2026-04-13 09-03-24

May 25, 2026 14:43 · 15:56 · English · Whisper Turbo · 2 Дынамік
Гэты запіс скончыцца сёння. Абнавіць для пастаяннага захоўвання →
Індэкс лекцыі
Толькі паказ
0:07
S… Speaker 1 (2026-04-13 09-03-24)
When you're writing queries in Splunk to perform
0:12
S… Speaker 1 (2026-04-13 09-03-24)
threat hunts,
0:13
S… Speaker 1 (2026-04-13 09-03-24)
you need to be familiar with the Splunk processing language.
0:18
S… Speaker 1 (2026-04-13 09-03-24)
It is how those queries are going to be formatted.
0:21
S… Speaker 1 (2026-04-13 09-03-24)
So let's take a look here at how these SPL
0:25
S… Speaker 1 (2026-04-13 09-03-24)
queries are formatted so that we can have or perform our
0:30
S… Speaker 1 (2026-04-13 09-03-24)
effective threat hunts.
0:31
S… Speaker 2 (2026-04-13 09-03-24)
Now,
0:32
S… Speaker 1 (2026-04-13 09-03-24)
I said in our last video,
0:34
S… Speaker 1 (2026-04-13 09-03-24)
if you've watched that all,
0:36
S… Speaker 1 (2026-04-13 09-03-24)
data in Splunk is stored in an index.
0:39
S… Speaker 1 (2026-04-13 09-03-24)
Everything is in an index,
0:42
S… Speaker 1 (2026-04-13 09-03-24)
and Splunk can have many different indexes,
0:45
S… Speaker 1 (2026-04-13 09-03-24)
just depends on how the organization needs to architecture their
0:49
S… Speaker 1 (2026-04-13 09-03-24)
systems.
0:50
S… Speaker 1 (2026-04-13 09-03-24)
Splunk has one main index that is just labeled as main,
0:54
S… Speaker 1 (2026-04-13 09-03-24)
but it is again best practice to not store production data
0:59
S… Speaker 1 (2026-04-13 09-03-24)
in that index.
1:00
S… Speaker 2 (2026-04-13 09-03-24)
However,
1:01
S… Speaker 1 (2026-04-13 09-03-24)
if you do not include an index in your search query,
1:05
S… Speaker 1 (2026-04-13 09-03-24)
then it is only going to search that main index.
1:10
S… Speaker 1 (2026-04-13 09-03-24)
Normally, if you exclude something,
1:13
S… Speaker 1 (2026-04-13 09-03-24)
it means it's not going to filter it out as much and it will include all
1:17
S… Speaker 1 (2026-04-13 09-03-24)
of the data.
1:18
S… Speaker 2 (2026-04-13 09-03-24)
In this case,
1:18
S… Speaker 1 (2026-04-13 09-03-24)
for the index field,
1:20
S… Speaker 1 (2026-04-13 09-03-24)
that is not true.
1:21
S… Speaker 1 (2026-04-13 09-03-24)
You need to specify which index you are trying to pull
1:25
S… Speaker 1 (2026-04-13 09-03-24)
data from.
1:25
S… Speaker 1 (2026-04-13 09-03-24)
If you don't and it's not in main,
1:28
S… Speaker 1 (2026-04-13 09-03-24)
then you're not going to see that data.
1:31
S… Speaker 1 (2026-04-13 09-03-24)
And once we go through all of these components here,
1:34
S… Speaker 1 (2026-04-13 09-03-24)
we'll take a look at how these queries are actually built in Splunk.
1:38
S… Speaker 1 (2026-04-13 09-03-24)
You also have the option to specify a source type.
1:41
S… Speaker 1 (2026-04-13 09-03-24)
This can narrow down the data,
1:44
S… Speaker 1 (2026-04-13 09-03-24)
the type of data,
1:46
S… Speaker 1 (2026-04-13 09-03-24)
the type of log that's being searched,
1:48
S… Speaker 1 (2026-04-13 09-03-24)
and you can see a list of the available source types when you
1:52
S… Speaker 1 (2026-04-13 09-03-24)
go and look at the data summary in Splunk,
1:55
S… Speaker 1 (2026-04-13 09-03-24)
which we did look at in our Splunk introduction video.
1:59
S… Speaker 1 (2026-04-13 09-03-24)
You can also do any number of filters in your query
2:04
S… Speaker 1 (2026-04-13 09-03-24)
to kind of narrow down the search by specifying what
2:08
S… Speaker 1 (2026-04-13 09-03-24)
fields should match what specific data.
2:12
S… Speaker 1 (2026-04-13 09-03-24)
And again, we'll take a look at all of this here in a second.
2:15
S… Speaker 1 (2026-04-13 09-03-24)
SPL does support using pipes,
2:18
S… Speaker 1 (2026-04-13 09-03-24)
kind of the vertical line character,
2:20
S… Speaker 1 (2026-04-13 09-03-24)
and they have a very similar function to when they're used in,
2:24
S… Speaker 1 (2026-04-13 09-03-24)
say, a CLI command.
2:25
S… Speaker 1 (2026-04-13 09-03-24)
Basically, it passes the output of one command to the input
2:30
S… Speaker 2 (2026-04-13 09-03-24)
of the next,
2:31
S… Speaker 1 (2026-04-13 09-03-24)
and Splunk does support what it calls commands.
2:34
S… Speaker 1 (2026-04-13 09-03-24)
This basically tells Splunk what to do with
2:39
S… Speaker 1 (2026-04-13 09-03-24)
certain events after their retrieve from the index.
2:42
S… Speaker 1 (2026-04-13 09-03-24)
A good portion of what you do in Splunk
2:46
S… Speaker 1 (2026-04-13 09-03-24)
is going to be,
2:48
S… Speaker 1 (2026-04-13 09-03-24)
you know...
2:50
S… Speaker 1 (2026-04-13 09-03-24)
Let me rephrase that.
2:52
S… Speaker 1 (2026-04-13 09-03-24)
A good portion of what you're typing in and building with that query
2:56
S… Speaker 1 (2026-04-13 09-03-24)
is going to be commands.
2:58
S… Speaker 1 (2026-04-13 09-03-24)
There's a lot of different commands.
3:02
S… Speaker 1 (2026-04-13 09-03-24)
There's a lot of different filters you can use,
3:05
S… Speaker 1 (2026-04-13 09-03-24)
and filters and commands are going to be the two most common things.
3:09
S… Speaker 2 (2026-04-13 09-03-24)
And by commands,
3:09
S… Speaker 1 (2026-04-13 09-03-24)
I'm talking about using things like the table command to
3:13
S… Speaker 1 (2026-04-13 09-03-24)
format the data into a table.
3:16
S… Speaker 1 (2026-04-13 09-03-24)
You have stats,
3:18
S… Speaker 1 (2026-04-13 09-03-24)
which will do any number of different kind of alterations
3:22
S… Speaker 1 (2026-04-13 09-03-24)
to the appearance of the data,
3:24
S… Speaker 1 (2026-04-13 09-03-24)
and will kind of organize the data in different manners,
3:27
S… Speaker 1 (2026-04-13 09-03-24)
and we'll take a look at some of those.
3:29
S… Speaker 1 (2026-04-13 09-03-24)
You can sort the data by different fields,
3:32
S… Speaker 1 (2026-04-13 09-03-24)
or you can show the most common values by using
3:36
S… Speaker 1 (2026-04-13 09-03-24)
the top command.
3:38
S… Speaker 2 (2026-04-13 09-03-24)
In addition,
3:39
S… Speaker 1 (2026-04-13 09-03-24)
you can use the dedupe command to kind of remove duplicates
3:43
S… Speaker 1 (2026-04-13 09-03-24)
in the events as well,
3:45
S… Speaker 1 (2026-04-13 09-03-24)
and you can specify the field you want to deduplicate by as well.
3:49
S… Speaker 1 (2026-04-13 09-03-24)
There's a lot of different commands.
3:50
S… Speaker 1 (2026-04-13 09-03-24)
These are just some of the most common you will use.
3:54
S… Speaker 1 (2026-04-13 09-03-24)
When you're talking about your filters and your fields,
3:58
S… Speaker 1 (2026-04-13 09-03-24)
everything is going to be field equals value.
4:01
S… Speaker 1 (2026-04-13 09-03-24)
That's the exact way it's going to be formatted.
4:04
S… Speaker 1 (2026-04-13 09-03-24)
But you can also use forms of grouping.
4:07
S… Speaker 1 (2026-04-13 09-03-24)
You can use Boolean logic like and and or,
4:11
S… Speaker 1 (2026-04-13 09-03-24)
and grouping is done with parentheses.
4:14
S… Speaker 1 (2026-04-13 09-03-24)
Now you have your raw event search and you have a transforming
4:19
S… Speaker 1 (2026-04-13 09-03-24)
search.
4:20
S… Speaker 1 (2026-04-13 09-03-24)
A raw event search kind of does what it sounds like.
4:24
S… Speaker 1 (2026-04-13 09-03-24)
It retrieves information from the index or indexes if you're
4:28
S… Speaker 1 (2026-04-13 09-03-24)
specifying more than one index you want to search,
4:30
S… Speaker 1 (2026-04-13 09-03-24)
but it doesn't typically include any commands.
4:34
S… Speaker 1 (2026-04-13 09-03-24)
It is just retrieving data.
4:36
S… Speaker 1 (2026-04-13 09-03-24)
It's not doing anything to that data,
4:39
S… Speaker 1 (2026-04-13 09-03-24)
the raw event search.
4:40
S… Speaker 1 (2026-04-13 09-03-24)
You have the transforming search,
4:43
S… Speaker 1 (2026-04-13 09-03-24)
which
4:43
S… Speaker 1 (2026-04-13 09-03-24)
transforms the results in some way.
4:46
S… Speaker 1 (2026-04-13 09-03-24)
It performs some type of calculation or visualization
4:51
S… Speaker 1 (2026-04-13 09-03-24)
to that data to kind of change how the information
4:55
S… Speaker 1 (2026-04-13 09-03-24)
is presented.
4:56
S… Speaker 1 (2026-04-13 09-03-24)
This is always going to include fields.
5:00
S… Speaker 2 (2026-04-13 09-03-24)
always going to include commands.
5:02
S… Speaker 2 (2026-04-13 09-03-24)
So your raw event search is basically going to be just using fields,
5:06
S… Speaker 2 (2026-04-13 09-03-24)
you know, a field equals a value,
5:08
S… Speaker 2 (2026-04-13 09-03-24)
and your transforming search is more going to be using more of your filters and
5:13
S… Speaker 2 (2026-04-13 09-03-24)
your commands as well.
5:16
S… Speaker 2 (2026-04-13 09-03-24)
So let's go ahead and jump into our lab environment
5:20
S… Speaker 2 (2026-04-13 09-03-24)
and take a look at how these queries are actually structured
5:24
S… Speaker 2 (2026-04-13 09-03-24)
in some example searches.
5:28
S… Speaker 1 (2026-04-13 09-03-24)
All right,
5:28
S… Speaker 1 (2026-04-13 09-03-24)
here in our search dashboard,
5:30
S… Speaker 2 (2026-04-13 09-03-24)
which if you watched the introduction video,
5:33
S… Speaker 1 (2026-04-13 09-03-24)
you're already familiar with this,
5:34
S… Speaker 2 (2026-04-13 09-03-24)
or if you've used Splunk before,
5:35
S… Speaker 1 (2026-04-13 09-03-24)
you're definitely familiar with this.
5:37
S… Speaker 2 (2026-04-13 09-03-24)
The first thing I want to do is verify our time frame that we're
5:41
S… Speaker 1 (2026-04-13 09-03-24)
looking at.
5:42
S… Speaker 2 (2026-04-13 09-03-24)
Again, for the purposes of this lab,
5:43
S… Speaker 2 (2026-04-13 09-03-24)
we're just going to select all time because we don't have that much data.
5:47
S… Speaker 1 (2026-04-13 09-03-24)
If you have...
5:49
S… Speaker 2 (2026-04-13 09-03-24)
you know, millions of events in your Splunk environment,
5:52
S… Speaker 2 (2026-04-13 09-03-24)
you probably don't want to select all time because it will have a very
5:56
S… Speaker 2 (2026-04-13 09-03-24)
large performance impact on your searches.
6:00
S… Speaker 2 (2026-04-13 09-03-24)
So let's take a look at basically just a basic index only
6:04
S… Speaker 2 (2026-04-13 09-03-24)
search, which we also did in our introduction video.
6:06
S… Speaker 2 (2026-04-13 09-03-24)
So in the purpose for this lab,
6:08
S… Speaker 2 (2026-04-13 09-03-24)
all of our data is going to be in the ECTHP
6:12
S… Speaker 1 (2026-04-13 09-03-24)
index.
6:13
S… Speaker 2 (2026-04-13 09-03-24)
So to show all that data,
6:14
S… Speaker 2 (2026-04-13 09-03-24)
we just do index equals ECTHP.
6:17
S… Speaker 2 (2026-04-13 09-03-24)
And you can see we returned 4 ,156
6:22
S… Speaker 2 (2026-04-13 09-03-24)
events right here,
6:23
S… Speaker 2 (2026-04-13 09-03-24)
which is all of the events for this log.
6:26
S… Speaker 2 (2026-04-13 09-03-24)
So that is just a simple index search.
6:29
S… Speaker 2 (2026-04-13 09-03-24)
And again, a lot of what you're going to kind of see in Splunk
6:33
S… Speaker 2 (2026-04-13 09-03-24)
searches is this simple field equals value.
6:37
S… Speaker 2 (2026-04-13 09-03-24)
And that's exactly what this is.
6:38
S… Speaker 1 (2026-04-13 09-03-24)
And remember,
6:39
S… Speaker 2 (2026-04-13 09-03-24)
again, the index is very important.
6:42
S… Speaker 2 (2026-04-13 09-03-24)
If you do not specify an index,
6:46
S… Speaker 2 (2026-04-13 09-03-24)
Splunk assumes you are only searching the main index.
6:50
S… Speaker 2 (2026-04-13 09-03-24)
It will not return any data from any other indexes.
6:54
S… Speaker 2 (2026-04-13 09-03-24)
So let's say we wanted to look at all of the events,
6:59
S… Speaker 2 (2026-04-13 09-03-24)
all the logs from the Windows event log,
7:01
S… Speaker 2 (2026-04-13 09-03-24)
specifically the security event log.
7:04
S… Speaker 2 (2026-04-13 09-03-24)
We know that's going to be a source type specifically,
7:07
S… Speaker 2 (2026-04-13 09-03-24)
and you can see there's a lot of autocomplete options here.
7:10
S… Speaker 2 (2026-04-13 09-03-24)
So for the purposes of this,
7:12
S… Speaker 2 (2026-04-13 09-03-24)
we want the win event log security.
7:15
S… Speaker 2 (2026-04-13 09-03-24)
And we can just hit enter right there,
7:17
S… Speaker 1 (2026-04-13 09-03-24)
and it will show,
7:17
S… Speaker 2 (2026-04-13 09-03-24)
it will basically complete the query for us when we're specifying a
7:22
S… Speaker 2 (2026-04-13 09-03-24)
source type.
7:23
S… Speaker 2 (2026-04-13 09-03-24)
A lot of the values when you're doing the field value should
7:27
S… Speaker 2 (2026-04-13 09-03-24)
be included in quotation marks,
7:29
S… Speaker 2 (2026-04-13 09-03-24)
just so there's no kind of ambiguity here in the
7:33
S… Speaker 1 (2026-04-13 09-03-24)
query.
7:34
S… Speaker 2 (2026-04-13 09-03-24)
We're going to look at only security events,
7:37
S… Speaker 2 (2026-04-13 09-03-24)
and we see that our logs include just security events,
7:41
S… Speaker 2 (2026-04-13 09-03-24)
as we can see here from log name security.
7:43
S… Speaker 2 (2026-04-13 09-03-24)
And we can see the source is the win event log security,
7:47
S… Speaker 2 (2026-04-13 09-03-24)
which also happens to be the name of the source type as well.
7:52
S… Speaker 1 (2026-04-13 09-03-24)
On the left -hand side here,
7:53
S… Speaker 2 (2026-04-13 09-03-24)
we can see fields that are returned in our data.
7:57
S… Speaker 2 (2026-04-13 09-03-24)
So we can see what hosts did this data come from.
8:00
S… Speaker 2 (2026-04-13 09-03-24)
So we see there are three different hosts that sent security log
8:04
S… Speaker 2 (2026-04-13 09-03-24)
information to Splunk,
8:06
S… Speaker 2 (2026-04-13 09-03-24)
prod, sec logs,
8:07
S… Speaker 1 (2026-04-13 09-03-24)
and client.
8:08
S… Speaker 2 (2026-04-13 09-03-24)
We can see account domain information.
8:11
S… Speaker 2 (2026-04-13 09-03-24)
We can see account name information.
8:13
S… Speaker 2 (2026-04-13 09-03-24)
So basically any of the...
8:17
S… Speaker 2 (2026-04-13 09-03-24)
the events,
8:18
S… Speaker 2 (2026-04-13 09-03-24)
any of the data in here that Splunk pulls out into fields is
8:22
S… Speaker 2 (2026-04-13 09-03-24)
going to be listed out here on the side.
8:24
S… Speaker 2 (2026-04-13 09-03-24)
Now, one of the key ones that's going to contain a lot of information is
8:28
S… Speaker 2 (2026-04-13 09-03-24)
the message field.
8:31
S… Speaker 1 (2026-04-13 09-03-24)
Take a look at that.
8:32
S… Speaker 2 (2026-04-13 09-03-24)
We're going to expand one of these events here,
8:34
S… Speaker 2 (2026-04-13 09-03-24)
and you can see all of the fields that are included in here,
8:37
S… Speaker 2 (2026-04-13 09-03-24)
including the message field.
8:39
S… Speaker 2 (2026-04-13 09-03-24)
The message field contains the bulk of the data,
8:42
S… Speaker 2 (2026-04-13 09-03-24)
at least when we're talking about our Windows events.
8:45
S… Speaker 2 (2026-04-13 09-03-24)
So it's always good if you have a specific keyword that you're looking
8:49
S… Speaker 2 (2026-04-13 09-03-24)
for that would normally be just included in the event itself,
8:52
S… Speaker 2 (2026-04-13 09-03-24)
then you want to probably search the message field.
8:57
S… Speaker 2 (2026-04-13 09-03-24)
So let's go back up to the top here and do another search.
9:01
S… Speaker 2 (2026-04-13 09-03-24)
So let's say we want to narrow this down.
9:04
S… Speaker 2 (2026-04-13 09-03-24)
We're going to narrow it down to a single host.
9:07
S… Speaker 2 (2026-04-13 09-03-24)
So we want to go with just the host named client.
9:10
S… Speaker 2 (2026-04-13 09-03-24)
Again, Splunk is going to be smart here and just go,
9:13
S… Speaker 2 (2026-04-13 09-03-24)
hey, here are your three hosts you have.
9:16
S… Speaker 1 (2026-04-13 09-03-24)
Which one do you want?
9:17
S… Speaker 1 (2026-04-13 09-03-24)
We'll pick client.
9:18
S… Speaker 2 (2026-04-13 09-03-24)
And it narrows down the events even further.
9:21
S… Speaker 2 (2026-04-13 09-03-24)
You can see how this is going.
9:22
S… Speaker 2 (2026-04-13 09-03-24)
We're just specifying multiple different fields here.
9:26
S… Speaker 2 (2026-04-13 09-03-24)
These are just our raw event searches.
9:29
S… Speaker 1 (2026-04-13 09-03-24)
And we can filter it down even more.
9:31
S… Speaker 2 (2026-04-13 09-03-24)
Let's say we want to find only the event code number
9:35
S… Speaker 1 (2026-04-13 09-03-24)
three.
9:36
S… Speaker 2 (2026-04-13 09-03-24)
That would be the syslog event number three.
9:40
S… Speaker 2 (2026-04-13 09-03-24)
Now we're going to have no results here.
9:42
S… Speaker 2 (2026-04-13 09-03-24)
The reason for that is because this event code,
9:46
S… Speaker 2 (2026-04-13 09-03-24)
this event ID,
9:47
S… Speaker 2 (2026-04-13 09-03-24)
an event code corresponds with event ID.
9:50
S… Speaker 2 (2026-04-13 09-03-24)
So the numbers match up.
9:51
S… Speaker 2 (2026-04-13 09-03-24)
So this would be a sysmon event ID three,
9:54
S… Speaker 2 (2026-04-13 09-03-24)
which is a network connection.
9:56
S… Speaker 2 (2026-04-13 09-03-24)
The reason we have no results here is because that event...
10:00
S… Speaker 1 (2026-04-13 09-03-24)
is not in the security event logs.
10:03
S… Speaker 1 (2026-04-13 09-03-24)
So we actually need to remove that.
10:05
S… Speaker 1 (2026-04-13 09-03-24)
We remove that,
10:06
S… Speaker 1 (2026-04-13 09-03-24)
press enter again,
10:07
S… Speaker 1 (2026-04-13 09-03-24)
now we have some information and we can see the different source
10:12
S… Speaker 1 (2026-04-13 09-03-24)
type.
10:12
S… Speaker 1 (2026-04-13 09-03-24)
So we don't specify a source type,
10:14
S… Speaker 1 (2026-04-13 09-03-24)
it's going to search across all of the source types here.
10:18
S… Speaker 1 (2026-04-13 09-03-24)
So again,
10:20
S… Speaker 1 (2026-04-13 09-03-24)
all of these so far have just been raw searches.
10:25
S… Speaker 1 (2026-04-13 09-03-24)
Let's take a look at one of the commands
10:29
S… Speaker 1 (2026-04-13 09-03-24)
we can use.
10:31
S… Speaker 1 (2026-04-13 09-03-24)
So let's remove the event code here.
10:34
S… Speaker 1 (2026-04-13 09-03-24)
Let's search for,
10:35
S… Speaker 1 (2026-04-13 09-03-24)
actually let's search for a different event code.
10:37
S… Speaker 1 (2026-04-13 09-03-24)
We're going to search for one related to PowerShell.
10:40
S… Speaker 1 (2026-04-13 09-03-24)
This is one of the PowerShell logging event.
10:43
S… Speaker 1 (2026-04-13 09-03-24)
Remember the event code corresponds to event IDs.
10:46
S… Speaker 1 (2026-04-13 09-03-24)
This would be event ID 4104.
10:49
S… Speaker 1 (2026-04-13 09-03-24)
And this time we are going to look inside the message
10:53
S… Speaker 1 (2026-04-13 09-03-24)
field.
10:54
S… Speaker 1 (2026-04-13 09-03-24)
So again,
10:54
S… Speaker 1 (2026-04-13 09-03-24)
we'll use a pipe character.
10:56
S… Speaker 1 (2026-04-13 09-03-24)
And Splunk,
10:57
S… Speaker 1 (2026-04-13 09-03-24)
assuming it's configured this way,
10:59
S… Speaker 1 (2026-04-13 09-03-24)
if you type a pipe,
11:00
S… Speaker 1 (2026-04-13 09-03-24)
it will automatically take you to a new line.
11:02
S… Speaker 1 (2026-04-13 09-03-24)
This is really just to keep the queries a little more organized
11:07
S… Speaker 1 (2026-04-13 09-03-24)
and easier to read.
11:09
S… Speaker 1 (2026-04-13 09-03-24)
So we're going to use the search command here.
11:11
S… Speaker 1 (2026-04-13 09-03-24)
And we're going to search the message field.
11:15
S… Speaker 1 (2026-04-13 09-03-24)
So we're going to do search message.
11:18
S… Speaker 1 (2026-04-13 09-03-24)
Put it in quotes.
11:19
S… Speaker 1 (2026-04-13 09-03-24)
And we can also,
11:21
S… Speaker 1 (2026-04-13 09-03-24)
when we're typing these queries,
11:22
S… Speaker 1 (2026-04-13 09-03-24)
you can use wildcards.
11:24
S… Speaker 1 (2026-04-13 09-03-24)
So we're going to look for suspicious PowerShell
11:28
S… Speaker 1 (2026-04-13 09-03-24)
commands here.
11:29
S… Speaker 1 (2026-04-13 09-03-24)
So there's a few different things we can look for.
11:32
S… Speaker 1 (2026-04-13 09-03-24)
We're going to look for invoke web request.
11:35
S… Speaker 1 (2026-04-13 09-03-24)
But because we're looking in the message,
11:37
S… Speaker 1 (2026-04-13 09-03-24)
remember we saw the message just a second ago contain a lot of information.
11:41
S… Speaker 1 (2026-04-13 09-03-24)
invoke web request is probably going to be surrounded by a lot of other text.
11:45
S… Speaker 1 (2026-04-13 09-03-24)
So we're going to use an asterisk here,
11:47
S… Speaker 1 (2026-04-13 09-03-24)
and we're going to do invoke web request,
11:50
S… Speaker 1 (2026-04-13 09-03-24)
another asterisk,
11:52
S… Speaker 1 (2026-04-13 09-03-24)
and then we will close the quotation mark.
11:55
S… Speaker 1 (2026-04-13 09-03-24)
We also want to search for IWR,
11:59
S… Speaker 1 (2026-04-13 09-03-24)
the short form of invoke web request.
12:02
S… Speaker 1 (2026-04-13 09-03-24)
So if we want to search for multiple different things in the message field,
12:06
S… Speaker 1 (2026-04-13 09-03-24)
there's a few different ways to do that.
12:07
S… Speaker 1 (2026-04-13 09-03-24)
One of those is to just simply use a Boolean.
12:10
S… Speaker 1 (2026-04-13 09-03-24)
They are case sensitive in Splunk,
12:12
S… Speaker 1 (2026-04-13 09-03-24)
so you should type it in uppercase for the Booleans or an and.
12:16
S… Speaker 1 (2026-04-13 09-03-24)
We're going to search again the message field,
12:19
S… Speaker 1 (2026-04-13 09-03-24)
and we're going to do IWR
12:23
S… Speaker 1 (2026-04-13 09-03-24)
this time.
12:24
S… Speaker 1 (2026-04-13 09-03-24)
And then we're also going to search for IEX,
12:28
S… Speaker 1 (2026-04-13 09-03-24)
invoke expression.
12:29
S… Speaker 1 (2026-04-13 09-03-24)
We'll just search for the short form of that.
12:32
S… Speaker 1 (2026-04-13 09-03-24)
So we will do IEX,
12:36
S… Speaker 1 (2026-04-13 09-03-24)
if I can type.
12:37
S… Speaker 1 (2026-04-13 09-03-24)
There we go.
12:40
S… Speaker 1 (2026-04-13 09-03-24)
Let's see what our results are.
12:41
S… Speaker 1 (2026-04-13 09-03-24)
We have one result.
12:42
S… Speaker 1 (2026-04-13 09-03-24)
So there is one result here for a suspicious PowerShell
12:47
S… Speaker 1 (2026-04-13 09-03-24)
command or what could be a suspicious PowerShell command.
12:51
S… Speaker 1 (2026-04-13 09-03-24)
If we go and expand this,
12:53
S… Speaker 1 (2026-04-13 09-03-24)
we see that it does create the message here contains invoke
12:58
S… Speaker 1 (2026-04-13 09-03-24)
web request as we specifically search for.
13:01
S… Speaker 1 (2026-04-13 09-03-24)
And we can see this appears to be some sort of a malicious file download
13:05
S… Speaker 1 (2026-04-13 09-03-24)
because they're using PowerShell to download an executable.
13:09
S… Speaker 1 (2026-04-13 09-03-24)
from an IP address.
13:11
S… Speaker 1 (2026-04-13 09-03-24)
So that is a way of using the search command.
13:13
S… Speaker 1 (2026-04-13 09-03-24)
There's a lot of other commands you can use.
13:17
S… Speaker 1 (2026-04-13 09-03-24)
Let's say we wanted to make this a little
13:21
S… Speaker 1 (2026-04-13 09-03-24)
easier to see.
13:22
S… Speaker 1 (2026-04-13 09-03-24)
Instead of having to expand the results,
13:25
S… Speaker 1 (2026-04-13 09-03-24)
what if we had,
13:26
S… Speaker 1 (2026-04-13 09-03-24)
you know, 300 results instead of one result that came up here?
13:30
S… Speaker 1 (2026-04-13 09-03-24)
And we just wanted to quickly see what type of commands might
13:34
S… Speaker 1 (2026-04-13 09-03-24)
have been run for our searches.
13:36
S… Speaker 1 (2026-04-13 09-03-24)
And again, we only have one result here,
13:37
S… Speaker 1 (2026-04-13 09-03-24)
so it's not going to be quite as impactful.
13:40
S… Speaker 1 (2026-04-13 09-03-24)
But one way we can do that is to format
13:44
S… Speaker 1 (2026-04-13 09-03-24)
the data into a table.
13:46
S… Speaker 1 (2026-04-13 09-03-24)
So we will do another pipe here.
13:49
S… Speaker 1 (2026-04-13 09-03-24)
and we will use the table command,
13:51
S… Speaker 1 (2026-04-13 09-03-24)
and we will then specify the fields we want
13:55
S… Speaker 1 (2026-04-13 09-03-24)
included in the table.
13:57
S… Speaker 1 (2026-04-13 09-03-24)
Now, there's an internal kind of field that's used by Splunk that
14:01
S… Speaker 1 (2026-04-13 09-03-24)
displays the time right here in the left -hand column.
14:04
S… Speaker 1 (2026-04-13 09-03-24)
It's not just time as it's labeled here.
14:08
S… Speaker 1 (2026-04-13 09-03-24)
You can relabel columns in tables,
14:11
S… Speaker 1 (2026-04-13 09-03-24)
but it is...
14:13
S… Speaker 1 (2026-04-13 09-03-24)
underscore lowercase time.
14:15
S… Speaker 1 (2026-04-13 09-03-24)
That's how you get it to display the time.
14:17
S… Speaker 1 (2026-04-13 09-03-24)
So let's say we want to make a table that has the time of the
14:21
S… Speaker 1 (2026-04-13 09-03-24)
event, the host that it happened on,
14:24
S… Speaker 1 (2026-04-13 09-03-24)
and then the full message.
14:26
S… Speaker 1 (2026-04-13 09-03-24)
So basically whatever the PowerShell script block that
14:30
S… Speaker 1 (2026-04-13 09-03-24)
was run was.
14:32
S… Speaker 1 (2026-04-13 09-03-24)
Press enter.
14:33
S… Speaker 1 (2026-04-13 09-03-24)
We see we see our same results,
14:35
S… Speaker 1 (2026-04-13 09-03-24)
but we have them in a much easier format to look for.
14:39
S… Speaker 1 (2026-04-13 09-03-24)
So we did a quick search here to look for suspicious PowerShell
14:44
S… Speaker 1 (2026-04-13 09-03-24)
commands,
14:45
S… Speaker 1 (2026-04-13 09-03-24)
and we get the time,
14:47
S… Speaker 1 (2026-04-13 09-03-24)
the host,
14:48
S… Speaker 1 (2026-04-13 09-03-24)
and the exact command that was run.
14:50
S… Speaker 1 (2026-04-13 09-03-24)
So we were looking at invoke web request.
14:52
S… Speaker 1 (2026-04-13 09-03-24)
Remember, we searched here for anything with invoke web
14:56
S… Speaker 1 (2026-04-13 09-03-24)
request in the message.
14:58
S… Speaker 1 (2026-04-13 09-03-24)
And again, there's many ways to format this.
15:00
S… Speaker 1 (2026-04-13 09-03-24)
This is just one option.
15:02
S… Speaker 1 (2026-04-13 09-03-24)
and we get the results in a much easier to see
15:07
S… Speaker 1 (2026-04-13 09-03-24)
form.
15:08
S… Speaker 1 (2026-04-13 09-03-24)
So this is kind of the basis of how these queries
15:12
S… Speaker 1 (2026-04-13 09-03-24)
are built.
15:13
S… Speaker 1 (2026-04-13 09-03-24)
We're going to keep expanding on these queries.
15:16
S… Speaker 1 (2026-04-13 09-03-24)
We're going to walk through some structured threat hunts here,
15:20
S… Speaker 1 (2026-04-13 09-03-24)
and there's going to be plenty to kind of play with in the lab
15:24
S… Speaker 1 (2026-04-13 09-03-24)
environment as well.
15:25
S… Speaker 1 (2026-04-13 09-03-24)
But this was just meant to be a quick introduction to
15:29
S… Speaker 1 (2026-04-13 09-03-24)
what SPL is,
15:31
S… Speaker 1 (2026-04-13 09-03-24)
and how these queries can be constructed.

Гэты тэкст быў створаны AI (аўтаматычнае вызначэнне мовы). Можа ўтрымліваць памылкі - праверце з арыгінальным гукам для выкарыстання. Палітыка AI

❤️ Любіш STT.ai? Раскажы сваім сябрам!
Кароткае апісанне
Націсніце "Сумаваць", каб стварыць падрабязнае апісанне гэтага транскрыпту.
Падрыхтоўка...
Запытаць у AI пра гэты пераклад
Запытайцеся пра што-небудзь з гэтага перакладу — машынны інтэлект знойдзе адпаведныя раздзелы і адкажа.
Перапісаць іншае