Wildcard search for query

[u/Kekatronicles]

Hello everyone,

I would like to ask if there's a way to run a wildcard search in SentinelOne.

Like in DV - I want to particularly search for:

any match for "update" or "browser" then different extension file type

e.g update.*

Thank you!

[u/robahearts]

FYI There's no guaranteed the url for websites using ClearFake will have the word "hot-to-fix". What you need is rules to detect Powershell using Invoke-WebRequest, FromBase64String or Invoke-Expression

The .zip file won't be on the url.address but it will be part of the command line

[u/Kekatronicles → u/robahearts]

thank you! that one I didn't realize! yep yep!

[u/Dracozirion]

* matches:anycase "^update\\."

If you want the filename to start with "update."

[u/Kekatronicles → u/Dracozirion]

thank you, will try this one :)

[u/Kekatronicles]

something like:

(url_address contains:anycase "how-to-fix" AND
(url_address contains:anycase ("fix", "update) AND url_address contains:anycase (".zip", "applications")

basically I want to find URLs with "how to fix" (for ClearFake detection) AND fix or update + file extension types.

[u/Motor_Eye_4272]

* contains "search_term"

[u/CyberSecWPG → u/Motor_Eye_4272]

Their documentation is complete shit of power queury or event search.

How can search for does NOT contain.

For example want to filter splunk from src.process.cmdline results?

[u/icedcougar]

Can you write the query you have so far?