Searching for SHA256

[mbaki]

Hi all,

I have a list of SHA256 (134 of them) that I need to search for. What's the best way to do that, manually will take forever.

Thanks
Monah

[weslambert]

You could use an Elastalert rule and query back since the beginning of your data , you could technically develop a Sigma rule, and have Playbook convert it for you, or you could use a simple bash script to create your ad-hoc query for you with something like the following:

#!/bin/bash
# Create ES query for list of values within a line-delimited text file
# Ex.
#      abc1234
#      bcd4567
#
# Use specific field:
# Ex. ./create_query ./hashlist hash.sha256
#
# Output: hash.sha256:(acbd1234 OR bcd4567)
#
# Don't use field:
# Ex. ./create_query ./hashlist
#
# Output: abc1234 OR bcd4567

FILE=$1
FIELD=$2

list=$FILE
while IFS= read -r line
do
  VALUES+="$line OR "
done < "$list"
CLEANVALUES=${VALUES%????}
echo "Paste the following into the query bar:"
echo
if ! [ -z "$FIELD" ]; then
    echo "$FIELD:($CLEANVALUES)"
else
    echo "$CLEANVALUES"
fi
echo