Files a user uploaded to a network file share – Splunk Lantern

You might need to find all files a user uploaded to a network file share when doing the following:

Investigating a ransomware attack

Prerequisites

In order to execute this procedure in your environment, you may need to first on-board the data, services, or apps shown in the following table.

Category	Name	Importance
Data	Operating system event data	Required

Example

The purpose of this example is to show you how this procedure works in a general environment. In your environment, you can optimize the search by specifying an index, a time range, or a different data source.

A user reports a ransomware attack on their machine. The user put a number of files on a network file share after the attack. You need to determine how many PDFs on the file share were encrypted as part of the attack.

Run the following search:

sourcetype=*win* pdf dest=<hostname of fileshare> Source_address=<IP address of infected system>
|stats dc(TargetFilename)

Search Explanation

The table provides an explanation of what each part of this search achieves. You can adjust this query based on the specifics of your environment.

Splunk Search	Explanation
sourcetype=win	Search only Windows event logs.
pdf	Search for all files of a certain type (.pdf in this example) on the file share.
dest=<hostname of fileshare>	Search the affected system, in this case, a file share on the network. Tip: Logs vary in the information they contain. Not all logs have hostnames or IP addresses. Sometimes the dest field will have a hostname in it but sometimes it will have an IP address. Parentheses and OR statements will broaden your search so you don’t miss anything. Example: (dest="192.0.2.0" OR dest_ip="192.0.2.0") Example: (dest="192.0.2.0" OR dest="example.com")
Source_address=<IP address of infected system>	Search for files that came from the infected system.
\|stats dc(TargetFilename)	Provide a distinct count of the number of affected files.

Result

Without the stats command, the search returns an event log for each PDF on the file share that was encrypted by the ransomware. The stats command provides a total count.

Prerequisites

Example

Search Explanation

Result

Related articles