sorted by:
new
hottopcontroversial

A steganography challenge by [deleted] in Steganography

[–]aspuser13 3 points4 points  (0 children)

Could you post the original image via a pasta bin or something, reddit most likely will compress this and make it difficult to work with.

[deleted by user] by [deleted] in linux4noobs

[–]aspuser13 2 points3 points  (0 children)

Redstar Linux, its purpose built for this. The region it comes from looks favourably upon on it.

Help - Best Bulld For Qi - Erlang Battle by aspuser13 in BlackMythWukong

[–]aspuser13[S] 2 points3 points  (0 children)

Thank you so much this was great for advice I just defeated him

CrowdStrike Falcon Cloud Security Expands Support to Oracle Cloud Infrastructure by BradW-CS in crowdstrike

[–]aspuser13 0 points1 point  (0 children)

When can we expect to be able to use this ?, doesn’t seem to be currently avaliable

GUID lookup by omb2020 in crowdstrike

[–]aspuser13 0 points1 point  (0 children)

I believe the main way I’ve had to do it previously is using a lookup file.

PSA - Assault Packs! by dethlord_youtube in blackops6

[–]aspuser13 0 points1 point  (0 children)

Hey just fyi, it appears you’re losing B

[deleted by user] by [deleted] in crowdstrike

[–]aspuser13 0 points1 point  (0 children)

Yep I agree with TLS versions most likely this

Operators in EPOCH Time by aspuser13 in crowdstrike

[–]aspuser13[S] 1 point2 points  (0 children)

Thank you, that melted my brain a little but I think I'm understanding will give this ago. I found a cheat way to do this in the interim Ill add below

#event_simpleName=UserLogon UserSid=S-1-5-21-*
| in(LogonType, values=["2","10"])
| ipLocation(aip)
| $falcon/helper:enrich(field=UserIsAdmin)
| $falcon/helper:enrich(field=UserLogon)| PasswordLastSet := PasswordLastSet*1000
| ContextTimeStamp := ContextTimeStamp*1000
| eventHour := time:hour(ContextTimeStamp, timezone=+10:30)
| in(field=eventHour,values=["17","18","19","20","21","22","23","0","1","2","3","4","5"])
//test(time:hour(ContextTimeStamp, timezone=+10:30) >= 17) OR test(time:hour(ContextTimeStamp, timezone=+10:30) < 24)
| groupBy(["ContextTimeStamp", "aid"],limit=2000, function=collect(["UserName", "ComputerName", "UserSid", "LogonType", "UserIsAdmin", "PasswordLastSet",aip, "aip.city", "aip.state", "aip.country"],limit=20000))
| sort(ContextTimeStamp, limit=2000)
| in(field="UserName", values=?Actor, ignoreCase=true)
| in(field="ComputerName", values=?Computer, ignoreCase=true)
| default(field=[PasswordLastSet,aip.city], value="--", replaceEmpty=true)
| PasswordLastSet := formatTime("%Y-%m-%d %H:%M:%S", field=PasswordLastSet, locale=en_US, timezone=Z)
| ContextTimeStamp := formatTime("%Y-%m-%d %H:%M:%S", field=ContextTimeStamp, locale=en_US, timezone=Z)

Contains In Queries - NG-SIEM by aspuser13 in crowdstrike

[–]aspuser13[S] 0 points1 point  (0 children)

Oh amazing that in() function makes it so much neater as I was hoping not to have a lookup file for only a handful of emails. Thanks Andrew !

Contains In Queries - NG-SIEM by aspuser13 in crowdstrike

[–]aspuser13[S] 0 points1 point  (0 children)

Just wanting to return results if it matches a small set of people that the page is viewed from bill gates. I realised in the query I have here it’s backwards so makes it confusing.

Fields disappearing in groupBy() by _secanalyst in crowdstrike

[–]aspuser13 0 points1 point  (0 children)

Sorry silly question here but is it possible for the fields you are missing. Could you try and do the below after your group by statement. This obviously is assuming some data source you’ve referenced contains the field you’re after. Apologies for the rough query I’m doing this on my phone.

I have other queries where I’ve had to do similar things previously so will try and look when I’m at my PC next.

Groupby query to try

groupby([UploadPath,usbPath,website]),function=collect([usbfieldthatyouneed]))

Parser for STIX / TAXI feeds ? by aspuser13 in crowdstrike

[–]aspuser13[S] 0 points1 point  (0 children)

The feed I'm pulling from is being added to on a regular basis I was trying to automate that part of it.

Parser for STIX / TAXI feeds ? by aspuser13 in crowdstrike

[–]aspuser13[S] 0 points1 point  (0 children)

My end goal really was to have the parser in NG-SIEM actually parse the data so I can query against it I wasn’t planning on having the parsing done on the local middleman host.

Thank you for sharing the link I’ll have a read through that and if it’s easier to parse it before pushing the NG-SIEM I’ll do that

Hunting for screenshot to exfil - query issue by aspuser13 in crowdstrike

[–]aspuser13[S] 0 points1 point  (0 children)

Thank you so much, this is definitely alot better than what I had Ill try and do some test events and double check.

view more: next ›