📺 Livestream Timestamp: 34:10 — Live Splunk Lab: AD Forensics Detection Queries

This lesson requires lab access. Get free access at cover6solutions.com/product/cover6-first-watch-free-access/ before continuing. Check your email for Splunk credentials, then log in at splunk.cover6solutions.com.

Set your time range to All Time before running any queries below.

The dataset is botsv2 — Boss of the SOC version 2. A real attack dataset from a real incident. This is what a real attack looks like in Splunk.

Query 1 — Password Spray Detection (EventCode 4625)

index=botsv2 EventCode=4625
| stats count by Account_Name
| sort -count | head 10

What you will see: MERCURY$ appears over 3,000 times. Machines do not mistype passwords — something is driving that count. The Administrator account at 115 failures means someone targeted the obvious high-value account directly.

Query 2 — Privilege Escalation (EventCode 4672)

index=botsv2 EventCode=4672
| stats count by Account_Name
| sort -count | head 10

What you will see: An account called service3 generating over 45,000 events. This is your attacker operating under a service account identity.

Query 3 — Backdoor Account Detection (EventCode 4720)

index=botsv2 EventCode=4720
| table _time, Account_Name, SAM_Account_Name

What you will see: An account named svcvnc was created by user billy.tun and service3. VNC in a service account name signals a remote access tool — a hidden backdoor account.

Query 4 — Kerberoasting Baseline (EventCode 4769)

index=botsv2 EventCode=4769
| stats count by Ticket_Encryption_Type, Service_Name
| sort -count

What you will see: All events show 0x12 (AES encryption) — no RC4. This IS the lesson. This is what a clean Kerberos baseline looks like. The moment a 0x17 appears in your environment, Kerberoasting is in progress. One event is the alert.

The Complete Attack Story

Query 1 — Attacker sprays credentials for initial access. Query 2 — service3 operates with elevated privileges. Query 3 — service3 creates svcvnc as a backdoor. Query 4 — Kerberos stays clean because the attacker already had enough access. Four queries. One complete attack chain.

Learning Objective

After this lesson, you can run all 4 SPL queries against the botsv2 dataset, interpret the results, and explain what each finding indicates about attacker behavior.

Part of the free Intro to Cyber course by Cover6 Solutions.

PreviousNext