Quantum-Safe Monitoring — Detection Runbook

| tstats summariesonly=t sum(All_Traffic.bytes_out) as bytes_out
  from datamodel=Network_Traffic.All_Traffic
  where All_Traffic.app=ssl OR All_Traffic.dest_port IN (443,8443)
        AND NOT All_Traffic.dest_category=internal
  by All_Traffic.src, _time span=1h
| eventstats avg(bytes_out) as avg_30d, stdev(bytes_out) as sd_30d
  by All_Traffic.src
| eval z_score = (bytes_out - avg_30d) / sd_30d
| where z_score > 4 AND bytes_out > 500000000
| eval gb_out = round(bytes_out/1024/1024/1024, 2)
| lookup asset_cmdb.csv ip as "All_Traffic.src" OUTPUT business_unit, criticality, owner
| table _time, All_Traffic.src, hostname, business_unit, gb_out, z_score, avg_30d
| sort -z_score

index=zeek sourcetype=bro:conn proto=tcp service=ssl
| where duration > 14400
| iplocation id.resp_h
| lookup business_partner_asn.csv asn OUTPUT partner as is_partner
| where isnull(is_partner) AND Country!="Thailand"
| eval gb = round(orig_bytes/1024/1024/1024, 2)
| where gb > 1
| lookup asset_cmdb.csv ip as "id.orig_h" OUTPUT business_unit, criticality
| table _time, id.orig_h, business_unit, id.resp_h, Country, asn, duration, gb, ja3

index=crowdstrike sourcetype=crowdstrike:event:json
  event_simpleName=ProcessRollup2
  (CommandLine="*7z*-p*" OR CommandLine="*openssl enc*"
   OR CommandLine="*gpg*--encrypt*" OR CommandLine="*rar* a -p*"
   OR CommandLine="*Compress-Archive*Password*")
| eval staging_time=_time, host=ComputerName
| table host, UserName, ParentBaseFileName, FileName, CommandLine, staging_time
| join host [
    search index=zeek sourcetype=bro:conn service=ssl earliest=-30m
    | where orig_bytes > 100000000
    | stats min(_time) as upload_time, sum(orig_bytes) as bytes
      by id.orig_h as host
  ]
| where upload_time - staging_time BETWEEN 0 AND 1800
| eval delta_min = round((upload_time - staging_time)/60, 1)
| eval gb = round(bytes/1073741824, 2)
| table host, UserName, CommandLine, delta_min, gb

index=crowdstrike event_simpleName=FileOpenInfo
  (TargetFileName="*.pem" OR TargetFileName="*.pfx"
   OR TargetFileName="*\\.ssh\\id_*" OR TargetFileName="*private.key"
   OR TargetFileName="*\\AppData\\Roaming\\*\\Local State"
   OR TargetFileName="/root/.ssh/*" OR TargetFileName="/home/*/.ssh/*")
| stats count, values(TargetFileName) as files, values(UserName) as users
  by ComputerName as host, ImageFileName
| lookup authorized_key_readers.csv process as ImageFileName OUTPUT is_authorized
| where isnull(is_authorized)
| sort -count

index=zeek sourcetype=bro:ssl
| stats count, dc(id.orig_h) as host_count,
        values(server_name) as sni,
        latest(_time) as last_seen by ja3
| lookup abuse_ja3.csv ja3 OUTPUT malware_family, threat_type
| where host_count <= 2 AND count > 5
| eval suspicious_score = case(
    isnotnull(malware_family), "critical",
    match(mvjoin(sni,","), "(?i)(pastebin|telegram|discord|onion)"), "high",
    count < 20, "medium",
    1=1, "low")
| eval last_seen = strftime(last_seen, "%Y-%m-%d %H:%M")
| where suspicious_score!="low"
| sort -suspicious_score, count

index=dns sourcetype IN (infoblox:dns,cisco_umbrella:dns,isc:bind:query)
| eval q_len = len(query)
| eval subdomain = mvindex(split(query,"."),0)
| eval entropy = round(, 2)
| stats count, avg(q_len) as avg_len, max(entropy) as max_ent,
        dc(query) as unique_queries,
        values(reply_code) as codes
  by src_ip, query_domain
| where avg_len > 30 AND max_ent > 4.0 AND unique_queries > 50
| eval nxdomain_burst = if(match(mvjoin(codes,","),"NXDOMAIN"), "yes", "no")
| lookup asset_cmdb.csv ip as src_ip OUTPUT business_unit, criticality
| sort -unique_queries

index=zscaler sourcetype=zscalernss-web action=allow
| eval gb_up = bytes_out/1073741824
| stats sum(gb_up) as gb_total, count, values(url) as urls,
        values(appname) as apps
  by user, urlcategory, bin(_time, 1d) as day
| where (urlcategory IN ("personal_storage","unsanctioned_apps","shadow_it")
         OR risk_score > 70) AND gb_total > 2
| eval severity = case(gb_total > 20, "critical",
                       gb_total > 10, "high", 1=1, "medium")
| sort -gb_total

index=netskope sourcetype="netskope:webtxn"
  activity=Upload OR activity=PostUpload
| eval gb_up = client_bytes/1073741824
| stats sum(gb_up) as gb_total by user, app, app_risk, bin(_time, 1d) as day
| where (app_risk >= 7 OR match(app_category,"(?i)Personal")) AND gb_total > 2
| sort -gb_total

index=aws sourcetype=aws:cloudtrail
  eventSource=kms.amazonaws.com
  eventName IN (Decrypt,GenerateDataKey)
| bin _time span=1h
| stats count by _time, userIdentity.userName, "resources{}.ARN"
| eventstats avg(count) as avg_30d, stdev(count) as sd_30d
  by userIdentity.userName, "resources{}.ARN"
| eval z_score = (count - avg_30d) / sd_30d
| where z_score > 5 AND count > 1000
| table _time, userIdentity.userName, "resources{}.ARN", count, avg_30d, z_score

index=zeek sourcetype=bro:ssl earliest=-1d@d latest=@d
| eval issue = case(
    match(cipher, "(?i)RC4|DES|MD5|EXPORT|NULL"), "weak_cipher",
    match(version, "TLSv10|TLSv11|SSLv3"), "weak_version",
    match(cipher, "RSA_WITH"), "non_PFS",
    1=1, "ok")
| where issue != "ok"
| stats count, values(issue) as issues, latest(_time) as last
  by id.resp_h, server_name, cipher, version
| eval last_seen = strftime(last, "%Y-%m-%d %H:%M")
| lookup asset_cmdb.csv ip as id.resp_h OUTPUT business_unit, owner
| sort -count

index=crowdstrike event_simpleName=ImageHash
  (ImageFileName="*bcrypt.dll" OR ImageFileName="*ncrypt.dll"
   OR ImageFileName="*libcrypto*" OR ImageFileName="*libssl*")
| stats count, values(ImageFileName) as libs, values(UserName) as users
  by ComputerName as host, ParentBaseFileName as parent
| lookup known_crypto_consumers.csv process as parent OUTPUT is_known
| where isnull(is_known)
| where parent NOT IN ("chrome.exe","firefox.exe","svchost.exe","msedge.exe",
                       "outlook.exe","teams.exe","slack.exe")
| sort -count

index=zscaler (action=bypass OR ssl_decrypt_action=no_decrypt)
  AND (reason IN ("cert_pinning","protocol_quic","unknown_protocol"))
| stats sum(bytes_out) as bytes, dc(url) as url_count
  by user, dest_host, reason
| eval mb = round(bytes/1048576, 2)
| where mb > 500
| iplocation dest_host as host
| eval risk = case(
    reason="protocol_quic", "medium",
    match(dest_host,"(?i)(t\.me|telegram|tor|onion|protonmail|signal)"), "critical",
    1=1, "high")
| where risk!="medium"
| sort -mb

| multisearch
  [search index=cert_inventory sourcetype=sslyze:scan
     earliest=-1d@d latest=@d
   | spath server_scan_results{}.scan_commands_results.ssl_2_0_cipher_suites
   | stats values(cipher_suite) as today_cipher,
            latest(pubkey_size) as today_pksize by hostname]
  [search index=cert_inventory sourcetype=sslyze:scan
     earliest=-2d@d latest=-1d@d
   | stats values(cipher_suite) as yesterday_cipher,
            latest(pubkey_size) as yesterday_pksize by hostname]
| eval drift = case(
    today_cipher!=yesterday_cipher, "cipher_changed",
    today_pksize!=yesterday_pksize, "keysize_changed",
    1=1, "same")
| where drift!="same"
| lookup asset_cmdb.csv hostname OUTPUT business_unit, owner
| table hostname, business_unit, drift, today_cipher, yesterday_cipher

index=cert_inventory sourcetype=sslyze:scan earliest=-1d
| eval score = 100
| eval score = if(match(tls_versions,"TLS_1_0|TLS_1_1|SSL"), score-30, score)
| eval score = if(match(cipher_list,"RSA_WITH|EXPORT|RC4|MD5|3DES"), score-25, score)
| eval score = if(pubkey_algorithm="rsaEncryption" AND pubkey_size<3072,
                  score-20, score)
| eval score = if(pubkey_algorithm="ecPublicKey" AND match(curve,"prime256"),
                  score-15, score)
| eval score = if(supports_pqc_hybrid="true", score+10, score)
| eval score = max(0, min(100, score))
| lookup asset_cmdb.csv hostname OUTPUT business_unit
| stats avg(score) as overall_score, count by hostname, business_unit
| sort score

index=netskope sourcetype="netskope:application:json"
| stats count, values(cipher_suite) as ciphers,
        latest(_time) as last_seen
  by app, app_risk, app_category
| where match(mvjoin(ciphers,","), "(?i)RSA_WITH|TLS_RSA|EXPORT|RC4|3DES")
| eval last_seen = strftime(last_seen, "%Y-%m-%d")
| table app, app_risk, app_category, ciphers, count, last_seen
| sort -count

| multisearch
   [search index=crowdstrike CommandLine="*7z*-p*"
              OR CommandLine="*openssl enc*" earliest=-7d
    | eval signal="edr_staging", weight=3
    | stats max(_time) as last_seen, values(signal) as signals,
            values(weight) as weights by ComputerName as host]
   [search index=zscaler urlcategory IN ("personal_storage","shadow_it")
              earliest=-7d
    | eval gb_up=bytes_out/1073741824
    | stats sum(gb_up) as gb by user
    | where gb>2
    | eval signal="casb_upload", weight=2
    | rename user as host
    | stats max(_time) as last_seen, values(signal) as signals,
            values(weight) as weights by host]
   [search index=cert_inventory sourcetype=sslyze:scan
              earliest=-7d
              cipher_list IN ("*RSA_WITH*","*RC4*","*DES*")
    | eval signal="weak_crypto", weight=1
    | rename hostname as host
    | stats max(_time) as last_seen, values(signal) as signals,
            values(weight) as weights by host]
| stats sum(weight) as risk_score, values(signals) as signals,
        max(last_seen) as last_seen by host
| where risk_score >= 4
| eval last_seen = strftime(last_seen, "%Y-%m-%d %H:%M")
| lookup asset_cmdb.csv hostname as host OUTPUT business_unit, criticality
| sort -risk_score