{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Windows Events to ATT&CK Techniques\n",
    "* **Author**: Jose Rodriguez (@Cyb3rPandah)\n",
    "* **Project**: Infosec Jupyter Book\n",
    "* **Public Organization**: [Open Threat Research](https://github.com/OTRF)\n",
    "* **License**: [Creative Commons Attribution-ShareAlike 4.0 International](https://creativecommons.org/licenses/by-sa/4.0/)\n",
    "* **Reference**: https://github.com/hunters-forge/OSSEM/tree/master/attack_data_sources"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Importing Libraries"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "metadata": {},
   "outputs": [],
   "source": [
    "from attackcti import attack_client\n",
    "\n",
    "import pandas as pd\n",
    "from pandas import json_normalize\n",
    "# Do not truncate Pandas output\n",
    "pd.set_option('display.max_colwidth', None)\n",
    "\n",
    "import requests\n",
    "\n",
    "import yaml"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Getting ATT&CK enterprise techniques for Windows platform"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* Getting all Windows techniques"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>tactic</th>\n",
       "      <th>technique_id</th>\n",
       "      <th>technique</th>\n",
       "      <th>data_sources</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>[impact]</td>\n",
       "      <td>T1531</td>\n",
       "      <td>Account Access Removal</td>\n",
       "      <td>[Windows event logs, Process command-line parameters, Process monitoring]</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>[credential-access]</td>\n",
       "      <td>T1539</td>\n",
       "      <td>Steal Web Session Cookie</td>\n",
       "      <td>[File monitoring, API monitoring]</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>[impact]</td>\n",
       "      <td>T1529</td>\n",
       "      <td>System Shutdown/Reboot</td>\n",
       "      <td>[Windows event logs, Process command-line parameters, Process monitoring]</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>[discovery]</td>\n",
       "      <td>T1518</td>\n",
       "      <td>Software Discovery</td>\n",
       "      <td>[Process command-line parameters, Process monitoring, File monitoring]</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>[lateral-movement]</td>\n",
       "      <td>T1534</td>\n",
       "      <td>Internal Spearphishing</td>\n",
       "      <td>[SSL/TLS inspection, DNS records, Anti-virus, Web proxy, File monitoring, Mail server, Office 365 trace logs]</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "                tactic technique_id                 technique  \\\n",
       "0             [impact]        T1531    Account Access Removal   \n",
       "1  [credential-access]        T1539  Steal Web Session Cookie   \n",
       "2             [impact]        T1529    System Shutdown/Reboot   \n",
       "3          [discovery]        T1518        Software Discovery   \n",
       "4   [lateral-movement]        T1534    Internal Spearphishing   \n",
       "\n",
       "                                                                                                    data_sources  \n",
       "0                                      [Windows event logs, Process command-line parameters, Process monitoring]  \n",
       "1                                                                              [File monitoring, API monitoring]  \n",
       "2                                      [Windows event logs, Process command-line parameters, Process monitoring]  \n",
       "3                                         [Process command-line parameters, Process monitoring, File monitoring]  \n",
       "4  [SSL/TLS inspection, DNS records, Anti-virus, Web proxy, File monitoring, Mail server, Office 365 trace logs]  "
      ]
     },
     "execution_count": 2,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "lift = attack_client()\n",
    "windowsTechniques = lift.get_techniques_by_platform('Windows',stix_format=False)\n",
    "windowsTechniques = lift.remove_revoked(windowsTechniques)\n",
    "windowsTechniques = json_normalize(windowsTechniques)\n",
    "windowsTechniques = windowsTechniques[['tactic','technique_id','technique','data_sources']]\n",
    "windowsTechniques.head()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* Splitting data_sources"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 3,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>tactic</th>\n",
       "      <th>technique_id</th>\n",
       "      <th>technique</th>\n",
       "      <th>data_sources</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>[impact]</td>\n",
       "      <td>T1531</td>\n",
       "      <td>Account Access Removal</td>\n",
       "      <td>Windows event logs</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>[credential-access]</td>\n",
       "      <td>T1539</td>\n",
       "      <td>Steal Web Session Cookie</td>\n",
       "      <td>File monitoring</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>[impact]</td>\n",
       "      <td>T1529</td>\n",
       "      <td>System Shutdown/Reboot</td>\n",
       "      <td>Windows event logs</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>[discovery]</td>\n",
       "      <td>T1518</td>\n",
       "      <td>Software Discovery</td>\n",
       "      <td>Process command-line parameters</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>[lateral-movement]</td>\n",
       "      <td>T1534</td>\n",
       "      <td>Internal Spearphishing</td>\n",
       "      <td>SSL/TLS inspection</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "                tactic technique_id                 technique  \\\n",
       "0             [impact]        T1531    Account Access Removal   \n",
       "1  [credential-access]        T1539  Steal Web Session Cookie   \n",
       "2             [impact]        T1529    System Shutdown/Reboot   \n",
       "3          [discovery]        T1518        Software Discovery   \n",
       "4   [lateral-movement]        T1534    Internal Spearphishing   \n",
       "\n",
       "                      data_sources  \n",
       "0               Windows event logs  \n",
       "1                  File monitoring  \n",
       "2               Windows event logs  \n",
       "3  Process command-line parameters  \n",
       "4               SSL/TLS inspection  "
      ]
     },
     "execution_count": 3,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "windowsTechniques = windowsTechniques['data_sources'].apply(pd.Series)\\\n",
    ".merge(windowsTechniques, left_index = True, right_index = True)\\\n",
    ".drop([\"data_sources\"], axis = 1)\\\n",
    ".melt(id_vars = ['tactic','technique_id','technique'], value_name = \"data_sources\")\\\n",
    ".drop(\"variable\", axis = 1)\\\n",
    ".dropna(subset=['data_sources'])\n",
    "windowsTechniques.head()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Getting OSSEM ATT&CK data sources modeling file"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* Getting Yaml File content"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 4,
   "metadata": {},
   "outputs": [],
   "source": [
    "yamlUrl = 'https://raw.githubusercontent.com/hunters-forge/OSSEM/master/attack_data_sources/event-mappings/all_data_sources.yml'\n",
    "dataSourcesModelingData = requests.get(yamlUrl)\n",
    "all_ds = yaml.safe_load(dataSourcesModelingData.text)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* Creating dictionary of data sources mapped to event IDs"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 5,
   "metadata": {},
   "outputs": [],
   "source": [
    "all_data_sources = {}\n",
    "# Create DS Keys\n",
    "for ds_record in all_ds:\n",
    "    ds_list = ds_record['data_source'].split(\", \")\n",
    "    for ds in ds_list:\n",
    "        if ds not in all_data_sources.keys():\n",
    "            all_data_sources[ds] = []\n",
    "        if ds_record['event_id'] not in all_data_sources[ds]:\n",
    "            all_data_sources[ds].append(ds_record['event_id'])"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* Generating dataframe"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 6,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>data_sources</th>\n",
       "      <th>event_ids</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>Authentication logs</td>\n",
       "      <td>[4776, 4771, 4624, 4648]</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>File monitoring</td>\n",
       "      <td>[6, 9, 11, 2, 5145, 4656, 4663, 4670, 4660, 4658]</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>DLL monitoring</td>\n",
       "      <td>[7]</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>Process use of network</td>\n",
       "      <td>[3, 5031, 5154, 5155, 5156, 5157, 5158, 5159]</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>Windows event logs</td>\n",
       "      <td>[4768, 4769, 4770, 4773, 4779, 4778, 4800, 4801, 4741, 4742, 4743, 4749, 4750, 4751, 4752, 4753, 4731, 4732, 4733, 4734, 4735, 4764, 4799, 4720, 4722, 4723, 4724, 4725, 4726, 4738, 4740, 4767, 4781, 4798, 4662, 4661, 5136, 5137, 5138, 5139, 5141, 4625, 5140, 5142, 5143, 5144, 4656, 4664, 4698, 4699, 4700, 4701, 4702, 4660, 4663, 4658, 4670, 4657, 4717, 4718, 4674, 4673, 5025, 5034, 4697, 4776, 4771, 4624, 4648]</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>5</th>\n",
       "      <td>Windows Registry</td>\n",
       "      <td>[4657, 12, 14, 13]</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>6</th>\n",
       "      <td>Process monitoring</td>\n",
       "      <td>[4688, 1, 4689, 5, 8, 10]</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>7</th>\n",
       "      <td>Process command-line parameters</td>\n",
       "      <td>[4688, 1]</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>8</th>\n",
       "      <td>Loaded DLLs</td>\n",
       "      <td>[7]</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>9</th>\n",
       "      <td>Named Pipes</td>\n",
       "      <td>[17, 18]</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>10</th>\n",
       "      <td>DNS records</td>\n",
       "      <td>[22]</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "                       data_sources  \\\n",
       "0               Authentication logs   \n",
       "1                   File monitoring   \n",
       "2                    DLL monitoring   \n",
       "3            Process use of network   \n",
       "4                Windows event logs   \n",
       "5                  Windows Registry   \n",
       "6                Process monitoring   \n",
       "7   Process command-line parameters   \n",
       "8                       Loaded DLLs   \n",
       "9                       Named Pipes   \n",
       "10                      DNS records   \n",
       "\n",
       "                                                                                                                                                                                                                                                                                                                                                                                                                         event_ids  \n",
       "0                                                                                                                                                                                                                                                                                                                                                                                                         [4776, 4771, 4624, 4648]  \n",
       "1                                                                                                                                                                                                                                                                                                                                                                                [6, 9, 11, 2, 5145, 4656, 4663, 4670, 4660, 4658]  \n",
       "2                                                                                                                                                                                                                                                                                                                                                                                                                              [7]  \n",
       "3                                                                                                                                                                                                                                                                                                                                                                                    [3, 5031, 5154, 5155, 5156, 5157, 5158, 5159]  \n",
       "4   [4768, 4769, 4770, 4773, 4779, 4778, 4800, 4801, 4741, 4742, 4743, 4749, 4750, 4751, 4752, 4753, 4731, 4732, 4733, 4734, 4735, 4764, 4799, 4720, 4722, 4723, 4724, 4725, 4726, 4738, 4740, 4767, 4781, 4798, 4662, 4661, 5136, 5137, 5138, 5139, 5141, 4625, 5140, 5142, 5143, 5144, 4656, 4664, 4698, 4699, 4700, 4701, 4702, 4660, 4663, 4658, 4670, 4657, 4717, 4718, 4674, 4673, 5025, 5034, 4697, 4776, 4771, 4624, 4648]  \n",
       "5                                                                                                                                                                                                                                                                                                                                                                                                               [4657, 12, 14, 13]  \n",
       "6                                                                                                                                                                                                                                                                                                                                                                                                        [4688, 1, 4689, 5, 8, 10]  \n",
       "7                                                                                                                                                                                                                                                                                                                                                                                                                        [4688, 1]  \n",
       "8                                                                                                                                                                                                                                                                                                                                                                                                                              [7]  \n",
       "9                                                                                                                                                                                                                                                                                                                                                                                                                         [17, 18]  \n",
       "10                                                                                                                                                                                                                                                                                                                                                                                                                            [22]  "
      ]
     },
     "execution_count": 6,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "all_data_sources = pd.DataFrame(list(all_data_sources.items()), columns=['data_sources', 'event_ids'])\n",
    "all_data_sources"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Mapping Techniques to Event Logs"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* Joining **Windows ATT&CK Techniques** & **OSSEM**"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 7,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>tactic</th>\n",
       "      <th>technique_id</th>\n",
       "      <th>technique</th>\n",
       "      <th>data_sources</th>\n",
       "      <th>event_ids</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>[impact]</td>\n",
       "      <td>T1531</td>\n",
       "      <td>Account Access Removal</td>\n",
       "      <td>Windows event logs</td>\n",
       "      <td>[4768, 4769, 4770, 4773, 4779, 4778, 4800, 4801, 4741, 4742, 4743, 4749, 4750, 4751, 4752, 4753, 4731, 4732, 4733, 4734, 4735, 4764, 4799, 4720, 4722, 4723, 4724, 4725, 4726, 4738, 4740, 4767, 4781, 4798, 4662, 4661, 5136, 5137, 5138, 5139, 5141, 4625, 5140, 5142, 5143, 5144, 4656, 4664, 4698, 4699, 4700, 4701, 4702, 4660, 4663, 4658, 4670, 4657, 4717, 4718, 4674, 4673, 5025, 5034, 4697, 4776, 4771, 4624, 4648]</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>[credential-access]</td>\n",
       "      <td>T1539</td>\n",
       "      <td>Steal Web Session Cookie</td>\n",
       "      <td>File monitoring</td>\n",
       "      <td>[6, 9, 11, 2, 5145, 4656, 4663, 4670, 4660, 4658]</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>[impact]</td>\n",
       "      <td>T1529</td>\n",
       "      <td>System Shutdown/Reboot</td>\n",
       "      <td>Windows event logs</td>\n",
       "      <td>[4768, 4769, 4770, 4773, 4779, 4778, 4800, 4801, 4741, 4742, 4743, 4749, 4750, 4751, 4752, 4753, 4731, 4732, 4733, 4734, 4735, 4764, 4799, 4720, 4722, 4723, 4724, 4725, 4726, 4738, 4740, 4767, 4781, 4798, 4662, 4661, 5136, 5137, 5138, 5139, 5141, 4625, 5140, 5142, 5143, 5144, 4656, 4664, 4698, 4699, 4700, 4701, 4702, 4660, 4663, 4658, 4670, 4657, 4717, 4718, 4674, 4673, 5025, 5034, 4697, 4776, 4771, 4624, 4648]</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>[discovery]</td>\n",
       "      <td>T1518</td>\n",
       "      <td>Software Discovery</td>\n",
       "      <td>Process command-line parameters</td>\n",
       "      <td>[4688, 1]</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>[lateral-movement]</td>\n",
       "      <td>T1534</td>\n",
       "      <td>Internal Spearphishing</td>\n",
       "      <td>SSL/TLS inspection</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "                tactic technique_id                 technique  \\\n",
       "0             [impact]        T1531    Account Access Removal   \n",
       "1  [credential-access]        T1539  Steal Web Session Cookie   \n",
       "2             [impact]        T1529    System Shutdown/Reboot   \n",
       "3          [discovery]        T1518        Software Discovery   \n",
       "4   [lateral-movement]        T1534    Internal Spearphishing   \n",
       "\n",
       "                      data_sources  \\\n",
       "0               Windows event logs   \n",
       "1                  File monitoring   \n",
       "2               Windows event logs   \n",
       "3  Process command-line parameters   \n",
       "4               SSL/TLS inspection   \n",
       "\n",
       "                                                                                                                                                                                                                                                                                                                                                                                                                        event_ids  \n",
       "0  [4768, 4769, 4770, 4773, 4779, 4778, 4800, 4801, 4741, 4742, 4743, 4749, 4750, 4751, 4752, 4753, 4731, 4732, 4733, 4734, 4735, 4764, 4799, 4720, 4722, 4723, 4724, 4725, 4726, 4738, 4740, 4767, 4781, 4798, 4662, 4661, 5136, 5137, 5138, 5139, 5141, 4625, 5140, 5142, 5143, 5144, 4656, 4664, 4698, 4699, 4700, 4701, 4702, 4660, 4663, 4658, 4670, 4657, 4717, 4718, 4674, 4673, 5025, 5034, 4697, 4776, 4771, 4624, 4648]  \n",
       "1                                                                                                                                                                                                                                                                                                                                                                               [6, 9, 11, 2, 5145, 4656, 4663, 4670, 4660, 4658]  \n",
       "2  [4768, 4769, 4770, 4773, 4779, 4778, 4800, 4801, 4741, 4742, 4743, 4749, 4750, 4751, 4752, 4753, 4731, 4732, 4733, 4734, 4735, 4764, 4799, 4720, 4722, 4723, 4724, 4725, 4726, 4738, 4740, 4767, 4781, 4798, 4662, 4661, 5136, 5137, 5138, 5139, 5141, 4625, 5140, 5142, 5143, 5144, 4656, 4664, 4698, 4699, 4700, 4701, 4702, 4660, 4663, 4658, 4670, 4657, 4717, 4718, 4674, 4673, 5025, 5034, 4697, 4776, 4771, 4624, 4648]  \n",
       "3                                                                                                                                                                                                                                                                                                                                                                                                                       [4688, 1]  \n",
       "4                                                                                                                                                                                                                                                                                                                                                                                                                             NaN  "
      ]
     },
     "execution_count": 7,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "mapping = pd.merge(windowsTechniques, all_data_sources, on = 'data_sources', how = 'left')\n",
    "mapping.head()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Techniques --> Event IDs"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* T1112 Modify Registry"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 8,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>tactic</th>\n",
       "      <th>technique_id</th>\n",
       "      <th>technique</th>\n",
       "      <th>data_sources</th>\n",
       "      <th>event_ids</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>110</th>\n",
       "      <td>[defense-evasion]</td>\n",
       "      <td>T1112</td>\n",
       "      <td>Modify Registry</td>\n",
       "      <td>Windows Registry</td>\n",
       "      <td>[4657, 12, 14, 13]</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>324</th>\n",
       "      <td>[defense-evasion]</td>\n",
       "      <td>T1112</td>\n",
       "      <td>Modify Registry</td>\n",
       "      <td>File monitoring</td>\n",
       "      <td>[6, 9, 11, 2, 5145, 4656, 4663, 4670, 4660, 4658]</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>510</th>\n",
       "      <td>[defense-evasion]</td>\n",
       "      <td>T1112</td>\n",
       "      <td>Modify Registry</td>\n",
       "      <td>Process monitoring</td>\n",
       "      <td>[4688, 1, 4689, 5, 8, 10]</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>646</th>\n",
       "      <td>[defense-evasion]</td>\n",
       "      <td>T1112</td>\n",
       "      <td>Modify Registry</td>\n",
       "      <td>Process command-line parameters</td>\n",
       "      <td>[4688, 1]</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>721</th>\n",
       "      <td>[defense-evasion]</td>\n",
       "      <td>T1112</td>\n",
       "      <td>Modify Registry</td>\n",
       "      <td>Windows event logs</td>\n",
       "      <td>[4768, 4769, 4770, 4773, 4779, 4778, 4800, 4801, 4741, 4742, 4743, 4749, 4750, 4751, 4752, 4753, 4731, 4732, 4733, 4734, 4735, 4764, 4799, 4720, 4722, 4723, 4724, 4725, 4726, 4738, 4740, 4767, 4781, 4798, 4662, 4661, 5136, 5137, 5138, 5139, 5141, 4625, 5140, 5142, 5143, 5144, 4656, 4664, 4698, 4699, 4700, 4701, 4702, 4660, 4663, 4658, 4670, 4657, 4717, 4718, 4674, 4673, 5025, 5034, 4697, 4776, 4771, 4624, 4648]</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "                tactic technique_id        technique  \\\n",
       "110  [defense-evasion]        T1112  Modify Registry   \n",
       "324  [defense-evasion]        T1112  Modify Registry   \n",
       "510  [defense-evasion]        T1112  Modify Registry   \n",
       "646  [defense-evasion]        T1112  Modify Registry   \n",
       "721  [defense-evasion]        T1112  Modify Registry   \n",
       "\n",
       "                        data_sources  \\\n",
       "110                 Windows Registry   \n",
       "324                  File monitoring   \n",
       "510               Process monitoring   \n",
       "646  Process command-line parameters   \n",
       "721               Windows event logs   \n",
       "\n",
       "                                                                                                                                                                                                                                                                                                                                                                                                                          event_ids  \n",
       "110                                                                                                                                                                                                                                                                                                                                                                                                              [4657, 12, 14, 13]  \n",
       "324                                                                                                                                                                                                                                                                                                                                                                               [6, 9, 11, 2, 5145, 4656, 4663, 4670, 4660, 4658]  \n",
       "510                                                                                                                                                                                                                                                                                                                                                                                                       [4688, 1, 4689, 5, 8, 10]  \n",
       "646                                                                                                                                                                                                                                                                                                                                                                                                                       [4688, 1]  \n",
       "721  [4768, 4769, 4770, 4773, 4779, 4778, 4800, 4801, 4741, 4742, 4743, 4749, 4750, 4751, 4752, 4753, 4731, 4732, 4733, 4734, 4735, 4764, 4799, 4720, 4722, 4723, 4724, 4725, 4726, 4738, 4740, 4767, 4781, 4798, 4662, 4661, 5136, 5137, 5138, 5139, 5141, 4625, 5140, 5142, 5143, 5144, 4656, 4664, 4698, 4699, 4700, 4701, 4702, 4660, 4663, 4658, 4670, 4657, 4717, 4718, 4674, 4673, 5025, 5034, 4697, 4776, 4771, 4624, 4648]  "
      ]
     },
     "execution_count": 8,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "T1112 = mapping[mapping['technique_id'] == 'T1112']\n",
    "T1112"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Tactics --> Event IDs"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* Lateral Movement"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 9,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>data_sources</th>\n",
       "      <th>event_ids</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>SSL/TLS inspection</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>Windows Error Reporting</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>PowerShell logs</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>File monitoring</td>\n",
       "      <td>[6, 9, 11, 2, 5145, 4656, 4663, 4670, 4660, 4658]</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>Authentication logs</td>\n",
       "      <td>[4776, 4771, 4624, 4648]</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>5</th>\n",
       "      <td>Process use of network</td>\n",
       "      <td>[3, 5031, 5154, 5155, 5156, 5157, 5158, 5159]</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>6</th>\n",
       "      <td>DNS records</td>\n",
       "      <td>[22]</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>7</th>\n",
       "      <td>Process monitoring</td>\n",
       "      <td>[4688, 1, 4689, 5, 8, 10]</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>8</th>\n",
       "      <td>API monitoring</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>9</th>\n",
       "      <td>Packet capture</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>10</th>\n",
       "      <td>Data loss prevention</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>11</th>\n",
       "      <td>Netflow/Enclave netflow</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>12</th>\n",
       "      <td>Third-party application logs</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>13</th>\n",
       "      <td>Anti-virus</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>14</th>\n",
       "      <td>Windows Registry</td>\n",
       "      <td>[4657, 12, 14, 13]</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>15</th>\n",
       "      <td>Web proxy</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>16</th>\n",
       "      <td>DLL monitoring</td>\n",
       "      <td>[7]</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>17</th>\n",
       "      <td>Process command-line parameters</td>\n",
       "      <td>[4688, 1]</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>18</th>\n",
       "      <td>Network protocol analysis</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>19</th>\n",
       "      <td>Mail server</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>20</th>\n",
       "      <td>Binary file metadata</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>21</th>\n",
       "      <td>Office 365 trace logs</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>22</th>\n",
       "      <td>Windows event logs</td>\n",
       "      <td>[4768, 4769, 4770, 4773, 4779, 4778, 4800, 4801, 4741, 4742, 4743, 4749, 4750, 4751, 4752, 4753, 4731, 4732, 4733, 4734, 4735, 4764, 4799, 4720, 4722, 4723, 4724, 4725, 4726, 4738, 4740, 4767, 4781, 4798, 4662, 4661, 5136, 5137, 5138, 5139, 5141, 4625, 5140, 5142, 5143, 5144, 4656, 4664, 4698, 4699, 4700, 4701, 4702, 4660, 4663, 4658, 4670, 4657, 4717, 4718, 4674, 4673, 5025, 5034, 4697, 4776, 4771, 4624, 4648]</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "                       data_sources  \\\n",
       "0                SSL/TLS inspection   \n",
       "1           Windows Error Reporting   \n",
       "2                   PowerShell logs   \n",
       "3                   File monitoring   \n",
       "4               Authentication logs   \n",
       "5            Process use of network   \n",
       "6                       DNS records   \n",
       "7                Process monitoring   \n",
       "8                    API monitoring   \n",
       "9                    Packet capture   \n",
       "10             Data loss prevention   \n",
       "11          Netflow/Enclave netflow   \n",
       "12     Third-party application logs   \n",
       "13                       Anti-virus   \n",
       "14                 Windows Registry   \n",
       "15                        Web proxy   \n",
       "16                   DLL monitoring   \n",
       "17  Process command-line parameters   \n",
       "18        Network protocol analysis   \n",
       "19                      Mail server   \n",
       "20             Binary file metadata   \n",
       "21            Office 365 trace logs   \n",
       "22               Windows event logs   \n",
       "\n",
       "                                                                                                                                                                                                                                                                                                                                                                                                                         event_ids  \n",
       "0                                                                                                                                                                                                                                                                                                                                                                                                                              NaN  \n",
       "1                                                                                                                                                                                                                                                                                                                                                                                                                              NaN  \n",
       "2                                                                                                                                                                                                                                                                                                                                                                                                                              NaN  \n",
       "3                                                                                                                                                                                                                                                                                                                                                                                [6, 9, 11, 2, 5145, 4656, 4663, 4670, 4660, 4658]  \n",
       "4                                                                                                                                                                                                                                                                                                                                                                                                         [4776, 4771, 4624, 4648]  \n",
       "5                                                                                                                                                                                                                                                                                                                                                                                    [3, 5031, 5154, 5155, 5156, 5157, 5158, 5159]  \n",
       "6                                                                                                                                                                                                                                                                                                                                                                                                                             [22]  \n",
       "7                                                                                                                                                                                                                                                                                                                                                                                                        [4688, 1, 4689, 5, 8, 10]  \n",
       "8                                                                                                                                                                                                                                                                                                                                                                                                                              NaN  \n",
       "9                                                                                                                                                                                                                                                                                                                                                                                                                              NaN  \n",
       "10                                                                                                                                                                                                                                                                                                                                                                                                                             NaN  \n",
       "11                                                                                                                                                                                                                                                                                                                                                                                                                             NaN  \n",
       "12                                                                                                                                                                                                                                                                                                                                                                                                                             NaN  \n",
       "13                                                                                                                                                                                                                                                                                                                                                                                                                             NaN  \n",
       "14                                                                                                                                                                                                                                                                                                                                                                                                              [4657, 12, 14, 13]  \n",
       "15                                                                                                                                                                                                                                                                                                                                                                                                                             NaN  \n",
       "16                                                                                                                                                                                                                                                                                                                                                                                                                             [7]  \n",
       "17                                                                                                                                                                                                                                                                                                                                                                                                                       [4688, 1]  \n",
       "18                                                                                                                                                                                                                                                                                                                                                                                                                             NaN  \n",
       "19                                                                                                                                                                                                                                                                                                                                                                                                                             NaN  \n",
       "20                                                                                                                                                                                                                                                                                                                                                                                                                             NaN  \n",
       "21                                                                                                                                                                                                                                                                                                                                                                                                                             NaN  \n",
       "22  [4768, 4769, 4770, 4773, 4779, 4778, 4800, 4801, 4741, 4742, 4743, 4749, 4750, 4751, 4752, 4753, 4731, 4732, 4733, 4734, 4735, 4764, 4799, 4720, 4722, 4723, 4724, 4725, 4726, 4738, 4740, 4767, 4781, 4798, 4662, 4661, 5136, 5137, 5138, 5139, 5141, 4625, 5140, 5142, 5143, 5144, 4656, 4664, 4698, 4699, 4700, 4701, 4702, 4660, 4663, 4658, 4670, 4657, 4717, 4718, 4674, 4673, 5025, 5034, 4697, 4776, 4771, 4624, 4648]  "
      ]
     },
     "execution_count": 9,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "lateral_movement = mapping[['data_sources','event_ids']][mapping['tactic'].apply(lambda x: 'lateral-movement' in x)]\n",
    "lateral_movement = lateral_movement.drop_duplicates(subset='data_sources').reset_index(drop=True)\n",
    "lateral_movement"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### An opportunity to improve ATT&CK data sources mapping!!"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "As we can see in the example above (Lateral Movement techniques), the data source that brings more event logs is **Windows event logs**. However, this data source has a broad scope. We can split this data source in more detailed new data sources."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 10,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>data_sources</th>\n",
       "      <th>event_ids</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>22</th>\n",
       "      <td>Windows event logs</td>\n",
       "      <td>[4768, 4769, 4770, 4773, 4779, 4778, 4800, 4801, 4741, 4742, 4743, 4749, 4750, 4751, 4752, 4753, 4731, 4732, 4733, 4734, 4735, 4764, 4799, 4720, 4722, 4723, 4724, 4725, 4726, 4738, 4740, 4767, 4781, 4798, 4662, 4661, 5136, 5137, 5138, 5139, 5141, 4625, 5140, 5142, 5143, 5144, 4656, 4664, 4698, 4699, 4700, 4701, 4702, 4660, 4663, 4658, 4670, 4657, 4717, 4718, 4674, 4673, 5025, 5034, 4697, 4776, 4771, 4624, 4648]</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "          data_sources  \\\n",
       "22  Windows event logs   \n",
       "\n",
       "                                                                                                                                                                                                                                                                                                                                                                                                                         event_ids  \n",
       "22  [4768, 4769, 4770, 4773, 4779, 4778, 4800, 4801, 4741, 4742, 4743, 4749, 4750, 4751, 4752, 4753, 4731, 4732, 4733, 4734, 4735, 4764, 4799, 4720, 4722, 4723, 4724, 4725, 4726, 4738, 4740, 4767, 4781, 4798, 4662, 4661, 5136, 5137, 5138, 5139, 5141, 4625, 5140, 5142, 5143, 5144, 4656, 4664, 4698, 4699, 4700, 4701, 4702, 4660, 4663, 4658, 4670, 4657, 4717, 4718, 4674, 4673, 5025, 5034, 4697, 4776, 4771, 4624, 4648]  "
      ]
     },
     "execution_count": 10,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "lateral_movement[lateral_movement['data_sources'] == 'Windows event logs']"
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.7.6"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 4
}
