2026-04-13 09-03-24

May 25, 2026 14:43 · 15:56 · English · Whisper Turbo · 2 اسپيڪر
هيءَ ترانسڪريٽ اڄ ختم ٿيندي. ساري وقت جي ذخيري لاءِ اپ گريڊ →
لکت جو فهرست
صرف ڏيکارڻ
0:07
S… Speaker 1 (2026-04-13 09-03-24)
When you're writing queries in Splunk to perform
0:12
S… Speaker 1 (2026-04-13 09-03-24)
threat hunts,
0:13
S… Speaker 1 (2026-04-13 09-03-24)
you need to be familiar with the Splunk processing language.
0:18
S… Speaker 1 (2026-04-13 09-03-24)
It is how those queries are going to be formatted.
0:21
S… Speaker 1 (2026-04-13 09-03-24)
So let's take a look here at how these SPL
0:25
S… Speaker 1 (2026-04-13 09-03-24)
queries are formatted so that we can have or perform our
0:30
S… Speaker 1 (2026-04-13 09-03-24)
effective threat hunts.
0:31
S… Speaker 2 (2026-04-13 09-03-24)
Now,
0:32
S… Speaker 1 (2026-04-13 09-03-24)
I said in our last video,
0:34
S… Speaker 1 (2026-04-13 09-03-24)
if you've watched that all,
0:36
S… Speaker 1 (2026-04-13 09-03-24)
data in Splunk is stored in an index.
0:39
S… Speaker 1 (2026-04-13 09-03-24)
Everything is in an index,
0:42
S… Speaker 1 (2026-04-13 09-03-24)
and Splunk can have many different indexes,
0:45
S… Speaker 1 (2026-04-13 09-03-24)
just depends on how the organization needs to architecture their
0:49
S… Speaker 1 (2026-04-13 09-03-24)
systems.
0:50
S… Speaker 1 (2026-04-13 09-03-24)
Splunk has one main index that is just labeled as main,
0:54
S… Speaker 1 (2026-04-13 09-03-24)
but it is again best practice to not store production data
0:59
S… Speaker 1 (2026-04-13 09-03-24)
in that index.
1:00
S… Speaker 2 (2026-04-13 09-03-24)
However,
1:01
S… Speaker 1 (2026-04-13 09-03-24)
if you do not include an index in your search query,
1:05
S… Speaker 1 (2026-04-13 09-03-24)
then it is only going to search that main index.
1:10
S… Speaker 1 (2026-04-13 09-03-24)
Normally, if you exclude something,
1:13
S… Speaker 1 (2026-04-13 09-03-24)
it means it's not going to filter it out as much and it will include all
1:17
S… Speaker 1 (2026-04-13 09-03-24)
of the data.
1:18
S… Speaker 2 (2026-04-13 09-03-24)
In this case,
1:18
S… Speaker 1 (2026-04-13 09-03-24)
for the index field,
1:20
S… Speaker 1 (2026-04-13 09-03-24)
that is not true.
1:21
S… Speaker 1 (2026-04-13 09-03-24)
You need to specify which index you are trying to pull
1:25
S… Speaker 1 (2026-04-13 09-03-24)
data from.
1:25
S… Speaker 1 (2026-04-13 09-03-24)
If you don't and it's not in main,
1:28
S… Speaker 1 (2026-04-13 09-03-24)
then you're not going to see that data.
1:31
S… Speaker 1 (2026-04-13 09-03-24)
And once we go through all of these components here,
1:34
S… Speaker 1 (2026-04-13 09-03-24)
we'll take a look at how these queries are actually built in Splunk.
1:38
S… Speaker 1 (2026-04-13 09-03-24)
You also have the option to specify a source type.
1:41
S… Speaker 1 (2026-04-13 09-03-24)
This can narrow down the data,
1:44
S… Speaker 1 (2026-04-13 09-03-24)
the type of data,
1:46
S… Speaker 1 (2026-04-13 09-03-24)
the type of log that's being searched,
1:48
S… Speaker 1 (2026-04-13 09-03-24)
and you can see a list of the available source types when you
1:52
S… Speaker 1 (2026-04-13 09-03-24)
go and look at the data summary in Splunk,
1:55
S… Speaker 1 (2026-04-13 09-03-24)
which we did look at in our Splunk introduction video.
1:59
S… Speaker 1 (2026-04-13 09-03-24)
You can also do any number of filters in your query
2:04
S… Speaker 1 (2026-04-13 09-03-24)
to kind of narrow down the search by specifying what
2:08
S… Speaker 1 (2026-04-13 09-03-24)
fields should match what specific data.
2:12
S… Speaker 1 (2026-04-13 09-03-24)
And again, we'll take a look at all of this here in a second.
2:15
S… Speaker 1 (2026-04-13 09-03-24)
SPL does support using pipes,
2:18
S… Speaker 1 (2026-04-13 09-03-24)
kind of the vertical line character,
2:20
S… Speaker 1 (2026-04-13 09-03-24)
and they have a very similar function to when they're used in,
2:24
S… Speaker 1 (2026-04-13 09-03-24)
say, a CLI command.
2:25
S… Speaker 1 (2026-04-13 09-03-24)
Basically, it passes the output of one command to the input
2:30
S… Speaker 2 (2026-04-13 09-03-24)
of the next,
2:31
S… Speaker 1 (2026-04-13 09-03-24)
and Splunk does support what it calls commands.
2:34
S… Speaker 1 (2026-04-13 09-03-24)
This basically tells Splunk what to do with
2:39
S… Speaker 1 (2026-04-13 09-03-24)
certain events after their retrieve from the index.
2:42
S… Speaker 1 (2026-04-13 09-03-24)
A good portion of what you do in Splunk
2:46
S… Speaker 1 (2026-04-13 09-03-24)
is going to be,
2:48
S… Speaker 1 (2026-04-13 09-03-24)
you know...
2:50
S… Speaker 1 (2026-04-13 09-03-24)
Let me rephrase that.
2:52
S… Speaker 1 (2026-04-13 09-03-24)
A good portion of what you're typing in and building with that query
2:56
S… Speaker 1 (2026-04-13 09-03-24)
is going to be commands.
2:58
S… Speaker 1 (2026-04-13 09-03-24)
There's a lot of different commands.
3:02
S… Speaker 1 (2026-04-13 09-03-24)
There's a lot of different filters you can use,
3:05
S… Speaker 1 (2026-04-13 09-03-24)
and filters and commands are going to be the two most common things.
3:09
S… Speaker 2 (2026-04-13 09-03-24)
And by commands,
3:09
S… Speaker 1 (2026-04-13 09-03-24)
I'm talking about using things like the table command to
3:13
S… Speaker 1 (2026-04-13 09-03-24)
format the data into a table.
3:16
S… Speaker 1 (2026-04-13 09-03-24)
You have stats,
3:18
S… Speaker 1 (2026-04-13 09-03-24)
which will do any number of different kind of alterations
3:22
S… Speaker 1 (2026-04-13 09-03-24)
to the appearance of the data,
3:24
S… Speaker 1 (2026-04-13 09-03-24)
and will kind of organize the data in different manners,
3:27
S… Speaker 1 (2026-04-13 09-03-24)
and we'll take a look at some of those.
3:29
S… Speaker 1 (2026-04-13 09-03-24)
You can sort the data by different fields,
3:32
S… Speaker 1 (2026-04-13 09-03-24)
or you can show the most common values by using
3:36
S… Speaker 1 (2026-04-13 09-03-24)
the top command.
3:38
S… Speaker 2 (2026-04-13 09-03-24)
In addition,
3:39
S… Speaker 1 (2026-04-13 09-03-24)
you can use the dedupe command to kind of remove duplicates
3:43
S… Speaker 1 (2026-04-13 09-03-24)
in the events as well,
3:45
S… Speaker 1 (2026-04-13 09-03-24)
and you can specify the field you want to deduplicate by as well.
3:49
S… Speaker 1 (2026-04-13 09-03-24)
There's a lot of different commands.
3:50
S… Speaker 1 (2026-04-13 09-03-24)
These are just some of the most common you will use.
3:54
S… Speaker 1 (2026-04-13 09-03-24)
When you're talking about your filters and your fields,
3:58
S… Speaker 1 (2026-04-13 09-03-24)
everything is going to be field equals value.
4:01
S… Speaker 1 (2026-04-13 09-03-24)
That's the exact way it's going to be formatted.
4:04
S… Speaker 1 (2026-04-13 09-03-24)
But you can also use forms of grouping.
4:07
S… Speaker 1 (2026-04-13 09-03-24)
You can use Boolean logic like and and or,
4:11
S… Speaker 1 (2026-04-13 09-03-24)
and grouping is done with parentheses.
4:14
S… Speaker 1 (2026-04-13 09-03-24)
Now you have your raw event search and you have a transforming
4:19
S… Speaker 1 (2026-04-13 09-03-24)
search.
4:20
S… Speaker 1 (2026-04-13 09-03-24)
A raw event search kind of does what it sounds like.
4:24
S… Speaker 1 (2026-04-13 09-03-24)
It retrieves information from the index or indexes if you're
4:28
S… Speaker 1 (2026-04-13 09-03-24)
specifying more than one index you want to search,
4:30
S… Speaker 1 (2026-04-13 09-03-24)
but it doesn't typically include any commands.
4:34
S… Speaker 1 (2026-04-13 09-03-24)
It is just retrieving data.
4:36
S… Speaker 1 (2026-04-13 09-03-24)
It's not doing anything to that data,
4:39
S… Speaker 1 (2026-04-13 09-03-24)
the raw event search.
4:40
S… Speaker 1 (2026-04-13 09-03-24)
You have the transforming search,
4:43
S… Speaker 1 (2026-04-13 09-03-24)
which
4:43
S… Speaker 1 (2026-04-13 09-03-24)
transforms the results in some way.
4:46
S… Speaker 1 (2026-04-13 09-03-24)
It performs some type of calculation or visualization
4:51
S… Speaker 1 (2026-04-13 09-03-24)
to that data to kind of change how the information
4:55
S… Speaker 1 (2026-04-13 09-03-24)
is presented.
4:56
S… Speaker 1 (2026-04-13 09-03-24)
This is always going to include fields.
5:00
S… Speaker 2 (2026-04-13 09-03-24)
always going to include commands.
5:02
S… Speaker 2 (2026-04-13 09-03-24)
So your raw event search is basically going to be just using fields,
5:06
S… Speaker 2 (2026-04-13 09-03-24)
you know, a field equals a value,
5:08
S… Speaker 2 (2026-04-13 09-03-24)
and your transforming search is more going to be using more of your filters and
5:13
S… Speaker 2 (2026-04-13 09-03-24)
your commands as well.
5:16
S… Speaker 2 (2026-04-13 09-03-24)
So let's go ahead and jump into our lab environment
5:20
S… Speaker 2 (2026-04-13 09-03-24)
and take a look at how these queries are actually structured
5:24
S… Speaker 2 (2026-04-13 09-03-24)
in some example searches.
5:28
S… Speaker 1 (2026-04-13 09-03-24)
All right,
5:28
S… Speaker 1 (2026-04-13 09-03-24)
here in our search dashboard,
5:30
S… Speaker 2 (2026-04-13 09-03-24)
which if you watched the introduction video,
5:33
S… Speaker 1 (2026-04-13 09-03-24)
you're already familiar with this,
5:34
S… Speaker 2 (2026-04-13 09-03-24)
or if you've used Splunk before,
5:35
S… Speaker 1 (2026-04-13 09-03-24)
you're definitely familiar with this.
5:37
S… Speaker 2 (2026-04-13 09-03-24)
The first thing I want to do is verify our time frame that we're
5:41
S… Speaker 1 (2026-04-13 09-03-24)
looking at.
5:42
S… Speaker 2 (2026-04-13 09-03-24)
Again, for the purposes of this lab,
5:43
S… Speaker 2 (2026-04-13 09-03-24)
we're just going to select all time because we don't have that much data.
5:47
S… Speaker 1 (2026-04-13 09-03-24)
If you have...
5:49
S… Speaker 2 (2026-04-13 09-03-24)
you know, millions of events in your Splunk environment,
5:52
S… Speaker 2 (2026-04-13 09-03-24)
you probably don't want to select all time because it will have a very
5:56
S… Speaker 2 (2026-04-13 09-03-24)
large performance impact on your searches.
6:00
S… Speaker 2 (2026-04-13 09-03-24)
So let's take a look at basically just a basic index only
6:04
S… Speaker 2 (2026-04-13 09-03-24)
search, which we also did in our introduction video.
6:06
S… Speaker 2 (2026-04-13 09-03-24)
So in the purpose for this lab,
6:08
S… Speaker 2 (2026-04-13 09-03-24)
all of our data is going to be in the ECTHP
6:12
S… Speaker 1 (2026-04-13 09-03-24)
index.
6:13
S… Speaker 2 (2026-04-13 09-03-24)
So to show all that data,
6:14
S… Speaker 2 (2026-04-13 09-03-24)
we just do index equals ECTHP.
6:17
S… Speaker 2 (2026-04-13 09-03-24)
And you can see we returned 4 ,156
6:22
S… Speaker 2 (2026-04-13 09-03-24)
events right here,
6:23
S… Speaker 2 (2026-04-13 09-03-24)
which is all of the events for this log.
6:26
S… Speaker 2 (2026-04-13 09-03-24)
So that is just a simple index search.
6:29
S… Speaker 2 (2026-04-13 09-03-24)
And again, a lot of what you're going to kind of see in Splunk
6:33
S… Speaker 2 (2026-04-13 09-03-24)
searches is this simple field equals value.
6:37
S… Speaker 2 (2026-04-13 09-03-24)
And that's exactly what this is.
6:38
S… Speaker 1 (2026-04-13 09-03-24)
And remember,
6:39
S… Speaker 2 (2026-04-13 09-03-24)
again, the index is very important.
6:42
S… Speaker 2 (2026-04-13 09-03-24)
If you do not specify an index,
6:46
S… Speaker 2 (2026-04-13 09-03-24)
Splunk assumes you are only searching the main index.
6:50
S… Speaker 2 (2026-04-13 09-03-24)
It will not return any data from any other indexes.
6:54
S… Speaker 2 (2026-04-13 09-03-24)
So let's say we wanted to look at all of the events,
6:59
S… Speaker 2 (2026-04-13 09-03-24)
all the logs from the Windows event log,
7:01
S… Speaker 2 (2026-04-13 09-03-24)
specifically the security event log.
7:04
S… Speaker 2 (2026-04-13 09-03-24)
We know that's going to be a source type specifically,
7:07
S… Speaker 2 (2026-04-13 09-03-24)
and you can see there's a lot of autocomplete options here.
7:10
S… Speaker 2 (2026-04-13 09-03-24)
So for the purposes of this,
7:12
S… Speaker 2 (2026-04-13 09-03-24)
we want the win event log security.
7:15
S… Speaker 2 (2026-04-13 09-03-24)
And we can just hit enter right there,
7:17
S… Speaker 1 (2026-04-13 09-03-24)
and it will show,
7:17
S… Speaker 2 (2026-04-13 09-03-24)
it will basically complete the query for us when we're specifying a
7:22
S… Speaker 2 (2026-04-13 09-03-24)
source type.
7:23
S… Speaker 2 (2026-04-13 09-03-24)
A lot of the values when you're doing the field value should
7:27
S… Speaker 2 (2026-04-13 09-03-24)
be included in quotation marks,
7:29
S… Speaker 2 (2026-04-13 09-03-24)
just so there's no kind of ambiguity here in the
7:33
S… Speaker 1 (2026-04-13 09-03-24)
query.
7:34
S… Speaker 2 (2026-04-13 09-03-24)
We're going to look at only security events,
7:37
S… Speaker 2 (2026-04-13 09-03-24)
and we see that our logs include just security events,
7:41
S… Speaker 2 (2026-04-13 09-03-24)
as we can see here from log name security.
7:43
S… Speaker 2 (2026-04-13 09-03-24)
And we can see the source is the win event log security,
7:47
S… Speaker 2 (2026-04-13 09-03-24)
which also happens to be the name of the source type as well.
7:52
S… Speaker 1 (2026-04-13 09-03-24)
On the left -hand side here,
7:53
S… Speaker 2 (2026-04-13 09-03-24)
we can see fields that are returned in our data.
7:57
S… Speaker 2 (2026-04-13 09-03-24)
So we can see what hosts did this data come from.
8:00
S… Speaker 2 (2026-04-13 09-03-24)
So we see there are three different hosts that sent security log
8:04
S… Speaker 2 (2026-04-13 09-03-24)
information to Splunk,
8:06
S… Speaker 2 (2026-04-13 09-03-24)
prod, sec logs,
8:07
S… Speaker 1 (2026-04-13 09-03-24)
and client.
8:08
S… Speaker 2 (2026-04-13 09-03-24)
We can see account domain information.
8:11
S… Speaker 2 (2026-04-13 09-03-24)
We can see account name information.
8:13
S… Speaker 2 (2026-04-13 09-03-24)
So basically any of the...
8:17
S… Speaker 2 (2026-04-13 09-03-24)
the events,
8:18
S… Speaker 2 (2026-04-13 09-03-24)
any of the data in here that Splunk pulls out into fields is
8:22
S… Speaker 2 (2026-04-13 09-03-24)
going to be listed out here on the side.
8:24
S… Speaker 2 (2026-04-13 09-03-24)
Now, one of the key ones that's going to contain a lot of information is
8:28
S… Speaker 2 (2026-04-13 09-03-24)
the message field.
8:31
S… Speaker 1 (2026-04-13 09-03-24)
Take a look at that.
8:32
S… Speaker 2 (2026-04-13 09-03-24)
We're going to expand one of these events here,
8:34
S… Speaker 2 (2026-04-13 09-03-24)
and you can see all of the fields that are included in here,
8:37
S… Speaker 2 (2026-04-13 09-03-24)
including the message field.
8:39
S… Speaker 2 (2026-04-13 09-03-24)
The message field contains the bulk of the data,
8:42
S… Speaker 2 (2026-04-13 09-03-24)
at least when we're talking about our Windows events.
8:45
S… Speaker 2 (2026-04-13 09-03-24)
So it's always good if you have a specific keyword that you're looking
8:49
S… Speaker 2 (2026-04-13 09-03-24)
for that would normally be just included in the event itself,
8:52
S… Speaker 2 (2026-04-13 09-03-24)
then you want to probably search the message field.
8:57
S… Speaker 2 (2026-04-13 09-03-24)
So let's go back up to the top here and do another search.
9:01
S… Speaker 2 (2026-04-13 09-03-24)
So let's say we want to narrow this down.
9:04
S… Speaker 2 (2026-04-13 09-03-24)
We're going to narrow it down to a single host.
9:07
S… Speaker 2 (2026-04-13 09-03-24)
So we want to go with just the host named client.
9:10
S… Speaker 2 (2026-04-13 09-03-24)
Again, Splunk is going to be smart here and just go,
9:13
S… Speaker 2 (2026-04-13 09-03-24)
hey, here are your three hosts you have.
9:16
S… Speaker 1 (2026-04-13 09-03-24)
Which one do you want?
9:17
S… Speaker 1 (2026-04-13 09-03-24)
We'll pick client.
9:18
S… Speaker 2 (2026-04-13 09-03-24)
And it narrows down the events even further.
9:21
S… Speaker 2 (2026-04-13 09-03-24)
You can see how this is going.
9:22
S… Speaker 2 (2026-04-13 09-03-24)
We're just specifying multiple different fields here.
9:26
S… Speaker 2 (2026-04-13 09-03-24)
These are just our raw event searches.
9:29
S… Speaker 1 (2026-04-13 09-03-24)
And we can filter it down even more.
9:31
S… Speaker 2 (2026-04-13 09-03-24)
Let's say we want to find only the event code number
9:35
S… Speaker 1 (2026-04-13 09-03-24)
three.
9:36
S… Speaker 2 (2026-04-13 09-03-24)
That would be the syslog event number three.
9:40
S… Speaker 2 (2026-04-13 09-03-24)
Now we're going to have no results here.
9:42
S… Speaker 2 (2026-04-13 09-03-24)
The reason for that is because this event code,
9:46
S… Speaker 2 (2026-04-13 09-03-24)
this event ID,
9:47
S… Speaker 2 (2026-04-13 09-03-24)
an event code corresponds with event ID.
9:50
S… Speaker 2 (2026-04-13 09-03-24)
So the numbers match up.
9:51
S… Speaker 2 (2026-04-13 09-03-24)
So this would be a sysmon event ID three,
9:54
S… Speaker 2 (2026-04-13 09-03-24)
which is a network connection.
9:56
S… Speaker 2 (2026-04-13 09-03-24)
The reason we have no results here is because that event...
10:00
S… Speaker 1 (2026-04-13 09-03-24)
is not in the security event logs.
10:03
S… Speaker 1 (2026-04-13 09-03-24)
So we actually need to remove that.
10:05
S… Speaker 1 (2026-04-13 09-03-24)
We remove that,
10:06
S… Speaker 1 (2026-04-13 09-03-24)
press enter again,
10:07
S… Speaker 1 (2026-04-13 09-03-24)
now we have some information and we can see the different source
10:12
S… Speaker 1 (2026-04-13 09-03-24)
type.
10:12
S… Speaker 1 (2026-04-13 09-03-24)
So we don't specify a source type,
10:14
S… Speaker 1 (2026-04-13 09-03-24)
it's going to search across all of the source types here.
10:18
S… Speaker 1 (2026-04-13 09-03-24)
So again,
10:20
S… Speaker 1 (2026-04-13 09-03-24)
all of these so far have just been raw searches.
10:25
S… Speaker 1 (2026-04-13 09-03-24)
Let's take a look at one of the commands
10:29
S… Speaker 1 (2026-04-13 09-03-24)
we can use.
10:31
S… Speaker 1 (2026-04-13 09-03-24)
So let's remove the event code here.
10:34
S… Speaker 1 (2026-04-13 09-03-24)
Let's search for,
10:35
S… Speaker 1 (2026-04-13 09-03-24)
actually let's search for a different event code.
10:37
S… Speaker 1 (2026-04-13 09-03-24)
We're going to search for one related to PowerShell.
10:40
S… Speaker 1 (2026-04-13 09-03-24)
This is one of the PowerShell logging event.
10:43
S… Speaker 1 (2026-04-13 09-03-24)
Remember the event code corresponds to event IDs.
10:46
S… Speaker 1 (2026-04-13 09-03-24)
This would be event ID 4104.
10:49
S… Speaker 1 (2026-04-13 09-03-24)
And this time we are going to look inside the message
10:53
S… Speaker 1 (2026-04-13 09-03-24)
field.
10:54
S… Speaker 1 (2026-04-13 09-03-24)
So again,
10:54
S… Speaker 1 (2026-04-13 09-03-24)
we'll use a pipe character.
10:56
S… Speaker 1 (2026-04-13 09-03-24)
And Splunk,
10:57
S… Speaker 1 (2026-04-13 09-03-24)
assuming it's configured this way,
10:59
S… Speaker 1 (2026-04-13 09-03-24)
if you type a pipe,
11:00
S… Speaker 1 (2026-04-13 09-03-24)
it will automatically take you to a new line.
11:02
S… Speaker 1 (2026-04-13 09-03-24)
This is really just to keep the queries a little more organized
11:07
S… Speaker 1 (2026-04-13 09-03-24)
and easier to read.
11:09
S… Speaker 1 (2026-04-13 09-03-24)
So we're going to use the search command here.
11:11
S… Speaker 1 (2026-04-13 09-03-24)
And we're going to search the message field.
11:15
S… Speaker 1 (2026-04-13 09-03-24)
So we're going to do search message.
11:18
S… Speaker 1 (2026-04-13 09-03-24)
Put it in quotes.
11:19
S… Speaker 1 (2026-04-13 09-03-24)
And we can also,
11:21
S… Speaker 1 (2026-04-13 09-03-24)
when we're typing these queries,
11:22
S… Speaker 1 (2026-04-13 09-03-24)
you can use wildcards.
11:24
S… Speaker 1 (2026-04-13 09-03-24)
So we're going to look for suspicious PowerShell
11:28
S… Speaker 1 (2026-04-13 09-03-24)
commands here.
11:29
S… Speaker 1 (2026-04-13 09-03-24)
So there's a few different things we can look for.
11:32
S… Speaker 1 (2026-04-13 09-03-24)
We're going to look for invoke web request.
11:35
S… Speaker 1 (2026-04-13 09-03-24)
But because we're looking in the message,
11:37
S… Speaker 1 (2026-04-13 09-03-24)
remember we saw the message just a second ago contain a lot of information.
11:41
S… Speaker 1 (2026-04-13 09-03-24)
invoke web request is probably going to be surrounded by a lot of other text.
11:45
S… Speaker 1 (2026-04-13 09-03-24)
So we're going to use an asterisk here,
11:47
S… Speaker 1 (2026-04-13 09-03-24)
and we're going to do invoke web request,
11:50
S… Speaker 1 (2026-04-13 09-03-24)
another asterisk,
11:52
S… Speaker 1 (2026-04-13 09-03-24)
and then we will close the quotation mark.
11:55
S… Speaker 1 (2026-04-13 09-03-24)
We also want to search for IWR,
11:59
S… Speaker 1 (2026-04-13 09-03-24)
the short form of invoke web request.
12:02
S… Speaker 1 (2026-04-13 09-03-24)
So if we want to search for multiple different things in the message field,
12:06
S… Speaker 1 (2026-04-13 09-03-24)
there's a few different ways to do that.
12:07
S… Speaker 1 (2026-04-13 09-03-24)
One of those is to just simply use a Boolean.
12:10
S… Speaker 1 (2026-04-13 09-03-24)
They are case sensitive in Splunk,
12:12
S… Speaker 1 (2026-04-13 09-03-24)
so you should type it in uppercase for the Booleans or an and.
12:16
S… Speaker 1 (2026-04-13 09-03-24)
We're going to search again the message field,
12:19
S… Speaker 1 (2026-04-13 09-03-24)
and we're going to do IWR
12:23
S… Speaker 1 (2026-04-13 09-03-24)
this time.
12:24
S… Speaker 1 (2026-04-13 09-03-24)
And then we're also going to search for IEX,
12:28
S… Speaker 1 (2026-04-13 09-03-24)
invoke expression.
12:29
S… Speaker 1 (2026-04-13 09-03-24)
We'll just search for the short form of that.
12:32
S… Speaker 1 (2026-04-13 09-03-24)
So we will do IEX,
12:36
S… Speaker 1 (2026-04-13 09-03-24)
if I can type.
12:37
S… Speaker 1 (2026-04-13 09-03-24)
There we go.
12:40
S… Speaker 1 (2026-04-13 09-03-24)
Let's see what our results are.
12:41
S… Speaker 1 (2026-04-13 09-03-24)
We have one result.
12:42
S… Speaker 1 (2026-04-13 09-03-24)
So there is one result here for a suspicious PowerShell
12:47
S… Speaker 1 (2026-04-13 09-03-24)
command or what could be a suspicious PowerShell command.
12:51
S… Speaker 1 (2026-04-13 09-03-24)
If we go and expand this,
12:53
S… Speaker 1 (2026-04-13 09-03-24)
we see that it does create the message here contains invoke
12:58
S… Speaker 1 (2026-04-13 09-03-24)
web request as we specifically search for.
13:01
S… Speaker 1 (2026-04-13 09-03-24)
And we can see this appears to be some sort of a malicious file download
13:05
S… Speaker 1 (2026-04-13 09-03-24)
because they're using PowerShell to download an executable.
13:09
S… Speaker 1 (2026-04-13 09-03-24)
from an IP address.
13:11
S… Speaker 1 (2026-04-13 09-03-24)
So that is a way of using the search command.
13:13
S… Speaker 1 (2026-04-13 09-03-24)
There's a lot of other commands you can use.
13:17
S… Speaker 1 (2026-04-13 09-03-24)
Let's say we wanted to make this a little
13:21
S… Speaker 1 (2026-04-13 09-03-24)
easier to see.
13:22
S… Speaker 1 (2026-04-13 09-03-24)
Instead of having to expand the results,
13:25
S… Speaker 1 (2026-04-13 09-03-24)
what if we had,
13:26
S… Speaker 1 (2026-04-13 09-03-24)
you know, 300 results instead of one result that came up here?
13:30
S… Speaker 1 (2026-04-13 09-03-24)
And we just wanted to quickly see what type of commands might
13:34
S… Speaker 1 (2026-04-13 09-03-24)
have been run for our searches.
13:36
S… Speaker 1 (2026-04-13 09-03-24)
And again, we only have one result here,
13:37
S… Speaker 1 (2026-04-13 09-03-24)
so it's not going to be quite as impactful.
13:40
S… Speaker 1 (2026-04-13 09-03-24)
But one way we can do that is to format
13:44
S… Speaker 1 (2026-04-13 09-03-24)
the data into a table.
13:46
S… Speaker 1 (2026-04-13 09-03-24)
So we will do another pipe here.
13:49
S… Speaker 1 (2026-04-13 09-03-24)
and we will use the table command,
13:51
S… Speaker 1 (2026-04-13 09-03-24)
and we will then specify the fields we want
13:55
S… Speaker 1 (2026-04-13 09-03-24)
included in the table.
13:57
S… Speaker 1 (2026-04-13 09-03-24)
Now, there's an internal kind of field that's used by Splunk that
14:01
S… Speaker 1 (2026-04-13 09-03-24)
displays the time right here in the left -hand column.
14:04
S… Speaker 1 (2026-04-13 09-03-24)
It's not just time as it's labeled here.
14:08
S… Speaker 1 (2026-04-13 09-03-24)
You can relabel columns in tables,
14:11
S… Speaker 1 (2026-04-13 09-03-24)
but it is...
14:13
S… Speaker 1 (2026-04-13 09-03-24)
underscore lowercase time.
14:15
S… Speaker 1 (2026-04-13 09-03-24)
That's how you get it to display the time.
14:17
S… Speaker 1 (2026-04-13 09-03-24)
So let's say we want to make a table that has the time of the
14:21
S… Speaker 1 (2026-04-13 09-03-24)
event, the host that it happened on,
14:24
S… Speaker 1 (2026-04-13 09-03-24)
and then the full message.
14:26
S… Speaker 1 (2026-04-13 09-03-24)
So basically whatever the PowerShell script block that
14:30
S… Speaker 1 (2026-04-13 09-03-24)
was run was.
14:32
S… Speaker 1 (2026-04-13 09-03-24)
Press enter.
14:33
S… Speaker 1 (2026-04-13 09-03-24)
We see we see our same results,
14:35
S… Speaker 1 (2026-04-13 09-03-24)
but we have them in a much easier format to look for.
14:39
S… Speaker 1 (2026-04-13 09-03-24)
So we did a quick search here to look for suspicious PowerShell
14:44
S… Speaker 1 (2026-04-13 09-03-24)
commands,
14:45
S… Speaker 1 (2026-04-13 09-03-24)
and we get the time,
14:47
S… Speaker 1 (2026-04-13 09-03-24)
the host,
14:48
S… Speaker 1 (2026-04-13 09-03-24)
and the exact command that was run.
14:50
S… Speaker 1 (2026-04-13 09-03-24)
So we were looking at invoke web request.
14:52
S… Speaker 1 (2026-04-13 09-03-24)
Remember, we searched here for anything with invoke web
14:56
S… Speaker 1 (2026-04-13 09-03-24)
request in the message.
14:58
S… Speaker 1 (2026-04-13 09-03-24)
And again, there's many ways to format this.
15:00
S… Speaker 1 (2026-04-13 09-03-24)
This is just one option.
15:02
S… Speaker 1 (2026-04-13 09-03-24)
and we get the results in a much easier to see
15:07
S… Speaker 1 (2026-04-13 09-03-24)
form.
15:08
S… Speaker 1 (2026-04-13 09-03-24)
So this is kind of the basis of how these queries
15:12
S… Speaker 1 (2026-04-13 09-03-24)
are built.
15:13
S… Speaker 1 (2026-04-13 09-03-24)
We're going to keep expanding on these queries.
15:16
S… Speaker 1 (2026-04-13 09-03-24)
We're going to walk through some structured threat hunts here,
15:20
S… Speaker 1 (2026-04-13 09-03-24)
and there's going to be plenty to kind of play with in the lab
15:24
S… Speaker 1 (2026-04-13 09-03-24)
environment as well.
15:25
S… Speaker 1 (2026-04-13 09-03-24)
But this was just meant to be a quick introduction to
15:29
S… Speaker 1 (2026-04-13 09-03-24)
what SPL is,
15:31
S… Speaker 1 (2026-04-13 09-03-24)
and how these queries can be constructed.

هيءَ ترانسڪريٽ AI (آٽوميٽڪ سڏ سڃاڻپ) پاران تيار ڪئي وئي آھي. ان ۾ غلطيون ٿي سگھن ٿيون - اصل آڊيو سان چيڪ ڪريو ته جيئن خطرناڪ استعمال ڪري سگھجي. AI پاليسي

❤️ STT.ai کي پيارو آهي؟ پنھنجن دوستن کي چئو!
خلاصو
ھن ترانسڪريپٽ جي AI خلاصي پيدا ڪرڻ لاءِ خلاصو دٻايو.
خلاصو ڪيو وڃي ٿو...
AI کان ان ترانسڪريپٽ بابت پڇو
ھن ترانسڪريپشن بابت ڪابه سوال ڪريو - AI لاڳاپيل حصا ڳوليندو ۽ جواب ڏيندو.
ٻيو لکڻ