0

I have a number of search strings from a siem to highlight certain security events from windows logs. The problem is these search strings contain nested boolean operators and I need to flatten them to show every possible option in a separate line.

So far I've tried to split the relevant sections out (Source, event_ids, additional parameters) The issue is due to the nesting and the various ORs and ANDs I'm struggling to accomplish this.

((`sysmon` event_id=1) OR (`windows-security` event_id=4688)) (process_command_line="*control* \/name*" OR process_command_line="rundll32* shell32.dll  Control_RunDLL") \

`sysmon` (event_id=12 OR event_id=13 OR event_id=14) (registry_key_path="*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ControlPanel\\NameSpace*" OR registry_key_path="*\\Software\\Microsoft\\Windows\\CurrentVersion\\Controls Folder\\*\\Shellex\\PropertySheetHandlers\\*" OR registry_key_path="*\\Software\\Microsoft\\Windows\\CurrentVersion\\Control Panel\\*") \ 

((`sysmon` event_id=1) OR (`windows-security` event_id=4688)) (process_name="net.exe" AND process_command_line="*net* config*") OR (process_name="ipconfig.exe" OR process_name="netsh.exe" OR process_name="arp.exe" OR process_name="nbtstat.exe") \

I'd expect to be able to flatten each one out with the result being it produces multiple flat match strings that only include ANDs e.g.

Original:

((`sysmon` event_id=1) OR (`windows-security` event_id=4688)) (process_command_line="*control* \/name*" OR process_command_line="rundll32* shell32.dll  Control_RunDLL") \

Expected Output:

sysmon, event_id=1, process_command_line="*control* \/name*"
sysmon, event_id=1, process_command_line="rundll32* shell32.dll  Control_RunDLL"
windows-security, event_id=4688, process_command_line="*control* \/name*"
windows-security, event_id=4688, process_command_line="rundll32* shell32.dll  Control_RunDLL"
RT Security
  • 47
  • 5
  • Are the first fields the string you are working with? Can you provide a couple input and a couple expected outputs for those inputs. After that I can help you find a solution. – Error - Syntactical Remorse Apr 18 '19 at 15:38
  • @Error-SyntacticalRemorse just updated for you, thanks :) – RT Security Apr 23 '19 at 08:00
  • Parsing this string is a nightmare without any common delimiter. You can get the contents of each parentheses using [this answer](https://stackoverflow.com/a/4285211/8150685) but it complicated to parse the string to get it into the desired format because you have no common delimiter. – Error - Syntactical Remorse Apr 23 '19 at 13:39

0 Answers0