Skip to content

Fix - Windows Kerberos Local Successful Logon #3763

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 5 commits into from
Nov 10, 2025
Merged

Fix - Windows Kerberos Local Successful Logon #3763

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
e3986aa
fixes?
patel-bhavin Nov 6, 2025
23031f8
Update windows_svchost_exe_parent_process_anomaly.yml
patel-bhavin Nov 6, 2025
aa9b182
manual test
patel-bhavin Nov 7, 2025
28c7dc9
unicode
patel-bhavin Nov 7, 2025
a6d9d98
Merge branch 'auto-ta-update-440' into fixes
patel-bhavin Nov 10, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions detections/endpoint/windows_kerberos_local_successful_logon.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
name: Windows Kerberos Local Successful Logon
id: 8309c3a8-4d34-48ae-ad66-631658214653
version: 9
date: '2025-10-14'
version: 10
date: '2025-11-06'
author: Michael Haag, Splunk
status: production
type: TTP
Expand All @@ -16,7 +16,7 @@ description: The following analytic identifies a local successful authentication
data_source:
- Windows Event Log Security 4624
search: '`wineventlog_security` EventCode=4624 LogonType=3 AuthenticationPackageName=Kerberos
action=success src=127.0.0.1 | stats count min(_time) as firstTime max(_time) as
action=success src=127.0.0.1 | fillnull | stats count min(_time) as firstTime max(_time) as
lastTime by action app authentication_method dest dvc process process_id process_name
process_path signature signature_id src src_port status subject user user_group
vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
Expand Down
5 changes: 3 additions & 2 deletions detections/endpoint/windows_svchost_exe_parent_process_anomaly.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
name: Windows Svchost.exe Parent Process Anomaly
id: 1d38e5e9-2ff8-4c47-872c-bf1657cefab5
version: 4
date: '2025-05-02'
version: 5
date: '2025-11-07'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
Expand Down Expand Up @@ -74,6 +74,7 @@ tags:
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
manual_test: This detection analytic is not passing unit tests due to a change with the latest windows 9.1.0 TA causing sysmon parsing to fail and the data does not get mapped to the datamodel correctly. Issue details- https://github.com/splunk/splunk-add-on-for-microsoft-windows/issues/563
tests:
- name: True Positive Test
attack_data:
Expand Down