Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Analyzing Windows Event Logs in Splunk · mukul975 | DecimalAI

Analyzing Windows Event Logs In Splunk

SkillScore52Maintained

analyzing-windows-event-logs-in-splunk

Analyzes Windows Security, System, and Sysmon event logs in Splunk to detect authentication attacks, privilege escalation, persistence mechanisms, and lateral movement using SPL queries mapped to MITRE ATT&CK techniques. Use when SOC analysts need to investigate Windows-based threats, build detection queries, or perform forensic timeline analysis of Windows endpoints and domain controllers.

Securityby mukul975

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/analyzing-windows-event-logs-in-splunk/SKILL.md

decimalai skills pull analyzing-windows-event-logs-in-splunk --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/analyzing-windows-event-logs-in-splunk/SKILL.md https://app.decimal.ai/s/analyzing-windows-event-logs-in-splunk/SKILL.md

Raw file: /s/analyzing-windows-event-logs-in-splunk/SKILL.md ↗ · machine-readable summary at /s/analyzing-windows-event-logs-in-splunk.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

23 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 55d ago

Yes — +52% lift · at higher cost+92% tokens0% turns52% of whole cases pass with skill (12/23)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-08	✗→✓	▲ Improved	—	—
case-10	✗→✓	▲ Improved	—	—
case-01	✗→✓	▲ Improved	—	—
case-09	✗→✓	▲ Improved	—	—
case-23	✗→✓	▲ Improved	—	—

Showing 5 of 23 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 7/30/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

mukul975 / Anthropic-Cybersecurity-Skills

skills/analyzing-windows-event-logs-in-splunk/SKILL.md

View on GitHub ↗

License Apache-2.0Imported 8/1/2026Version v1Bundled 2 files · scripts

Skill contents

scripts/

references/

SKILL.md

Analyzing Windows Event Logs in Splunk

When to Use

Use this skill when:

SOC analysts investigate alerts related to Windows authentication, process execution, or AD changes
Detection engineers build SPL queries for Windows-based threat detection
Incident responders need forensic timelines of Windows endpoint or domain controller activity
Periodic threat hunting targets Windows-specific ATT&CK techniques

Do not use for Linux/macOS endpoint analysis or network-only investigations.

Prerequisites

Splunk with Windows Event Log data ingested (sourcetype WinEventLog:Security, WinEventLog:System, XmlWinEventLog:Microsoft-Windows-Sysmon/Operational)
Sysmon deployed on endpoints with SwiftOnSecurity or Olaf Hartong configuration
CIM data model acceleration for Endpoint and Authentication data models
Knowledge of Windows Security Event IDs and Sysmon event types

Workflow

Step 1: Authentication Attack Detection

Brute Force Detection (EventCode 4625 — Failed Logon):

spl
index=wineventlog sourcetype="WinEventLog:Security" EventCode=4625
| stats count, dc(TargetUserName) AS unique_users, values(TargetUserName) AS targeted_users
  by src_ip, Logon_Type, Status
| where count > 20
| eval attack_type = case(
    Logon_Type=3, "Network Brute Force",
    Logon_Type=10, "RDP Brute Force",
    Logon_Type=2, "Interactive Brute Force",
    1=1, "Other"
  )
| eval status_meaning = case(
    Status="0xc000006d", "Bad Username or Password",
    Status="0xc000006a", "Incorrect Password (valid user)",
    Status="0xc0000234", "Account Locked Out",
    Status="0xc0000072", "Account Disabled",
    1=1, Status
  )
| sort - count
| table src_ip, attack_type, status_meaning, count, unique_users, targeted_users

Password Spray Detection:

spl
index=wineventlog sourcetype="WinEventLog:Security" EventCode=4625 Logon_Type=3
| bin _time span=10m
| stats dc(TargetUserName) AS unique_users, count AS total_attempts,
  values(TargetUserName) AS users_targeted by src_ip, _time
| where unique_users > 10 AND total_attempts < unique_users * 3
| eval spray_confidence = if(unique_users > 25, "HIGH", "MEDIUM")

Successful Logon After Failures (Compromise Indicator):

spl
index=wineventlog sourcetype="WinEventLog:Security"
(EventCode=4625 OR EventCode=4624) src_ip!="127.0.0.1"
| sort _time
| stats earliest(_time) AS first_seen, latest(_time) AS last_seen,
  sum(eval(if(EventCode=4625,1,0))) AS failures,
  sum(eval(if(EventCode=4624,1,0))) AS successes
  by src_ip, TargetUserName, ComputerName
| where failures > 10 AND successes > 0
| eval time_to_success = round((last_seen - first_seen)/60, 1)
| sort - failures

Step 2: Privilege Escalation Detection

New Admin Account Created (T1136.001):

spl
index=wineventlog sourcetype="WinEventLog:Security" EventCode=4720
| join TargetUserName type=left [
    search index=wineventlog EventCode=4732 TargetUserName="Administrators"
    | rename MemberName AS TargetUserName
  ]
| table _time, SubjectUserName, TargetUserName, ComputerName
| eval alert = "New account created and added to Administrators group"

Special Privileges Assigned (EventCode 4672):

spl
index=wineventlog sourcetype="WinEventLog:Security" EventCode=4672
SubjectUserName!="SYSTEM" SubjectUserName!="LOCAL SERVICE" SubjectUserName!="NETWORK SERVICE"
| stats count, values(PrivilegeList) AS privileges by SubjectUserName, ComputerName
| where count > 0
| search privileges IN ("SeDebugPrivilege", "SeTcbPrivilege", "SeBackupPrivilege",
  "SeRestorePrivilege", "SeAssignPrimaryTokenPrivilege")

Token Manipulation Detection (T1134):

spl
index=sysmon EventCode=10 TargetImage="*\\lsass.exe"
GrantedAccess IN ("0x1010", "0x1038", "0x1fffff", "0x40")
| stats count by SourceImage, SourceUser, Computer, GrantedAccess
| where NOT match(SourceImage, "(svchost|csrss|wininit|MsMpEng|CrowdStrike)")
| sort - count

Step 3: Persistence Mechanism Detection

Scheduled Task Creation (T1053.005):

spl
index=wineventlog (sourcetype="WinEventLog:Security" EventCode=4698)
  OR (sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
      Image="*\\schtasks.exe")
| eval task_info = coalesce(TaskContent, CommandLine)
| search task_info="*powershell*" OR task_info="*cmd*" OR task_info="*http*" OR task_info="*\\Temp\\*"
| table _time, Computer, SubjectUserName, TaskName, task_info

Registry Run Key Modification (T1547.001):

spl
index=sysmon EventCode=13
TargetObject IN (
  "*\\CurrentVersion\\Run\\*",
  "*\\CurrentVersion\\RunOnce\\*",
  "*\\CurrentVersion\\RunServices\\*",
  "*\\Explorer\\Shell Folders\\*"
)
| stats count by Computer, Image, TargetObject, Details
| where NOT match(Image, "(explorer\.exe|msiexec\.exe|setup\.exe)")
| sort - count

WMI Event Subscription (T1546.003):

spl
index=sysmon EventCode=20 OR EventCode=21
| stats count by Computer, Operation, Consumer, EventNamespace
| where count > 0

Step 4: Lateral Movement Detection

Remote Service Exploitation (T1021.002 — SMB/Windows Admin Shares):

spl
index=wineventlog sourcetype="WinEventLog:Security" EventCode=4624 Logon_Type=3
| stats dc(ComputerName) AS unique_destinations, values(ComputerName) AS targets
  by src_ip, TargetUserName
| where unique_destinations > 3
| sort - unique_destinations
| table src_ip, TargetUserName, unique_destinations, targets

PsExec Detection (T1021.002):

spl
index=sysmon EventCode=1
(Image="*\\psexec.exe" OR Image="*\\psexesvc.exe"
 OR ParentImage="*\\psexesvc.exe"
 OR OriginalFileName="psexec.c")
| table _time, Computer, User, ParentImage, Image, CommandLine

RDP Lateral Movement (T1021.001):

spl
index=wineventlog sourcetype="WinEventLog:Security" EventCode=4624 Logon_Type=10
| stats count, dc(ComputerName) AS rdp_targets, values(ComputerName) AS destinations
  by src_ip, TargetUserName
| where rdp_targets > 2
| sort - rdp_targets

Step 5: Build Forensic Timeline

Create comprehensive timeline for a compromised host:

spl
(index=wineventlog OR index=sysmon) Computer="WORKSTATION-042"
earliest="2024-03-14T00:00:00" latest="2024-03-16T00:00:00"
| eval event_description = case(
    EventCode=4624, "Logon: ".TargetUserName." (Type ".Logon_Type.")",
    EventCode=4625, "Failed Logon: ".TargetUserName,
    EventCode=4688 OR (sourcetype="XmlWinEventLog:*Sysmon*" AND EventCode=1),
      "Process: ".Image." CMD: ".CommandLine,
    EventCode=4698, "Scheduled Task: ".TaskName,
    EventCode=3, "Network: ".DestinationIp.":".DestinationPort,
    EventCode=11, "File Created: ".TargetFilename,
    EventCode=13, "Registry: ".TargetObject,
    1=1, "Event ".EventCode
  )
| sort _time
| table _time, EventCode, event_description, User, src_ip

Step 6: Create Lookup Tables for Enrichment

Build reference lookups for Windows Event ID context:

spl
| inputlookup windows_eventcode_lookup.csv
| table EventCode, Description, ATT_CK_Technique, Severity

If lookup doesn't exist, create it:

csv
EventCode,Description,ATT_CK_Technique,Severity
4624,Successful Logon,T1078,Informational
4625,Failed Logon,T1110,Low
4648,Explicit Credential Logon,T1078,Medium
4672,Special Privileges Assigned,T1134,Medium
4688,New Process Created,T1059,Informational
4698,Scheduled Task Created,T1053.005,Medium
4720,User Account Created,T1136.001,High
4732,Member Added to Security Group,T1098,High
4768,Kerberos TGT Requested,T1558,Informational
4769,Kerberos Service Ticket,T1558.003,Low
4771,Kerberos Pre-Auth Failed,T1110,Low

Key Concepts

| Term | Definition | |------|-----------| | EventCode 4624 | Successful logon event — Logon_Type 2 (interactive), 3 (network), 10 (RDP), 7 (unlock) | | EventCode 4625 | Failed logon event — Status code indicates failure reason (bad password, account locked, disabled) | | Sysmon EventCode 1 | Process creation with full command line, parent process, and hash information | | Sysmon EventCode 3 | Network connection initiated by a process — source/dest IP, port, and process context | | Logon Type 3 | Network logon (SMB, WMI, PowerShell Remoting) — key indicator of lateral movement | | Logon Type 10 | Remote interactive logon via RDP/Terminal Services |

Tools & Systems

Splunk Enterprise: SIEM platform with SPL query engine for Windows event log analysis and correlation
Sysmon (System Monitor): Microsoft Sysinternals tool providing detailed process, network, and file activity logging
Splunk CIM: Common Information Model mapping Windows events to normalized fields for cross-source queries
Windows Event Forwarding (WEF): Built-in Windows mechanism for centralizing event logs to a collector server

Common Scenarios

Kerberoasting (T1558.003): Detect EventCode 4769 with encryption type 0x17 (RC4) for non-standard service accounts
DCSync (T1003.006): Detect EventCode 4662 with DS-Replication-Get-Changes from non-DC sources
Golden Ticket (T1558.001): Detect EventCode 4769 with abnormal ticket properties (long lifetime, non-standard encryption)
Pass-the-Hash (T1550.002): Detect EventCode 4624 Logon_Type 3 with NTLM authentication from unexpected sources
DLL Side-Loading (T1574.002): Sysmon EventCode 7 showing unsigned DLLs loaded by legitimate processes

Output Format

WINDOWS EVENT LOG ANALYSIS — HOST: WORKSTATION-042
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Period:     2024-03-14 to 2024-03-15
Events:     12,847 total (Security: 9,231 | Sysmon: 3,616)

Authentication Summary:
  Successful Logons (4624):    487 (Type 3: 312, Type 10: 45, Type 2: 130)
  Failed Logons (4625):        847 (from 192.168.1.105 — BRUTE FORCE)
  Explicit Creds (4648):       12

Suspicious Findings:
  [HIGH]   847 failed logons followed by success at 14:35 from 192.168.1.105
  [HIGH]   New user "backdoor_admin" created (4720) at 14:38
  [HIGH]   User added to Administrators group (4732) at 14:38
  [MEDIUM] schtasks.exe creating persistence task at 14:42
  [MEDIUM] PowerShell encoded command execution at 14:45

ATT&CK Mapping:
  T1110.001 — Password Guessing (847 failed logons)
  T1136.001 — Local Account Creation (backdoor_admin)
  T1053.005 — Scheduled Task (persistence)
  T1059.001 — PowerShell (encoded execution)

Illustrative Want to see what analyzing-windows-event-logs-in-splunk would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

7/28/2026, 00:09 UTC · 23 cases

Lift

+52%

52% vs 0%

Agent turns

1.0 vs 1.0

Tokens

+92%

5,324.35 vs 2,771.57

fail → pass · 12fail → fail · 11

Per-case results (23)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-12 We suspect LSASS memory scraping on our Windows endpoints. Build a Splunk Sysmon query using EventCode 10 targeting LSASS process access. What GrantedAccess masks indicate dangerous access, and which common processes should be excluded?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-08 Construct a Splunk SPL search for Windows EventCode 4625 to flag password spraying across multiple user accounts within 10-minute windows. We are deciding between checking for 5 unique users or a different threshold, and how to set confidence.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-04 We need to investigate unauthorized sudo access on our Ubuntu server (host: ip-10-0-1-45). Write a query to analyze /var/log/auth.log or Linux auditd events in Splunk for repeated sudo failures.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-02 I am triaging potential lateral movement on server FIN-DC-02 for the period of 2024-06-01 to 2024-06-02. Please review the Windows Security and Sysmon event telemetry in Splunk and compile a summary. I need the response formatted with the target host header and date range, total log counts split by source type, an authentication statistics breakdown (including logon types and failure counts), high/medium severity security findings, and MITRE ATT&CK tactic/technique mappings for any suspicious behaviors.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-10 Create a Splunk SPL search to detect when a new local user account is created on Windows and subsequently added to the Administrators group. Should we use EventCode 4720 alone or join with another event?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-01 We had an alert trigger for host WORKSTATION-088 showing failed logons and potential persistence setup between 2024-05-10 and 2024-05-11. Please analyze the ingested Splunk Security and Sysmon logs for this endpoint and generate a full investigation report. The output should follow the standard structure: a header block with host name, period, and total event count broken down by log source; an Authentication Summary showing successful logons by type, failed logons, and explicit credentials; a list of Suspicious Findings rated by severity; and a section mapping detected activities to ATT&CK techniques.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-05 We are investigating potential IP port scanning activity across our Palo Alto perimeter firewall logs in Splunk (`sourcetype=pan:traffic`). Construct an SPL query to detect network sweeps.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-09 We need an SPL query in Splunk that identifies hosts where an external source IP had more than 10 failed logon attempts followed by at least one successful logon. We want to exclude local loopback activity.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-23 We want to enrich Windows Event Log data in Splunk using a lookup file windows_eventcode_lookup.csv. What fields should be included in this lookup schema, and what ATT&CK technique maps to EventCode 4720?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-16 Create an SPL query to flag potential SMB lateral movement where a user connects to multiple distinct destination machines over network logons.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-06 We need to hunt for persistence mechanisms created via macOS LaunchDaemons using Splunk logs from our Mac fleet (`sourcetype=macOS:UnifiedLog`). Generate the query.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-11 Write an SPL query to monitor Windows EventCode 4672 (Special Privileges Assigned) while filtering out standard system service accounts. Which specific high-risk privileges should be highlighted?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-15 What Sysmon EventCodes should be queried in Splunk to detect WMI Event Consumers and Event Filter bindings used for persistence?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-22 When analyzing Windows EventCode 4625 in Splunk, what do the failure status codes 0xc000006a and 0xc0000234 signify?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-20 Which Windows Security EventCode and specific access right filter should be queried in Splunk to identify potential DCSync domain replication attacks from non-Domain Controller sources?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-14 Draft a Sysmon SPL search for registry modifications (EventCode 13) to detect persistence under startup run keys, while filtering out normal setup utilities.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-19 We want to hunt for Kerberoasting activity in Windows Security logs using Splunk. Which Windows EventCode and ticket encryption type indicate RC4 ticket requests for service accounts?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-13 We want to write a Splunk query that correlates Windows Security EventCode 4698 with Sysmon EventCode 1 process execution for task creation via schtasks.exe. What command line keywords indicate high risk?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-03 Could you run an analysis on Splunk logs for host EXEC-DEV-01 for activity recorded on 2024-07-15? We suspect credential testing followed by a privilege escalation attempt. Give me the results using the standard layout: top host section with execution period and event tallies for Security vs Sysmon, an authentication log breakdown, flagged suspicious findings tagged with severity levels like [HIGH] or [MEDIUM], and a mapped ATT&CK technique breakdown at the bottom.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-07 We want to write a Splunk SPL query to detect brute force attacks against Windows hosts using EventCode 4625. Our analyst wants to group by source IP, logon type, and failure status, but isn't sure how many failed attempts should trigger the alert or how to label Logon_Type 3 vs 10.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-17 Write an SPL search using Sysmon EventCode 1 telemetry to detect execution of PsExec or its lightweight service executable across the domain.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-18 Build a Splunk SPL search targeting Windows Event Log data to detect RDP lateral movement across multiple target workstations.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-21 Write a unified Splunk SPL query that constructs a chronological forensic timeline for host WORKSTATION-042 combining Security log events and Sysmon events, mapping event codes to readable descriptions.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 23 cases were attempted. The headline lift of +52 percentage points is the difference between those two pass rates over the 23 comparable cases.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 0%
Pass rate with the skill: 52.2%
Cases attempted: 23
Cases counted toward lift: 23
Cases that regressed: 0
Skill version measured: v1
Run completed: 7/28/2026, 00:09 UTC

The per-case answers from this run were removed by the retention sweep, so the case table below shows the verdicts without the text either arm produced. The counts above were recorded at the time and are unaffected. Answers are now kept for 180 days.

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run52

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 54 days ago

Other measured skills in the registry, with their headline benchmark lift.