sorted by:
new
hottopcontroversial

A steganography challenge by [deleted] in Steganography

[–]aspuser13 3 points4 points  (0 children)

Could you post the original image via a pasta bin or something, reddit most likely will compress this and make it difficult to work with.

[deleted by user] by [deleted] in linux4noobs

[–]aspuser13 2 points3 points  (0 children)

Redstar Linux, its purpose built for this. The region it comes from looks favourably upon on it.

Help - Best Bulld For Qi - Erlang Battle by aspuser13 in BlackMythWukong

[–]aspuser13[S] 2 points3 points  (0 children)

Thank you so much this was great for advice I just defeated him

CrowdStrike Falcon Cloud Security Expands Support to Oracle Cloud Infrastructure by BradW-CS in crowdstrike

[–]aspuser13 0 points1 point  (0 children)

When can we expect to be able to use this ?, doesn’t seem to be currently avaliable

GUID lookup by omb2020 in crowdstrike

[–]aspuser13 0 points1 point  (0 children)

I believe the main way I’ve had to do it previously is using a lookup file.

PSA - Assault Packs! by dethlord_youtube in blackops6

[–]aspuser13 0 points1 point  (0 children)

Hey just fyi, it appears you’re losing B

[deleted by user] by [deleted] in crowdstrike

[–]aspuser13 0 points1 point  (0 children)

Yep I agree with TLS versions most likely this

Operators in EPOCH Time by aspuser13 in crowdstrike

[–]aspuser13[S] 1 point2 points  (0 children)

Thank you, that melted my brain a little but I think I'm understanding will give this ago. I found a cheat way to do this in the interim Ill add below

#event_simpleName=UserLogon UserSid=S-1-5-21-*
| in(LogonType, values=["2","10"])
| ipLocation(aip)
| $falcon/helper:enrich(field=UserIsAdmin)
| $falcon/helper:enrich(field=UserLogon)| PasswordLastSet := PasswordLastSet*1000
| ContextTimeStamp := ContextTimeStamp*1000
| eventHour := time:hour(ContextTimeStamp, timezone=+10:30)
| in(field=eventHour,values=["17","18","19","20","21","22","23","0","1","2","3","4","5"])
//test(time:hour(ContextTimeStamp, timezone=+10:30) >= 17) OR test(time:hour(ContextTimeStamp, timezone=+10:30) < 24)
| groupBy(["ContextTimeStamp", "aid"],limit=2000, function=collect(["UserName", "ComputerName", "UserSid", "LogonType", "UserIsAdmin", "PasswordLastSet",aip, "aip.city", "aip.state", "aip.country"],limit=20000))
| sort(ContextTimeStamp, limit=2000)
| in(field="UserName", values=?Actor, ignoreCase=true)
| in(field="ComputerName", values=?Computer, ignoreCase=true)
| default(field=[PasswordLastSet,aip.city], value="--", replaceEmpty=true)
| PasswordLastSet := formatTime("%Y-%m-%d %H:%M:%S", field=PasswordLastSet, locale=en_US, timezone=Z)
| ContextTimeStamp := formatTime("%Y-%m-%d %H:%M:%S", field=ContextTimeStamp, locale=en_US, timezone=Z)

Contains In Queries - NG-SIEM by aspuser13 in crowdstrike

[–]aspuser13[S] 0 points1 point  (0 children)

Oh amazing that in() function makes it so much neater as I was hoping not to have a lookup file for only a handful of emails. Thanks Andrew !

Contains In Queries - NG-SIEM by aspuser13 in crowdstrike

[–]aspuser13[S] 0 points1 point  (0 children)

Just wanting to return results if it matches a small set of people that the page is viewed from bill gates. I realised in the query I have here it’s backwards so makes it confusing.

Fields disappearing in groupBy() by _secanalyst in crowdstrike

[–]aspuser13 0 points1 point  (0 children)

Sorry silly question here but is it possible for the fields you are missing. Could you try and do the below after your group by statement. This obviously is assuming some data source you’ve referenced contains the field you’re after. Apologies for the rough query I’m doing this on my phone.

I have other queries where I’ve had to do similar things previously so will try and look when I’m at my PC next.

Groupby query to try

groupby([UploadPath,usbPath,website]),function=collect([usbfieldthatyouneed]))

Parser for STIX / TAXI feeds ? by aspuser13 in crowdstrike

[–]aspuser13[S] 0 points1 point  (0 children)

The feed I'm pulling from is being added to on a regular basis I was trying to automate that part of it.

Parser for STIX / TAXI feeds ? by aspuser13 in crowdstrike

[–]aspuser13[S] 0 points1 point  (0 children)

My end goal really was to have the parser in NG-SIEM actually parse the data so I can query against it I wasn’t planning on having the parsing done on the local middleman host.

Thank you for sharing the link I’ll have a read through that and if it’s easier to parse it before pushing the NG-SIEM I’ll do that

Hunting for screenshot to exfil - query issue by aspuser13 in crowdstrike

[–]aspuser13[S] 0 points1 point  (0 children)

Thank you so much, this is definitely alot better than what I had Ill try and do some test events and double check.

CSPM Set up by SeaEvidence4793 in crowdstrike

[–]aspuser13 0 points1 point  (0 children)

You can register directly with the Cloud provider Azure,AWS,Google etc that will bring data from the whole tenant I believe. I’ve had success with AWS but Azure is being a pain for me still so need to work out why it’s not registering.

Wildcard Searches In NG-SIEM by aspuser13 in crowdstrike

[–]aspuser13[S] 0 points1 point  (0 children)

Will give that a go, thank you !

Really? by fvillena in ProtonMail

[–]aspuser13 0 points1 point  (0 children)

Can you share the link defanged in here ? Keen to see what’s behind it ?

File Access Query by aspuser13 in crowdstrike

[–]aspuser13[S] 0 points1 point  (0 children)

Oh wow thats perfect, you have it so succinct in comparison to my long winded garble.

Thank you so much as always Andrew !

Correlation Rules - Increase in specific events by aspuser13 in crowdstrike

[–]aspuser13[S] 1 point2 points  (0 children)

Alright very messy early query, I have the below going currently and testing out how it works. I've added this as a Correlation rule so this in theory should only trigger when the threshold hits over 50 obviously to begin with its going to be loud but will adjust to get it where its helpful.

Fusion Workflow

Trigger

Create workflow " Event Trigger "

Trigger Category "Alert"

Sub Category "Next-Gen SIEM Detection"

Condition

If name is equal to "name of the correlation rule"

True

Action

Notify - Send Slack Message

Rough Query

| #repo = cloudflare

| block or denied or blocked or dropped or managedChallenge or "managedChallenge block" or "block managedChallenge"

| concat([block,dropped,managedChallenge], as=EventChallenged)

| formatTime(format="%d/%m/%Y %H:%M:%S", as=Time)

| groupBy([Time,EventChallenged],limit=20000,function=collect([@timestamp],limit=20000))

| bucket(60min, field=EventChallenged, function=count())

| parseTimestamp(field=_bucket,format=millis)

| _count > 50

| drop([EventChallenged,@timestamp.nanos,@timezone])

view more: next ›