UserIdentity: CrowdStrike Event That Maps UserSid to UserName

What it records

UserIdentity describes an account that logged on to a host: its name (UserName), SID (UserSid), domain (LogonDomain), principal name (UserPrincipal), the server that authenticated it (LogonServer) and how — AuthenticationPackage, such as Kerberos or NTLM, and LogonType. It adds facts about the account itself: UserIsAdmin for administrator rights on the host, PasswordLastSet, and UserFlags, whose LOGON_PKINIT value marks a certificate-based Kerberos logon such as a smart card.

According to Panther’s schema the sensor normally sends it about once per account rather than at every logon, which makes it a reference record. That matters because other events name the user only by SID: ProcessRollup2 carries UserSid, and CrowdStrike’s ProcessRollup2 curation query notes that the user name is not in those records when they come through Falcon Data Replicator. UserIdentity (together with UserLogon) is how CrowdStrike’s own queries — that curation query and its join example — turn those SIDs into names.

When it matters

• Naming the user behind a process. In exported Falcon data, a suspicious command line comes with a SID. Joining UserIdentity on aid and UserSid gives the account, domain and principal name you need for the report and for disabling the account.
• New administrators. An account appearing with UserIsAdmin 1 on hosts where it never had administrator rights is worth asking about.
• NTLM where Kerberos is expected. Domain accounts that authenticate with NTLM on hosts that normally use Kerberos can be older software, or credentials used in ways Kerberos would not allow; either way it is a list worth having when hardening.

How to investigate

1. Build a SID-to-name table per host from UserIdentity, leaving out machine accounts and Windows session accounts.
2. Join it to the events you are investigating on aid and UserSid.
3. For an account of interest, review LogonServer, AuthenticationPackage and UserIsAdmin across hosts, then its logons and failed logons.

PowerShell executions with the account name added from UserIdentity, in Falcon’s event search:

#event_simpleName=ProcessRollup2 event_platform=Win ImageFileName=/\\powershell\.exe$/i
| join({#event_simpleName=UserIdentity}, field=[aid, UserSid], include=[UserName, LogonDomain], mode=left)
| groupBy([aid, UserSid, UserName, LogonDomain], function=count(as=Executions), limit=max)
| sort(Executions, order=desc)

Accounts seen authenticating with NTLM, by number of hosts:

#event_simpleName=UserIdentity event_platform=Win
| AuthenticationPackage=/ntlm/i
| UserName!=/(\$$|^DWM-|^UMFD-)/
| groupBy([UserName, LogonDomain, LogonServer], function=count(aid, distinct=true, as=Hosts), limit=max)
| sort(Hosts, order=desc)

A SID-to-name table over Falcon Data Replicator data in Splunk (add your index):

sourcetype="crowdstrike:events:sensor" event_simpleName=UserIdentity
| stats latest(UserName) AS LastName, latest(LogonDomain) AS Domain, values(AuthenticationPackage) AS Packages by aid, UserSid

The CrowdStrike field reference covers the export format itself.