mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
divious1
47 lines
2.1 KiB
JSON
47 lines
2.1 KiB
JSON
{
|
|
"channel": "ESCU",
|
|
"creation_date": "2017-06-26",
|
|
"data_metadata": {
|
|
"data_source": [
|
|
"Network Communications"
|
|
],
|
|
"data_sourcetypes": [
|
|
"stream:http"
|
|
],
|
|
"providing_technologies": [
|
|
"Splunk Stream"
|
|
]
|
|
},
|
|
"fields_required": [
|
|
"src_ip",
|
|
"dest_ip"
|
|
],
|
|
"how_to_implement": "This particular search leverages data extracted from Stream:HTTP. You must configure the http stream using the Splunk Stream App on your Splunk Stream deployment server to extract the cs_content_type field.",
|
|
"maintainers": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "bpatel@splunk.com",
|
|
"name": "Bhavin Patel"
|
|
}
|
|
],
|
|
"modification_date": "2017-10-20",
|
|
"original_authors": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "bpatel@splunk.com",
|
|
"name": "Bhavin Patel"
|
|
}
|
|
],
|
|
"search": "| search sourcetype=stream:http src_ip=\"{src_ip}\" dest_ip=\"{dest_ip}\" | eval cs_content_type_length = len(cs_content_type) | search cs_content_type_length > 100 | rex field=\"cs_content_type\" (?<suspicious_strings>cmd.exe) | eval suspicious_strings_found=if(match(cs_content_type, \"application\"), \"True\", \"False\") | rename suspicious_strings_found AS \"Suspicious Content-Type Found\" | fields \"Suspicious Content-Type Found\", dest_ip, src_ip, suspicious_strings, cs_content_type, cs_content_type_length, url",
|
|
"search_description": "This search helps an analyst investigate a notable event related to a potential Apache Struts exploitation. To investigate, we will want to isolate and analyze the \"payload\" or the commands that were passed to the vulnerable hosts by creating a few regular expressions to carve out the commands focusing on common keywords from the payload, such as cmd.exe, /bin/bash and whois. The search returns these suspicious strings found in the HTTP logs of the system of interest.",
|
|
"search_id": "bc91a8cf-35e7-4bb2-8140-e756cc06fd89",
|
|
"search_name": "Investigate Suspicious Strings in HTTP Header",
|
|
"search_type": "investigative",
|
|
"search_window": {
|
|
"earliest_time_offset": 3600,
|
|
"latest_time_offset": 3600
|
|
},
|
|
"spec_version": 1,
|
|
"version": "1.0"
|
|
}
|