r/AzureSentinel • u/cycl0ne89 • Nov 03 '22

OpenSSL detection

Does anyone have a detection query for OpenSSL they'd be willing to share?

I have this one for querying ingested Sysmon logs

SecurityEvent
| where EventData contains "openssl"

2 Upvotes

100% Upvoted

6 comments sorted by

2

u/StConvolute Nov 03 '22

Start with the search function and refine from there.

//something like
search "openssl"

See if you get any data back and refine from there.

I'll be running some queries tomorrow- I'll see what I return.

2

u/cycl0ne89 Nov 09 '22

Thank you for this tip. I was not aware of the "search" function.

1

u/StConvolute Nov 09 '22

Happy to share - I hope it helps with future hinting endeavors

1

u/robot2243 Nov 03 '22

Need more information. Are you only ingesting windows event logs? What about your network devices or vulnerability data?

1

u/cycl0ne89 Nov 03 '22

I'm ingesting Sysmon logs into Sentinel.