topic Re: Issue with excluding a decoded base64 command in Security

Issue with excluding a decoded base64 command

vnarahari — Tue, 02 Apr 2024 20:08:49 GMT

I have been working on decoding a base64 encoded command using the decrypt2 app. I have successfully decoded the string but facing difficulty excluding or searching and also running stats of decoded field which gives a "p" thing as a result.

Examples of | Search NOT:

Example of Stats resulted "p":

| rex field="process" ".*-(e|E)(n|N)[codemanCODEMAN]{0,12}\ (?<process_enc>[A-Za-z\d+/=]*)?"
| decrypt field=process_enc b64 emit('process_decoded')
| stats count by process_decoded

Could someone please provide guidance on the correct syntax to exclude or search the decoded field using search not or using a lookup and help clarify the "P" thing from stats command?

Re: Issue with excluding a decoded base64 command

ITWhisperer — Tue, 02 Apr 2024 22:35:13 GMT

I don't know the decrypt command so this might be completely irrelevant, but, is the output (emitted) field a multi value field and if so do you need to use mvexpand to separate out the strings that you want to filter on?

Another possibility is perhaps the regex command

| regex process_decoded!="SELECT"

Re: Issue with excluding a decoded base64 command

vnarahari — Wed, 03 Apr 2024 17:38:19 GMT

@ITWhisperer Thanks for your response, It's not multivalued field and tried regex which isn't excluding the results as well.