junk/spl
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update splunk-magic-hound.md

Browse Source
This commit is contained in:
junk
2025-01-08 20:33:18 -05:00
parent 835d115a18
commit ebd206dcd7
1 changed files with 3 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
splunk-magic-hound.txt → splunk-magic-hound.md
View File

@ -1,4 +1,6 @@
```check against powershell /c "Get-PhysicalDisk | Select-Object DeviceID, MediaType, Size, FriendlyName"``` ```check against powershell /c "Get-PhysicalDisk | Select-Object DeviceID, MediaType, Size, FriendlyName"```
```
`indextime` (`sysmon` OR `windows`) AND "powershell /c "Get-PhysicalDisk" `indextime` (`sysmon` OR `windows`) AND "powershell /c "Get-PhysicalDisk"
| eval hash_sha256= lower(hash_sha256), | eval hash_sha256= lower(hash_sha256),
hunting_trigger="Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.", hunting_trigger="Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.",
@ -19,6 +21,7 @@ priority=""
| convert ctime(indextime) | convert ctime(indextime)
| table _time indextime event_description hash_sha256 host_fqdn user_name original_file_name process_path process_guid process_parent_path process_id process_parent_id process_command_line process_parent_command_line process_parent_guid mitre_category mitre_technique mitre_technique_id hunting_trigger mitre_subtechnique mitre_subtechnique_id apt mitre_link creator upload_date last_modify_date mitre_version priority | table _time indextime event_description hash_sha256 host_fqdn user_name original_file_name process_path process_guid process_parent_path process_id process_parent_id process_command_line process_parent_command_line process_parent_guid mitre_category mitre_technique mitre_technique_id hunting_trigger mitre_subtechnique mitre_subtechnique_id apt mitre_link creator upload_date last_modify_date mitre_version priority
| collect `jarvis_index` | collect `jarvis_index`
```
`indextime` (`sysmon` OR `windows`) AND ('powershell.exe /c "Set-MpPreference -DisableRealtimeMonitoring $true"' OR 'powershell.exe /c "Set-Service -Name windefend -StartupType Disabled"' OR 'powershell.exe /c "Stop-Service -Name windefend"') `indextime` (`sysmon` OR `windows`) AND ('powershell.exe /c "Set-MpPreference -DisableRealtimeMonitoring $true"' OR 'powershell.exe /c "Set-Service -Name windefend -StartupType Disabled"' OR 'powershell.exe /c "Stop-Service -Name windefend"')
| eval hash_sha256= lower(hash_sha256), | eval hash_sha256= lower(hash_sha256),