Detection rules › Splunk
Windows Powershell Logoff User via Quser
The following analytic detects the process of logging off a user through the use of the quser and logoff commands. By monitoring for these commands, the analytic identifies actions where a user session is forcibly terminated, which could be part of an administrative task or a potentially unauthorized access attempt. This detection helps identify potential misuse or malicious activity where a user’s access is revoked without proper authorization, providing insight into potential security incidents involving account management or session manipulation.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Execution | T1059.001 Command and Scripting Interpreter: PowerShell |
| Impact | T1531 Account Access Removal |
Event coverage
| Provider | Event ID | Title |
|---|---|---|
| PowerShell | 4104 | Creating Scriptblock text (MessageNumber of MessageTotal). |
Stages and Predicates
Stage 1: search
search EventCode=4104 ScriptBlockText="*quser*logoff*"
Stage 2: fillnull
fillnull
Stage 3: stats
stats BY dest, signature, signature_id, user_id, vendor_product, EventID, Guid, Opcode, Name, Path, ProcessID, ScriptBlockId, ScriptBlockText
Stage 4: search
search
Stage 5: search
search
Stage 6: search
search `macro`
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EventCode | eq |
|
ScriptBlockText | eq |
|
Neighbors
Broader alternatives (more inclusive than this rule)
These rules match a superset of what this rule catches. They cover the same events plus more. Use them if you want wider coverage and can absorb more false positives.
- Potential PowerShell Obfuscation via Invalid Escape Sequences (drops 2 filters this rule applies)
- Potential PowerShell Obfuscation via Backtick-Escaped Variable Expansion (drops 2 filters this rule applies)
- Potential PowerShell Obfuscation via Character Array Reconstruction (drops 2 filters this rule applies)
- Potential PowerShell Obfuscation via Concatenated Dynamic Command Invocation (drops 2 filters this rule applies)
- Potential PowerShell Obfuscation via High Numeric Character Proportion (drops 2 filters this rule applies)
- Potential Dynamic IEX Reconstruction via Environment Variables (drops 2 filters this rule applies)
- Dynamic IEX Reconstruction via Method String Access (drops 2 filters this rule applies)
- PowerShell Obfuscation via Negative Index String Reversal (drops 2 filters this rule applies)
- Potential PowerShell Obfuscation via Reverse Keywords (drops 2 filters this rule applies)
- Potential PowerShell Obfuscation via String Concatenation (drops 2 filters this rule applies)
- Potential PowerShell Obfuscation via String Reordering (drops 2 filters this rule applies)
- Potential PowerShell Obfuscation via Special Character Overuse (drops 2 filters this rule applies)
- PowerShell 4104 Hunting (drops 1 filter this rule applies)