There is a more elegant solution out there though… and I call it bitmap hunting<\/em>.<\/p>\n\n\n\n Instead of getting fixated on the sequence of the events that fit our narrative (set of failures followed by a success in the above example), we focus on building a bitmap of ALL states registered by the respective telemetry, the one that we can always group by the endpoint name, user, time\/time bucket, etc..<\/p>\n\n\n\n Let’s look at an example:<\/p>\n\n\n\n These SPL commands build a list of fake events for us, where 2 endpoints sys01 <\/em>and sys02 <\/em>register their logon events, where the endpoint<\/em>, username<\/em>, and status<\/em> fields\/columns include all the info about the set of events occurring. In essence, this is how it looks like (ignore the _time<\/em> as I didn’t want to clutter the commands above even more):<\/p>\n\n\n\n We can use the status of all events (success=1, failure=0) to build a bitmap of all of them by grouping them all together by the endpoint<\/em>:<\/p>\n\n\n\n The result gives us this:<\/p>\n\n\n\n As you can clearly see, it’s pretty easy now to ‘guess’ that Looking at the bitmap created by all the logon statuses we can quickly devise a logic to detect f.ex. successful password spray\/brute force\/dictionary attacks:<\/p>\n\n\n\n In the example above, we detect at least 3 failed logons before a successful logon.<\/p>\n\n\n\n And yes, it will hit False Positives too (legitimate logons will be amongst the malicious ones), but number of failed logons will be usually high enough and as such, a good indicator of badness, plus at least we now have something to triage…<\/p>\n\n\n\n p.s. logon events are just one example, but you can convert any condition into a bitmap — as such, you can build more complex conditions too (f.ex. more than two specific events present in a sequence of events)<\/p>\n","protected":false},"excerpt":{"rendered":" One of the most annoying hunting exercises is detecting a sequence of failures followed by a success. Brute-force attacks, dictionary attacks, and finally password spray attacks have all this in common: lots of failures, sometimes followed by a success. The … Continue reading | makeresults | eval endpoint=\"sys01\" | eval username=\"test\" | eval status = 0 \n| append [| makeresults | eval endpoint=\"sys01\" | eval username=\"foo\" | eval status = 0] \n| append [| makeresults | eval endpoint=\"sys01\" | eval username=\"bar\" | eval status = 0] \n| append [| makeresults | eval endpoint=\"sys01\" | eval username=\"abc\" | eval status = 0] \n| append [| makeresults | eval endpoint=\"sys01\" | eval username=\"nimda\" | eval status = 0] \n| append [| makeresults | eval endpoint=\"sys01\" | eval username=\"root\" | eval status = 0] \n| append [| makeresults | eval endpoint=\"sys01\" | eval username=\"r00t\" | eval status = 0] \n| append [| makeresults | eval endpoint=\"sys01\" | eval username=\"john.doe\" | eval status = 1]\n| append [| makeresults | eval endpoint=\"sys02\" | eval username=\"jane.doe\" | eval status = 0] \n| append [| makeresults | eval endpoint=\"sys02\" | eval username=\"jane.doe\" | eval status = 1]\n| table _time, endpoint, username, status<\/pre>\n\n\n\n
![\"\"](\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2024\/01\/spl_bitmap2-1.png\")
<\/a><\/figure>\n\n\n\n| stats list(status) as allstatuses, list(username) as allusernames by endpoint\n| eval allstatuses_bitmap = mvjoin(allstatuses,\"\")\n| table endpoint, allstatuses_bitmap, allusernames<\/pre>\n\n\n\n
<\/a><\/figure>\n\n\n\nsys02<\/code> user Jane.doe<\/code> is just a possible typo or otherwise minor issue that led the user account to be logged in after the first failure, while the sys01<\/code> system experienced a barrage of logon attempts with different user names that eventually led to a successful logon. The sys01<\/code> should be definitely investigated.<\/p>\n\n\n\n| stats list(status) as allstatuses, list(username) as allusernames by endpoint
| eval allstatuses_bitmap = mvjoin(allstatuses,\"\")
| where like(allstatuses_bitmap, \"%0001\")
| table endpoint, allstatuses_bitmap, allusernames<\/pre>\n\n\n\n