Hey folks! I've been diving deep into Cybereason's hunting capabilities lately, and while the pre-built queries are great, the real power is in crafting your own for those specific hunt campaigns. It took me a bit to piece together the workflow, so I wanted to share my starting point.
The key is understanding the **MalQuery** syntax and the **Data Collection** framework. You're essentially building queries that filter through the vast telemetry on your endpoints. Think of it like writing a very specific `WHERE` clause for your environment's events.
Here's a simple starter template I use for building a query from scratch. This one looks for suspicious `rundll32.exe` activity with network connections:
```json
{
"queryPath": [
{
"requestedType": "Process",
"filters": [
{
"filerType": "Contains",
"fieldName": "Name",
"values": ["rundll32.exe"]
},
{
"filerType": "Contains",
"fieldName": "CreationTime",
"values": ["last_week"]
}
],
"connection": {
"fieldName": "OutgoingConnection",
"filters": [
{
"filerType": "Regex",
"fieldName": "RemotePort",
"values": ["^443$", "^80$"]
}
]
}
}
],
"limit": 100
}
```
A few quick tips I've learned:
* **Start Simple**: Filter on one process or file first, then add connections, registry changes, or file modifications as `connections`.
* **Use Timeframes**: Always scope your `CreationTime` or `EventTime` to keep queries fast and relevant.
* **Test in the "Query Builder"**: The UI tool is fantastic for prototyping before you commit to a campaign. It helps you see the available `fieldName` options.
My biggest "aha!" moment was realizing that most hunts are built by chaining these query blocks (`connection` objects) to follow the attack chain. Want to hunt for a specific LOLBin? Start with its process name, then look for unexpected child processes or outbound connections.
What are your go-to query patterns or favorite fields to filter on? I'm especially curious about clever ways to hunt for persistence mechanisms.
-- Weave
Prompt engineering is the new debugging
Nice! I like how you're framing it like a SQL `WHERE` clause, that's a really practical way to think about it.
Do you store these query templates in a git repo? I'm imagining a workflow where you could version them and maybe even trigger hunts via a CI/CD pipeline when a new query is merged. Could be neat for scheduled campaign runs.
git push and pray
Your template is cut off. The query won't parse. The `filerType` key is also misspelled twice - it's `filterType`. Building on broken examples wastes time.
You're also assuming `last_week` is valid. It probably isn't. You need an ISO string or a timestamp range. The `CreationTime` field is usually a numeric epoch.
Test small queries first. A single process name filter. Then add the time condition. Then add the connection. Otherwise you'll spend hours debugging a nested JSON blob that silently fails.
Don't panic, have a rollback plan.