9. Detection_EventIDs_Splunk

1. BLUF (Bottom Line Up Front)

This reference maps every recon technique from Scenarios 1–4 to its corresponding Windows Event IDs, Sysmon IDs, network-layer indicators, and Splunk detection queries. Use this as a cross-reference when building detections or validating that your pentest activity is (or isn't) being logged.

2. Architecture

graph TB
    subgraph "Recon Activity"
        EXT["Scenario 1
External Scan"]
        INT["Scenario 2
Internal No-Creds"]
        AUTH["Scenario 3
Authenticated Pivot"]
        C2["Scenario 4
C2 SOCKS"]
    end

    subgraph "Detection Sources"
        FW["Firewall Logs"]
        IDS["IDS/IPS
Suricata / Snort"]
        SIEM["SIEM
Splunk / Sentinel"]
        EDR["EDR
Defender / CrowdStrike"]
        DC["Domain Controller
Windows Event Logs"]
        SYSMON["Sysmon"]
    end

    EXT --> FW
    EXT --> IDS
    INT --> IDS
    INT --> DC
    INT --> SYSMON
    AUTH --> DC
    AUTH --> EDR
    AUTH --> SYSMON
    C2 --> IDS
    C2 --> EDR
    C2 --> FW

    FW --> SIEM
    IDS --> SIEM
    EDR --> SIEM
    DC --> SIEM
    SYSMON --> SIEM

    style SIEM fill:#ff9999
    style EDR fill:#99ccff
    style DC fill:#ccffcc

3. Event ID Reference by Technique

Port Scanning (Scenarios 1, 2, 3)

SMB / Null Session Enumeration (Scenario 2)

LDAP / AD Enumeration (Scenario 2)

DNS Enumeration (Scenarios 1, 2)

Kerberos Activity (Scenario 2)

LLMNR / NBT-NS / Responder (Scenario 2)

SSH / Tunnel / Pivot Activity (Scenarios 3, 4)

Service Enumeration / Banner Grabbing (Scenarios 1, 2, 3)

4. Splunk Detection Queries

Port Scan Detection

// Detect horizontal port scan (one source → many dest ports)
index=firewall OR index=sysmon sourcetype=WinEventLog:Security EventCode=5156
| stats dc(dest_port) as unique_ports, count as total_conns by src_ip
| where unique_ports > 20 AND total_conns > 50
| sort -unique_ports
| table src_ip, unique_ports, total_conns

// Detect vertical scan (one source → many hosts, same port)
index=firewall OR index=sysmon sourcetype=WinEventLog:Security EventCode=5156
| stats dc(dest_ip) as unique_hosts by src_ip, dest_port
| where unique_hosts > 10
| sort -unique_hosts
| table src_ip, dest_port, unique_hosts

// Detect slow/distributed scan (GHOST tier — expand time window)
index=firewall OR index=sysmon sourcetype=WinEventLog:Security
  (EventCode=5156 OR EventCode=5157)
| bucket _time span=1h
| stats dc(dest_port) as unique_ports, count(eval(EventCode=5157)) as blocked by src_ip, _time
| where unique_ports > 5
| streamstats sum(unique_ports) as cumulative_ports by src_ip
| where cumulative_ports > 30
| table _time, src_ip, unique_ports, cumulative_ports, blocked

Failed Connection Ratio (Best Scan Indicator)

// High failed-to-successful connection ratio = scan
index=firewall action IN ("allowed", "blocked", "denied", "drop")
| eval success=if(action="allowed",1,0), fail=if(action!="allowed",1,0)
| stats sum(success) as successes, sum(fail) as failures, dc(dest_port) as unique_ports by src_ip
| eval fail_ratio=round(failures/(successes+failures)*100,1)
| where fail_ratio > 70 AND unique_ports > 10
| sort -fail_ratio
| table src_ip, successes, failures, fail_ratio, unique_ports

SMB Null Session / Anonymous Access

// Detect anonymous/null SMB logon attempts
index=wineventlog sourcetype=WinEventLog:Security EventCode=4624 Logon_Type=3
  (TargetUserName="ANONYMOUS LOGON" OR TargetUserName="Guest" OR TargetUserName="")
| stats count by src_ip, TargetUserName, TargetDomainName, ComputerName
| where count > 3
| table src_ip, TargetUserName, ComputerName, count

// IPC$ share access (null session enumeration)
index=wineventlog sourcetype=WinEventLog:Security EventCode=5140 ShareName="\\\\*\\IPC$"
  SubjectUserName="ANONYMOUS LOGON"
| stats count by IpAddress, ShareName, SubjectUserName
| table IpAddress, ShareName, count

LDAP Enumeration

// Large LDAP queries (requires Event ID 1644 enabled on DC)
index=wineventlog sourcetype=WinEventLog:Directory\ Service EventCode=1644
| where SearchTimeInMs > 1000 OR EntriesReturned > 100
| stats count, avg(EntriesReturned) as avg_entries by ClientIP, Filter
| sort -avg_entries
| table ClientIP, Filter, count, avg_entries

// Bulk AD object reads
index=wineventlog sourcetype=WinEventLog:Security EventCode=4662
| stats dc(ObjectName) as unique_objects by SubjectUserName, SubjectIP
| where unique_objects > 50
| sort -unique_objects
| table SubjectUserName, SubjectIP, unique_objects

Kerberos Enumeration

// AS-REP Roasting / User enumeration (4768 with failure)
index=wineventlog sourcetype=WinEventLog:Security EventCode=4768 Status!=0x0
| stats count by IpAddress, TargetUserName, Status
| where count > 10
| sort -count
| table IpAddress, TargetUserName, Status, count

// Kerberoasting (TGS requests for service accounts)
index=wineventlog sourcetype=WinEventLog:Security EventCode=4769
  TicketEncryptionType=0x17
| stats dc(ServiceName) as unique_spns, count by IpAddress, TargetUserName
| where unique_spns > 3
| sort -unique_spns
| table IpAddress, TargetUserName, unique_spns, count

// Password spray (many failed pre-auths in short window)
index=wineventlog sourcetype=WinEventLog:Security EventCode=4771
| bucket _time span=10m
| stats dc(TargetUserName) as unique_users, count by IpAddress, _time
| where unique_users > 5
| sort -unique_users
| table _time, IpAddress, unique_users, count

LLMNR / Responder Detection

// Unexpected LLMNR responses (Responder spoofing)
index=sysmon EventCode=3 DestPort=5355 Initiated=false
| stats count by SourceIp, DestIp
| where count > 5
| table SourceIp, DestIp, count

// IDS alert for Responder
index=ids_alerts alert_signature="*LLMNR*" OR alert_signature="*NBT-NS*" OR alert_signature="*Responder*"
| stats count by src_ip, alert_signature
| table src_ip, alert_signature, count

Tunnel / C2 / Pivot Detection

// Long-lived outbound connections (tunnels)
index=sysmon EventCode=3 Initiated=true
| eval duration=round((_time - strptime(UtcTime,"%Y-%m-%d %H:%M:%S.%3N"))/60,0)
| where duration > 30
| stats count, values(DestPort) as ports by SourceIp, DestIp, Image
| table Image, SourceIp, DestIp, ports, count

// Suspicious process creating outbound connections (Chisel, Ligolo, SSH tunnels)
index=sysmon EventCode=1
  (Image="*chisel*" OR Image="*ligolo*" OR Image="*agent*" OR CommandLine="*ssh*-D*" OR CommandLine="*socks*")
| stats count by Image, CommandLine, User, ComputerName
| table ComputerName, User, Image, CommandLine

// DNS tunneling / high DNS query volume
index=sysmon EventCode=22
| stats dc(QueryName) as unique_queries, count by Image, SourceIp
| where unique_queries > 500
| sort -unique_queries
| table Image, SourceIp, unique_queries, count

Web Directory Enumeration

// Brute-force directory enumeration (high 404/403 rate)
index=web sourcetype=access_combined
| stats count(eval(status=404)) as c404, count(eval(status=403)) as c403, count as total by clientip
| eval error_ratio=round((c404+c403)/total*100,1)
| where error_ratio > 80 AND total > 50
| sort -total
| table clientip, total, c404, c403, error_ratio

5. Quick Reference: Sysmon Event IDs for Recon

6. Enable Enhanced Logging (Prerequisites)

Not all Event IDs fire by default. Key GPO/registry settings to enable: