mitre-attck

index=auth sourcetype=linux_secure "Failed password" | stats count by src_ip, user | where count > 20
index=proxy "POST" url="*/oauth/token" | stats count by client_ip | where count > 100
index=endpoint process_name=powershell.exe command_line="*EncodedCommand*"

Threat hunting query ideas mapped to MITRE ATT and CK patterns

threat-hunting mitre-attck siem

by Kai Nakamura 1 tab