Skip to content

dashboard_spl_queries.md

Latest commit

 

History

History
165 lines (107 loc) · 4.81 KB

dashboard_spl_queries.md

File metadata and controls

165 lines (107 loc) · 4.81 KB
Raw

🔐 Windows Brute Force Detection Dashboard

This Splunk dashboard is designed to detect and analyze brute-force login attempts against Windows systems within the homelab Active Directory environment.

📸 Dashboard Overview

The dashboard contains several panels that track login failures, attack sources, targeted accounts, and suspicious PowerShell activity. The data is sourced from Windows Security Event Logs, primarily focusing on:

  • EventCode=4625 (Failed Login)
  • EventCode=4624 (Successful Login)
  • PowerShell execution patterns

The lab simulates real-world attack behavior using tools like Hydra, Atomic Red Team.

🔍 Dashboard SPL Queries & Logic

Each panel is driven by a custom SPL (Search Processing Language) query for detection clarity and security context.

1️⃣ Top IPs with Failed Logins

index=endpoint EventCode=4625
| stats count as failed_attempts by Source_Network_Address
| where failed_attempts > 5
| sort -failed_attempts
  • Detects: IPs with high volumes of failed login attempts.
  • Why: These are likely attack sources attempting brute-force access.

2️⃣ Top Targeted Usernames

index=endpoint EventCode=4625
| stats count as failed_attempts by Account_Name
| where failed_attempts > 5
| sort -failed_attempts
  • Detects: Most frequently targeted usernames.
  • Why: Helps identify enumeration or password spray attempts.

3️⃣ Failed Logins Over Time

index=endpoint EventCode=4625
| timechart span=5m count as failed_logins
  • Detects: Login failure trends over time.
  • Why: Spikes reveal potential brute-force activity windows.

4️⃣ Brute Force Signature: Many Failures + 1 Success

index=endpoint (EventCode=4625 OR EventCode=4624)
| stats count(eval(EventCode=4625)) as failed, count(eval(EventCode=4624)) as success by Account_Name, Source_Network_Address
| where failed > 5 AND success > 0
  • Detects: Accounts that had multiple failures before a successful login.
  • Why: Strong indicator of successful brute-force attacks.

5️⃣ Failure Reason Breakdown

index=endpoint EventCode=4625
| rex "Failure Reason:\s+(?<failure_reason>.+)"
| stats count by failure_reason
| sort -count
  • Detects: Specific reasons for failed logins.
  • Why: Helps understand attacker behavior — wrong password vs nonexistent user, etc.

6️⃣ PowerShell -NoProfile Execution Detected

index=endpoint "bypass -NoProfile"
| stats count by host, technique_id, technique_name
| sort -count

  • Detects: PowerShell scripts using -NoProfile, commonly seen in fileless attacks.

  • Mapped To:

    • T1059.003: PowerShell
    • T1083: File Discovery

  • Why: Indicates possible post-exploitation or red-team simulation via tools like Atomic Red Team.

📊 Dashboard Panel Explanations

dashboard

🔹 Failed Logins Over Time (Graph - Top Left)

  • Time-based trend of failed login attempts.
  • Spike on May 5 implies a coordinated brute-force effort.

🔹 Top IPs with Failed Logins (Center)

  • IP 192.168.0.194 flagged with the most failed attempts.
  • This is likely the attacker’s IP (e.g., from a Kali Linux).

🔹 Brute Force Signature: Many Failures + 1 Success (Top Right)

  • Visual representation of accounts with brute-force success patterns.
  • Green bars show successful logins post-failure streaks — e.g., mthompson, vhenderson.

🔹 Top Targeted Usernames (Table - Center Bottom)

  • Lists accounts like mthompson, schen, and WINDOWS-10$ repeatedly targeted.
  • Shows signs of user enumeration and password spraying.

🔹 Failure Reason (Bottom)

  • Shows the text "Unknown user name or bad password."
  • Supports the conclusion: the attacker is guessing usernames and/or passwords.

🔹 PowerShell -NoProfile Execution Detected (Bottom Right)

  • Detected -NoProfile executions on WINDOWS-10.
  • May indicate post-breach activity, like enumeration or malware delivery via script.

🧪 Simulated Attack Context

This dashboard was populated using a controlled homelab with the following simulated attack chain:

  • Brute-force attacks using Hydra
  • Windows event forwarding to Splunk
  • Post-auth activity via PowerShell
  • Atomic Red Team tests for ATT&CK techniques

Lab Project Repository: active-directory-lab

✅ Usage

To use this dashboard in your lab:

  1. Ensure Windows logs (Security) are being forwarded to Splunk (EventCode=4625, 4624)
  2. Create panels using the provided SPL queries
  3. Customize thresholds (> 5) as needed for your environment
  4. Simulate attacks using Atomic Red Team or other tools to test detection