You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
DECRYPT is a set of Splunk commands which provide encryption and
14
14
decryption routines commonly used in malware communication and data
@@ -51,102 +51,120 @@ The above example can be explained as:
51
51
- Pass the output of `hex` to `emit` with the argument `'decrypted'`, creating a `decrypted` field
52
52
53
53
## Functions
54
-
`btoa()`
55
-
Encodes input to a Base64 string.
54
+
### `btoa()`
55
+
-Encodes input to a Base64 string.
56
56
57
57
`b64(), atob()`
58
-
Decodes a Base64 encoded string.
58
+
-Decodes a Base64 encoded string.
59
59
60
60
`b32()`
61
-
Decodes a Base32 encoded string.
61
+
-Decodes a Base32 encoded string.
62
62
63
63
`b58()`
64
-
Decodes a Base58 encoded string.
64
+
-Decodes a Base58 encoded string.
65
65
66
66
`rotx(count)`
67
-
Implements Caesarian shift. The count argument specifies the amount to shift and must be an integer.
67
+
-Implements Caesarian shift. The count argument specifies the amount to shift and must be an integer.
68
68
69
69
`rol(count)`
70
-
Implements rotate-on-left to each character within the string using an 8 bit boundary. The count argument specifies the amount to rotate and must be an integer.
70
+
-Implements rotate-on-left to each character within the string using an 8 bit boundary. The count argument specifies the amount to rotate and must be an integer.
71
71
72
72
`ror(count)`
73
-
Implements rotate-on-right to each character within the string using an 8 bit boundary. The count argument specifies the amount to rotate and must be an integer.
73
+
- Implements rotate-on-right to each character within the string using an 8 bit boundary.
74
+
- The count argument specifies the amount to rotate and must be an integer.
74
75
75
76
`xor(key)`
76
-
Implements basic XOR cipher against the field with the supplied key. The key can be provided as a string or integer.
77
+
- Implements basic XOR cipher against the field with the supplied key.
78
+
- The key can be provided as a string or integer.
77
79
78
80
`rc4('key')`
79
-
Implements the RC4 cipher against the field with the supplied key. The key provided must be a string.
81
+
- Implements the RC4 cipher against the field with the supplied key.
82
+
- The key provided must be a string.
80
83
81
84
`hex()`
82
-
Transforms input into its hexadecimal representation.
85
+
-Transforms input into its hexadecimal representation.
83
86
84
87
`unhex()`
85
-
Transforms hexadecimal input into its byte form.
88
+
-Transforms hexadecimal input into its byte form.
86
89
87
90
`save('name')`
88
-
Saves the current state to memory as name.
91
+
-Saves the current state to memory as name.
89
92
90
93
`load('name')`
91
-
Recalls the previously saved state name from memory.
94
+
-Recalls the previously saved state name from memory.
92
95
93
96
`ascii()`
94
-
Transforms input into ASCII output. Non-printable characters will be replaced with a period.
97
+
-Transforms input into ASCII output. Non-printable characters will be replaced with a period.
95
98
96
99
`emit('name')`
97
-
Outputs the current state as UTF-8 to the field name.
100
+
-Outputs the current state as UTF-8 to the field name.
98
101
99
102
`substr(offset, count)`
100
-
Returns a substring of the input, starting at the index offset with the number of characters count. Set the count to `'null'` to return from the start offset to the end of the input.
103
+
- Returns a substring of the input, starting at the index offset with the number of characters count.
104
+
- Set the count to `'null'` to return from the start offset to the end of the input.
101
105
102
106
`slice(start, end)`
103
-
Returns a slice of the input, starting at start offset to the end offset. Set the end to `'null'` to go to the end of the input.
107
+
- Returns a slice of the input, starting at start offset to the end offset.
108
+
- Set the end to `'null'` to go to the end of the input.
104
109
105
110
`decode('codec')`
106
-
Returns a decoded version of the input based on the codec, python codec list is available on https://docs.python.org/3/library/codecs.html#standard-encodings
111
+
- Returns a decoded version of the input based on the codec.
112
+
- Python codec list is available on https://docs.python.org/3/library/codecs.html#standard-encodings
107
113
108
114
`escape`
109
-
Returns a string where control characters, \, and non-ASCII characters are backslash escaped (e.g. `\x0a`, `\\`, `\x80`).
115
+
-Returns a string where control characters, \, and non-ASCII characters are backslash escaped (e.g. `\x0a`, `\\`, `\x80`).
110
116
111
117
`unescape`
112
-
Returns a string run through python unicode_escape (i.e. return the unicode point(s)). Reverses `escape`. Also unescapes Unicode codepoints (`\uxxxx` or `\Uxxxxxxxx`), which `escape` does not produce.
118
+
- Returns a string run through python unicode_escape (i.e. return the unicode point(s)). Reverses `escape`.
119
+
- Also unescapes Unicode codepoints (`\uxxxx` or `\Uxxxxxxxx`), which `escape` does not produce.
113
120
114
121
`htmlescape`
115
-
Returns a string with `&`, `<`, and `>` XML escaped like `&`.
122
+
-Returns a string with `&`, `<`, and `>` XML escaped like `&`.
116
123
117
124
`htmlunescape`
118
-
Returns a string with HTML references like `>` and `>` unescaped to `>`.
125
+
-Returns a string with HTML references like `>` and `>` unescaped to `>`.
119
126
120
127
`tr('from', 'to')`
121
-
Takes an argument to translate "from" and an argument of characters to translate "to" and then returns a result with the result (similar to `tr` in Unix).
128
+
-Takes an argument to translate "from" and an argument of characters to translate "to" and then returns a result with the result (similar to `tr` in Unix).
122
129
123
130
`rev()`
124
-
Returns the input in reverse order.
131
+
-Returns the input in reverse order.
125
132
126
133
`find('subseq', start)`
127
-
Returns the index of a subsequence "subseq" starting at index "start", or `-1` if the subsequence is not found.
134
+
-Returns the index of a subsequence "subseq" starting at index "start", or `-1` if the subsequence is not found.
128
135
129
136
`b32re()`
130
-
Returns a reverse-endian base32 decoded string, as used in the SunBurst DGA.
137
+
-Returns a reverse-endian base32 decoded string, as used in the SunBurst DGA.
131
138
132
139
`b64re()`
133
-
Returns a reverse-endian base64 decoded string.
140
+
-Returns a reverse-endian base64 decoded string.
134
141
135
142
`zlib_inflate()`
136
-
Returns zlib.decompress() inflated bytes. The window size (wbits) must be provided.
143
+
- Returns zlib.decompress() inflated bytes.
144
+
- Default window size of -15 (raw inflate) is used if a wbits value is not provided.
145
+
146
+
`zlib_deflate()`
147
+
- Returns zlib.compress() deflated bytes.
148
+
- Default level of -1 (currently 6) and window size of -15 (raw deflate) if values are not provided.
149
+
150
+
`entropy()`
151
+
- Returns base2 entropy of input. The maximum entropy for Unicode strings can be greater than 8.
137
152
138
153
_Note: you must use **single quotes** around the strings._
139
154
140
155
# Function Arguments
141
156
## Strings
142
-
Strings can be specified by encapsulating values in apostrophes (single quote). Strings accept Pythonic escape sequences, so hexadecimal and octal values can be specified with \xhh and \ooo respectively.
157
+
Strings can be specified by encapsulating values in apostrophes (single quote). Strings accept Pythonic escape sequences, so hexadecimal and octal values can be specified with `\xhh` and `\ooo` respectively.
158
+
Unicode values can be expressed as `\u0000` or `\U00000000`
143
159
144
160
`'This is a valid string'`
161
+
145
162
`'This is also \x61 valid string.'`
146
163
147
164
Quotation marks (double quotes) **cannot** be used.
148
165
149
166
`"This is not a valid string"`
167
+
150
168
## Integers
151
169
Integers can be specified numerically or as hexadecimal representations by prefixing values with a 0x.
152
170
@@ -161,19 +179,23 @@ The above example demonstrates passing the sourcetype field as the key to the xo
161
179
Fields saved using the save command can also be referenced.
Functions which take no arguments do not need parenthesis in order for syntax checking to pass. The following examples will pass syntax checks and execute the same.
166
185
167
186
`... | decrypt field=_raw b64 hex unhex`
187
+
168
188
`... | decrypt field=_raw b64() hex() unhex()`
189
+
169
190
`... | decrypt field=_raw b64() hex unhex`
170
191
171
192
New lines can be used to break up command sequences for easier readability.
0 commit comments