analyzing-windows-event-logs-in-splunk

name	analyzing-windows-event-logs-in-splunk
description	Analyzes Windows Security, System, and Sysmon event logs in Splunk to detect authentication attacks, privilege escalation, persistence mechanisms, and lateral movement using SPL queries mapped to MITRE ATT&CK techniques. Use when SOC analysts need to investigate Windows-based threats, build detection queries, or perform forensic timeline analysis of Windows endpoints and domain controllers.
domain	cybersecurity
tags	["soc","splunk","windows-events","sysmon","event-logs","mitre-attack","active-directory"]
subdomain	soc-operations
version	1.0
author	oyi77
license	Apache-2.0
d3fend_techniques	["Restore Access","Password Authentication","Biometric Authentication","Strong Password Policy","Restore User Account Access"]
nist_csf	["DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06"]

Analyzing Windows Event Logs In Splunk

Overview

Cybersecurity skill for analyzing windows event logs in splunk. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "analyzing windows event logs in splunk"
• "SOC analysts investigate alerts related to Windows authentication, process execu"
• "Detection engineers build SPL queries for Windows-based threat detection"
• "Incident responders need forensic timelines of Windows endpoint or domain contro"

Use this skill when:

• SOC analysts investigate alerts related to Windows authentication, process execution, or AD changes
• Detection engineers build SPL queries for Windows-based threat detection
• Incident responders need forensic timelines of Windows endpoint or domain controller activity
• Periodic threat hunting targets Windows-specific ATT&CK techniques

Do not use for Linux/macOS endpoint analysis or network-only investigations.

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• Splunk with Windows Event Log data ingested (sourcetype WinEventLog:Security, WinEventLog:System, XmlWinEventLog:Microsoft-Windows-Sysmon/Operational)
• Sysmon deployed on endpoints with SwiftOnSecurity or Olaf Hartong configuration
• CIM data model acceleration for Endpoint and Authentication data models
• Knowledge of Windows Security Event IDs and Sysmon event types

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: str) -> :
     {k: re.findall(v, text)  k, v  IOC_PATTERNS.items()}