Splunkmon — Taking Sysmon to the Next Level

Splunkmon — Taking Sysmon to the Next Level
7-Zip
ÂÂ
index=sysmon Hashes="*IMPHASH=06CCDA30750899D24EC1383D46A36E65*"
ÂÂ
index=sysmon Hashes="*IMPHASH=06CCDA30750899D24EC1383D46A36E65*" NOT Image="*7z.
exe*"
ÂÂ
index=sysmon CommandLine="* a *"
Miscellaneous
Stacking Command Line Working Directories
ÂÂ
index=sysmon ParentImage="*\\cmd.exe" | stats count by CurrentDirectory
Stacking processes that don’t have an executable extension
ÂÂ
index=sysmon EventCode="1" NOT Image="*.exe" NOT Image="System" NOT
Image="<unknown process>" | stats count by Computer,CommandLine
Stacking processes with a single character file name
ÂÂ
index=sysmon | regex Image="\\\\.\....$" | stats count by Computer,CommandLine
Stacking binary network connections
ÂÂ
index=sysmon EventCode=3 | iplocation dest_ip | stats count by process,dest_ip,Country
Statistical search of processes opening network connections
  index=sysmon EventCode=3 | streamstats window=1 global=f current=f last(_time) as next_ts
by Computer Image DestinationIp | eval tm_to_next=next_ts-_time | stats values(direction) as
direction count avg(tm_to_next) as avgTimeToNext stdev(tm_to_next) as stdDevTimeToNext by
Computer Image DestinationIp | where stdDevTimeToNext < 1 AND count > 5 AND avgTimeToNext
> 0| iplocation DestinationIp | lookup dnslookup clientip as DestinationIp | fields - lat lon | sort
stdDevTimeToNext
© The Crypsis Group www.crypsisgroup.com 28