Host Software Skill

host-software.md

argument-hint	<hostname> [days=7]
allowed-tools	Bash Read Write

Host Software -- Infer Running Software from Sysmon

Query Splunk for Sysmon process creation, image load, driver load, network connection, and DNS query logs on a host, then categorize all running software.

Input

$ARGUMENTS contains the hostname (Sysmon Computer field). Optionally includes days=N to set the lookback window (default: 7).

If no hostname is provided, ask the user for one.

Configuration

SPLUNK_URL  -- from environment variable $SPLUNK_URL
SPLUNK_TOKEN -- from environment variable $SPLUNK_TOKEN
VAULT=Obsidian Vault

Workflow

Target: 4 Splunk calls (parallel where possible), 1 Obsidian write.

Step 1 -- Query process creations (EventCode=1)

Every process that ran on the host -- the backbone of the inventory.

curl -s -k \
  -H "Authorization: Bearer $SPLUNK_TOKEN" \
  -d "search=search index=sysmon Computer=\"<HOST>*\" EventCode=1 | stats count values(User) as users latest(_time) as last_seen earliest(_time) as first_seen by Image | sort -count" \
  -d "output_mode=json" \
  -d "exec_mode=oneshot" \
  -d "earliest_time=-<DAYS>d" \
  -d "latest_time=now" \
  "$SPLUNK_URL/services/search/jobs/export" > /tmp/host_procs.json

Step 2 -- Query image loads (EventCode=7) -- framework DLLs only

Only pull DLL loads that match known framework indicators. This avoids scanning millions of generic DLL events.

curl -s -k \
  -H "Authorization: Bearer $SPLUNK_TOKEN" \
  -d "search=search index=sysmon Computer=\"<HOST>*\" EventCode=7 (ImageLoaded=\"*clr.dll\" OR ImageLoaded=\"*clrjit.dll\" OR ImageLoaded=\"*coreclr.dll\" OR ImageLoaded=\"*mscorlib.ni.dll\" OR ImageLoaded=\"*jvm.dll\" OR ImageLoaded=\"*java.dll\" OR ImageLoaded=\"*python3*.dll\" OR ImageLoaded=\"*libnode.dll\" OR ImageLoaded=\"*v8.dll\" OR ImageLoaded=\"*electron.dll\" OR ImageLoaded=\"*rustc_driver*.dll\" OR ImageLoaded=\"*libgo*.dll\") | stats count by Image ImageLoaded" \
  -d "output_mode=json" \
  -d "exec_mode=oneshot" \
  -d "earliest_time=-<DAYS>d" \
  -d "latest_time=now" \
  "$SPLUNK_URL/services/search/jobs/export" > /tmp/host_imageloads.json

Step 3 -- Query driver loads (EventCode=6)

Kernel drivers -- reveals security products, VPN, virtualization, and hardware-level software.

curl -s -k \
  -H "Authorization: Bearer $SPLUNK_TOKEN" \
  -d "search=search index=sysmon Computer=\"<HOST>*\" EventCode=6 | stats count latest(_time) as last_seen values(Signature) as signatures values(SignatureStatus) as sig_status by ImageLoaded | sort -count" \
  -d "output_mode=json" \
  -d "exec_mode=oneshot" \
  -d "earliest_time=-<DAYS>d" \
  -d "latest_time=now" \
  "$SPLUNK_URL/services/search/jobs/export" > /tmp/host_drivers.json

Step 4 -- Query network connections + DNS (EventCode=3 OR EventCode=22)

Network-active processes and what domains they resolve -- reveals software phoning home for updates and telemetry.

curl -s -k \
  -H "Authorization: Bearer $SPLUNK_TOKEN" \
  -d "search=search index=sysmon Computer=\"<HOST>*\" (EventCode=3 OR EventCode=22) | eval activity=if(EventCode=3, \"connect\", \"dns\") | stats count dc(DestinationIp) as unique_destinations by Image activity | sort -count" \
  -d "output_mode=json" \
  -d "exec_mode=oneshot" \
  -d "earliest_time=-<DAYS>d" \
  -d "latest_time=now" \
  "$SPLUNK_URL/services/search/jobs/export" > /tmp/host_network.json

Replace <HOST> with the hostname and <DAYS> with the lookback window in all queries.

Run all 4 curl commands in parallel (they are independent).

Step 5 -- Parse results

Read all four NDJSON files. Each line is a JSON object -- extract result from each.

From process data (EC=1): Build a list of every unique Image path with count, users, parent processes, first/last seen.

From image loads (EC=7): For each process, extract the DLLs it loaded. Look for these framework indicators:

DLL Pattern	Indicates
clr.dll, clrjit.dll, mscorlib.ni.dll, coreclr.dll	.NET runtime
jvm.dll, java.dll	Java runtime
python3*.dll, python*.dll	Python runtime
libnode.dll, v8.dll, electron.dll	Node.js / Electron
rustc_driver*.dll	Rust toolchain
libgo*.dll	Go runtime

From driver loads (EC=6): List all kernel drivers with their signatures. Group by vendor/product:

• Security drivers (WdFilter, csagent, cbk*, etc.)
• VPN drivers (tap-windows, virtual adapter)
• Virtualization (vmci, vmhgfs, VBoxGuest)
• Storage/filesystem filters
• Unsigned or revoked drivers (check SignatureStatus)

From network/DNS data (EC=3 + EC=22): Map each process to its network connections and DNS queries. Use domain patterns to help identify software:

• *update*, *telemetry*, *download* domains -> confirms software identity
• Cloud service domains (googleapis.com, azure.com, amazonaws.com) -> cloud tooling

Merge all four datasets by Image path to build a complete profile per executable.

Step 6 -- Categorize and analyze

Ignore OS built-ins (svchost, csrss, lsass, dwm, smss, wininit, services, spoolsv, SearchIndexer, rundll32, WmiPrvSE, backgroundTaskHost, CompatTelRunner, SystemSettings, etc.) and security tools (MsMpEng, MpDefenderCoreService, WdFilter, CrowdStrike, Splunk forwarder, carbon black, sentinel, osquery, etc.). Only categorize third-party software.

Use both the executable name/path and the DLLs it loaded for more accurate classification:

Category	What belongs here
Browser	Web browsers (chrome, firefox, msedge, brave, iexplore, etc.)
Office & Productivity	Document editors, email, collaboration, password managers (WINWORD, EXCEL, OUTLOOK, POWERPNT, Teams, OneDrive, KeePass, etc.)
Development	IDEs, compilers, runtimes, package managers, containers (code.exe, devenv, python, node, git, docker, java, dotnet, etc.). Use DLL evidence: if a generic .exe loads clr.dll -> .NET app, jvm.dll -> Java app, python3*.dll -> Python app.
Remote Access	RDP, SSH, VPN, remote admin (mstsc, ssh, vpn clients, AnyDesk, TeamViewer, etc.). Corroborate with VPN kernel drivers.
Communication	Chat, video, messaging (slack, zoom, discord, signal, etc.)
File Sharing	Torrent clients, file sync, cloud storage clients (qbittorrent, transmission, rclone, megasync, syncthing, etc.)
Unknown	Anything third-party you can't confidently categorize

Step 7 -- Write Obsidian note

Note name: Host Software -- <HOSTNAME>

Structure:

---
host: <HOSTNAME>
scan_date: <YYYY-MM-DD>
time_range: <DAYS>d
total_unique_executables: <N>
total_process_events: <N>
network_active_processes: <N>
unique_drivers: <N>
---

# Host Software -- <HOSTNAME>

> [!info] Scan Summary
> **Host:** `<HOSTNAME>`
> **Period:** last <DAYS> days
> **Unique executables:** <N>
> **Total process creations:** <N>
> **Network-active processes:** <N>
> **Unique DLLs observed:** <N>
> **Kernel drivers loaded:** <N>

## Software Inventory

(one section per non-empty category -- skip categories with zero entries, skip OS and security binaries)

### Browser (<count>)

| Executable | Executions | Users | Frameworks | Network | Last Seen |
|-----------|-----------|-------|------------|---------|-----------|
| msedge.exe | 5 | Administrator | -- | 2 connect | 2026-03-22 |

(repeat for each non-empty category)

## Frameworks & Runtimes

Summary of runtime environments detected via DLL analysis:

| Framework | Processes Using It | Examples |
|-----------|-------------------|----------|
| .NET CLR | 12 | powershell.exe, svchost.exe, custom-app.exe |
| Java JVM | 3 | java.exe, javaw.exe |
| Python | 2 | python.exe, custom-tool.exe |
| Electron/Node | 4 | code.exe, slack.exe, teams.exe, discord.exe |

## Kernel Drivers

| Driver | Vendor (Signature) | Status | Loads | Last Seen |
|--------|-------------------|--------|-------|-----------|
| WdFilter.sys | Microsoft | Valid | 1 | 2026-03-22 |
| csagent.sys | CrowdStrike | Valid | 1 | 2026-03-22 |

(flag any with Status != Valid using bold/warning)

## Network Activity

Top 20 processes by unique destination count:

| Executable | Connections | Unique Destinations | Ports | Top DNS Queries |
|-----------|-------------|-------------------|-------|-----------------|

Write via single obsidian call:

obsidian create vault="{VAULT}" name="Host Software -- {HOSTNAME}" overwrite content="..."

Use > [!success] callout style if the scan completed with results, > [!warning] if zero process events found, > [!failure] for errors.

Step 8 -- Summary

Report to the user:

• Hostname and scan period
• Total unique executables, DLLs, and drivers
• Frameworks detected (one line, e.g. ".NET (12 procs) | Java (3) | Electron (4)")
• Count per software category (one line, e.g. "OS: 45 | Security: 8 | Browser: 3 | Dev: 12 | ...")
• Confirm note written to Obsidian