security_content/data_sources/ntlm_operational_8004.yml at 2b6d541b4c179dc3fc0dbabcb420fb98ba1d5f88 · splunk/security_content · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
name: NTLM Operational 8004
id: fd08cb77-c26e-464c-a43e-2867e232127e
version: 2
creation_date: '2025-02-21'
modification_date: '2026-05-13'
author: Bhavin Patel, Splunk
description: Data source object for NTLM Operational 8004
source: XmlWinEventLog:Microsoft-Windows-NTLM/Operational
sourcetype: XmlWinEventLog:Microsoft-Windows-NTLM/Operational
separator: EventCode
supported_TA:
    - name: Splunk Add-on for Microsoft Windows
      url: https://splunkbase.splunk.com/app/742
      version: 10.0.1
fields:
    - CategoryString
    - Channel
    - Computer
    - DomainName
    - EventCode
    - EventData_Xml
    - EventID
    - EventRecordID
    - Guid
    - Image_File_Name
    - Keywords
    - Level
    - Name
    - Opcode
    - ProcessID
    - RecordNumber
    - RenderingInfo_Xml
    - SChannelName
    - SChannelType
    - SourceName
    - SubStatus
    - SystemTime
    - System_Props_Xml
    - Task
    - TaskCategory
    - ThreadID
    - UserID
    - UserName
    - Version
    - WorkstationName
    - action
    - category
    - date_hour
    - date_mday
    - date_minute
    - date_month
    - date_second
    - date_wday
    - date_year
    - date_zone
    - dvc
    - dvc_nt_host
    - event_id
    - eventtype
    - host
    - id
    - index
    - linecount
    - name
    - parent_process
    - process_name
    - punct
    - result
    - service
    - service_id
    - service_name
    - severity
    - severity_id
    - signature
    - signature_id
    - source
    - sourcetype
    - splunk_server
    - splunk_server_group
    - subject
    - tag
    - tag::action
    - tag::eventtype
    - timeendpos
    - timestartpos
    - user_group_id
    - user_id
    - vendor_product
    - _bkt
    - _cd
    - _eventtype_color
    - _indextime
    - _raw
    - _serial
    - _si
    - _sourcetype
    - _subsecond
    - _time
example_log: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Netlogon' Guid='{E5BA83F6-07D0-46B1-8BC7-7E669A1D31DC}'/><EventID>8004</EventID><Version>0</Version><Level>4</Level><Task>2</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2024-01-18T05:04:59.727635000Z'/><EventRecordID>2728229667</EventRecordID><Correlation/><Execution ProcessID='812' ThreadID='3684'/><Channel>Microsoft-Windows-NTLM/Operational</Channel><Computer>attack_dc.attack_range.lan</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='SChannelName'>VICTIM_PC</Data><Data Name='UserName'>backup</Data><Data Name='DomainName'>NULL</Data><Data Name='WorkstationName'>WIN-SHKRDLDI338</Data><Data Name='SChannelType'>2</Data></EventData></Event>