Skip to content

Instantly share code, notes, and snippets.

@Shivammalaviya

Shivammalaviya/Online C2s

Created June 16, 2022 16:03
Show Gist options
  • Save Shivammalaviya/d0bfc8c2af4504973366fdc867f99bd1 to your computer and use it in GitHub Desktop.
Save Shivammalaviya/d0bfc8c2af4504973366fdc867f99bd1 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
Online C2s
externaldata(RemoteIP: string, RemotePort: int, Status: string)
[
"https://feodotracker.abuse.ch/downloads/ipblocklist_recommended.json"
]
with(format="MultiJSON", ingestionMapping='[{"Column":"RemoteIP","Properties":{"Path":"$.ip_address"}}, {"Column":"RemotePort","Properties":{"Path":"$.port"}}, {"Column":"Status","Properties":{"Path":"$.status"}}]')
| where Status == "online"
| join kind=inner DeviceNetworkEvents on RemoteIP, RemotePort
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment