👋 keywords discussions

[mthcht]

👋 Welcome!

We’re using Discussions as a place to connect with other members of our community. We hope that you:

• Ask questions you’re wondering about.
• Share ideas.
• Engage with other community members.
• Welcome others and are open-minded. Remember that this is a community we
  build together 💪

[L0ranCyb]

Hello, The search on the _raw can be very very long and impossible in a production environment.
The list of keywords (threathunting-keywords.csv) cannot be used with a datamodel search. This is because the keywords used often have space. Because of the blanks positioned in the keyword lookup, this cannot be matched with a field from a datamodel where there is only (without spaces).

Example:
keyword: * --coin=monero*
command in datamodel endpoint : --coin=monero
--> this cannot match because of the 2 spaces between * and --.

Maybe we need a version of threathunting-keywords.csv without this spaces?

[mthcht]

@L0ranCyb Hello i guess you are working with the ELK stack ? with ELK there is a lot of restrictions, you have two options:

• Use another list available here in the same repo https://github.com/mthcht/ThreatHunting-Keywords/tree/main/elk (it's not a direct extract of threathunting-keywords.csv, it's modified for ELK)
• Use Sigma "hunting" rules, directly extracted from this project https://github.com/mthcht/ThreatHunting-Keywords-sigma-rules with pysigma for the convertion

[L0ranCyb]

Thanks for the response ! But it's with Splunk. ;-)

[mthcht]

@L0ranCyb It's working for me:

Splunk doesn't have issues with special caracters or spaces for matching fields, it should work for you too, did you declare your lookup definition like this https://github.com/mthcht/ThreatHunting-Keywords?tab=readme-ov-file#use-the-list-to-hunt-with-splunk ?

For the keyword it shoud have been * --coin=monero* i put two spaces by error, but still it works in my example

[L0ranCyb]

sorry, I make an error in the search filter (metadata is not metata!!)
Everything works perfectly well !!!!
Thanks for the job !

[L0ranCyb]

hello, I think there's an error for the keyword "* rusthound.exe*".
the process rusthound.exe is not detected because the keyword "* rusthound.exe" must not have a space. With "*rusthound.exe", this works

[mthcht]

@L0ranCyb the space was put on purpose here, we have the keywords with a /, \ and a

On which field are you trying to match the keyword ? if it's a process_name field with only the process name it will not match here, a process or file path is more adapted to the list, this is done to help reduce false positives with wildcard keywords.

[L0ranCyb]

It's with process.
I have a process like "rusthound.exe -zip......."

[mthcht]

i see i should have add rusthound.exe with a space at the end to take this into account, i will update the list thanks