curben
/
blog
mirror of https://gitlab.com/curben/blog
1
0
Fork 0
Code Issues Releases Wiki Activity

page(threat-hunting): Unusual User Agent

This commit is contained in:
Ming Di Leom 2025-05-04 01:22:44 +00:00
parent daedc05d2f
commit 872144936c
No known key found for this signature in database
GPG Key ID: 32D3E28E96A695E8
1 changed files with 14 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
source/threat-hunting/index.md
View File

@ -2,7 +2,7 @@
title: Splunk Threat Hunting
layout: page
date: 2025-01-15
updated: 2025-04-09
updated: 2025-05-04
---
Some searches utilise [cmdb_ci_list_lookup](https://gitlab.com/curben/splunk-scripts/-/tree/main/Splunk_TA_snow) lookup.
@ -1541,6 +1541,19 @@ SPL:
| table Time, index, host, EventCode, EventDescription, parent_process, process, user, Name, Email
```
## Unusual User Agent
References: [1](https://www.security.com/threat-intelligence/shuckworm-ukraine-gammasteel)
SPL:
```spl
| tstats summariesonly=true allow_old_summaries=true fillnull_value="(null)" count FROM datamodel=Web WHERE index="proxy" NOT Web.http_user_agent IN ("*Chrome*", "*Safari*", "*Safari*") BY Web.user, Web.src, Web.url, Web.url_domain, Web.category, Web.http_user_agent, Web.http_referrer, _time span=1s
| append
[| tstats summariesonly=true allow_old_summaries=true fillnull_value="(null)" count FROM datamodel=Web WHERE index="proxy" BY Web.user, Web.src, Web.url, Web.url_domain, Web.category, Web.http_user_agent, Web.http_referrer, _time span=1s
| where len(Web.http_user_agent) > 130]
| rename Web.* AS *, http_user_agent AS user_agent, http_referrer AS referrer
```
## Unusual printui.exe path
References: [1](https://redcanary.com/blog/threat-intelligence/tangerine-turkey/)