BOTSv1 Investigate Workshop

APT

Suricata signatures

earliest=0 index=botsv1 imreallynotbatman.com src=40.80.148.42 sourcetype=suricata
| stats count by signature
| eventstats sum(count) as percent | eval percent=round(count*100/percent,2)
| sort -count
# or just | top signature

Source IPs

earliest=0 index=botsv1 imreallynotbatman.com sourcetype=stream*
| stats count(src_ip) by src_ip
| sort -src_ip

Scanner (user agent)

earliest=0 index=botsv1 src=40.80.148.42 sourcetype=stream:http 
| stats count by http_user_agent
| sort -count

Scanner (headers)

earliest=0 index=botsv1 src=40.80.148.42 sourcetype=stream:http 
| stats count by src_headers
| sort -count

Target

earliest=0 index=botsv1 src=40.80.148.42 sourcetype=stream:http
| stats count by dest_ip

CMS

earliest=0 index=botsv1 sourcetype=stream:http dest_ip="192.168.250.70"
| top limit=5 uri