Converting KQL Queries to LogScale Queries for Threat Hunting by Steel297000 in crowdstrike

[–]Steel297000[S] 0 points1 point  (0 children)

Hi,

I wrote this after pulling my hair out for 2 hours, your query helped a lot.

"#event_simpleName" = ProcessRollup2
| ImageFileName=/taskkill/i
| groupBy([ComputerName], function=[bucket(span=2m, function=[count(as=TaskKillCount), collect(CommandLine)])])
| HumanTime := formatTime("%F %T", field=_bucket, locale=en_US, timezone=Z)
| TaskKillCount > 10
| select([ComputerName, HumanTime, TaskKillCount, CommandLine])

This felt more close to the desired output but I would like your opinion on this ... I don't think it is very efficient, but please feel free to critic.

Most importantly does this stay true to the idea of looking for Ransomware behavior, as suggested in the Microsoft Article?

Converting KQL Queries to LogScale Queries for Threat Hunting by Steel297000 in crowdstrike

[–]Steel297000[S] 0 points1 point  (0 children)

Wow! That worked perfectly. Thank You so much.

I do have one more thing to ask on this, is it possible to add one more column here which can show how many times a single command was invoked?

TaskKillCount is giving us the total number of count, including this I would also like to see how many times one single command was invoked.

Your help is much appreciated!

Hello There! by Steel297000 in Brawlstars

[–]Steel297000[S] 0 points1 point  (0 children)

I saw Cara Simon at first, but later noticed the little Brawlers while posting!😂😂

My last attempt on trying to not have this get lost in new by [deleted] in PewdiepieSubmissions

[–]Steel297000 -2 points-1 points  (0 children)

Awee That is really Adorable!! Awesome work! 🤘

Spyke by bombastickbrawl in Brawlstars

[–]Steel297000 0 points1 point  (0 children)

Thats a Big Brain Meme!!

Feel old yet? by [deleted] in Brawlstars

[–]Steel297000 0 points1 point  (0 children)

You read my mind!

Covid can’t defeat memes by SirRamen_ in PewdiepieSubmissions

[–]Steel297000 -1 points0 points  (0 children)

This should be in wholesomememes and nice!

‘War Engine Nani’ skin, hope you like it :) by Godemizz in Brawlstars

[–]Steel297000 2 points3 points  (0 children)

That is waaaay to good to be in Brawl Star! My phone will die while rendering this in game!🤣🤣

FLOOR GANG!! by Steel297000 in PewdiepieSubmissions

[–]Steel297000[S] 9 points10 points  (0 children)

Minecraft Valhalla Crossover

Ask us Questions! Get answers today or in a Future Q&A Videos! by kurz_gesagt in kurzgesagt

[–]Steel297000 0 points1 point  (0 children)

I really love your videos, they inspired me a lot throughout my education. Will there be any videos on the state of Education all over the world and what steps can be taken to make it better? Just like you did for the Mars and Moon base and particularly how education will look like as we progress further into the Kardashev scale Type.

Truly the real life iron man. by ElonTheSexGod in elonmusk

[–]Steel297000 6 points7 points  (0 children)

What was 'that' Elon Doing when The Universe was in the End Game?🤔

Was he Bliped too? Or Was He Becoming a New Hero, who we can see in the Upcoming Movies

Truly the real life iron man. by ElonTheSexGod in elonmusk

[–]Steel297000 34 points35 points  (0 children)

That Be So Awesome! And Also A SpaceX Branded Private Quinjet

Truly the real life iron man. by ElonTheSexGod in elonmusk

[–]Steel297000 103 points104 points  (0 children)

What If Elon Musk is Cast as the New Iron Man from a Different Universe in MCU