I'm trying to get results which show randomized filenames but it's giving me randomization in the path directory location. I just want to see randomized filenames. Here's what I have so far:
eventtype=winevent EventCode=4688 (New_Process_Name="C:\\Windows\\TEMP\\*" OR New_Process_Name="C:\\users\\*\\appdata\\local\\temp\\*") NOT New_Process_Name="C:\\Users\\asiaynrf\\AppData\\Local\\Temp\\QIKCache\\*"
| lookup ut_shannon_lookup word as New_Process_Name
| where ut_shannon > 4.5
| stats values(ut_shannon) as "Shannon Entropy Score" by New_Process_Name,host
| rename New_Process_Name as Process,host as Endpoint | sort -"Shannon Entropy Score"
How do I limit randomization to filename and not the whole path?
To check the randomization of the filename rather than the whole path, extract the name from the New_Process_Name field.
eventtype=winevent EventCode=4688 (New_Process_Name="C:\\Windows\\TEMP\\*" OR New_Process_Name="C:\\users\\*\\appdata\\local\\temp\\*") NOT New_Process_Name="C:\\Users\\asiaynrf\\AppData\\Local\\Temp\\QIKCache\\*"
| rex field=New_Process_Name "\\\(?<filename>[^\\\]+)$"
| lookup ut_shannon_lookup word as filename
| where ut_shannon > 4.5
| stats values(ut_shannon) as "Shannon Entropy Score" by New_Process_Name,host
| rename New_Process_Name as Process,host as Endpoint | sort -"Shannon Entropy Score"
To check the randomization of the filename rather than the whole path, extract the name from the New_Process_Name field.
eventtype=winevent EventCode=4688 (New_Process_Name="C:\\Windows\\TEMP\\*" OR New_Process_Name="C:\\users\\*\\appdata\\local\\temp\\*") NOT New_Process_Name="C:\\Users\\asiaynrf\\AppData\\Local\\Temp\\QIKCache\\*"
| rex field=New_Process_Name "\\\(?<filename>[^\\\]+)$"
| lookup ut_shannon_lookup word as filename
| where ut_shannon > 4.5
| stats values(ut_shannon) as "Shannon Entropy Score" by New_Process_Name,host
| rename New_Process_Name as Process,host as Endpoint | sort -"Shannon Entropy Score"