About cyberfan

cyberfan · ‎10-05-2020

Hi, we patch the AD server Aug.11 monthly rollup, we test the exploit, the exploit is not successful , but no 5827-5831 event is generated, do I need to setup windows server, so these event code will be generated

cyberfan · ‎10-04-2020

Hi, any one knows the benefits of search command? search src="10.9.165.*" and src_ip="10.9.165.*" , any difference?

cyberfan · ‎10-04-2020

Given free sample http stream data download from splunk website. I got two questions with start time, record time and endtime. (1). is "_time" the recorded time by splunk index? how to output as "H:MM:SS" format. and "HH:MM:SS" format respectfully? example, 18:27.36.257, HH:MM:SS will be 18:27:36, H:MM:SS will be 6:27:36 (2), say, user enter hacker.com/a.js in chrome at 18:27:36, at 18:27:50, a.js start loading, 18:28:59, a.js finished execution, would splunk index capture start time, record time, endtime? what are the fields? thanks

cyberfan · ‎10-02-2020

any idea to write the query to capture the first packet recorded of the reconnaissance from the vulnerability scanner

cyberfan · ‎10-02-2020

For example, My ip is 202.101.53.4, I want to identify what are the domains sent me the most number of packets (most frequently), what will be the query look like? I want to know the domain who sent me the most number of traffics, what would be the query look like? I want to know the vulnerability scanner the malicious domain is using for reconaissance, which filed I can get info from splunk?

cyberfan · ‎09-30-2020

Hi Ri, Thanks, but the OR condition does not mean the chain of events happen at short time interval, say less than 0.05 seconds， right？ also I want sam account="abc" in event 4741 and sid="xyz" in event 4743, do you suggest " (event id=4741 and sam="abc") or (event id=4743 and sid="xyz") then count>2?

cyberfan · ‎09-30-2020

we want to detect the multiple events together, for example, we want to find out those events which have event 4741 and event 4743 happen together. scenario 1： at certain time (2020.3.20 18:00:00) both 4741 and 4743 happen together Scenario2： the interval between 4741 and 4743 is short (less than 2 second) how to define SPL for these two scenarios, do we need correlation search?

cyberfan · ‎09-22-2020

Hi, thanks, but we did not incorporate windows Event into splunk, how to detect ?

cyberfan · ‎09-21-2020

we want to check any zero-logon exploit in the environment, is there splunk search available? how to detect malicious rpc connection? thanks

cyberfan · ‎08-02-2020

there are some malware enabled by word Macro and run VB script to communicate to outside. I want to find out what are the hosts open word document, VB script is executed (I don't know the word file name), any search can help? thanks

cyberfan · ‎08-02-2020

I have one txt file, only one column, the txt file has around 60 SHA-256 hashes. these hashes are from malicious files. I want to search the system any hosts associated with these hashes, what would be the search string I need to pass to splunk? thanks

Posts	11
Solutions	0
Karma Given	0
Karma Received	1
Member Since	‎08-02-2020

Online Status	Offline
Date Last Visited	‎10-06-2020 12:16 PM

benefits of using search command

web event start time, splunk record time and endti...

first packet recorded of the reconnaissance

identify scanner and malicious domain

multiple event code search

search for net-logon with less false positive

search for script launched

search events from txt

Re: search for net-logon with less false positive