Quickly search through elasticsearch documents for oddly named fields (ex: isass.exe files impersonating lsass.exe)

elk_find_spoofs.py

import elasticsearch

# this will search for closely named permutations of strings ... IE a common attacker technique is to
# name binaries close to a legitimate binary (isass.exe vs lsass.exe) ... this will search through
# millions of ES documents very quickly, and only return the closely related permutations!

es = elasticsearch.Elasticsearch([{host="localhost", port=9200}])
es.search( index="files_index", body={ "query": { "bool": { "should": [ {"fuzzy": { "file_name":"svchost.exe" }} ], "must_not": [ {"match": { "file_name":"svchost.exe" }} ] } } })["hits"]