T1681 Search Threat Vendor Data Detection — KQL & SPL Queries for Sentinel and Splunk

Microsoft Sentinel / Defender

kusto

let ThreatIntelAPIs = dynamic([
    "virustotal.com", "api.virustotal.com",
    "api.shodan.io", "shodan.io",
    "api.recordedfuture.com", "app.recordedfuture.com",
    "api.greynoise.io", "viz.greynoise.io",
    "otx.alienvault.com",
    "urlscan.io", "urlscan.io",
    "malwarebazaar.abuse.ch", "bazaar.abuse.ch",
    "threatfox.abuse.ch",
    "mb-api.abuse.ch",
    "pulsedive.com",
    "api.threatminer.org",
    "www.hybrid-analysis.com", "api.hybrid-analysis.com",
    "tria.ge", "api.tria.ge",
    "any.run"
]);
let KnownSOCAccounts = dynamic(["svc-threathunting", "svc-siem", "soc-analyst", "siem-collector"]);
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where isnotempty(RequestURL)
| extend AccessedDomain = tolower(extract(@"(?:https?://)?([^/:?#\\s]+)", 1, RequestURL))
| where AccessedDomain has_any (ThreatIntelAPIs)
| where SourceUserName !in~ (KnownSOCAccounts)
| where DeviceAction !in ("block", "deny", "drop")
| summarize
    QueryCount = count(),
    UniqueURLs = dcount(RequestURL),
    SampledURLs = make_set(RequestURL, 10),
    UserAccounts = make_set(SourceUserName, 10),
    BytesOut = sum(SentBytes),
    FirstSeen = min(TimeGenerated),
    LastSeen = max(TimeGenerated)
    by SourceIP, AccessedDomain
| join kind=leftouter (
    ThreatIntelligenceIndicator
    | where TimeGenerated > ago(30d)
    | where IsActive == true
    | where IndicatorType == "networkip"
    | summarize ThreatScore = max(ConfidenceScore), ThreatTypes = make_set(ThreatType, 5) by NetworkIP
) on $left.SourceIP == $right.NetworkIP
| extend RiskFlag = case(
    isnotempty(ThreatScore) and ThreatScore > 70, "KnownMaliciousSource",
    QueryCount > 100 and array_length(UserAccounts) == 1, "HighVolumeNonSOC",
    UniqueURLs > 20, "BroadRecon",
    "Low"
)
| where RiskFlag != "Low"
| project FirstSeen, LastSeen, SourceIP, AccessedDomain, QueryCount, UniqueURLs, SampledURLs, UserAccounts, ThreatScore, ThreatTypes, RiskFlag
| sort by ThreatScore desc, QueryCount desc

medium severity low confidence

Data Sources

Microsoft Sentinel Network Proxy / Firewall (CEF format) Microsoft Defender Threat Intelligence

Required Tables

CommonSecurityLog ThreatIntelligenceIndicator

False Positives

Security Operations Center analysts performing daily threat hunting or indicator enrichment via threat intel APIs
Automated SOAR playbooks or SIEM enrichment workflows querying VirusTotal or similar platforms to enrich alerts
Vulnerability management or penetration testing tools performing infrastructure fingerprinting via Shodan
Security researchers and threat intelligence teams conducting legitimate campaign analysis
Endpoint protection platforms that perform cloud-based file reputation lookups through proxy-visible connections

Splunk

spl

index=proxy OR index=firewall OR index=web
    sourcetype="bluecoat:proxysg:access:kv" OR sourcetype=squid OR sourcetype="cisco:wsa:squid" OR sourcetype="palo_alto_networks:firewall" OR sourcetype="cisco:asa"
| eval req_url = lower(coalesce(url, cs_uri_stem, dest_url, "-"))
| eval src = coalesce(src_ip, c_ip, src, "-")
| eval user = coalesce(cs_username, user, src_user, "unknown")
| where like(req_url, "%virustotal.com%")
    OR like(req_url, "%shodan.io%")
    OR like(req_url, "%api.recordedfuture.com%")
    OR like(req_url, "%otx.alienvault.com%")
    OR like(req_url, "%urlscan.io%")
    OR like(req_url, "%greynoise.io%")
    OR like(req_url, "%malwarebazaar.abuse.ch%")
    OR like(req_url, "%threatfox.abuse.ch%")
    OR like(req_url, "%bazaar.abuse.ch%")
    OR like(req_url, "%hybrid-analysis.com%")
    OR like(req_url, "%tria.ge%")
    OR like(req_url, "%pulsedive.com%")
| where NOT (user="svc-threathunting" OR user="svc-siem" OR user="soc-analyst" OR user="siem-collector")
| where NOT (action="blocked" OR action="denied")
| lookup threat_intel_ips ip AS src OUTPUT threat_score threat_category
| eval threat_score = coalesce(threat_score, 0)
| stats
    count AS query_count,
    dc(req_url) AS unique_urls,
    values(req_url) AS sampled_urls,
    values(user) AS users,
    min(_time) AS first_seen,
    max(_time) AS last_seen,
    max(threat_score) AS max_threat_score
    BY src
| eval risk_flag = case(
    max_threat_score > 70, "KnownMaliciousSource",
    query_count > 100, "HighVolumeNonSOC",
    unique_urls > 20, "BroadRecon",
    1=1, "Low"
)
| where risk_flag != "Low"
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| table src, query_count, unique_urls, sampled_urls, users, first_seen, last_seen, max_threat_score, risk_flag
| sort -max_threat_score -query_count

medium severity low confidence

Data Sources

Proxy logs (BlueCoat, Squid, Cisco WSA) Firewall logs (Palo Alto, Cisco ASA) Threat Intel IP lookup table

Required Sourcetypes

bluecoat:proxysg:access:kv squid cisco:wsa:squid palo_alto_networks:firewall cisco:asa

False Positives

Automated SOAR enrichment pipelines using shared service accounts not on the exclusion list
Developer workstations where security researchers are manually investigating malware samples or campaign indicators
Threat intelligence platform integrations that aggregate data from multiple vendors through proxy-visible egress
Security tool vendor agents performing cloud reputation checks that route through corporate proxy
Red team or penetration testing engagements performing infrastructure OSINT through corporate egress

Elastic Security (EQL)

eql

any where (
  event.type : ("start", "creation", "connection") and
  process.name : ("powershell.exe", "cmd.exe", "python.exe", "wscript.exe") and
  not process.code_signature.trusted == true
)

medium severity low confidence

Data Sources

Elastic Endpoint Security

Required Tables

logs-endpoint.events.*

False Positives

Security Operations Center analysts performing daily threat hunting or indicator enrichment via threat intel APIs
Automated SOAR playbooks or SIEM enrichment workflows querying VirusTotal or similar platforms to enrich alerts
Vulnerability management or penetration testing tools performing infrastructure fingerprinting via Shodan

IBM QRadar (AQL)

sql

SELECT
    DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS EventTime,
    LOGSOURCENAME(logsourceid) AS LogSource,
    "username" AS AccountName,
    sourceip AS SourceIP,
    "CommandLine" AS CommandLine,
    CASE
        WHEN "CommandLine" ILIKE '%bypass%' THEN 85
        WHEN "CommandLine" ILIKE '%-enc%' THEN 80
        ELSE 60
    END AS RiskScore
FROM events
WHERE
    LOGSOURCETYPENAME(devicetype) IN ('Microsoft Windows Security Event Log', 'Universal DSM')
    AND eventid IN (4688, 1)
    AND RiskScore >= 60
ORDER BY EventTime DESC
LAST 1 HOURS

medium severity low confidence

Data Sources

IBM QRadar SIEM Windows Security Events Endpoint Agent

Required Tables

events

False Positives

Security Operations Center analysts performing daily threat hunting or indicator enrichment via threat intel APIs
Automated SOAR playbooks or SIEM enrichment workflows querying VirusTotal or similar platforms to enrich alerts
Vulnerability management or penetration testing tools performing infrastructure fingerprinting via Shodan

Sumo Logic CSE

sql

_sourceCategory=windows/* OR _sourceCategory=endpoint/*
| json auto
| where process_name in ("powershell.exe", "cmd.exe", "wscript.exe", "cscript.exe")
| where process_cmdline matches /(-enc|-bypass|-hidden)/i
| if(process_cmdline matches /-enc/i, 80, 60) as risk_score
| where risk_score >= 60
| count by host, user, process_name, process_cmdline, risk_score
| sort - risk_score

medium severity low confidence

Data Sources

Sumo Logic Cloud SIEM Windows Event Logs Endpoint Telemetry

Required Tables

_sourceCategory=windows/* OR _sourceCategory=endpoint/*

False Positives

Security Operations Center analysts performing daily threat hunting or indicator enrichment via threat intel APIs
Automated SOAR playbooks or SIEM enrichment workflows querying VirusTotal or similar platforms to enrich alerts
Vulnerability management or penetration testing tools performing infrastructure fingerprinting via Shodan

Google Chronicle / SecOps

yaral

rule detection_t1681 {
  meta:
    author = "Argus Detection Platform"
    description = "Detects Search Threat Vendor Data - T1681"
    severity = "HIGH"
    mitre_attack = "T1681"
    reference = "https://attack.mitre.org/techniques/T1681/"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    $e.principal.hostname = $hostname
    $e.target.process.file.full_path = $process_path
    $e.target.process.command_line = $cmdline
    re.regex($e.target.process.file.full_path, `(?i)(powershell|cmd|wscript|cscript)\.exe$`) and
    re.regex($e.target.process.command_line, `(?i)(-enc|-bypass|invoke-expression)`)
    not re.regex($e.principal.process.file.full_path, `(?i)(trustedinstaller|msiexec)`)

  condition:
    $e
}

medium severity low confidence

Data Sources

EDR Platform

Required Tables

PROCESS_LAUNCH

False Positives

Security Operations Center analysts performing daily threat hunting or indicator enrichment via threat intel APIs
Automated SOAR playbooks or SIEM enrichment workflows querying VirusTotal or similar platforms to enrich alerts
Vulnerability management or penetration testing tools performing infrastructure fingerprinting via Shodan

CrowdStrike LogScale (CQL)

cql

#event_simpleName = "ProcessRollup2"
| ImageFileName = /(?i)(powershell|cmd|wscript|cscript|mshta)\.exe$/
| CommandLine = /(?i)(-enc|-bypass|invoke-expression)/
| case {
    CommandLine = /(?i)-enc/ | DetectionType := "EncodedCommand" ;
    CommandLine = /(?i)-bypass/ | DetectionType := "BypassExecution" ;
    * | DetectionType := "SuspiciousExecution"
}
| table([ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName, DetectionType, ProcessId])
| sort(@timestamp, order=desc, limit=100)

medium severity low confidence

Data Sources

CrowdStrike Falcon Endpoint Protection

Required Tables

ProcessRollup2

False Positives

Security Operations Center analysts performing daily threat hunting or indicator enrichment via threat intel APIs
Automated SOAR playbooks or SIEM enrichment workflows querying VirusTotal or similar platforms to enrich alerts
Vulnerability management or penetration testing tools performing infrastructure fingerprinting via Shodan

Search Threat Vendor Data

Data Sources

Required Tables

False Positives

Data Sources

Required Sourcetypes

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock Pro Content

Related Detections

Same Tactic: Reconnaissance

Popular Detections