[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6EST1R7183TX8AF164GCZ6C":3,"skill-same:01M6EST1R7183TX8AF164GCZ6C":111},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":72,"commitSha":73,"skillDirectory":74,"forksCount":14,"repositoryHtmlUrl":75,"repositoryHomepageUrl":76,"ownerHtmlUrl":77,"ownerBlogUrl":6,"ownerDescription":78,"updatedAt":79,"install":80,"resources":93},"01M6EST1R7183TX8AF164GCZ6C","analyzing-windows-event-logs-in-splunk",null,"Analyzes Windows Security, System, and Sysmon event logs in Splunk to detect authentication attacks, privilege escalation, persistence mechanisms, and lateral movement using SPL queries mapped to MITRE ATT&CK techniques. Use when SOC analysts need to investigate Windows-based threats, build detection queries, or perform forensic timeline analysis of Windows endpoints and domain controllers.","henriquescastilho\u002Fmy-claude","henriquescastilho","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F153296945?v=4","01M6ESH7EXPXTH9CVQ4K16SRG8","Henrique Scheer","01M6ESH7JHEK2PTNNH4HEH787Z",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fanalyzing-windows-event-logs-in-splunk\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"windows","event","analyzing windows event logs in splunk","analyzing","splunk","logs","soc","mitre-attack","windows-events","sysmon","event-logs","authentication","t1558","T1547.001","analysis","access","cm","active","de","cybersecurity","2026-11-10 10:12:30",false,"---\nname: analyzing-windows-event-logs-in-splunk\ndescription: 'Analyzes Windows Security, System, and Sysmon event logs in Splunk to\n  detect authentication attacks, privilege escalation, persistence mechanisms, and\n  lateral movement using SPL queries mapped to MITRE ATT&CK techniques. Use when SOC\n  analysts need to investigate Windows-based threats, build detection queries, or\n  perform forensic timeline analysis of Windows endpoints and domain controllers.\n\n  '\ndomain: cybersecurity\nsubdomain: soc-operations\ntags:\n- soc\n- splunk\n- windows-events\n- sysmon\n- event-logs\n- mitre-attack\n- active-directory\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nd3fend_techniques:\n- Restore Access\n- Password Authentication\n- Biometric Authentication\n- Strong Password Policy\n- Restore User Account Access\nnist_csf:\n- DE.CM-01\n- DE.AE-02\n- RS.MA-01\n- DE.AE-06\nmitre_attack:\n- T1110\n- T1053.005\n- T1547.001\n- T1021.002\n- T1558.003\n- T1003.006\n---\n# Analyzing Windows Event Logs in Splunk\n\n## When to Use\n\nUse this skill when:\n- SOC analysts investigate alerts related to Windows authentication, process execution, or AD changes\n- Detection engineers build SPL queries for Windows-based threat detection\n- Incident responders need forensic timelines of Windows endpoint or domain controller activity\n- Periodic threat hunting targets Windows-specific ATT&CK techniques\n\n**Do not use** for Linux\u002FmacOS endpoint analysis or network-only investigations.\n\n## Prerequisites\n\n- Splunk with Windows Event Log data ingested (sourcetype `WinEventLog:Security`, `WinEventLog:System`, `XmlWinEventLog:Microsoft-Windows-Sysmon\u002FOperational`)\n- Sysmon deployed on endpoints with SwiftOnSecurity or Olaf Hartong configuration\n- CIM data model acceleration for Endpoint and Authentication data models\n- Knowledge of Windows Security Event IDs and Sysmon event types\n\n## Workflow\n\n### Step 1: Authentication Attack Detection\n\n**Brute Force Detection (EventCode 4625 — Failed Logon):**\n```spl\nindex=wineventlog sourcetype=\"WinEventLog:Security\" EventCode=4625\n| stats count, dc(TargetUserName) AS unique_users, values(TargetUserName) AS targeted_users\n  by src_ip, Logon_Type, Status\n| where count > 20\n| eval attack_type = case(\n    Logon_Type=3, \"Network Brute Force\",\n    Logon_Type=10, \"RDP Brute Force\",\n    Logon_Type=2, \"Interactive Brute Force\",\n    1=1, \"Other\"\n  )\n| eval status_meaning = case(\n    Status=\"0xc000006d\", \"Bad Username or Password\",\n    Status=\"0xc000006a\", \"Incorrect Password (valid user)\",\n    Status=\"0xc0000234\", \"Account Locked Out\",\n    Status=\"0xc0000072\", \"Account Disabled\",\n    1=1, Status\n  )\n| sort - count\n| table src_ip, attack_type, status_meaning, count, unique_users, targeted_users\n```\n\n**Password Spray Detection:**\n```spl\nindex=wineventlog sourcetype=\"WinEventLog:Security\" EventCode=4625 Logon_Type=3\n| bin _time span=10m\n| stats dc(TargetUserName) AS unique_users, count AS total_attempts,\n  values(TargetUserName) AS users_targeted by src_ip, _time\n| where unique_users > 10 AND total_attempts \u003C unique_users * 3\n| eval spray_confidence = if(unique_users > 25, \"HIGH\", \"MEDIUM\")\n```\n\n**Successful Logon After Failures (Compromise Indicator):**\n```spl\nindex=wineventlog sourcetype=\"WinEventLog:Security\"\n(EventCode=4625 OR EventCode=4624) src_ip!=\"127.0.0.1\"\n| sort _time\n| stats earliest(_time) AS first_seen, latest(_time) AS last_seen,\n  sum(eval(if(EventCode=4625,1,0))) AS failures,\n  sum(eval(if(EventCode=4624,1,0))) AS successes\n  by src_ip, TargetUserName, ComputerName\n| where failures > 10 AND successes > 0\n| eval time_to_success = round((last_seen - first_seen)\u002F60, 1)\n| sort - failures\n```\n\n### Step 2: Privilege Escalation Detection\n\n**New Admin Account Created (T1136.001):**\n```spl\nindex=wineventlog sourcetype=\"WinEventLog:Security\" EventCode=4720\n| join TargetUserName type=left [\n    search index=wineventlog EventCode=4732 TargetUserName=\"Administrators\"\n    | rename MemberName AS TargetUserName\n  ]\n| table _time, SubjectUserName, TargetUserName, ComputerName\n| eval alert = \"New account created and added to Administrators group\"\n```\n\n**Special Privileges Assigned (EventCode 4672):**\n```spl\nindex=wineventlog sourcetype=\"WinEventLog:Security\" EventCode=4672\nSubjectUserName!=\"SYSTEM\" SubjectUserName!=\"LOCAL SERVICE\" SubjectUserName!=\"NETWORK SERVICE\"\n| stats count, values(PrivilegeList) AS privileges by SubjectUserName, ComputerName\n| where count > 0\n| search privileges IN (\"SeDebugPrivilege\", \"SeTcbPrivilege\", \"SeBackupPrivilege\",\n  \"SeRestorePrivilege\", \"SeAssignPrimaryTokenPrivilege\")\n```\n\n**Token Manipulation Detection (T1134):**\n```spl\nindex=sysmon EventCode=10 TargetImage=\"*\\\\lsass.exe\"\nGrantedAccess IN (\"0x1010\", \"0x1038\", \"0x1fffff\", \"0x40\")\n| stats count by SourceImage, SourceUser, Computer, GrantedAccess\n| where NOT match(SourceImage, \"(svchost|csrss|wininit|MsMpEng|CrowdStrike)\")\n| sort - count\n```\n\n### Step 3: Persistence Mechanism Detection\n\n**Scheduled Task Creation (T1053.005):**\n```spl\nindex=wineventlog (sourcetype=\"WinEventLog:Security\" EventCode=4698)\n  OR (sourcetype=\"XmlWinEventLog:Microsoft-Windows-Sysmon\u002FOperational\" EventCode=1\n      Image=\"*\\\\schtasks.exe\")\n| eval task_info = coalesce(TaskContent, CommandLine)\n| search task_info=\"*powershell*\" OR task_info=\"*cmd*\" OR task_info=\"*http*\" OR task_info=\"*\\\\Temp\\\\*\"\n| table _time, Computer, SubjectUserName, TaskName, task_info\n```\n\n**Registry Run Key Modification (T1547.001):**\n```spl\nindex=sysmon EventCode=13\nTargetObject IN (\n  \"*\\\\CurrentVersion\\\\Run\\\\*\",\n  \"*\\\\CurrentVersion\\\\RunOnce\\\\*\",\n  \"*\\\\CurrentVersion\\\\RunServices\\\\*\",\n  \"*\\\\Explorer\\\\Shell Folders\\\\*\"\n)\n| stats count by Computer, Image, TargetObject, Details\n| where NOT match(Image, \"(explorer\\.exe|msiexec\\.exe|setup\\.exe)\")\n| sort - count\n```\n\n**WMI Event Subscription (T1546.003):**\n```spl\nindex=sysmon EventCode=20 OR EventCode=21\n| stats count by Computer, Operation, Consumer, EventNamespace\n| where count > 0\n```\n\n### Step 4: Lateral Movement Detection\n\n**Remote Service Exploitation (T1021.002 — SMB\u002FWindows Admin Shares):**\n```spl\nindex=wineventlog sourcetype=\"WinEventLog:Security\" EventCode=4624 Logon_Type=3\n| stats dc(ComputerName) AS unique_destinations, values(ComputerName) AS targets\n  by src_ip, TargetUserName\n| where unique_destinations > 3\n| sort - unique_destinations\n| table src_ip, TargetUserName, unique_destinations, targets\n```\n\n**PsExec Detection (T1021.002):**\n```spl\nindex=sysmon EventCode=1\n(Image=\"*\\\\psexec.exe\" OR Image=\"*\\\\psexesvc.exe\"\n OR ParentImage=\"*\\\\psexesvc.exe\"\n OR OriginalFileName=\"psexec.c\")\n| table _time, Computer, User, ParentImage, Image, CommandLine\n```\n\n**RDP Lateral Movement (T1021.001):**\n```spl\nindex=wineventlog sourcetype=\"WinEventLog:Security\" EventCode=4624 Logon_Type=10\n| stats count, dc(ComputerName) AS rdp_targets, values(ComputerName) AS destinations\n  by src_ip, TargetUserName\n| where rdp_targets > 2\n| sort - rdp_targets\n```\n\n### Step 5: Build Forensic Timeline\n\nCreate comprehensive timeline for a compromised host:\n\n```spl\n(index=wineventlog OR index=sysmon) Computer=\"WORKSTATION-042\"\nearliest=\"2024-03-14T00:00:00\" latest=\"2024-03-16T00:00:00\"\n| eval event_description = case(\n    EventCode=4624, \"Logon: \".TargetUserName.\" (Type \".Logon_Type.\")\",\n    EventCode=4625, \"Failed Logon: \".TargetUserName,\n    EventCode=4688 OR (sourcetype=\"XmlWinEventLog:*Sysmon*\" AND EventCode=1),\n      \"Process: \".Image.\" CMD: \".CommandLine,\n    EventCode=4698, \"Scheduled Task: \".TaskName,\n    EventCode=3, \"Network: \".DestinationIp.\":\".DestinationPort,\n    EventCode=11, \"File Created: \".TargetFilename,\n    EventCode=13, \"Registry: \".TargetObject,\n    1=1, \"Event \".EventCode\n  )\n| sort _time\n| table _time, EventCode, event_description, User, src_ip\n```\n\n### Step 6: Create Lookup Tables for Enrichment\n\nBuild reference lookups for Windows Event ID context:\n\n```spl\n| inputlookup windows_eventcode_lookup.csv\n| table EventCode, Description, ATT_CK_Technique, Severity\n```\n\nIf lookup doesn't exist, create it:\n\n```csv\nEventCode,Description,ATT_CK_Technique,Severity\n4624,Successful Logon,T1078,Informational\n4625,Failed Logon,T1110,Low\n4648,Explicit Credential Logon,T1078,Medium\n4672,Special Privileges Assigned,T1134,Medium\n4688,New Process Created,T1059,Informational\n4698,Scheduled Task Created,T1053.005,Medium\n4720,User Account Created,T1136.001,High\n4732,Member Added to Security Group,T1098,High\n4768,Kerberos TGT Requested,T1558,Informational\n4769,Kerberos Service Ticket,T1558.003,Low\n4771,Kerberos Pre-Auth Failed,T1110,Low\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **EventCode 4624** | Successful logon event — Logon_Type 2 (interactive), 3 (network), 10 (RDP), 7 (unlock) |\n| **EventCode 4625** | Failed logon event — Status code indicates failure reason (bad password, account locked, disabled) |\n| **Sysmon EventCode 1** | Process creation with full command line, parent process, and hash information |\n| **Sysmon EventCode 3** | Network connection initiated by a process — source\u002Fdest IP, port, and process context |\n| **Logon Type 3** | Network logon (SMB, WMI, PowerShell Remoting) — key indicator of lateral movement |\n| **Logon Type 10** | Remote interactive logon via RDP\u002FTerminal Services |\n\n## Tools & Systems\n\n- **Splunk Enterprise**: SIEM platform with SPL query engine for Windows event log analysis and correlation\n- **Sysmon (System Monitor)**: Microsoft Sysinternals tool providing detailed process, network, and file activity logging\n- **Splunk CIM**: Common Information Model mapping Windows events to normalized fields for cross-source queries\n- **Windows Event Forwarding (WEF)**: Built-in Windows mechanism for centralizing event logs to a collector server\n\n## Common Scenarios\n\n- **Kerberoasting (T1558.003)**: Detect EventCode 4769 with encryption type 0x17 (RC4) for non-standard service accounts\n- **DCSync (T1003.006)**: Detect EventCode 4662 with DS-Replication-Get-Changes from non-DC sources\n- **Golden Ticket (T1558.001)**: Detect EventCode 4769 with abnormal ticket properties (long lifetime, non-standard encryption)\n- **Pass-the-Hash (T1550.002)**: Detect EventCode 4624 Logon_Type 3 with NTLM authentication from unexpected sources\n- **DLL Side-Loading (T1574.002)**: Sysmon EventCode 7 showing unsigned DLLs loaded by legitimate processes\n\n## Output Format\n\n```\nWINDOWS EVENT LOG ANALYSIS — HOST: WORKSTATION-042\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nPeriod:     2024-03-14 to 2024-03-15\nEvents:     12,847 total (Security: 9,231 | Sysmon: 3,616)\n\nAuthentication Summary:\n  Successful Logons (4624):    487 (Type 3: 312, Type 10: 45, Type 2: 130)\n  Failed Logons (4625):        847 (from 192.168.1.105 — BRUTE FORCE)\n  Explicit Creds (4648):       12\n\nSuspicious Findings:\n  [HIGH]   847 failed logons followed by success at 14:35 from 192.168.1.105\n  [HIGH]   New user \"backdoor_admin\" created (4720) at 14:38\n  [HIGH]   User added to Administrators group (4732) at 14:38\n  [MEDIUM] schtasks.exe creating persistence task at 14:42\n  [MEDIUM] PowerShell encoded command execution at 14:45\n\nATT&CK Mapping:\n  T1110.001 — Password Guessing (847 failed logons)\n  T1136.001 — Local Account Creation (backdoor_admin)\n  T1053.005 — Scheduled Task (persistence)\n  T1059.001 — PowerShell (encoded execution)\n```\n","# Analyzing Windows Event Logs in Splunk\n\n## When to Use\n\nUse this skill when:\n- SOC analysts investigate alerts related to Windows authentication, process execution, or AD changes\n- Detection engineers build SPL queries for Windows-based threat detection\n- Incident responders need forensic timelines of Windows endpoint or domain controller activity\n- Periodic threat hunting targets Windows-specific ATT&CK techniques\n\n**Do not use** for Linux\u002FmacOS endpoint analysis or network-only investigations.\n\n## Prerequisites\n\n- Splunk with Windows Event Log data ingested (sourcetype `WinEventLog:Security`, `WinEventLog:System`, `XmlWinEventLog:Microsoft-Windows-Sysmon\u002FOperational`)\n- Sysmon deployed on endpoints with SwiftOnSecurity or Olaf Hartong configuration\n- CIM data model acceleration for Endpoint and Authentication data models\n- Knowledge of Windows Security Event IDs and Sysmon event types\n\n## Workflow\n\n### Step 1: Authentication Attack Detection\n\n**Brute Force Detection (EventCode 4625 — Failed Logon):**\n```spl\nindex=wineventlog sourcetype=\"WinEventLog:Security\" EventCode=4625\n| stats count, dc(TargetUserName) AS unique_users, values(TargetUserName) AS targeted_users\n  by src_ip, Logon_Type, Status\n| where count > 20\n| eval attack_type = case(\n    Logon_Type=3, \"Network Brute Force\",\n    Logon_Type=10, \"RDP Brute Force\",\n    Logon_Type=2, \"Interactive Brute Force\",\n    1=1, \"Other\"\n  )\n| eval status_meaning = case(\n    Status=\"0xc000006d\", \"Bad Username or Password\",\n    Status=\"0xc000006a\", \"Incorrect Password (valid user)\",\n    Status=\"0xc0000234\", \"Account Locked Out\",\n    Status=\"0xc0000072\", \"Account Disabled\",\n    1=1, Status\n  )\n| sort - count\n| table src_ip, attack_type, status_meaning, count, unique_users, targeted_users\n```\n\n**Password Spray Detection:**\n```spl\nindex=wineventlog sourcetype=\"WinEventLog:Security\" EventCode=4625 Logon_Type=3\n| bin _time span=10m\n| stats dc(TargetUserName) AS unique_users, count AS total_attempts,\n  values(TargetUserName) AS users_targeted by src_ip, _time\n| where unique_users > 10 AND total_attempts \u003C unique_users * 3\n| eval spray_confidence = if(unique_users > 25, \"HIGH\", \"MEDIUM\")\n```\n\n**Successful Logon After Failures (Compromise Indicator):**\n```spl\nindex=wineventlog sourcetype=\"WinEventLog:Security\"\n(EventCode=4625 OR EventCode=4624) src_ip!=\"127.0.0.1\"\n| sort _time\n| stats earliest(_time) AS first_seen, latest(_time) AS last_seen,\n  sum(eval(if(EventCode=4625,1,0))) AS failures,\n  sum(eval(if(EventCode=4624,1,0))) AS successes\n  by src_ip, TargetUserName, ComputerName\n| where failures > 10 AND successes > 0\n| eval time_to_success = round((last_seen - first_seen)\u002F60, 1)\n| sort - failures\n```\n\n### Step 2: Privilege Escalation Detection\n\n**New Admin Account Created (T1136.001):**\n```spl\nindex=wineventlog sourcetype=\"WinEventLog:Security\" EventCode=4720\n| join TargetUserName type=left [\n    search index=wineventlog EventCode=4732 TargetUserName=\"Administrators\"\n    | rename MemberName AS TargetUserName\n  ]\n| table _time, SubjectUserName, TargetUserName, ComputerName\n| eval alert = \"New account created and added to Administrators group\"\n```\n\n**Special Privileges Assigned (EventCode 4672):**\n```spl\nindex=wineventlog sourcetype=\"WinEventLog:Security\" EventCode=4672\nSubjectUserName!=\"SYSTEM\" SubjectUserName!=\"LOCAL SERVICE\" SubjectUserName!=\"NETWORK SERVICE\"\n| stats count, values(PrivilegeList) AS privileges by SubjectUserName, ComputerName\n| where count > 0\n| search privileges IN (\"SeDebugPrivilege\", \"SeTcbPrivilege\", \"SeBackupPrivilege\",\n  \"SeRestorePrivilege\", \"SeAssignPrimaryTokenPrivilege\")\n```\n\n**Token Manipulation Detection (T1134):**\n```spl\nindex=sysmon EventCode=10 TargetImage=\"*\\\\lsass.exe\"\nGrantedAccess IN (\"0x1010\", \"0x1038\", \"0x1fffff\", \"0x40\")\n| stats count by SourceImage, SourceUser, Computer, GrantedAccess\n| where NOT match(SourceImage, \"(svchost|csrss|wininit|MsMpEng|CrowdStrike)\")\n| sort - count\n```\n\n### Step 3: Persistence Mechanism Detection\n\n**Scheduled Task Creation (T1053.005):**\n```spl\nindex=wineventlog (sourcetype=\"WinEventLog:Security\" EventCode=4698)\n  OR (sourcetype=\"XmlWinEventLog:Microsoft-Windows-Sysmon\u002FOperational\" EventCode=1\n      Image=\"*\\\\schtasks.exe\")\n| eval task_info = coalesce(TaskContent, CommandLine)\n| search task_info=\"*powershell*\" OR task_info=\"*cmd*\" OR task_info=\"*http*\" OR task_info=\"*\\\\Temp\\\\*\"\n| table _time, Computer, SubjectUserName, TaskName, task_info\n```\n\n**Registry Run Key Modification (T1547.001):**\n```spl\nindex=sysmon EventCode=13\nTargetObject IN (\n  \"*\\\\CurrentVersion\\\\Run\\\\*\",\n  \"*\\\\CurrentVersion\\\\RunOnce\\\\*\",\n  \"*\\\\CurrentVersion\\\\RunServices\\\\*\",\n  \"*\\\\Explorer\\\\Shell Folders\\\\*\"\n)\n| stats count by Computer, Image, TargetObject, Details\n| where NOT match(Image, \"(explorer\\.exe|msiexec\\.exe|setup\\.exe)\")\n| sort - count\n```\n\n**WMI Event Subscription (T1546.003):**\n```spl\nindex=sysmon EventCode=20 OR EventCode=21\n| stats count by Computer, Operation, Consumer, EventNamespace\n| where count > 0\n```\n\n### Step 4: Lateral Movement Detection\n\n**Remote Service Exploitation (T1021.002 — SMB\u002FWindows Admin Shares):**\n```spl\nindex=wineventlog sourcetype=\"WinEventLog:Security\" EventCode=4624 Logon_Type=3\n| stats dc(ComputerName) AS unique_destinations, values(ComputerName) AS targets\n  by src_ip, TargetUserName\n| where unique_destinations > 3\n| sort - unique_destinations\n| table src_ip, TargetUserName, unique_destinations, targets\n```\n\n**PsExec Detection (T1021.002):**\n```spl\nindex=sysmon EventCode=1\n(Image=\"*\\\\psexec.exe\" OR Image=\"*\\\\psexesvc.exe\"\n OR ParentImage=\"*\\\\psexesvc.exe\"\n OR OriginalFileName=\"psexec.c\")\n| table _time, Computer, User, ParentImage, Image, CommandLine\n```\n\n**RDP Lateral Movement (T1021.001):**\n```spl\nindex=wineventlog sourcetype=\"WinEventLog:Security\" EventCode=4624 Logon_Type=10\n| stats count, dc(ComputerName) AS rdp_targets, values(ComputerName) AS destinations\n  by src_ip, TargetUserName\n| where rdp_targets > 2\n| sort - rdp_targets\n```\n\n### Step 5: Build Forensic Timeline\n\nCreate comprehensive timeline for a compromised host:\n\n```spl\n(index=wineventlog OR index=sysmon) Computer=\"WORKSTATION-042\"\nearliest=\"2024-03-14T00:00:00\" latest=\"2024-03-16T00:00:00\"\n| eval event_description = case(\n    EventCode=4624, \"Logon: \".TargetUserName.\" (Type \".Logon_Type.\")\",\n    EventCode=4625, \"Failed Logon: \".TargetUserName,\n    EventCode=4688 OR (sourcetype=\"XmlWinEventLog:*Sysmon*\" AND EventCode=1),\n      \"Process: \".Image.\" CMD: \".CommandLine,\n    EventCode=4698, \"Scheduled Task: \".TaskName,\n    EventCode=3, \"Network: \".DestinationIp.\":\".DestinationPort,\n    EventCode=11, \"File Created: \".TargetFilename,\n    EventCode=13, \"Registry: \".TargetObject,\n    1=1, \"Event \".EventCode\n  )\n| sort _time\n| table _time, EventCode, event_description, User, src_ip\n```\n\n### Step 6: Create Lookup Tables for Enrichment\n\nBuild reference lookups for Windows Event ID context:\n\n```spl\n| inputlookup windows_eventcode_lookup.csv\n| table EventCode, Description, ATT_CK_Technique, Severity\n```\n\nIf lookup doesn't exist, create it:\n\n```csv\nEventCode,Description,ATT_CK_Technique,Severity\n4624,Successful Logon,T1078,Informational\n4625,Failed Logon,T1110,Low\n4648,Explicit Credential Logon,T1078,Medium\n4672,Special Privileges Assigned,T1134,Medium\n4688,New Process Created,T1059,Informational\n4698,Scheduled Task Created,T1053.005,Medium\n4720,User Account Created,T1136.001,High\n4732,Member Added to Security Group,T1098,High\n4768,Kerberos TGT Requested,T1558,Informational\n4769,Kerberos Service Ticket,T1558.003,Low\n4771,Kerberos Pre-Auth Failed,T1110,Low\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **EventCode 4624** | Successful logon event — Logon_Type 2 (interactive), 3 (network), 10 (RDP), 7 (unlock) |\n| **EventCode 4625** | Failed logon event — Status code indicates failure reason (bad password, account locked, disabled) |\n| **Sysmon EventCode 1** | Process creation with full command line, parent process, and hash information |\n| **Sysmon EventCode 3** | Network connection initiated by a process — source\u002Fdest IP, port, and process context |\n| **Logon Type 3** | Network logon (SMB, WMI, PowerShell Remoting) — key indicator of lateral movement |\n| **Logon Type 10** | Remote interactive logon via RDP\u002FTerminal Services |\n\n## Tools & Systems\n\n- **Splunk Enterprise**: SIEM platform with SPL query engine for Windows event log analysis and correlation\n- **Sysmon (System Monitor)**: Microsoft Sysinternals tool providing detailed process, network, and file activity logging\n- **Splunk CIM**: Common Information Model mapping Windows events to normalized fields for cross-source queries\n- **Windows Event Forwarding (WEF)**: Built-in Windows mechanism for centralizing event logs to a collector server\n\n## Common Scenarios\n\n- **Kerberoasting (T1558.003)**: Detect EventCode 4769 with encryption type 0x17 (RC4) for non-standard service accounts\n- **DCSync (T1003.006)**: Detect EventCode 4662 with DS-Replication-Get-Changes from non-DC sources\n- **Golden Ticket (T1558.001)**: Detect EventCode 4769 with abnormal ticket properties (long lifetime, non-standard encryption)\n- **Pass-the-Hash (T1550.002)**: Detect EventCode 4624 Logon_Type 3 with NTLM authentication from unexpected sources\n- **DLL Side-Loading (T1574.002)**: Sysmon EventCode 7 showing unsigned DLLs loaded by legitimate processes\n\n## Output Format\n\n```\nWINDOWS EVENT LOG ANALYSIS — HOST: WORKSTATION-042\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nPeriod:     2024-03-14 to 2024-03-15\nEvents:     12,847 total (Security: 9,231 | Sysmon: 3,616)\n\nAuthentication Summary:\n  Successful Logons (4624):    487 (Type 3: 312, Type 10: 45, Type 2: 130)\n  Failed Logons (4625):        847 (from 192.168.1.105 — BRUTE FORCE)\n  Explicit Creds (4648):       12\n\nSuspicious Findings:\n  [HIGH]   847 failed logons followed by success at 14:35 from 192.168.1.105\n  [HIGH]   New user \"backdoor_admin\" created (4720) at 14:38\n  [HIGH]   User added to Administrators group (4732) at 14:38\n  [MEDIUM] schtasks.exe creating persistence task at 14:42\n  [MEDIUM] PowerShell encoded command execution at 14:45\n\nATT&CK Mapping:\n  T1110.001 — Password Guessing (847 failed logons)\n  T1136.001 — Local Account Creation (backdoor_admin)\n  T1053.005 — Scheduled Task (persistence)\n  T1059.001 — PowerShell (encoded execution)\n```\n",{"name":5,"tags":49,"author":51,"domain":43,"license":15,"version":52,"nist_csf":53,"subdomain":58,"description":59,"mitre_attack":60,"d3fend_techniques":66},[30,28,32,33,34,31,50],"active-directory","mahipal","1.0",[54,55,56,57],"DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06","soc-operations","Analyzes Windows Security, System, and Sysmon event logs in Splunk to detect authentication attacks, privilege escalation, persistence mechanisms, and lateral movement using SPL queries mapped to MITRE ATT&CK techniques. Use when SOC analysts need to investigate Windows-based threats, build detection queries, or perform forensic timeline analysis of Windows endpoints and domain controllers.\n",[61,62,37,63,64,65],"T1110","T1053.005","T1021.002","T1558.003","T1003.006",[67,68,69,70,71],"Restore Access","Password Authentication","Biometric Authentication","Strong Password Policy","Restore User Account Access","main","7925716f065257435fdb12e97f7e52842147d5ad",".claude\u002Fskills\u002Fanalyzing-windows-event-logs-in-splunk","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude","https:\u002F\u002Fclaude.com\u002Fclaude-code","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho","Software · Applied AI · Quantitative Modeling · Building with Claude.","2026-06-10 12:24:46",{"source":8,"skillName":5,"commands":81,"prompt":91,"zipAvailable":92},[82,85,88],{"tool":83,"command":84},"npx","npx skills add henriquescastilho\u002Fmy-claude --skill analyzing-windows-event-logs-in-splunk",{"tool":86,"command":87},"bunx","bunx skills add henriquescastilho\u002Fmy-claude --skill analyzing-windows-event-logs-in-splunk",{"tool":89,"command":90},"pnpm","pnpm dlx skills add henriquescastilho\u002Fmy-claude --skill analyzing-windows-event-logs-in-splunk","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fanalyzing-windows-event-logs-in-splunk\u002FSKILL.md",true,[94,99,105],{"path":95,"resourceType":95,"resourceTypeDesc":96,"sizeBytes":97,"sourceHtmlUrl":98},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fanalyzing-windows-event-logs-in-splunk\u002FLICENSE",{"path":100,"resourceType":101,"resourceTypeDesc":102,"sizeBytes":103,"sourceHtmlUrl":104},"references\u002Fapi-reference.md","REFERENCE","参考文档",2035,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fanalyzing-windows-event-logs-in-splunk\u002Freferences\u002Fapi-reference.md",{"path":106,"resourceType":107,"resourceTypeDesc":108,"sizeBytes":109,"sourceHtmlUrl":110},"scripts\u002Fagent.py","SCRIPT","脚本",7017,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fanalyzing-windows-event-logs-in-splunk\u002Fscripts\u002Fagent.py",[112,153,162,171,193,218],{"skillNo":113,"name":114,"nameZh":6,"description":115,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":116,"licenseFileUrl":6,"sourceHtmlUrl":117,"categories":118,"keywords":133,"publishedAt":44},"01M6F0B6XPQ65AX2X0DWK8KT3E","markitdown","Convert files and office documents to Markdown. Supports PDF, DOCX, PPTX, XLSX, images (with OCR), audio (with transcription), HTML, CSV, JSON, XML, ZIP, YouTube URLs, EPubs and more.","MIT","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[119,122,125,128],{"categoryNo":120,"categoryName":121,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000002","文档处理",{"categoryNo":123,"categoryName":124,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":126,"categoryName":127,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000004","电子表格",{"categoryNo":129,"categoryName":130,"taxonomyType":131,"taxonomyTypeDesc":132},"01JBSEEDCAT000000000000034","行政与办公人员","PROFESSION","适用职业",[114,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152],"docx","PDF","pptx","xlsx","documents","csv","ocr","Audio","Bash","markdown","convert","read","write","edit","html","images","files","youtube","with",{"skillNo":154,"name":114,"nameZh":6,"description":115,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":116,"licenseFileUrl":6,"sourceHtmlUrl":155,"categories":156,"keywords":161,"publishedAt":44},"01M6F06SBHR9F0SDWE282Y8075","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fscientific_writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[157,158,159,160],{"categoryNo":120,"categoryName":121,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":123,"categoryName":124,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":126,"categoryName":127,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":129,"categoryName":130,"taxonomyType":131,"taxonomyTypeDesc":132},[114,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152],{"skillNo":163,"name":114,"nameZh":6,"description":115,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":116,"licenseFileUrl":6,"sourceHtmlUrl":164,"categories":165,"keywords":170,"publishedAt":44},"01M6F02D4R14EJAPBWVDF9J9VQ","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[166,167,168,169],{"categoryNo":120,"categoryName":121,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":123,"categoryName":124,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":126,"categoryName":127,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":129,"categoryName":130,"taxonomyType":131,"taxonomyTypeDesc":132},[114,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152],{"skillNo":172,"name":173,"nameZh":6,"description":174,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":116,"licenseFileUrl":6,"sourceHtmlUrl":175,"categories":176,"keywords":177,"publishedAt":44},"01M6F000KS6YB4MKS774G4R8ND","zarr-python","Chunked N-D arrays for cloud storage. Compressed arrays, parallel I\u002FO, S3\u002FGCS integration, NumPy\u002FDask\u002FXarray compatible, for large-scale scientific computing pipelines.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fzarr-python\u002FSKILL.md",[],[178,179,180,181,182,183,184,185,186,187,188,189,190,191,192],"python","zarr python","storage","integration","s3","gcs","cloud","dask","parallel","pipelines","arrays","numpy","scientific computing","scale","scientific",{"skillNo":194,"name":195,"nameZh":6,"description":196,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":116,"licenseFileUrl":6,"sourceHtmlUrl":197,"categories":198,"keywords":200,"publishedAt":44},"01M6EZZJWFXM1GR78KTW6J0DN8","what-if-oracle","Run structured What-If scenario analysis with multi-branch possibility exploration. Use this skill when the user asks speculative questions like \"what if...\", \"what would happen if...\", \"what are the possibilities\", \"explore scenarios\", \"scenario analysis\", \"possibility space\", \"what could go wrong\", \"best case \u002F worst case\", \"risk analysis\", \"contingency planning\", \"strategic options\", or any question about uncertain futures. Also trigger when the user faces a fork-in-the-road decision, wants to stress-test an idea, or needs to think through consequences before committing.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fwhat-if-oracle\u002FSKILL.md",[199],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[201,202,203,204,205,206,38,207,208,209,210,145,146,211,212,213,214,215,216,217],"oracle","what if oracle","go","run","ux","futures","explore","decision","branch","question","idea","exploration","options","stress-test","strategies","scenario","stress",{"skillNo":219,"name":220,"nameZh":6,"description":221,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":116,"licenseFileUrl":6,"sourceHtmlUrl":222,"categories":223,"keywords":234,"publishedAt":44},"01M6EZZCXAEB49RXGQCJX5E8GB","venue-templates","Access comprehensive LaTeX templates, formatting requirements, and submission guidelines for major scientific publication venues (Nature, Science, PLOS, IEEE, ACM), academic conferences (NeurIPS, ICML, CVPR, CHI), research posters, and grant proposals (NSF, NIH, DOE, DARPA). This skill should be used when preparing manuscripts for journal submission, conference papers, research posters, or grant proposals and need venue-specific formatting requirements and templates.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fvenue-templates\u002FSKILL.md",[224,227,230,231],{"categoryNo":225,"categoryName":226,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":228,"categoryName":229,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000021","资料检索与研究",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":232,"categoryName":233,"taxonomyType":131,"taxonomyTypeDesc":132},"01JBSEEDCAT000000000000036","内容创作者",[235,236,237,238,239,240,241,242,142,39,145,146,147,243,244,245,246,247,192,248],"templates","venue templates","research","guidelines","NeurIPS","ICML","LaTeX","science","proposals","Academic","requirements","formatting","journal","chi"]