@L0ranCyb Hello i guess you are working with the ELK stack ? with ELK there is a lot of restrictions, you have two options:

• Use another list available here in the same repo https://github.com/mthcht/ThreatHunting-Keywords/tree/main/elk (it's not a direct extract of threathunting-keywords.csv, it's modified for ELK)
• Use Sigma "hunting" rules, directly extracted from this project https://github.com/mthcht/ThreatHunting-Keywords-sigma-rules with pysigma for the convertion

Thanks for the response ! But it's with Splunk. ;-)

@L0ranCyb It's working for me:

Splunk doesn't have issues with special caracters or spaces for matching fields, it should work for you too, did you declare your lookup definition like this https://github.com/mthcht/ThreatHunting-Keywords?tab=readme-ov-file#use-the-list-to-hunt-with-splunk ?

For the keyword it shoud have been * --coin=monero* i put two spaces by error, but still it works in my example

sorry, I make an error in the search filter (metadata is not metata!!)
Everything works perfectly well !!!!
Thanks for the job !

@L0ranCyb the space was put on purpose here, we have the keywords with a /, \ and a

On which field are you trying to match the keyword ? if it's a process_name field with only the process name it will not match here, a process or file path is more adapted to the list, this is done to help reduce false positives with wildcard keywords.

It's with process.
I have a process like "rusthound.exe -zip......."

i see i should have add rusthound.exe with a space at the end to take this into account, i will update the list thanks