Exchange¶
Datasets, lookups, detections, models, saved searches, dashboards, normalizers and alert policies, shared for every Bifract install. Bundles group the pieces of one use case so you can add them together.
To add one, open Exchange in Bifract's sidebar (under Data) and click Add. See Using the Exchange for what each kind adds and how to contribute.
21 items
BundleRemote management tool huntingFind remote monitoring and management tools from Magic Sword's LOLRMM list: the lookup, a per-user rarity model, an alert for tools rare for their user, a saved search and a dashboard.BundleCelesTLSH fuzzy hash huntingFind variants of public attack tools by TLSH similarity: Magonia Research's CelesTLSH lookup, the TLSH index, an alert for untrusted binaries close to a tool, and a dashboard. Needs process events with a tlsh field.BundleLimaCharlie normalizersEvery LimaCharlie normalizer, covering EDR process, network, activity and injection events, detections, and Sysmon over WEL.DatasetLab 001: Meridian workstation intrusionThree days of endpoint and network telemetry from a small Windows domain, with an intrusion inside it. Sysmon, Windows event logs, Zeek and Velociraptor Autoruns from a domain controller, three workstations and a network sensor. Domains and attacker infrastructure are fictional; do not contact any indicator in it.LookupLOLRMM toolsRemote monitoring and management tools attackers abuse, keyed on their install paths as globs. Use with match() on a process image to flag RMM tools.LookupCelesTLSH attack tool hashesTLSH digests of public attack tools and C2 frameworks, keyed on TLSH_Hash. Use with tlsh(dict="celes_tlsh"), then match() on tlsh_match to bring in Repo_Name and File_Name.ModelRMM tools by userRarity model of which LOLRMM tools each user runs, so a tool new to a user stands out. Needs Sysmon process events with a user field.ModelTLSH indexIndexes the distinct digests in the tlsh field, which tlsh() needs. Run a backfill after adding it to cover logs already stored.DetectionRemote Management Tool Rare for the UserA user ran a LOLRMM tool that is new to them or a small share of their RMM use.DetectionUntrusted Binary Similar to an Attack ToolAn untrusted process within TLSH distance 50 of a public attack tool. Needs Sysmon process events enriched with tlsh and authenticode_trusted, such as Velociraptor's Windows.EventLogs.SysmonProcessEnriched produces.Saved searchLOLRMM tool executionsProcess starts whose image matches a LOLRMM install path, with the tool's name.DashboardRemote Management ToolsWhich RMM tools run, where, by whom, and which are rare for their user.DashboardTLSH Similarity to Attack ToolsExecutables close to public attack tools by TLSH distance, by family, host and time.NormalizerSysmonMaps Windows Sysmon events onto Bifract's normalized fields, including bifract_category.NormalizerLimaCharlie EDR - ProcessMaps LimaCharlie NEW_PROCESS and EXISTING_PROCESS events.NormalizerLimaCharlie EDR - NetworkMaps LimaCharlie NETWORK_CONNECTIONS, NEW_TCP4_CONNECTION and CODE_IDENTITY events.NormalizerLimaCharlie EDR - ActivityMaps LimaCharlie NEW_DOCUMENT, DNS_REQUEST and TERMINATE_PROCESS events.NormalizerLimaCharlie EDR - InjectionMaps LimaCharlie REMOTE_PROCESS_HANDLE and NEW_REMOTE_THREAD events.NormalizerLimaCharlie - DetectionsMaps LimaCharlie D&R detections (output --type detect).NormalizerLimaCharlie WEL - SysmonMaps Sysmon events delivered through LimaCharlie's Windows Event Log stream.PolicySOC baselineConservative alert policy rules. ATT&CK labels and no wildcard queries block; the rest advise.
No items match.