Threat Detection Engineering

• Threat Detection: Detecting a Webserver Attack
• Threat Intelligence for SOC
• Detection Engineering vs Threat Hunting
• Yara 101
• Threat Intelligence Tools – Abuse.ch
• Threat Intelligence Tools – URLScan.io
• Custom detection rule with the MITRE ATT&CK framework in Splunk
• Investigate SQLi attacks using Splunk
• Splunk: Search Processing Language (SPL) Basics
• Practical Threat Hunting using Elastic SIEM: Hunting for Stuxbot
• MITRE Framework
• SOC Tools and Useful Links
• ELASTIC SIEM: Kibana Query Language (KQL) 
• SOC Home LAB: Elastic SIEM Installation
• MISP (Malware Information Sharing Platform)

Views: 63

Splunk Search Processing Language comprises of multiple functions, operators and commands that are used together to form a simple to complex search and get the desired results from the ingested logs.

Main components of SPL

Search Field Operators

Comparison Operators

These operators are used to compare the values against the fields.

Lets use the comparison operator to display all the event logs from the index “windowslogs”, where AccountName is not Equal to “System”

Boolean Operators

#Example Search Query

index=windowslogs AccountName !=SYSTEM AND AccountName=James

Wild Card

#Example Search Query
index=windowslogs DestinationIp=172.*

#Some additional Search Queries

index=windowslogs EventID="1" User="Cybertees\\James"

index=windowslogs DestinationIp=172.18.39.6 DestinationPort=135

index=windowslogs  Hostname="Salena.Adam" DestinationIp="172.18.38.5"

Filtering the results in SPL

 SPL allows us to use Filters to narrow down the result and only show the important events that we are interested in. We can add or remove certain data from the result using filters. 

Fields

#Example Query
index=windowslogs | fields + host + User + SourceIp

Search

#Example Query

index=windowslogs | search Powershell

Dedup

We can use the dedup command to show the list of unique EventIDs from a particular hostname.

#Example Search Query

index=windowslogs | table EventID User Image Hostname | dedup EventID

Rename

#Example Query

index=windowslogs | fields + host + User + SourceIp | rename User as Employees

#Additional Search Queries

index=windowslogs | table _time EventID Hostname SourceName | reverse 

#Example Query

index=windowslogs | table _time EventID Hostname SourceName | reverse 
| dedup Hostname

Structuring the Search Results

SPL provides various commands to bring structure or order to the search results. These sorting commands like head, tail, and sort can be very useful during logs investigation.

Table

This search query will create a table with three columns selected and ignore all the remaining columns from the display.

#Example Search Query

index=windowslogs | table EventID Hostname SourceName

Head

The following search query will show the table containing the mentioned fields and display only the top 5 entries.

index=windowslogs |  table _time EventID Hostname SourceName | head 5

Tail

The following search query will show the table containing the mentioned fields and display only 5 entries from the bottom of the list.

#Example Search Query

index=windowslogs |  table _time EventID Hostname SourceName | tail 5

Sort

The following search query will sort the results based on the Hostname field.

#Example Search Query

index=windowslogs |  table _time EventID Hostname SourceName | sort Hostname

Reverse

#Example Query

index=windowslogs | table _time EventID Hostname SourceName | reverse

 Transformational Commands in SPL

Transformational commands are those commands that change the result into a data structure from the field-value pairs. These commands simply transform specific values for each event into numerical values which can easily be utilized for statistical purposes or turn the results into visualizations. Searches that use these transforming commands are called transforming searches. Some of the most used transforming commands are explained below.

Top

The following command will display the top 7 Image ( representing Processes) captured.

#Example Search Query
index=windowslogs | top limit=7 Image

Rare

index=windowslogs | rare limit=7 Image

Highlight

The following command will highlight the three mentioned fields in the raw logs

index=windowslogs | highlight User, host, EventID, Image

STATS Commands

SPL supports various stats commands that help in calculating statistics on the values. Some common stat commands are:

Splunk Chart Commands

Chart

#Search Query: 
index=windowslogs | chart count by User

#Search Query: 
index=windowslogs | chart count by User

Timechart

The following query will display the Image chart based on the time.

#Search Query:
index=windowslogs | timechart count by Imag