curben
/
blog
mirror of https://gitlab.com/curben/blog
1
0
Fork 0
Code Issues Releases Wiki Activity

fix(unusual-ua): include firefox

This commit is contained in:
Ming Di Leom 2025-05-04 01:24:30 +00:00
parent 872144936c
commit 8fc44aae9d
No known key found for this signature in database
GPG Key ID: 32D3E28E96A695E8
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
source/threat-hunting/index.md
View File

@ -1547,7 +1547,7 @@ References: [1](https://www.security.com/threat-intelligence/shuckworm-ukraine-g
SPL: SPL:
```spl ```spl
| tstats summariesonly=true allow_old_summaries=true fillnull_value="(null)" count FROM datamodel=Web WHERE index="proxy" NOT Web.http_user_agent IN ("*Chrome*", "*Safari*", "*Safari*") BY Web.user, Web.src, Web.url, Web.url_domain, Web.category, Web.http_user_agent, Web.http_referrer, _time span=1s | tstats summariesonly=true allow_old_summaries=true fillnull_value="(null)" count FROM datamodel=Web WHERE index="proxy" NOT Web.http_user_agent IN ("*Chrome*", "*Safari*", "*Firefox*") BY Web.user, Web.src, Web.url, Web.url_domain, Web.category, Web.http_user_agent, Web.http_referrer, _time span=1s
| append | append
[| tstats summariesonly=true allow_old_summaries=true fillnull_value="(null)" count FROM datamodel=Web WHERE index="proxy" BY Web.user, Web.src, Web.url, Web.url_domain, Web.category, Web.http_user_agent, Web.http_referrer, _time span=1s [| tstats summariesonly=true allow_old_summaries=true fillnull_value="(null)" count FROM datamodel=Web WHERE index="proxy" BY Web.user, Web.src, Web.url, Web.url_domain, Web.category, Web.http_user_agent, Web.http_referrer, _time span=1s
| where len(Web.http_user_agent) > 130] | where len(Web.http_user_agent) > 130]