✄𐘗
text code block:
✄𐘗FROM logs-system.security-* METADATA _id, _index, _version
| WHERE event.code == "4887" AND
    winlog.event_data.Requester LIKE "*$" AND
    winlog.event_data.Attributes IS NOT NULL

// Parse Attributes for RMD and CDC, and as a fallback when dedicated template or SAN fields are absent.
// CDC and the effective template are retained for triage purposes
| GROK winlog.event_data.Attributes
    """(?im)^[ \t]*CertificateTemplate[ \t]*:[ \t]*(?<Esql.attributes_certificate_template>[^\r\n]+)\r?$"""
| GROK winlog.event_data.Attributes
    """(?im)^[ \t]*SAN[ \t]*:[ \t]*dns[ \t]*=[ \t]*(?<Esql.attributes_san_value>[^\r\n]+)\r?$"""
| GROK winlog.event_data.SubjectAlternativeName
    """(?im)^[ \t]*DNS[ \t]+Name[ \t]*=[ \t]*(?<Esql.event_san_value>[^\r\n]+)\r?$"""
| GROK winlog.event_data.Attributes
    """(?im)^[ \t]*cdc[ \t]*:[ \t]*(?<Esql.cdc_value>[^\r\n]+)\r?$"""
| GROK winlog.event_data.Attributes
    """(?im)^[ \t]*rmd[ \t]*:[ \t]*(?<Esql.rmd_value>[^\r\n]+)\r?$"""
| EVAL Esql.effective_certificate_template = TRIM(COALESCE(
         winlog.event_data.CertificateTemplate,
         Esql.attributes_certificate_template
       )),
       Esql.san_value = TRIM(COALESCE(Esql.event_san_value, Esql.attributes_san_value)),
       Esql.cdc_value = TRIM(Esql.cdc_value),
       Esql.rmd_value = TRIM(Esql.rmd_value),
       Esql.normalized_requester = TO_LOWER(
         REPLACE(winlog.event_data.Requester, """^.*\\|\$$""", "")
       ),
       Esql.normalized_san_value = TO_LOWER(
         REPLACE(Esql.san_value, """\.$""", "")
       ),
       Esql.normalized_rmd_value = TO_LOWER(
         REPLACE(Esql.rmd_value, """\.$""", "")
       )
// Preserve IP-shaped values; shorten other SAN and RMD values to the first DNS label for machine-account comparison.
| EVAL Esql.san_is_ip_shaped =
          Esql.normalized_san_value RLIKE """[0-9]{1,3}(\.[0-9]{1,3}){3}""" OR Esql.normalized_san_value LIKE "*:*",
       Esql.rmd_is_ip_shaped =
          Esql.normalized_rmd_value RLIKE """[0-9]{1,3}(\.[0-9]{1,3}){3}""" OR Esql.normalized_rmd_value LIKE "*:*"
| EVAL Esql.normalized_san_target = CASE(
         Esql.san_is_ip_shaped,
         Esql.normalized_san_value,
         REPLACE(Esql.normalized_san_value, """\..*$""", "")
       ),
       Esql.normalized_rmd_target = CASE(
         Esql.rmd_is_ip_shaped,
         Esql.normalized_rmd_value,
         REPLACE(Esql.normalized_rmd_value, """\..*$""", "")
       )
| WHERE Esql.normalized_requester IS NOT NULL AND
    Esql.normalized_san_target IS NOT NULL AND
    Esql.normalized_rmd_target IS NOT NULL
| WHERE Esql.normalized_requester != Esql.normalized_rmd_target AND
    Esql.normalized_san_target == Esql.normalized_rmd_target
| KEEP @timestamp, _id, _index, _version, event.code, event.action, event.category, event.type, event.outcome,
    event.created, event.ingested, data_stream.dataset, data_stream.namespace, host.id, host.name,
    winlog.computer_name, winlog.record_id, winlog.event_data.RequestId, winlog.event_data.Requester,
    winlog.event_data.CertificateTemplate, winlog.event_data.Subject, winlog.event_data.SubjectAlternativeName,
    winlog.event_data.Attributes, winlog.event_data.Disposition, winlog.event_data.SubjectKeyIdentifier,
    Esql.effective_certificate_template, Esql.san_value, Esql.cdc_value, Esql.rmd_value,
    Esql.normalized_requester, Esql.normalized_san_target, Esql.normalized_rmd_target