Splunk Indicator Hunting

This playbook queries Splunk for indicators such as file hashes, IP addresses, domains, or urls. It outputs detected users, ip addresses, and hostnames related to the indicators.

Splunk · 77 tasks · 21 inputs · 5 outputs

Inputs

  • MD5 — MD5 hash file or an array of hashes for which to search.
  • SplunkMD5Field — The name of the fields, in Splunk, in which to find the MD5 hash. You can enter multiple field names using a comma-separated format. If no field is specified, the search uses quick filter.
  • SHA1 — SHA1 hash file or an array of hashes on which to search.
  • SplunkSHA1Field — The name of the fields, in Splunk, in which to find the SHA1 field. You can enter multiple field names using a comma-separated format. If no field is specified, the search uses quick filter.
  • SHA256 — SHA256 hash file or an array of hashes on which to search.
  • SplunkSHA256Field — The name of the fields, in Splunk, in which to find the SHA256. You can enter multiple field names using a comma-separated format. If no field is specified, the search uses quick filter.
  • IPAddress — Source or destination IP on which to search. Can be a single address or an array of addresses.
  • SplunkIPField — The name of the fields, in Splunk, in which to find the IP addresses. You can enter multiple field names using a comma-separated format. For example, sourceip,destinationip.
  • URLDomain — Domain or Url can be single or an array of domain/urls to search. By default the LIKE clause is used.
  • SplunkURLDomainField — The name of the fields, in Splunk, in which to find the URL/Domain. If no field is specified, the search uses quick filter. Only one field can be used in this parameter.
  • earliest_time — Earliest time to search. Examples: -7d -24h More examples https://docs.splunk.com/Documentation/Splunk/8.0.0/Search/Specifytimemodifiersinyoursearch For more examples view https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/SearchTimeModifiers It is recommended to set a limit for the time frame.
  • latest_time — Latest time to search. Examples: -6d -23h More examples https://docs.splunk.com/Documentation/Splunk/8.0.0/Search/Specifytimemodifiersinyoursearch For more examples view https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/SearchTimeModifiers It is recommended to set a limit for the time frame.
  • event_limit — Limit the number of events returned by query. This argument is not mandatory for the command, but is mandatory for the playbook.
  • IPFieldsToReturn — The value of the IP fields to return from Splunk when the specified indicator is found. These values are used as inputs in the Setting IP addresses section. For example, src,src_ip,dst,dst_ip.
  • UserFieldsToReturn — The value of the username fields to return from Splunk when the specified indicator is found. These values are used as inputs in the Setting user names section. For example, username,src_username,dst_username.
  • HostFieldsToReturn — The value of the hostname fields to return from Splunk when the specified indicator is found. These values are used as inputs in the Setting host names section. For example, hostname,src_hostname, dst_hostname.
  • InternalIPRange — A list of internal IP ranges to check IP addresses against. The list should be provided in CIDR format, separated by commas. An example of a list of ranges could be: 172.16.0.0/12,10.0.0.0/8,192.168.0.0/16. If a list of IP ranges is not provided, the list provided in the IsIPInRanges script (the known IPv4 private address ranges) is used by default.
  • IndexName — A single Spunk index to use in the search.
  • SelectFields — Use this field to include additional enrichment data for the Splunk query. If you have defined one or more investigation fields, the SelectField should not include those fields. If there are no other investigation fields defined, the SelectField must contain some value. Enter a comma-separated list of field names as they appear in Splunk. * is valid value, but not recommended since it creates large output.
  • InternalDomainName — The organizations internal domain name. This is provided for the script IsInternalHostName that checks if the detected host names are internal or external if the hosts contain the internal domains suffix. For example demisto.com. If there is more than one domain, use the | character to separate values such as (demisto.com|test.com)
  • InternalHostRegex — This is provided for the script IsInternalHostName that checks if the detected host names are internal or external. if the hosts match the organizations naming convention. For example the host testpc1 will have the following regex \w{6}\d{1}

Outputs

  • Splunk.DetectedUsers — Users detected based on the username field in your search.
  • Splunk.DetectedInternalIPs — Internal IP addresses detected by your search.
  • Splunk.DetectedExternalIPs — External IP addresses detected by your search.
  • Splunk.DetectedInternalHosts — Internal host names detected based on the fields in your search.
  • Splunk.DetectedExternalHosts — External host names detected based on the fields in your search.

Commands used

splunk-search

Flowchart

yes yes yes yes yes yes yes yes yes yes yes yes yes yes yes yes yes yes yes yes yes yes yes Start Start Hash Search Hash Search IP Search IP Search Domain/Url Search Domain/Url Search Is there an IP to search? Is there an IP to search? Is there a hash to search? Is there a hash to search? Is there a Domain/Url to search? Is there a Domain/Url to ... Was there a custom domain/url field? Was there a custom domain... Set MD5 to an array - Set Set MD5 to an array Set Was there a custom MD5 field? Was there a custom MD5 fi... Is there an MD5 to search? Is there an MD5 to search? MD5 Search MD5 Search SHA1 Search SHA1 Search Is there a SHA1 hash to search Is there a SHA1 hash to s... Was there a custom SHA1 field? Was there a custom SHA1 f... SHA256 Search SHA256 Search Is there a SHA256 hash to search Is there a SHA256 hash to... Was there a custom SHA256 field? Was there a custom SHA256... Done Searching Done Searching Was there a custom IP field? Was there a custom IP field? Is Splunk enabled? Is Splunk enabled? Splunk search with custom fields - splunk-search Splunk search with custom... splunk-search Splunk search with custom fields - splunk-search Splunk search with custom... splunk-search Splunk search without custom fields - splunk-search Splunk search without cus... splunk-search Splunk search without custom fields - splunk-search Splunk search without cus... splunk-search Splunk search without custom fields - splunk-search Splunk search without cus... splunk-search Splunk search without custom fields - splunk-search Splunk search without cus... splunk-search Splunk search with custom fields - splunk-search Splunk search with custom... splunk-search Splunk search with custom fields - splunk-search Splunk search with custom... splunk-search Splunk search without custom fields - splunk-search Splunk search without cus... splunk-search Splunk query with custom fields Splunk query with custom ... Splunk-free text query Splunk-free text query Splunk query with custom fields Splunk query with custom ... Splunk-free text query Splunk-free text query Splunk query with custom fields Splunk query with custom ... Splunk-free text query Splunk-free text query Splunk query with custom fields Splunk query with custom ... Splunk-free text query Splunk-free text query Splunk-free text query Splunk-free text query Splunk-query with custom fields Splunk-query with custom ... Have results been detected? Have results been detected? Set detected IP addresses - SetAndHandleEmpty Set detected IP addresses SetAndHandleEmpty Set detected user names - SetAndHandleEmpty Set detected user names SetAndHandleEmpty Set detected host names - SetAndHandleEmpty Set detected host names SetAndHandleEmpty Set a SHA1 hash to array - Set Set a SHA1 hash to array Set Set a SHA256 hash to array - Set Set a SHA256 hash to array Set Set an IP address to array - Set Set an IP address to array Set Set DomainUrl to array - Set Set DomainUrl to array Set Sort internal and external IP addresses Sort internal and externa... Are there detected IP addresses? Are there detected IP add... Determine whether the IP address is internal or external - IsIPInRanges Determine whether the IP ... IsIPInRanges Set detected IP addresses as internal - SetAndHandleEmpty Set detected IP addresses... SetAndHandleEmpty Set detected IP addresses as external - SetAndHandleEmpty Set detected IP addresses... SetAndHandleEmpty Done sorting IP addresses Done sorting IP addresses Splunk search with custom fields - splunk-search Splunk search with custom... splunk-search Setting results to outputs Setting results to outputs Are there investigation fields for IP's? Are there investigation f... Are there investigation fields for host names? Are there investigation f... Are there investigation fields for user names? Are there investigation f... Done Done Manually list detected IP addresses Manually list detected IP... Set manual IP addresses - commentsToContext Set manual IP addresses commentsToContext Manually list detected user names Manually list detected us... Set manual user names - commentsToContext Set manual user names commentsToContext Manually list detected host names Manually list detected ho... Set manual host names - commentsToContext Set manual host names commentsToContext Setting user names Setting user names Setting host names Setting host names Setting IP addresses Setting IP addresses Sort internal and external host names Sort internal and externa... Are there detected host names? Are there detected host n... Determine whether the host names are internal or external - IsInternalHostName Determine whether the hos... IsInternalHostName Done sorting host names Done sorting host names Set detected host names as internal - SetAndHandleEmpty Set detected host names a... SetAndHandleEmpty Set detected host names as external - SetAndHandleEmpty Set detected host names a... SetAndHandleEmpty Has the domain name been provided? Has the domain name been ... Set detected host names as internal - SetAndHandleEmpty Set detected host names a... SetAndHandleEmpty