Splunk Search

Translate Windows security descriptor to readable format

coenvandijk
Observer

Im working on using Splunk for Windows auditing. In events 4670, 4656 and 4663 one (or more) security descriptors are present.

These descriptors are very cryptic and look like D:(A;;GA;;;SY)(A;;RC;;;OW)(A;;GA;;;S-1-5-86-615999462-62705297-2911207457-59056572-3668589837)

I want to translate these (either at index, parse or searchtie) to a reable format. Is this possible? If so, how can I do this?

Thanks in advance,
Coen

Tags (1)
0 Karma

wenthold
Communicator

I think what you would wind up doing is breaking out each ACE and creating lookups for each of the different components. I think the quickest approach would be to extract each ACE, which will lead to the ACE field often being a multivalue field. Then use mvexpand which will then allow lookups against each of the ACE components. There number of ACEs in a security descriptor is variable, doing this in search is going to be somewhat complex.

Here's a link to a good breakdown of how each ACE is constructed and what the strings mean:

ACE strings on MSDN

Linked in the ACE strings page but easy to miss: ACE SID strings

And here's a decent (but old) blog post on deciphering security descriptors in this format that ties it all together:

MS SDD blog post

0 Karma

coenvandijk
Observer

Thank your the answer.

I was allready afraid that I would need to do something like this. It would have been nice if the Splunk Windows TA would already do this automagically

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...