junk/spl
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update splunk_alert.md

Browse Source
This commit is contained in:
junk
2024-12-03 14:29:27 -05:00
parent 8ef4e7b183
commit 5217422b89
1 changed files with 17 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

29
splunk_alert.md
View File

@ -1,23 +1,24 @@
``` ```
index=* RuleName=T* `indextime` `sysmon` RuleName="technique_id=T1027,technique_name=Obfuscated Files or Information"
| eval hash_sha256= lower(hash_sha256), | eval hash_sha256= lower(hash_sha256),
mitre_technique_id="T1543", hunting_trigger="",
mitre_technique="Create or Modify System Process", mitre_category="Defense_Evasion",
mitre_subtechnique_id="T1543.001", mitre_technique="Obfuscated Files or Information",
mitre_subtechnique="Launch Agent", mitre_technique_id="T1027",
mitre_category="Persistence", mitre_subtechnique="",
apt=mvappend("APT28", ""), mitre_subtechnique_id="",
hunting_trigger="Look for unusual modifications to system processes.", apt="",
mitre_link="https://attack.mitre.org/techniques/T1543/", mitre_link="https://attack.mitre.org/techniques/T1027/",
creator="Cpl Iverson", creator="Cpl Iverson",
upload_date="", upload_date="2024/12/03",
last_modify_date="", last_modify_date="2024/12/03",
mitre_version="v16", mitre_version="v16",
priority="High" priority=""
| `process_create_whitelist` | `process_create_whitelist`
| eval indextime = _indextime | eval indextime = _indextime
| convert ctime(indextime) | convert ctime(indextime)
| table _time indextime event_description hash_sha256 host_fqdn user_name original_file_name process_path process_guid process_parent_path process_id process_parent_id process_command_line process_parent_command_line process_parent_guid mitre_category mitre_technique mitre_technique_id mitre_subtechnique_id mitre_subtechnique apt hunting_trigger mitre_link upload_date last_modify_date mitre_version priority | table _time indextime event_description hash_sha256 host_fqdn user_name original_file_name process_path process_guid process_parent_path process_id process_parent_id process_command_line process_parent_command_line process_parent_guid mitre_category mitre_technique mitre_technique_id mitre_subtechnique_id mitre_subtechnique apt hunting_trigger mitre_link upload_date last_modify_date mitre_version priority
| collect `jarvis_index`
``` ```
# Permissions # Permissions
@ -32,3 +33,7 @@ priority="High"
- Schedule Priority: Default - Schedule Priority: Default
- Schedule Window: Auto - Schedule Window: Auto
# Macros
- jarvis_index: index=jarvis
- indextime: _index_earliest=-15m@m AND _index_latest=now