User Sessions Hunting

User Added To Group

event_simpleName=UserAccountAddedToGroup 
| fields aid, ComputerName, ContextTimeStamp_decimal, DomainSid, GroupRid, LocalAddressIP4, UserRid, timestamp
| eval GroupRid_dec=tonumber(ltrim(tostring(GroupRid), "0"), 16)
| eval UserRid_dec=tonumber(ltrim(tostring(UserRid), "0"), 16)
| eval UserSid_readable=DomainSid. "-" .UserRid_dec
| lookup local=true usersid_username_win.csv UserSid_readable OUTPUT UserName
| lookup local=true grouprid_wingroup.csv GroupRid_dec OUTPUT WinGroup
| fillnull value="Unknown" UserName, WinGroup
| stats dc(UserSid_readable) as userAccountsAdded values(WinGroup) as windowsGroupsManipulated values(GroupRid_dec) as groupRIDs by ComputerName, aid
| eval cloudTime=cloudTime/1000
| convert ctime(endpointTime) ctime(cloudTime)
| sort + endpointTime

Auditing SSH Connections in Linux

event_platform=lin event_simpleName=CriticalEnvironmentVariableChanged, EnvironmentVariableName IN (SSH_CONNECTION, USER) 
| eventstats list(EnvironmentVariableName) as EnvironmentVariableName,list(EnvironmentVariableValue) as EnvironmentVariableValue by aid, ContextProcessId_decimal
| eval tempData=mvzip(EnvironmentVariableName,EnvironmentVariableValue,":")
| rex field=tempData "SSH_CONNECTION\:((?<clientIP>\d+\.\d+\.\d+\.\d+)\s+(?<rPort>\d+)\s+(?<serverIP>\d+\.\d+\.\d+\.\d+)\s+(?<lPort>\d+))"
| rex field=tempData "USER\:(?<userName>.*)"
| where isnotnull(clientIP)
| iplocation clientIP
| lookup local=true aid_master aid OUTPUT Version as osVersion, Country as sshServerCountry
| fillnull City, Country, Region value="-"
| table _time aid ComputerName sshServerCountry osVersion serverIP lPort userName clientIP rPort City Region Country
| where isnotnull(userName)
| sort +ComputerName, +_time

Parsing and Hunting Failed User Logons in Windows

event_platform=win event_simpleName=UserLogonFailed2 
| eval SubStatus_hex=tostring(SubStatus_decimal,"hex")
| rename SubStatus_decimal as Status_code_decimal
| lookup local=true LogonType.csv LogonType_decimal OUTPUT LogonType
| lookup local=true win_status_codes.csv Status_code_decimal OUTPUT Description 
| stats count(aid) as failCount earliest(ContextTimeStamp_decimal) as firstLogonAttempt latest(ContextTimeStamp_decimal) as lastLogonAttempt values(LocalAddressIP4) as localIP values(aip) as externalIP by aid, ComputerName, UserName, LogonType, SubStatus_hex, Description 
| eval firstLastDeltaHours=round((lastLogonAttempt-firstLogonAttempt)/60/60,2)
| eval logonAttemptsPerHour=round(failCount/firstLastDeltaHours,0)
| convert ctime(firstLogonAttempt) ctime(lastLogonAttempt)
| sort - failCount

Failed User Logons

index=main sourcetype=UserLogonFailed* event_platform=win event_simpleName=UserLogonFailed2 
| search LogonType_decimal IN (2, 7, 10, 13)
| where ComputerName=LogonDomain
| eval LogonType=case(LogonType_decimal="2", "Interactive", LogonType_dgecimal="7", "Unlock", LogonType_decimal="10", "RDP", LogonType_decimal="13", "Unlock Workstation")
| eval SubStatus_decimal=tostring(SubStatus_decimal,"hex")
| eval SubStatus_decimal=replace(SubStatus_decimal,"0xC0000064", "User name does not exist")
| eval SubStatus_decimal=replace(SubStatus_decimal,"0xC000006A", "User name is correct but the password is wrong")
| eval SubStatus_decimal=replace(SubStatus_decimal,"0xC0000234", "User is currently locked out")
| eval SubStatus_decimal=replace(SubStatus_decimal,"0xC0000072", "Account is currently disabled")
| eval SubStatus_decimal=replace(SubStatus_decimal,"0xC000006F", "User tried to logon outside his day of week or time of day restrictions")
| eval SubStatus_decimal=replace(SubStatus_decimal,"0xC0000070", "Workstation restriction, or Authentication Policy Silo violation (look for event ID 4820 on domain controller)")
| eval SubStatus_decimal=replace(SubStatus_decimal,"0xC0000193", "Account expiration")
| eval SubStatus_decimal=replace(SubStatus_decimal,"0xC0000071", "Expired password")
| eval SubStatus_decimal=replace(SubStatus_decimal,"0xC0000133", "Clocks between DC and other computer too far out of sync")
| eval SubStatus_decimal=replace(SubStatus_decimal,"0xC0000224", "User is required to change password at next logon")
| eval SubStatus_decimal=replace(SubStatus_decimal,"0xC0000225", "Evidently a bug in Windows and not a risk")
| eval SubStatus_decimal=replace(SubStatus_decimal,"0xc000015b", "The user has not been granted the requested logon type (aka logon right) at this machine")
| eval SubStatus_decimal=replace(SubStatus_decimal,"0xC000006E", "Unknown user name or bad password")
| stats values(ComputerName) as computerName, values(LocalAddressIP4) as localIPAddresses, count(aid) as failedLogonAttempts, dc(UserName) as credentialsUsed, values(UserName) as userNames, earliest(ContextTimeStamp_decimal) as firstFailedAttmpt, latest(ContextTimeStamp_decimal) as lastFailedAttempt, values(RemoteAddressIP4) as remoteIPAddresses, values(LogonType) as logonTypes, values(SubStatus_decimal) as failedLogonReasons by aid
| eval failedLoginsDeltaMinutes=round((lastFailedAttempt-firstFailedAttmpt)/60,0)
| eval failedLoginsDeltaSeconds=round((lastFailedAttempt-firstFailedAttmpt),2)
| where failedLogonAttempts>=5
| convert ctime(firstFailedAttmpt) ctime(lastFailedAttempt)
| sort -failedLogonAttempts