) AS privileges by SubjectUserName, ComputerName\n| where count > 0\n| search privileges IN (\"SeDebugPrivilege\", \"SeTcbPrivilege\", \"SeBackupPrivilege\",\n  \"SeRestorePrivilege\", \"SeAssignPrimaryTokenPrivilege\")\n```\n\n**Token Manipulation Detection (T1134):**\n```spl\nindex=sysmon EventCode=10 TargetImage=\"*\\\\lsass.exe\"\nGrantedAccess IN (\"0x1010\", \"0x1038\", \"0x1fffff\", \"0x40\")\n| stats count by SourceImage, SourceUser, Computer, GrantedAccess\n| where NOT match(SourceImage, \"(svchost|csrss|wininit|MsMpEng|CrowdStrike)\")\n| sort - count\n```\n\n### Step 3: Persistence Mechanism Detection\n\n**Scheduled Task Creation (T1053.005):**\n```spl\nindex=wineventlog (sourcetype=\"WinEventLog:Security\" EventCode=4698)\n  OR (sourcetype=\"XmlWinEventLog:Microsoft-Windows-Sysmon\u002FOperational\" EventCode=1\n      Image=\"*\\\\schtasks.exe\")\n| eval task_info = coalesce(TaskContent, CommandLine)\n| search task_info=\"*powershell*\" OR task_info=\"*cmd*\" OR task_info=\"*http*\" OR task_info=\"*\\\\Temp\\\\*\"\n| table _time, Computer, SubjectUserName, TaskName, task_info\n```\n\n**Registry Run Key Modification (T1547.001):**\n```spl\nindex=sysmon EventCode=13\nTargetObject IN (\n  \"*\\\\CurrentVersion\\\\Run\\\\*\",\n  \"*\\\\CurrentVersion\\\\RunOnce\\\\*\",\n  \"*\\\\CurrentVersion\\\\RunServices\\\\*\",\n  \"*\\\\Explorer\\\\Shell Folders\\\\*\"\n)\n| stats count by Computer, Image, TargetObject, Details\n| where NOT match(Image, \"(explorer\\.exe|msiexec\\.exe|setup\\.exe)\")\n| sort - count\n```\n\n**WMI Event Subscription (T1546.003):**\n```spl\nindex=sysmon EventCode=20 OR EventCode=21\n| stats count by Computer, Operation, Consumer, EventNamespace\n| where count > 0\n```\n\n### Step 4: Lateral Movement Detection\n\n**Remote Service Exploitation (T1021.002 — SMB\u002FWindows Admin Shares):**\n```spl\nindex=wineventlog sourcetype=\"WinEventLog:Security\" EventCode=4624 Logon_Type=3\n| stats dc(ComputerName) AS unique_destinations, values(ComputerName) AS targets\n  by src_ip, TargetUserName\n| where unique_destinations > 3\n| sort - unique_destinations\n| table src_ip, TargetUserName, unique_destinations, targets\n```\n\n**PsExec Detection (T1021.002):**\n```spl\nindex=sysmon EventCode=1\n(Image=\"*\\\\psexec.exe\" OR Image=\"*\\\\psexesvc.exe\"\n OR ParentImage=\"*\\\\psexesvc.exe\"\n OR OriginalFileName=\"psexec.c\")\n| table _time, Computer, User, ParentImage, Image, CommandLine\n```\n\n**RDP Lateral Movement (T1021.001):**\n```spl\nindex=wineventlog sourcetype=\"WinEventLog:Security\" EventCode=4624 Logon_Type=10\n| stats count, dc(ComputerName) AS rdp_targets, values(ComputerName) AS destinations\n  by src_ip, TargetUserName\n| where rdp_targets > 2\n| sort - rdp_targets\n```\n\n### Step 5: Build Forensic Timeline\n\nCreate comprehensive timeline for a compromised host:\n\n```spl\n(index=wineventlog OR index=sysmon) Computer=\"WORKSTATION-042\"\nearliest=\"2024-03-14T00:00:00\" latest=\"2024-03-16T00:00:00\"\n| eval event_description = case(\n    EventCode=4624, \"Logon: \".TargetUserName.\" (Type \".Logon_Type.\")\",\n    EventCode=4625, \"Failed Logon: \".TargetUserName,\n    EventCode=4688 OR (sourcetype=\"XmlWinEventLog:*Sysmon*\" AND EventCode=1),\n      \"Process: \".Image.\" CMD: \".CommandLine,\n    EventCode=4698, \"Scheduled Task: \".TaskName,\n    EventCode=3, \"Network: \".DestinationIp.\":\".DestinationPort,\n    EventCode=11, \"File Created: \".TargetFilename,\n    EventCode=13, \"Registry: \".TargetObject,\n    1=1, \"Event \".EventCode\n  )\n| sort _time\n| table _time, EventCode, event_description, User, src_ip\n```\n\n### Step 6: Create Lookup Tables for Enrichment\n\nBuild reference lookups for Windows Event ID context:\n\n```spl\n| inputlookup windows_eventcode_lookup.csv\n| table EventCode, Description, ATT_CK_Technique, Severity\n```\n\nIf lookup doesn't exist, create it:\n\n```csv\nEventCode,Description,ATT_CK_Technique,Severity\n4624,Successful Logon,T1078,Informational\n4625,Failed Logon,T1110,Low\n4648,Explicit Credential Logon,T1078,Medium\n4672,Special Privileges Assigned,T1134,Medium\n4688,New Process Created,T1059,Informational\n4698,Scheduled Task Created,T1053.005,Medium\n4720,User Account Created,T1136.001,High\n4732,Member Added to Security Group,T1098,High\n4768,Kerberos TGT Requested,T1558,Informational\n4769,Kerberos Service Ticket,T1558.003,Low\n4771,Kerberos Pre-Auth Failed,T1110,Low\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **EventCode 4624** | Successful logon event — Logon_Type 2 (interactive), 3 (network), 10 (RDP), 7 (unlock) |\n| **EventCode 4625** | Failed logon event — Status code indicates failure reason (bad password, account locked, disabled) |\n| **Sysmon EventCode 1** | Process creation with full command line, parent process, and hash information |\n| **Sysmon EventCode 3** | Network connection initiated by a process — source\u002Fdest IP, port, and process context |\n| **Logon Type 3** | Network logon (SMB, WMI, PowerShell Remoting) — key indicator of lateral movement |\n| **Logon Type 10** | Remote interactive logon via RDP\u002FTerminal Services |\n\n## Tools & Systems\n\n- **Splunk Enterprise**: SIEM platform with SPL query engine for Windows event log analysis and correlation\n- **Sysmon (System Monitor)**: Microsoft Sysinternals tool providing detailed process, network, and file activity logging\n- **Splunk CIM**: Common Information Model mapping Windows events to normalized fields for cross-source queries\n- **Windows Event Forwarding (WEF)**: Built-in Windows mechanism for centralizing event logs to a collector server\n\n## Common Scenarios\n\n- **Kerberoasting (T1558.003)**: Detect EventCode 4769 with encryption type 0x17 (RC4) for non-standard service accounts\n- **DCSync (T1003.006)**: Detect EventCode 4662 with DS-Replication-Get-Changes from non-DC sources\n- **Golden Ticket (T1558.001)**: Detect EventCode 4769 with abnormal ticket properties (long lifetime, non-standard encryption)\n- **Pass-the-Hash (T1550.002)**: Detect EventCode 4624 Logon_Type 3 with NTLM authentication from unexpected sources\n- **DLL Side-Loading (T1574.002)**: Sysmon EventCode 7 showing unsigned DLLs loaded by legitimate processes\n\n## Output Format\n\n```\nWINDOWS EVENT LOG ANALYSIS — HOST: WORKSTATION-042\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nPeriod:     2024-03-14 to 2024-03-15\nEvents:     12,847 total (Security: 9,231 | Sysmon: 3,616)\n\nAuthentication Summary:\n  Successful Logons (4624):    487 (Type 3: 312, Type 10: 45, Type 2: 130)\n  Failed Logons (4625):        847 (from 192.168.1.105 — BRUTE FORCE)\n  Explicit Creds (4648):       12\n\nSuspicious Findings:\n  [HIGH]   847 failed logons followed by success at 14:35 from 192.168.1.105\n  [HIGH]   New user \"backdoor_admin\" created (4720) at 14:38\n  [HIGH]   User added to Administrators group (4732) at 14:38\n  [MEDIUM] schtasks.exe creating persistence task at 14:42\n  [MEDIUM] PowerShell encoded command execution at 14:45\n\nATT&CK Mapping:\n  T1110.001 — Password Guessing (847 failed logons)\n  T1136.001 — Local Account Creation (backdoor_admin)\n  T1053.005 — Scheduled Task (persistence)\n  T1059.001 — PowerShell (encoded execution)\n```\n","# Analyzing Windows Event Logs in Splunk\n\n## When to Use\n\nUse this skill when:\n- SOC analysts investigate alerts related to Windows authentication, process execution, or AD changes\n- Detection engineers build SPL queries for Windows-based threat detection\n- Incident responders need forensic timelines of Windows endpoint or domain controller activity\n- Periodic threat hunting targets Windows-specific ATT&CK techniques\n\n**Do not use** for Linux\u002FmacOS endpoint analysis or network-only investigations.\n\n## Prerequisites\n\n- Splunk with Windows Event Log data ingested (sourcetype `WinEventLog:Security`, `WinEventLog:System`, `XmlWinEventLog:Microsoft-Windows-Sysmon\u002FOperational`)\n- Sysmon deployed on endpoints with SwiftOnSecurity or Olaf Hartong configuration\n- CIM data model acceleration for Endpoint and Authentication data models\n- Knowledge of Windows Security Event IDs and Sysmon event types\n\n## Workflow\n\n### Step 1: Authentication Attack Detection\n\n**Brute Force Detection (EventCode 4625 — Failed Logon):**\n```spl\nindex=wineventlog sourcetype=\"WinEventLog:Security\" EventCode=4625\n| stats count, dc(TargetUserName) AS unique_users, values(TargetUserName) AS targeted_users\n  by src_ip, Logon_Type, Status\n| where count > 20\n| eval attack_type = case(\n    Logon_Type=3, \"Network Brute Force\",\n    Logon_Type=10, \"RDP Brute Force\",\n    Logon_Type=2, \"Interactive Brute Force\",\n    1=1, \"Other\"\n  )\n| eval status_meaning = case(\n    Status=\"0xc000006d\", \"Bad Username or Password\",\n    Status=\"0xc000006a\", \"Incorrect Password (valid user)\",\n    Status=\"0xc0000234\", \"Account Locked Out\",\n    Status=\"0xc0000072\", \"Account Disabled\",\n    1=1, Status\n  )\n| sort - count\n| table src_ip, attack_type, status_meaning, count, unique_users, targeted_users\n```\n\n**Password Spray Detection:**\n```spl\nindex=wineventlog sourcetype=\"WinEventLog:Security\" EventCode=4625 Logon_Type=3\n| bin _time span=10m\n| stats dc(TargetUserName) AS unique_users, count AS total_attempts,\n  values(TargetUserName) AS users_targeted by src_ip, _time\n| where unique_users > 10 AND total_attempts \u003C unique_users * 3\n| eval spray_confidence = if(unique_users > 25, \"HIGH\", \"MEDIUM\")\n```\n\n**Successful Logon After Failures (Compromise Indicator):**\n```spl\nindex=wineventlog sourcetype=\"WinEventLog:Security\"\n(EventCode=4625 OR EventCode=4624) src_ip!=\"127.0.0.1\"\n| sort _time\n| stats earliest(_time) AS first_seen, latest(_time) AS last_seen,\n  sum(eval(if(EventCode=4625,1,0))) AS failures,\n  sum(eval(if(EventCode=4624,1,0))) AS successes\n  by src_ip, TargetUserName, ComputerName\n| where failures > 10 AND successes > 0\n| eval time_to_success = round((last_seen - first_seen)\u002F60, 1)\n| sort - failures\n```\n\n### Step 2: Privilege Escalation Detection\n\n**New Admin Account Created (T1136.001):**\n```spl\nindex=wineventlog sourcetype=\"WinEventLog:Security\" EventCode=4720\n| join TargetUserName type=left [\n    search index=wineventlog EventCode=4732 TargetUserName=\"Administrators\"\n    | rename MemberName AS TargetUserName\n  ]\n| table _time, SubjectUserName, TargetUserName, ComputerName\n| eval alert = \"New account created and added to Administrators group\"\n```\n\n**Special Privileges Assigned (EventCode 4672):**\n```spl\nindex=wineventlog sourcetype=\"WinEventLog:Security\" EventCode=4672\nSubjectUserName!=\"SYSTEM\" SubjectUserName!=\"LOCAL SERVICE\" SubjectUserName!=\"NETWORK SERVICE\"\n| stats count, values(PrivilegeList) AS privileges by SubjectUserName, ComputerName\n| where count > 0\n| search privileges IN (\"SeDebugPrivilege\", \"SeTcbPrivilege\", \"SeBackupPrivilege\",\n  \"SeRestorePrivilege\", \"SeAssignPrimaryTokenPrivilege\")\n```\n\n**Token Manipulation Detection (T1134):**\n```spl\nindex=sysmon EventCode=10 TargetImage=\"*\\\\lsass.exe\"\nGrantedAccess IN (\"0x1010\", \"0x1038\", \"0x1fffff\", \"0x40\")\n| stats count by SourceImage, SourceUser, Computer, GrantedAccess\n| where NOT match(SourceImage, \"(svchost|csrss|wininit|MsMpEng|CrowdStrike)\")\n| sort - count\n```\n\n### Step 3: Persistence Mechanism Detection\n\n**Scheduled Task Creation (T1053.005):**\n```spl\nindex=wineventlog (sourcetype=\"WinEventLog:Security\" EventCode=4698)\n  OR (sourcetype=\"XmlWinEventLog:Microsoft-Windows-Sysmon\u002FOperational\" EventCode=1\n      Image=\"*\\\\schtasks.exe\")\n| eval task_info = coalesce(TaskContent, CommandLine)\n| search task_info=\"*powershell*\" OR task_info=\"*cmd*\" OR task_info=\"*http*\" OR task_info=\"*\\\\Temp\\\\*\"\n| table _time, Computer, SubjectUserName, TaskName, task_info\n```\n\n**Registry Run Key Modification (T1547.001):**\n```spl\nindex=sysmon EventCode=13\nTargetObject IN (\n  \"*\\\\CurrentVersion\\\\Run\\\\*\",\n  \"*\\\\CurrentVersion\\\\RunOnce\\\\*\",\n  \"*\\\\CurrentVersion\\\\RunServices\\\\*\",\n  \"*\\\\Explorer\\\\Shell Folders\\\\*\"\n)\n| stats count by Computer, Image, TargetObject, Details\n| where NOT match(Image, \"(explorer\\.exe|msiexec\\.exe|setup\\.exe)\")\n| sort - count\n```\n\n**WMI Event Subscription (T1546.003):**\n```spl\nindex=sysmon EventCode=20 OR EventCode=21\n| stats count by Computer, Operation, Consumer, EventNamespace\n| where count > 0\n```\n\n### Step 4: Lateral Movement Detection\n\n**Remote Service Exploitation (T1021.002 — SMB\u002FWindows Admin Shares):**\n```spl\nindex=wineventlog sourcetype=\"WinEventLog:Security\" EventCode=4624 Logon_Type=3\n| stats dc(ComputerName) AS unique_destinations, values(ComputerName) AS targets\n  by src_ip, TargetUserName\n| where unique_destinations > 3\n| sort - unique_destinations\n| table src_ip, TargetUserName, unique_destinations, targets\n```\n\n**PsExec Detection (T1021.002):**\n```spl\nindex=sysmon EventCode=1\n(Image=\"*\\\\psexec.exe\" OR Image=\"*\\\\psexesvc.exe\"\n OR ParentImage=\"*\\\\psexesvc.exe\"\n OR OriginalFileName=\"psexec.c\")\n| table _time, Computer, User, ParentImage, Image, CommandLine\n```\n\n**RDP Lateral Movement (T1021.001):**\n```spl\nindex=wineventlog sourcetype=\"WinEventLog:Security\" EventCode=4624 Logon_Type=10\n| stats count, dc(ComputerName) AS rdp_targets, values(ComputerName) AS destinations\n  by src_ip, TargetUserName\n| where rdp_targets > 2\n| sort - rdp_targets\n```\n\n### Step 5: Build Forensic Timeline\n\nCreate comprehensive timeline for a compromised host:\n\n```spl\n(index=wineventlog OR index=sysmon) Computer=\"WORKSTATION-042\"\nearliest=\"2024-03-14T00:00:00\" latest=\"2024-03-16T00:00:00\"\n| eval event_description = case(\n    EventCode=4624, \"Logon: \".TargetUserName.\" (Type \".Logon_Type.\")\",\n    EventCode=4625, \"Failed Logon: \".TargetUserName,\n    EventCode=4688 OR (sourcetype=\"XmlWinEventLog:*Sysmon*\" AND EventCode=1),\n      \"Process: \".Image.\" CMD: \".CommandLine,\n    EventCode=4698, \"Scheduled Task: \".TaskName,\n    EventCode=3, \"Network: \".DestinationIp.\":\".DestinationPort,\n    EventCode=11, \"File Created: \".TargetFilename,\n    EventCode=13, \"Registry: \".TargetObject,\n    1=1, \"Event \".EventCode\n  )\n| sort _time\n| table _time, EventCode, event_description, User, src_ip\n```\n\n### Step 6: Create Lookup Tables for Enrichment\n\nBuild reference lookups for Windows Event ID context:\n\n```spl\n| inputlookup windows_eventcode_lookup.csv\n| table EventCode, Description, ATT_CK_Technique, Severity\n```\n\nIf lookup doesn't exist, create it:\n\n```csv\nEventCode,Description,ATT_CK_Technique,Severity\n4624,Successful Logon,T1078,Informational\n4625,Failed Logon,T1110,Low\n4648,Explicit Credential Logon,T1078,Medium\n4672,Special Privileges Assigned,T1134,Medium\n4688,New Process Created,T1059,Informational\n4698,Scheduled Task Created,T1053.005,Medium\n4720,User Account Created,T1136.001,High\n4732,Member Added to Security Group,T1098,High\n4768,Kerberos TGT Requested,T1558,Informational\n4769,Kerberos Service Ticket,T1558.003,Low\n4771,Kerberos Pre-Auth Failed,T1110,Low\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **EventCode 4624** | Successful logon event — Logon_Type 2 (interactive), 3 (network), 10 (RDP), 7 (unlock) |\n| **EventCode 4625** | Failed logon event — Status code indicates failure reason (bad password, account locked, disabled) |\n| **Sysmon EventCode 1** | Process creation with full command line, parent process, and hash information |\n| **Sysmon EventCode 3** | Network connection initiated by a process — source\u002Fdest IP, port, and process context |\n| **Logon Type 3** | Network logon (SMB, WMI, PowerShell Remoting) — key indicator of lateral movement |\n| **Logon Type 10** | Remote interactive logon via RDP\u002FTerminal Services |\n\n## Tools & Systems\n\n- **Splunk Enterprise**: SIEM platform with SPL query engine for Windows event log analysis and correlation\n- **Sysmon (System Monitor)**: Microsoft Sysinternals tool providing detailed process, network, and file activity logging\n- **Splunk CIM**: Common Information Model mapping Windows events to normalized fields for cross-source queries\n- **Windows Event Forwarding (WEF)**: Built-in Windows mechanism for centralizing event logs to a collector server\n\n## Common Scenarios\n\n- **Kerberoasting (T1558.003)**: Detect EventCode 4769 with encryption type 0x17 (RC4) for non-standard service accounts\n- **DCSync (T1003.006)**: Detect EventCode 4662 with DS-Replication-Get-Changes from non-DC sources\n- **Golden Ticket (T1558.001)**: Detect EventCode 4769 with abnormal ticket properties (long lifetime, non-standard encryption)\n- **Pass-the-Hash (T1550.002)**: Detect EventCode 4624 Logon_Type 3 with NTLM authentication from unexpected sources\n- **DLL Side-Loading (T1574.002)**: Sysmon EventCode 7 showing unsigned DLLs loaded by legitimate processes\n\n## Output Format\n\n```\nWINDOWS EVENT LOG ANALYSIS — HOST: WORKSTATION-042\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nPeriod:     2024-03-14 to 2024-03-15\nEvents:     12,847 total (Security: 9,231 | Sysmon: 3,616)\n\nAuthentication Summary:\n  Successful Logons (4624):    487 (Type 3: 312, Type 10: 45, Type 2: 130)\n  Failed Logons (4625):        847 (from 192.168.1.105 — BRUTE FORCE)\n  Explicit Creds (4648):       12\n\nSuspicious Findings:\n  [HIGH]   847 failed logons followed by success at 14:35 from 192.168.1.105\n  [HIGH]   New user \"backdoor_admin\" created (4720) at 14:38\n  [HIGH]   User added to Administrators group (4732) at 14:38\n  [MEDIUM] schtasks.exe creating persistence task at 14:42\n  [MEDIUM] PowerShell encoded command execution at 14:45\n\nATT&CK Mapping:\n  T1110.001 — Password Guessing (847 failed logons)\n  T1136.001 — Local Account Creation (backdoor_admin)\n  T1053.005 — Scheduled Task (persistence)\n  T1059.001 — PowerShell (encoded execution)\n```\n",{"name":5,"tags":47,"author":48,"domain":39,"license":15,"version":49,"nist_csf":50,"subdomain":55,"description":56,"mitre_attack":57,"d3fend_techniques":64},[34,28,32,31,30,29,36],"mahipal","1.0",[51,52,53,54],"DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06","soc-operations","Analyzes Windows Security, System, and Sysmon event logs in Splunk to detect authentication attacks, privilege escalation, persistence mechanisms, and lateral movement using SPL queries mapped to MITRE ATT&CK techniques. Use when SOC analysts need to investigate Windows-based threats, build detection queries, or perform forensic timeline analysis of Windows endpoints and domain controllers.\n",[58,59,60,61,62,63],"T1110","T1053.005","T1547.001","T1021.002","T1558.003","T1003.006",[65,66,67,68,69],"Restore Access","Password Authentication","Biometric Authentication","Strong Password Policy","Restore User Account Access","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fanalyzing-windows-event-logs-in-splunk",4425,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":81,"prompt":91,"zipAvailable":92},[82,85,88],{"tool":83,"command":84},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill analyzing-windows-event-logs-in-splunk",{"tool":86,"command":87},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill analyzing-windows-event-logs-in-splunk",{"tool":89,"command":90},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill analyzing-windows-event-logs-in-splunk","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-windows-event-logs-in-splunk\u002FSKILL.md",true,[94,99,105],{"path":95,"resourceType":95,"resourceTypeDesc":96,"sizeBytes":97,"sourceHtmlUrl":98},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-windows-event-logs-in-splunk\u002FLICENSE",{"path":100,"resourceType":101,"resourceTypeDesc":102,"sizeBytes":103,"sourceHtmlUrl":104},"references\u002Fapi-reference.md","REFERENCE","参考文档",2035,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-windows-event-logs-in-splunk\u002Freferences\u002Fapi-reference.md",{"path":106,"resourceType":107,"resourceTypeDesc":108,"sizeBytes":109,"sourceHtmlUrl":110},"scripts\u002Fagent.py","SCRIPT","脚本",7017,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-windows-event-logs-in-splunk\u002Fscripts\u002Fagent.py",[112,138,161,189,213,240],{"skillNo":113,"name":114,"nameZh":6,"description":115,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":116,"categories":117,"keywords":119,"publishedAt":42},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[118],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[120,121,122,123,41,39,124,125,126,127,128,129,130,131,132,133,134,135,136,137],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":139,"name":140,"nameZh":6,"description":141,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":142,"categories":143,"keywords":145,"publishedAt":42},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[144],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[146,134,147,148,41,40,39,126,149,150,151,152,153,154,155,156,157,158,159,160],"boot","TPM","validating tpm measured boot attestation","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":162,"name":163,"nameZh":6,"description":164,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":165,"categories":166,"keywords":171,"publishedAt":42},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[167,170],{"categoryNo":168,"categoryName":169,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[155,172,173,174,175,39,176,177,149,178,179,180,181,182,183,184,185,186,187,188],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":190,"name":191,"nameZh":6,"description":192,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":193,"categories":194,"keywords":196,"publishedAt":42},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[195],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[25,197,198,39,199,200,26,201,202,203,204,205,206,207,208,209,152,210,211,212],"kape","triaging windows with kape","registry","browser","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":214,"name":215,"nameZh":6,"description":216,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":217,"categories":218,"keywords":220,"publishedAt":42},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[219],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[221,222,223,39,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":241,"name":242,"nameZh":6,"description":243,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":244,"categories":245,"keywords":247,"publishedAt":42},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[246],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[41,248,39,249,250,251,34,252,253,254,255,184,256,185,257,258,259,260,261,262],"triaging security incident","siem","file","ioc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]