Skip to content

Instantly share code, notes, and snippets.

@MHaggis

MHaggis/UT_Toolbox Examples

Created August 1, 2018 12:50
Show Gist options
  • Save MHaggis/0f6f5fe282888e1d92dc8e2d000f8349 to your computer and use it in GitHub Desktop.
Save MHaggis/0f6f5fe282888e1d92dc8e2d000f8349 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
UT_Toolbox Examples
Source: https://www.splunk.com/blog/2017/11/03/you-can-t-hyde-from-dr-levenshtein-when-you-use-url-toolbox.html
Data type required: Carbon Black Response, CrowdStrike Falcon
`cb` process_path=*\\users\\*
| `ut_shannon(process_path)`
| where ut_shannon > 4.5
| stats values(ut_shannon) as "Shannon Entropy Score" by process_path, computer_name
| rename process_path as Process, computer_name as Endpoint
sourcetype="crowdstrike:falconhost:json" ImageFileName=*\\users\\*
| `ut_shannon(ImageFileName)`
| where ut_shannon > 4.5
| stats values(ut_shannon) as "Shannon Entropy Score" by ImageFileName, ComputerName
| rename ImageFileName as Process, ComputerName as Endpoint
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment