I find myself spending more time on regex then using the platform

[RSAAdmin]

Seems I spend more time troubleshooting regexs instead of investigating events....for all the money spent on the tool its pretty primitive and time consuming to narrow the data down to what you want.

I figured simple things like ip.dst != 10.0.0.0/8 would simply work....or src.org !='org name" would work....

How about a better regex guide....I really dont have the time to figure out what works and what doesn't....

Scott,

[Anonymous]

Thanks Scott!

My post was partly in response to the person who said that you never need to use regex, and partly my frustration in getting it to work.  I found that I needed the parentheses when testing in several web-based regex testers, but I'll delete them from now on.  Great catch to find the behavior by the fat client.

I'm a great fan of Python, so I"ll def use the sample REST app in the future.

regards

[RSAAdmin]

Instead of using an app rule or custom drill to detect hex directories and filenames, try this as a parser:

local hexPath = nw.createParser("Hex_Path", "hex character directory and filename detection")

hexPath:setKeys({

     nwlanguagekey.create("risk.suspicious"),

})

function hexPath:checkDir(idx, vlu)

     if vlu then

         if string.find(vlu, "%X") then

             return

         end

         nw.createMeta(self.keys["risk.suspicious"], "hexadecimal directory name")

     end

end

function hexPath:checkFile(idx, vlu)

     if vlu then

         local dotPosition = string.find(vlu, "%.")

         if dotPosition then

             repeat

                 local loopControl = 0

                 local tmpPosition = string.find(vlu, "%.", dotPosition + 1)

                 if tmpPosition then

                     dotPosition = tmpPosition

                     loopControl = 1

                 end

             until loopControl == 0

             vlu = string.sub(vlu, 1, dotPosition - 1)

         end

         if string.find(vlu, "%X") then

             return

         end

         nw.createMeta(self.keys["risk.suspicious"], "hexadecimal file name")

     end

end

hexPath:setCallbacks({

     [nwlanguagekey.create("directory")] = hexPath.checkDir,

     [nwlanguagekey.create("filename"] = hexPath.checkFile

})

[RSAAdmin · Accepted solution]

Irimi,

I've found a workaround for you.  If you click the "Custom Drill" button on the toolbar, you can enter your query like this:

filename regex '([0-9a-zA-Z]{20,})'

And it will submit the query correctly without modifying the parens.  I've also fixed Investigator 9.8 so that it will not modify the regex.  Look for the fix in a future service pack.

Scott

[RSAAdmin]

What is the malware that you see that makes these get requests?  Do you have a hash?  I might have better rules for detecting this that I could share.