Detection

index=security sourcetype=auth action=failure | stats count by src_ip user | sort -count

index=windows EventCode=4688 | stats count by New_Process_Name Parent_Process_Name | sort -count

index=dns query="*.zip" OR query="*.mov" | stats count by src_ip query

index=proxy status=200 bytes_out>5000000 | table _time src_ip user url bytes_out

index=edr process_name=powershell.exe | search command_line="*EncodedCommand*"

index=vpn action=success | stats dc(src_ip) as locations by user | where locations > 2

index=cloud eventName=ConsoleLogin responseElements.ConsoleLogin=Failure | stats count by sourceIPAddress userIdentity.arn

index=email verdict=phish | stats count by sender recipient subject

index=security severity=high | timechart span=15m count by signature

index=endpoint file_name=lsass.exe action=read | table _time host process_name user

sigma convert -t splunk rules/windows/process_creation/proc_creation_win_susp_powershell.yml

sigma check rules/windows/process_creation/*.yml

sigma list targets

sigma convert -t elastalert rules/cloud/aws/aws_console_login_failures.yml

sigma convert -t sentinel rules/windows/powershell/powershell_susp_download.yml

sigma check rules/linux/auditd/*.yml

sigma convert -t lucene rules/proxy/proxy_susp_user_agent.yml

sigma convert -t splunk --pipeline splunk_windows rules/windows/sysmon/*.yml

sigma check --fail-on-warnings rules/

sigma convert -t qradar rules/windows/builtin/win_security_susp_logon.yml

suricata -T -c /etc/suricata/suricata.yaml -S local.rules

suricata-update list-sources

suricata-update enable-source et/open

suricata -r capture.pcap -k none -l eve-output/

jq 'select(.event_type=="alert")' eve.json

jq 'select(.event_type=="dns") | {src_ip,query:.dns.rrname}' eve.json

suricata --dump-config | grep default-rule-path

suricatasc -c ruleset-reload-nonblocking

jq 'select(.alert.severity<=2) | .alert.signature' eve.json

suricata -T -c suricata.yaml

velociraptor query "SELECT * FROM info()"

velociraptor artifacts list | grep Windows

velociraptor query "SELECT Name, CommandLine FROM pslist()"

velociraptor query "SELECT * FROM glob(globs='C:/Windows/Temp/*')"

velociraptor query "SELECT * FROM Artifact.Windows.EventLogs.EvtxHunter()"

velociraptor query "SELECT * FROM Artifact.Generic.Client.Info()"

velociraptor config show --section Client

velociraptor query "SELECT * FROM users()"

velociraptor query "SELECT * FROM netstat()"

velociraptor query "SELECT * FROM hash(path='C:/Windows/System32/cmd.exe')"

osqueryi "select name,path,pid from processes limit 10;"

osqueryi "select * from listening_ports where port not in (80,443,22);"

osqueryi "select username,description from users;"

osqueryi "select name,version from programs order by name;"

osqueryi "select * from startup_items;"

osqueryi "select * from logged_in_users;"

osqueryi "select address,mac,interface from interface_addresses;"

osqueryi "select * from certificates where common_name like '%corp%';"

osqueryi "select * from crontab;"

osqueryi "select path,sha256 from hash where path='/bin/bash';"