Anvilogic high experimental spl

Multiple Host logons [splunk-unix]

Use case looks for users who have logged into multiple hosts. -- Threat Actor Association: CL-STA-0043

View Source

Detection Logic

`get_endpoint_data` `get_endpoint_data_unix` type IN(user_auth, user_login) op IN(success, login) NOT TERM(failed)
| eval user=coalesce(acct, user, id), src_ip=coalesce(addr, hostname)
| table _time, host, user, process, process_*, parent_*, src_ip, addr, hostname, acct, id, res
| bin span=86400s
| stats values(*) as * by _time, user
| eventstats dc(host) as dc_host by user, _time
| where dc_host > 1

Field Validations

Loading…

Comments (0)

Loading comments...