faststeak

index=<your tenable index here> sourcetype=tenable:sc:vuln (pluginID=10396 OR pluginID=10395 OR pluginID=23973 OR pluginID=24271 OR pluginID=42411 OR pluginID=60119) TERM(<your testuser here>)
| table ip dnsName pluginID pluginName pluginText
| rex field=pluginText max_match=0 (?<allInfo>((?<=\n-\s)((?<=\n-\s)(.+\n)*)*))
| mvexpand allInfo
| rex field=allInfo (?<shareContents>((?<=:\n)(.+\n)*(.)*))
| rex field=allInfo (?<sharePermissions>(((?<=\s{2}-\s\()(.)*)(?=\))))
| rex field=allInfo (?<shareName>((.)*(?=\s{2}-)))
| search sharePermissions=*writable*
| table dnsName shareName

faststeak

index=<your target indexes>
| regex "(?i)\${(\${(.*?:|.*?:.*?:-)(\'|\"|\`)*(?1)}*|[jndi:(ldap|ldaps|rmi|dns|nis|iiop|corba|nds|http)](\'|\"|\`)*}*){9,10}"

| rex field=_raw max_match=0 "(?<ip_addr>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"
| rex field=_raw "Base64\/(?<base64>[A-Za-z0-9+]{15,}[=]{0,2})"
| decrypt field=base64 b64 emit('payload')

| table _time index sourcetype host ip_addr base64 payload _raw

| mvexpand ip_addr

faststeak

{
  "id": "PowershellTranscripts",
  "lib": "custom",
  "rules": [
    {
      "condition": "sourcetype=='powershell:transcripts'",
      "type": "regex",
      "timestampAnchorRegex": "/Start time:\\s/",
      "timestamp": {
        "type": "format",