junk/spl
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update splunk/rules_to_add_to_github.md

Browse Source
This commit is contained in:
junk
2025-04-15 15:24:02 -04:00
parent a7c138fcf8
commit e1a8b41062
1 changed files with 6 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
splunk/rules_to_add_to_github.md
View File

@ -10,7 +10,7 @@ mitre_technique_id="T0000",
mitre_subtechnique="",
mitre_subtechnique_id="",
apt="Volt Typhoon",
mitre_link="https://attack.mitre.org/techniques/T1071/",
mitre_link="",
creator="Cpl Iverson",
last_tested="2025-04-15",
upload_date="2025-04-15",
@ -20,7 +20,7 @@ priority="high"
| `process_create_whitelist`
| eval indextime = _indextime
| convert ctime(indextime)
| table _time indextime event_description hash_sha256 host_fqdn user_name original_file_name process_path process_guid process_parent_path process_id process_parent_id process_command_line process_parent_command_line process_parent_guid mitre_category mitre_technique mitre_technique_id hunting_trigger mitre_subtechnique mitre_subtechnique_id apt mitre_link creator last_tested upload_date last_modify_date mitre_version priority
| table _time indextime id.orig_p id.orig_h id.resp_p id.resp_h mitre_category mitre_technique mitre_technique_id hunting_trigger mitre_subtechnique mitre_subtechnique_id apt mitre_link creator last_tested upload_date last_modify_date mitre_version priority
| collect `jarvis_index`
```
@ -48,7 +48,8 @@ level: medium
ICMPDoor
```
`indextime` sourcetype=zeek* (id.orig_p IN (6000,7000) AND id.resp_p=*) OR (id.resp_p IN (6000,7000) AND id.orig_p=*)
`indextime` sourcetype=zeek*
| where icmp_type=0 OR icmp_type=8
| eval hash_sha256= lower(hash_sha256),
hunting_trigger="Detects FRPC communication using designated ports.",
mitre_category="Command and Control",
@ -59,7 +60,7 @@ mitre_subtechnique_id="",
apt="Volt Typhoon",
mitre_link="https://attack.mitre.org/techniques/T1071/",
creator="Cpl Iverson",
last_tested="2025-04-15",
last_tested="",
upload_date="2025-04-15",
last_modify_date="2025-04-15",
mitre_version="v16.1",
@ -67,7 +68,7 @@ priority="high"
| `process_create_whitelist`
| eval indextime = _indextime
| convert ctime(indextime)
| table _time indextime event_description hash_sha256 host_fqdn user_name original_file_name process_path process_guid process_parent_path process_id process_parent_id process_command_line process_parent_command_line process_parent_guid mitre_category mitre_technique mitre_technique_id hunting_trigger mitre_subtechnique mitre_subtechnique_id apt mitre_link creator last_tested upload_date last_modify_date mitre_version priority
| table _time indextime event_description src_ip dest_ip icmp_type icmp_code mitre_category mitre_technique mitre_technique_id hunting_trigger mitre_subtechnique mitre_subtechnique_id apt mitre_link creator last_tested upload_date last_modify_date mitre_version priority
| collect `jarvis_index`
```