{"id":6462,"date":"2019-06-21T23:35:39","date_gmt":"2019-06-21T23:35:39","guid":{"rendered":"http:\/\/www.hexacorn.com\/blog\/?p=6462"},"modified":"2019-06-22T00:51:25","modified_gmt":"2019-06-22T00:51:25","slug":"the-missing-excel-move","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2019\/06\/21\/the-missing-excel-move\/","title":{"rendered":"The Missing Excel Move"},"content":{"rendered":"\n<p>This post is a request for Excel devs to implement a novelty data navigation function. <\/p>\n\n\n\n<p>I call it a &#8216;Levenshtein Move&#8217;.<\/p>\n\n\n\n<p>When we review data, especially in a security field, and in particular sorted data gathered by Threat Hunters, we often come across data sets where multiple rows (often thousands, or tens of thousand) contain data very similar to each other. <\/p>\n\n\n\n<p>At first, we obviously blame idiots who run tons of legitimate processes that use random values as a part of command line which makes our life hell, or similar idiots that make web logs full of almost identical entries, but then we still have to go through it.<\/p>\n\n\n\n<p>For instance, if we see stuff like this:<\/p>\n\n\n\n<ul><li>hxxp:\/\/foobar.com?xyz=123456<\/li><li>hxxp:\/\/foobar.com?xyz=123457<\/li><li>hxxp:\/\/foobar.com?xyz=123458<\/li><li>hxxp:\/\/google.com<\/li><\/ul>\n\n\n\n<p>&#8211; it is only natural to want to skip the repetitive values and just go to the google one next (also see GIF embedded below).<\/p>\n\n\n\n<p>Because once we see it, we know we can just exclude this data using a regex or a wildcard. However, that next item on the list may be 10K rows later; there is no way to find it unless you skillfully use mouse for scrolling, or use the old-fashioned PageDown brute-force attack.<\/p>\n\n\n\n<p>Now imagine making the computer working it out for you.<\/p>\n\n\n\n<p>You could use a <a href=\"https:\/\/en.wikipedia.org\/wiki\/Levenshtein_distance\">Levenshtein distance<\/a> between the current cell value, and the cells below. As long as the calculated distance is low, we could continue to progress. And only stop when the next cell is substantially different from the one that is currently selected:<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" loading=\"lazy\" width=\"198\" height=\"218\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2019\/06\/Levenshtein_distance.gif\" alt=\"\" class=\"wp-image-6463\"\/><\/figure>\n\n\n\n<p>The core code I used to demo it looks like this:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Sub Levenshtein_Move_down()\n    On Error Resume Next\n    c = ActiveCell.Column\n    r = ActiveCell.Row\n    firstcell = Cells(r, c).Value\n\n    Do While True\n        r = r + 1\n        curcell = ActiveSheet.Cells(r, c)\n        If curcell = \"\" Then\n             Exit Do\n        End If\n        l = Levenshtein(firstcell, curcell)\n        If l > 3 Then\n            Exit Do\n        End If\n    Loop\n    Cells(r, c).Select\nEnd Sub\n\nFunction Levenshtein(ByVal string1 As String, ByVal string2 As String) As Long\n\nDim i As Long, j As Long\nDim string1_length As Long\nDim string2_length As Long\nDim distance() As Long\n\nstring1_length = Len(string1)\nstring2_length = Len(string2)\nReDim distance(string1_length, string2_length)\n\nFor i = 0 To string1_length\n    distance(i, 0) = i\nNext\n\nFor j = 0 To string2_length\n    distance(0, j) = j\nNext\n\nFor i = 1 To string1_length\n    For j = 1 To string2_length\n        If Asc(Mid$(string1, i, 1)) = Asc(Mid$(string2, j, 1)) Then\n            distance(i, j) = distance(i - 1, j - 1)\n        Else\n            distance(i, j) = Application.WorksheetFunction.Min _\n            (distance(i - 1, j) + 1, _\n             distance(i, j - 1) + 1, _\n             distance(i - 1, j - 1) + 1)\n        End If\n    Next\nNext\n\nLevenshtein = distance(string1_length, string2_length)\n\nEnd Function<\/code><\/pre>\n\n\n\n<p>I borrowed the VBA code for Levenshtein distance from this <a href=\"https:\/\/stackoverflow.com\/questions\/4243036\/levenshtein-distance-in-vba\">post<\/a> on Stack Overflow.<\/p>\n\n\n\n<p>And yes, you can embed it in your Excel workbook and assign it to a shortcut.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>This post is a request for Excel devs to implement a novelty data navigation function. I call it a &#8216;Levenshtein Move&#8217;. When we review data, especially in a security field, and in particular sorted data gathered by Threat Hunters, we &hellip; <a href=\"https:\/\/www.hexacorn.com\/blog\/2019\/06\/21\/the-missing-excel-move\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[58],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/6462"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=6462"}],"version-history":[{"count":9,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/6462\/revisions"}],"predecessor-version":[{"id":6472,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/6462\/revisions\/6472"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=6462"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=6462"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=6462"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}