Techniques
Sample rules
Windows Account Access Removal via Logoff Exec
- source: splunk
- technicques:
- T1059.001
- T1531
Description
The following analytic detects the process of logging off a user through the use of the quser and logoff commands. By monitoring for these commands, the analytic identifies actions where a user session is forcibly terminated, which could be part of an administrative task or a potentially unauthorized access attempt. This detection helps identify potential misuse or malicious activity where a user’s access is revoked without proper authorization, providing insight into potential security incidents involving account management or session manipulation.
Detection logic
| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = logoff.exe by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_guid Processes.dest Processes.user
| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_account_access_removal_via_logoff_exec_filter`
Windows Powershell Logoff User via Quser
- source: splunk
- technicques:
- T1059.001
- T1531
Description
The following analytic detects the process of logging off a user through the use of the quser and logoff commands. By monitoring for these commands, the analytic identifies actions where a user session is forcibly terminated, which could be part of an administrative task or a potentially unauthorized access attempt. This detection helps identify potential misuse or malicious activity where a user’s access is revoked without proper authorization, providing insight into potential security incidents involving account management or session manipulation.
Detection logic
`powershell` EventCode=4104 ScriptBlockText = "*quser*logoff*"
| stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText UserID Computer
| rename Computer as dest, UserID as user
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_powershell_logoff_user_via_quser_filter`