---------------------------------
WINDOWS USECASES
------------------------------


Duration of login and log out.. same user on same system login and

logout duration



index=* sourcetype="WMI:WinEventLog:Security" (EventCode=4624 OR

EventCode=4634) (Logon_Type=2 OR Logon_Type=10)



| eval Date=strftime(_time, "%Y/%m/%d")|eval

Start&End=strftime(_time,"%Y-%m-%d %H:%M:%S")



| eval LogonType=case(Logon_Type="2", "Local Console Access",

Logon_Type="10", "Remote Desktop")



| transaction host user session_id startswith=EventCode=4624

endswith=EventCode=4634 maxevents=2



| eval Duration = round (duration/60 ,2)



| dedup host,user,Start&End



| table src_ip,host,user, LogonType,Duration, Date ,Start&End | rename

Duration as "Session in Minutes" | sort   date



More than 10 successful login on 1 system from different user accounts



index=* sourcetype="WMI:WinEventLog:Security" EventCode=4624

(Logon_Type=2 OR Logon_Type=10)| bucket _time span=60m | stats

values(user) AS UserName  dc(user) AS User_Count by host | where

User_Count>10 |table UserName host User_Count     (time span of

60minutes)



Single user logged in to more than 5 systems at the same time (30

minutes)


index=* sourcetype="WMI:WinEventLog:Security" EventCode=4624

(Logon_Type=2 OR Logon_Type=10)| bucket _time span=30m | stats

values(host) AS HostName  dc(host) AS Host_Count by user | where

Host_Count>5|table user HostName Host_Count



Successful logins on Hosts in 1 day time period

index=*  EventCode=4624|stats  values(Workstation_Name)  AS Source

count by host| table Source host count  |rename host AS Destination |

sort -count



Failed logins on Hosts in 1 day time period



index=*  EventCode=4625|stats  values(Workstation_Name)  AS Source

count by host| table Source host count  |rename host AS Destination |

sort -count



Brute Force Attempt


index=* EventCode=4625 | stats  count by Account_Name Failure_Reason

Logon_Type | where count > 7  (Threshold limit is for visualization

purpose only)


More than 2 login failures from the same user  in 1 day



index=* EventCode=4625 | stats count by Account_Name Failure_Reason

Logon_Type | where count > 2


------------------------------------------------------------------------------------
FIREWALL/NETWORK USECASES
--------------------------------------------------------------------------------------
MS networking worm
index=* sourcetype=firewall | bucket _time span=1m  | where match  (dest_port, "^(445|139|137|135)$") | stats dc(dest_ip) values(dest_ip) by src_ip
Smtp mass mailer
index=* sourcetype=firewall | search dest_port=25 | stats dc(dest_ip) AS destination values(dest_port) values(dest_ip) by src_ip |where destination > 5
IRC connections
index=* sourcetype=firewall | where match (dest_port,"^(6667|6668|6669|6697)$") |stats  count by action,src_ip dest_ip src_port dest_port | sort  -count
DNS Flood
index=* sourcetype=firewall |bucket _time span=1m| search dest_port=53|stats sum(bytes_in) sum(packets_in) count by src_ip dest_ip dest_port src_port  | sort -count
Large DNS reponse
index=* sourcetype=firewall | search dest_port=53 |where bytes_in>512  |stats sum(packets_in) count by bytes_in src_ip dest_ip  dest_port src_port  | sort -count
DNS requests to External network
index=* sourcetype=firewall | search dest_port=53 | stats count by src_ip dest_ip action src_port| sort -count
P2P traffic
index=* sourcetype=firewall| bucket _time span=1m  | where match  (dest_port, "^(4662|4672|6257|6346-6347|6699|6881-6889|6969)$") | stats dc(dest_ip) values(dest_port) values(dest_ip) by src_ip
Production IP's communicating to external IP's
index=* sourcetype=firewall NOT (dest_ip=192.168.* OR dest_ip=10.*)  | stats dc(dest_ip) AS dest_count values(dest_port) values(dest_ip) by src_ip |sort -dest_count
Backdoor communication on well known proxy port
index=* sourcetype=FIREWALL | search dest_port=3128 | stats dc(dest_ip) AS dest_count values(dest_port) values(dest_ip) by src_ip |sort -dest_count


Check for suspicious ICMP traffic

index=* sourcetype=firewall | eval size= bytes_in / packets_in | where size > 200 ||stats values(packets_in) values(size) As sizeofpacket by src_ip src_hostname dest_ip dest_hostname src_port dest_port| sort -sizeofpacket

Identify unusual protocol occurrences or volumes

index=* sourcetype=firewall NOT (protoid=6 OR protoid=17 OR protoid=1 OR protoid=89 OR protoid=41 ) | stats values(src_ip) values(dest_ip) sum(bytes_in) as Bytes by protoid

Ping Sweep
index=* (proto=icmp OR protoid=1) |bucket _time span=1m | stats values(dest_ip) As dstip dc(dest_ip) AS ipscan by src, _time|where ipscan>20


Large DNS response

index=* sourcetype=firewall src_port=53|where bytes_in>512||stats sum(packets_in) by bytes_in src_ip src_hostname dest_ip dest_hostname|sort -bytes_in


Database Ping sweep detection	index=*  sourcetype=firewall| where match(dest_port, "^(1443|1521|3306)$") | bucket _time span=1m|stats dc(dest_ip) AS connections values(dest_port) values(dest_ip)  by src_ip | sort -connections | where connections > 50


Port Scan	index=* |bucket _time span=1m| stats  values(src_IP) values(dest_IP) dc(dest_port) AS PortsScanned by src,dst, _time |where PortsScanned>300| dedup src, PortsScanned

Check Responses or downloads	index=*  sourcetype=firewall| where src_port < 1024 AND dest_port > 1023 | stats sum(bytes_in) as Bytes by src_port, dest_port | eval MB=Bytes/(1024*1024) | rename src_port as Source, dest_port as Destination | table Source, Destination, MB | sort -MB


Check requests or uploads

"index=* sourcetype=firewall | where dest_port < 1024 AND src_port > 1023 | stats sum(bytes_in) as Bytes by src_port,
dest_port | eval MB=Bytes/(1024*1024) | rename src_port as Source, dest_port as Destination | table Source, Destination, MB | sort -MB"


Check Reponses or downloads with Specific wellknown Ports, latest 25	index=*  sourcetype=firewall| where match(src_port, "^(20|21|23|69|512|513|514)$") AND dest_port > 1023 | stats sum(bytes_in) as Bytes by src_ip, dest_ip src_port | eval MB=Bytes/(1024*1024) | sort -MB limit=25


Check Reposne Downloads apart from port  445	index=*  sourcetype=firewall NOT src_port = 445 AND dest_port > 1023 | bucket _time span=1s |stats sum(packets_in) as Packets sum(bytes_in) as Bytes by _time src_ip, dest_ip |lookup dnslookup clientip as dest_ip OUTPUT clienthost as dest_hostname|lookup dnslookup clientip as src_ip OUTPUT clienthost as src_hostname| eval MB=Bytes/(1024*1024) | sort 10 -MB


Rouge DHCP server detection	index=* (sourcetype=firewall ) protoid=17  NOT (src_ip=DHCPSERVER_IP OR src_ip=DHCPSERVER_IP) src_port=67 | stats dc(dest_ip) values(src_port) values(dest_port) values(dest_ip) by src_ip



Botnet activity	index=* sourcetype=FIREWALL  NOT dest_ip=10.0.0.0/8 NOT dest_ip=172.16.0.0/12 NOT dest_ip=192.168.0.0/16 NOT dest_ip=169.254.0.0/16 action=allowed NOT dest_ip=255.255.255.255 | bucket _time span=10m  |stats dc(src_ip) as botnet_ip by _time dest_ip |where botnet_ip>=5


Blacklisted IP Communication	index=*|lookup blacklist.csv destip as dest_ip OUTPUT type as ioc_type|where isnotnull(ioc_type)|stats count by src_ip dest_ip dest_port,action,ioc_type



Check packets sending size above ethernet MTU size	index=* sourcetype=firewall (protoid=6 OR  protoid=17)| eval size= bytes_in / packets_in | where size > 1518 | stats values(packets_in) values(size) As sizeofpacket by src_ip dest_ip src_port dest_port protoid|sort -sizeofpacket


UDP Bandwidth Exhaustion Attacks	index=* sourcetype=firewall protoid=17|bucket _time span=1m|stats sum(bytes_in) as Bytes by src_ip, dest_ip, _time | eval MB=Bytes/(1024*1024)| rename src_ip as Source, dest_ip as Destination | table _time Source, Destination, MB |where MB>1024| sort 5 -MB


ICMP Banwidth Exhaustion Attacks	index=* sourcetype=firewall protoid=1|bucket _time span=1m|stats sum(bytes_in) as Bytes by src_ip, dest_ip, _time | eval MB=Bytes/(1024*1024)| rename src_ip as Source, dest_ip as Destination | table _time Source, Destination, MB | sort 5 -MB


DNS Flood	index=* sourcetype=firewall NOT (src_ip=DNS_SERVER OR src_ip=DNS_SERVER OR src_ip=DNS_SERVER OR src_ip=DNS_SERVER)|bucket _time span=1m| search dest_port=53|stats sum(bytes_in) sum(packets_in) count by src_ip dest_ip dest_port src_port  | sort -count


Data dumping activity/Probable SQL Injection	index=*  sourcetype=firewall| where match(src_port, "^(1443|1521|3306)$") | stats sum(bytes_in) as Bytes by src_ip, dest_ip src_port | eval MB=Bytes/(1024*1024) | where Bytes>1200 | sort -MB

Top 10 internal hosts or sources performing large amount of Data transfer that require investigation.	index=* sourcetype=firewall | stats sum(bytes_in) as Bytes by src_ip, dest_ip, protoid | eval MB=Bytes/(1024*1024)| rename src_ip as Source, dest_ip as Destination | sort 10 -MB


Top Denied Inbound by Ports	index=* sourcetype=FIREWALL NOT src_ip=10.0.0.0/8 NOT src_ip=172.16.0.0/12 NOT src_ip=192.168.0.0/16   (action=dropped OR action=blocked) | top 10 dest_port

Denied Outbound Connections (Address)	index=* sourcetype=FIREWALL  NOT dest_ip=10.0.0.0/8 NOT dest_ip=172.16.0.0/12 NOT dest_ip=192.168.0.0/16 NOT dest_ip=169.254.0.0/16 (action=dropped OR action=blocked) | top 10 src_ip


Denied Outbound Connections (Ports apart from 80, 443) - Internal Host	index=* sourcetype=FIREWALL NOT dest_ip=10.0.0.0/8 NOT dest_ip=172.16.0.0/12 NOT dest_ip=192.168.0.0/16 NOT  (action=dropped OR action=blocked) NOT (dest_port=80 OR dest_port=443) | top 10 src_ip


Top 10 Accepted Ports (Inbound)	index=* sourcetype=FIREWALL NOT src_ip=10.0.0.0/8 NOT src_ip=172.16.0.0/12 NOT src_ip=192.168.0.0/16 NOT src_ip=169.254.0.0/16  action=allowed | top 10 dest_port

Top 10 Accepted Ports (Outbound)	index=* sourcetype=FIREWALL  NOT dest_ip=10.0.0.0/8 NOT dest_ip=172.16.0.0/12 NOT dest_ip=192.168.0.0/16 NOT dest_ip=169.254.0.0/16 NOT dest_ip=255.255.255.255 action=allowed | top 10 dest_port

TOP Connections Drop - 10 events	index=* sourcetype=FIREWALL (action=dropped OR action=blocked) | stats count by src_ip dest_ip dest_port | sort 10 -count