BOTSv1

index=botsv1 source="stream:http" imreallynotbatman.com http_method=POST 
| table c_ip, dest_ip, request, form_data

index=botsv1 source="stream:http" imreallynotbatman.com c_ip="40.80.148.42" dest_ip="192.168.250.70" http_method=POST 
| stats count by http_user_agent, src_headers

index=botsv1 source="stream:http" imreallynotbatman.com dest_ip="192.168.250.70" 
| rex field=dest_content "name=\"generator\"\s+content=\"(?<cms_identity>[^\"]+)\""
| stats count by cms_identity

index=botsv1 sourcetype=fgt_utm (srcip="192.168.250.70" OR dstip="192.168.250.70") catdesc="Malicious Websites"

index=botsv1 sourcetype=fgt_utm (srcip="192.168.250.70" OR dstip="192.168.250.70") catdesc="Malicious Websites"

index=botsv1 sourcetype=fgt_utm (srcip="192.168.250.70" OR dstip="192.168.250.70") catdesc="Malicious Websites"

index="botsv1" imreallynotbatman.com sourcetype="stream:http" http_method=POST
| rex field=form_data "username=(?<username>[^&]+)"
| rex field=form_data "(passwd|password)=(?<password>[^&]+)"
| where isnotnull(password) AND isnotnull(username)
| table username, password, c_ip, dest_ip, uri

index="botsv1" dest_ip="192.168.250.70" sourcetype="suricata" http.http_method=POST "imreallynotbatman.com"
| rex field=fileinfo.filename "(?<executable>.*?\.(exe|ps1))"
| where isnotnull(executable)
| table _time, executable, src_ip

index="botsv1" source="WinEventLog:Microsoft-Windows-Sysmon/Operational" 3791.exe extracted_eventid=1 
| table Command_Line, Image_Path, Parent_Image_Path

index="botsv1" source="WinEventLog:Microsoft-Windows-Sysmon/Operational" extracted_eventid=1 "3791.exe" 
| table Command_Line, Image_Path, Parent_Image_Path, Hashes

index="botsv1" imreallynotbatman.com sourcetype="stream:http" http_method=POST
| rex field=form_data "username=(?<username>[^&]+)"
| rex field=form_data "(passwd|password)=(?<password>[^&]+)"
| where isnotnull(password) AND isnotnull(username)
| table _time, username, password, c_ip, dest_ip, uri

index="botsv1" "imreallynotbatman.com" sourcetype="stream:http" http_method=POST
| rex field=form_data "username=(?<username>[^&]+)" 
| rex field=form_data "(passwd|password)=(?<password>[^&]+)"
| where isnotnull(password) AND len(password) == 6
| fields _time, username, password, c_ip, dest_ip
| append [ search sourcetype="coldplay" | fields songName ]
| eventstats values(songName) as all_songs
| mvexpand all_songs
| where lower(password) == lower(all_songs)
| table _time, c_ip, dest_ip, username, password, all_songs

index="botsv1" "imreallynotbatman.com" sourcetype="stream:http" http_method=POST
| rex field=form_data "username=(?<username>[^&]+)" 
| rex field=form_data "(passwd|password)=(?<password>[^&]+)"
| where username="admin"
| table _time, c_ip, dest_ip, username, password, http_user_agent

index="botsv1" "imreallynotbatman.com" sourcetype="stream:http" http_method=POST
| rex field=form_data "(passwd|password)=(?<password>[^&]+)"
| eval average_password = len(password)
| stats avg(average_password) as average_lenght

index="botsv1" "imreallynotbatman.com" sourcetype="stream:http" http_method=POST
| rex field=form_data "username=(?<username>[^&]+)" 
| rex field=form_data "(passwd|password)=(?<password>[^&]+)"
| search username="admin" AND password="batman"
| sort 0 _time
| delta _time as elapsedTime 
| where elapsedTime > 0
| eval elapsedTime = round(elapsedTime, 2)
| stats values(elapsedTime) as elapsedTime

index="botsv1" "imreallynotbatman.com" sourcetype="stream:http" http_method=POST
| rex field=form_data "username=(?<username>[^&]+)" 
| rex field=form_data "(passwd|password)=(?<password>[^&]+)"
| search username="admin" http_user_agent="Python-urllib/2.7"
| stats dc(password) as uniquePasswordCount

index=botsv1 we8105desk earliest="08/24/2016:00:00:00" latest="08/24/2016:23:59:59" 
    source="WinEventLog:Security" "EventCode=4624" 
    Security_ID="WAYNECORPINC\\WE8105DESK$"
| stats count by Source_Network_Address, Account_Name

index=botsv1 sourcetype="suricata" signature 
| stats count by alert.signature, alert.signature_id

index=botsv1 sourcetype="suricata" alert.signature="ETPRO TROJAN Ransomware/Cerber Checkin 2"
| table alert.action, alert.category, alert.signature, alert.signature_id, src_ip, dest_ip

index=botsv1 source="stream:dns" (src_ip="192.168.250.100") "query_type{}"=A
| stats count by query{}

index=botsv1 source="stream:dns" (src_ip="192.168.250.100") "query_type{}"=A 
    NOT (query{}="*microsoft*" OR query{}="*waynecorpinc*" OR 
         query{}="*wpad*" OR query{}="*bing*" OR query{}="*isatap")
| table _time, query{}, dest_ip

index=botsv1 sourcetype="WinEventLog" EventCode=4688 "*.vbs*" host=we8105desk
| eval commadLen=len(Process_Command_Line)
| table Process_Command_Line, commadLen

index=botsv1 sourcetype="winregistry" key_path="*USBSTOR*" 
    registry_value_name="FriendlyName"
| stats count by registry_value_data, host
| rename registry_value_data as "USB_Device_Name"

index=botsv1 source="stream:smb" src_ip="192.168.250.100" dest_port=445
| stats count by dest_ip

index=botsv1 source="WinEventLog:Security" Source_Address="192.168.250.100" "*.pdf*"
| stats dc(Relative_Target_Name) as total_encrypted_file

index=botsv1 source="WinEventLog:Microsoft-Windows-Sysmon/Operational" 
    "*121214.tmp*" "*.vbs*"

index=botsv1 sourcetype="xmlwineventlog" host=we8105desk extracted_eventid=2 
    TargetFilename="C:\\Users\\bob.smith.WAYNECORPINC*.txt"
| stats dc(TargetFileName) as Total_encrypted_txt_file

index=botsv1 sourcetype=fgt_utm srcip="192.168.250.100" msg="File is infected."