Hey Shane,
Thanks for trying to help!
For now, I have decided to use a workaround which isn't very sympathetic. Instead of a reference set I am going to use the "Custom property matches this regex" test and then put each value that was supposed to go in the reference set into a .*Value.* | pattern so I can test it out against all the different values if it matches on any one of them it will give me an match.
Was hoping to have something a bit more friendly as this requires me to change the regex any time I want to add or remove a new value.
------------------------------
Gideon Balchasan
------------------------------
Original Message:
Sent: Mon October 07, 2019 06:19 AM
From: SHANE LUNDY
Subject: malicious arguments in script
Hi,
So you can't do that with ref sets currently. We do have roadmap items to be able to do this in the future.
I'm just following up here to see if anyone knows a workaround to do this.
Shane
------------------------------
SHANE LUNDY
------------------------------
Original Message:
Sent: Mon October 07, 2019 05:29 AM
From: Gideon Balchasan
Subject: malicious arguments in script
Hey there Shane.
Yes exactly, that is what I am trying to achieve.
------------------------------
Gideon Balchasan
Original Message:
Sent: Mon October 07, 2019 05:23 AM
From: SHANE LUNDY
Subject: malicious arguments in script
Hi, You are right what I stated above. Its for exact matches. As in the custom property value has to match exactly what is in the ref set. So from my understanding you are looking for a partial match? You have the long string in the Custom Property and you want to know if any of the values in the ref set match these log strings. ?
------------------------------
SHANE LUNDY
Original Message:
Sent: Sun October 06, 2019 02:10 AM
From: Gideon Balchasan
Subject: malicious arguments in script
Hey there @SHANE LUNDY, thank you for the quick reply.
I think you don't quite understand what I am working with,
I have a script, a long list of multiple commands changing and varying each time and I want to know if any of the values in the reference set are contained in my script. (In the event property) not the other way around.
The test rule says "Match when the event property is contained in any of the reference set values" and I want to do the opposite, "Match when any of the reference set values are contained in the event property."
Any one know how to do that?
------------------------------
Gideon Balchasan
Original Message:
Sent: Fri October 04, 2019 05:15 AM
From: SHANE LUNDY
Subject: malicious arguments in script
Hi,
Yes if I understand correctly what you are trying to do this is very easy to do in QRadar. You have events coming into QRadar where one of the Custom Properties is pulling out the list of commands. On the other hand you have a list of these commands in a list and you want to know if one of the malicious commands in your list is seen in your events.
OK so
1. Add your list of malicious commands into a reference set
2. In your rule then simply say when this properties is contained in this ref set fire an offense.
If you want an example of this already for you. Download the sysmon content pack here https://exchange.xforce.ibmcloud.com/hub/extension/e41e758e2ab5786173438cd09219a9d0
and look at the rule Process Loaded Executable from Temp Directory
------------------------------
SHANE LUNDY