Splunk
index="botsv1" imreallynotbatman.com sourcetype="stream:http"
| stats count(src_ip) as "Source IP" by src_ip
| sort + "Source IP"
index="botsv1" sourcetype="stream:http" status=200 src="40.80.148.42" dest="192.168.250.70" | stats count by uri | sort - count
index="botsv1" sourcetype="suricata" src="40.80.148.42" | search event_type=alert | stats count(alert.signature) as "Alert" by alert.signature | sort - "Alert"
index=botsv1 imreallynotbatman.com sourcetype="stream:http" http_method="POST"
| stats count by src_ip
index=botsv1 imreallynotbatman.com sourcetype="stream:http" http_method="POST" c_ip="40.80.148.42" | stats count by src_headers| sort -count
index=botsv1 imreallynotbatman.com sourcetype="stream:http" http_method="POST" c_ip="40.80.148.42"
| stats count by url
index=botsv1 sourcetype="suricata" src_ip="192.168.250.70" dest_ip="23.22.63.114"
index=botsv1 sourcetype="suricata" src_ip="192.168.250.70" dest_ip="23.22.63.114"
sourcetype="stream:http" imreallynotbatman.com
| regex (passw)
| top limit=20 src_ip
index=botsv1 sourcetype="stream:http" http_method=POST *passwd*
| table form_data
index=botsv1 sourcetype="stream:http" http_method=POST form_data=*username*passwd*
| rex field=form_data "passwd=(?<password>\w+)"
| rex field=form_data "username=(?<user>\w+)"
| table _time, password, user
| sort by _time
index=botsv1 sourcetype=stream:http dest="192.168.250.70" "multipart/form-data" | stats count by part_filename{}
index=botsv1 3791.exe
| stats count by sourcetype
index=botsv1 3791.exe sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational"
| stats values(process_name) by MD5
index="botsv1" 3791.exe sourcetype="xmlwineventlog:microsoft-windows-sysmon/operational" commandline"3791.exe"
| stats values(process_name) by MD5
index="botsv1" earliest=0 Image="*\\cmd.exe" | stats values(CommandLine) by host
Última actualización 11mo ago