Пример #1
0
def title(event):
    ips = ",".join(ioc_match(event.get("p_any_ip_addresses"), LOG4J_IP_IOCS))
    return f"IP seen in LOG4J exploit scanning detected IP: {ips}"
Пример #2
0
def title(event):
    domains = ','.join(
        ioc_match(event.get('p_any_domain_names'), SUNBURST_FQDN_IOCS))
    return sanitize_domain(
        f"Sunburst Indicator of Compromise Detected [Domains]: {domains}")
Пример #3
0
def rule(event):
    return any(ioc_match(event.get("p_any_ip_addresses"), LOG4J_IP_IOCS))
Пример #4
0
def rule(event):
    return any(ioc_match(event.get('p_any_domain_names'), SUNBURST_FQDN_IOCS))
Пример #5
0
def title(event):
    ips = ",".join(ioc_match(event.get("p_any_ip_addresses"), SUNBURST_IP_IOCS))
    return f"Sunburst Indicator of Compromise Detected [IPs]: {ips}"
Пример #6
0
def rule(event):
    return any(ioc_match(event.get("p_any_ip_addresses"), SUNBURST_IP_IOCS))
Пример #7
0
def title(event):
    hashes = ','.join(
        ioc_match(event.get('p_any_sha256_hashes'), SUNBURST_SHA256_IOCS))
    return f"Sunburst Indicator of Compromise Detected [SHA256 hash]: {hashes}"
Пример #8
0
def rule(event):
    return any(
        ioc_match(event.get('p_any_sha256_hashes'), SUNBURST_SHA256_IOCS))