From 8fc44aae9d7e62f2922939f71c54cddb4e046405 Mon Sep 17 00:00:00 2001 From: Ming Di Leom <2809763-curben@users.noreply.gitlab.com> Date: Sun, 4 May 2025 01:24:30 +0000 Subject: [PATCH] fix(unusual-ua): include firefox --- source/threat-hunting/index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/source/threat-hunting/index.md b/source/threat-hunting/index.md index eab73af..c95f7d4 100644 --- a/source/threat-hunting/index.md +++ b/source/threat-hunting/index.md @@ -1547,7 +1547,7 @@ References: [1](https://www.security.com/threat-intelligence/shuckworm-ukraine-g SPL: ```spl -| tstats summariesonly=true allow_old_summaries=true fillnull_value="(null)" count FROM datamodel=Web WHERE index="proxy" NOT Web.http_user_agent IN ("*Chrome*", "*Safari*", "*Safari*") BY Web.user, Web.src, Web.url, Web.url_domain, Web.category, Web.http_user_agent, Web.http_referrer, _time span=1s +| tstats summariesonly=true allow_old_summaries=true fillnull_value="(null)" count FROM datamodel=Web WHERE index="proxy" NOT Web.http_user_agent IN ("*Chrome*", "*Safari*", "*Firefox*") BY Web.user, Web.src, Web.url, Web.url_domain, Web.category, Web.http_user_agent, Web.http_referrer, _time span=1s | append [| tstats summariesonly=true allow_old_summaries=true fillnull_value="(null)" count FROM datamodel=Web WHERE index="proxy" BY Web.user, Web.src, Web.url, Web.url_domain, Web.category, Web.http_user_agent, Web.http_referrer, _time span=1s | where len(Web.http_user_agent) > 130]