{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Credential Extraction"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### FGdump"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2020-10-21T18:06:20.305699Z",
     "iopub.status.busy": "2020-10-21T18:06:20.305420Z",
     "iopub.status.idle": "2020-10-21T18:06:35.431304Z",
     "shell.execute_reply": "2020-10-21T18:06:35.430703Z",
     "shell.execute_reply.started": "2020-10-21T18:06:20.305672Z"
    }
   },
   "outputs": [
    {
     "data": {
      "application/vnd.jupyter.widget-view+json": {
       "model_id": "ce9b4b5a9ad04012bca3a6f99f1650b5",
       "version_major": 2,
       "version_minor": 0
      },
      "text/plain": [
       "HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=5.0), HTML(value='')))"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      " Finished.                     "
     ]
    },
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>start_time</th>\n",
       "      <th>cmd_line</th>\n",
       "      <th>entities</th>\n",
       "      <th>process_name</th>\n",
       "      <th>parent_process_name</th>\n",
       "      <th>end_time</th>\n",
       "      <th>process_path</th>\n",
       "      <th>input_event</th>\n",
       "      <th>timestamp</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>2020-09-14 20:57:28</td>\n",
       "      <td>-v</td>\n",
       "      <td>[eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZ...</td>\n",
       "      <td>cachedump64.exe</td>\n",
       "      <td>C:\\Users\\Administrator\\Downloads\\fgdump-2.1.0-...</td>\n",
       "      <td>2020-09-14 20:57:28</td>\n",
       "      <td>c:\\users\\admini~1\\appdata\\local\\temp</td>\n",
       "      <td>{'_tenant': 'test', '_time': '1600117048000', ...</td>\n",
       "      <td>2020-09-14 20:57:28</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "           start_time  ...           timestamp\n",
       "0 2020-09-14 20:57:28  ... 2020-09-14 20:57:28\n",
       "\n",
       "[1 rows x 9 columns]"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "\n"
     ]
    },
    {
     "data": {
      "text/plain": [
       "<spl2_kernel.spl2_runner.SPL2Job at 0x7fc6bafc8510>"
      ]
     },
     "execution_count": 1,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "%%spl2 --parallelism=7\n",
    "| from read_text(\"s3://smle-experiments/datasets/ssa/misko_ssa_detections/logFgdump.log\")\n",
    "| select from_json_object(value) as input_event\n",
    "| eval timestamp=parse_long(ucast(map_get(input_event, \"_time\"), \"string\", null)),\n",
    "       cmd_line=ucast(map_get(input_event, \"process\"), \"string\", null),\n",
    "       process_name=ucast(map_get(input_event, \"process_name\"), \"string\", null),\n",
    "       process_path=ucast(map_get(input_event, \"process_path\"), \"string\", null),\n",
    "       parent_process_name=ucast(map_get(input_event, \"parent_process_name\"), \"string\", null)\n",
    "| where cmd_line != null AND\n",
    "        match_regex(parent_process_name, /(?i)fgdump.exe/)=true\n",
    "| eval start_time = timestamp,\n",
    "       end_time = timestamp,\n",
    "       entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), \n",
    "                            ucast(map_get(input_event, \"dest_device_id\"), \"string\", null));"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 12,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2020-10-19T07:31:33.752874Z",
     "iopub.status.busy": "2020-10-19T07:31:33.752605Z",
     "iopub.status.idle": "2020-10-19T07:31:36.961722Z",
     "shell.execute_reply": "2020-10-19T07:31:36.960969Z",
     "shell.execute_reply.started": "2020-10-19T07:31:33.752852Z"
    }
   },
   "outputs": [
    {
     "data": {
      "application/vnd.jupyter.widget-view+json": {
       "model_id": "8ed2f12e58284468be940ca472904ca6",
       "version_major": 2,
       "version_minor": 0
      },
      "text/plain": [
       "HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=5.0), HTML(value='')))"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      " Finished.                     "
     ]
    },
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>start_time</th>\n",
       "      <th>cmd_line</th>\n",
       "      <th>entities</th>\n",
       "      <th>process_name</th>\n",
       "      <th>parent_process_name</th>\n",
       "      <th>end_time</th>\n",
       "      <th>process_path</th>\n",
       "      <th>input_event</th>\n",
       "      <th>timestamp</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>2020-09-14 20:57:28</td>\n",
       "      <td>\"\"C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\cachedu...</td>\n",
       "      <td>[eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZ...</td>\n",
       "      <td>cachedump64.exe</td>\n",
       "      <td>C:\\Windows\\System32\\services.exe</td>\n",
       "      <td>2020-09-14 20:57:28</td>\n",
       "      <td>c:\\users\\admini~1\\appdata\\local\\temp</td>\n",
       "      <td>{'_tenant': 'test', '_time': '1600117048000', ...</td>\n",
       "      <td>2020-09-14 20:57:28</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "           start_time  ...           timestamp\n",
       "0 2020-09-14 20:57:28  ... 2020-09-14 20:57:28\n",
       "\n",
       "[1 rows x 9 columns]"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "\n"
     ]
    },
    {
     "data": {
      "text/plain": [
       "<spl2_kernel.spl2_runner.SPL2Job at 0x7f1180aec090>"
      ]
     },
     "execution_count": 12,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "%%spl2 --parallelism=7\n",
    "| from read_text(\"s3://smle-experiments/datasets/ssa/misko_ssa_detections/logFgdump.log\")\n",
    "| select from_json_object(value) as input_event\n",
    "| eval timestamp=parse_long(ucast(map_get(input_event, \"_time\"), \"string\", null)),\n",
    "       cmd_line=ucast(map_get(input_event, \"process\"), \"string\", null),\n",
    "       process_name=ucast(map_get(input_event, \"process_name\"), \"string\", null),\n",
    "       process_path=ucast(map_get(input_event, \"process_path\"), \"string\", null),\n",
    "       parent_process_name=ucast(map_get(input_event, \"parent_process_name\"), \"string\", null)\n",
    "| where cmd_line != null AND process_name != null AND parent_process_name != null AND\n",
    "        match_regex(parent_process_name, /(?i)System32\\\\services.exe/)=true AND\n",
    "        match_regex(process_name, /(?i)cachedump\\d{0,2}.exe/)=true AND\n",
    "        match_regex(process_path, /(?i)\\\\Temp/)=true AND\n",
    "        match_regex(cmd_line, /(?i)\\-s/)=true \n",
    "| eval start_time = timestamp,\n",
    "       end_time = timestamp,\n",
    "       entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), \n",
    "                            ucast(map_get(input_event, \"dest_device_id\"), \"string\", null));"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 4,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2020-10-19T06:43:38.657607Z",
     "iopub.status.busy": "2020-10-19T06:43:38.657338Z",
     "iopub.status.idle": "2020-10-19T06:43:43.943417Z",
     "shell.execute_reply": "2020-10-19T06:43:43.942731Z",
     "shell.execute_reply.started": "2020-10-19T06:43:38.657582Z"
    }
   },
   "outputs": [
    {
     "data": {
      "application/vnd.jupyter.widget-view+json": {
       "model_id": "f54e0d67a72f4885b5728174656682dc",
       "version_major": 2,
       "version_minor": 0
      },
      "text/plain": [
       "HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=5.0), HTML(value='')))"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      " Finished.                     "
     ]
    },
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>start_time</th>\n",
       "      <th>cmd_line</th>\n",
       "      <th>entities</th>\n",
       "      <th>process_name</th>\n",
       "      <th>end_time</th>\n",
       "      <th>process_path</th>\n",
       "      <th>input_event</th>\n",
       "      <th>timestamp</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>2020-09-14 20:57:28</td>\n",
       "      <td>-v</td>\n",
       "      <td>[eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZ...</td>\n",
       "      <td>cachedump64.exe</td>\n",
       "      <td>2020-09-14 20:57:28</td>\n",
       "      <td>c:\\users\\admini~1\\appdata\\local\\temp</td>\n",
       "      <td>{'_tenant': 'test', '_time': '1600117048000', ...</td>\n",
       "      <td>2020-09-14 20:57:28</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "           start_time  ...           timestamp\n",
       "0 2020-09-14 20:57:28  ... 2020-09-14 20:57:28\n",
       "\n",
       "[1 rows x 8 columns]"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "\n"
     ]
    },
    {
     "data": {
      "text/plain": [
       "<spl2_kernel.spl2_runner.SPL2Job at 0x7f1180b99510>"
      ]
     },
     "execution_count": 4,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "%%spl2 --parallelism=7\n",
    "| from read_text(\"s3://smle-experiments/datasets/ssa/misko_ssa_detections/logFgdump.log\")\n",
    "| select from_json_object(value) as input_event\n",
    "| eval timestamp=parse_long(ucast(map_get(input_event, \"_time\"), \"string\", null)),\n",
    "       cmd_line=ucast(map_get(input_event, \"process\"), \"string\", null),\n",
    "       process_name=ucast(map_get(input_event, \"process_name\"), \"string\", null),\n",
    "       process_path=ucast(map_get(input_event, \"process_path\"), \"string\", null)\n",
    "| where cmd_line != null AND process_name != null AND process_path != null AND\n",
    "        match_regex(process_name, /(?i)cachedump\\d{0,2}.exe/)=true AND\n",
    "        match_regex(process_path, /(?i)\\\\Temp/)=true AND\n",
    "        match_regex(cmd_line, /(?i)\\-v/)=true \n",
    "| eval start_time = timestamp,\n",
    "       end_time = timestamp,\n",
    "       entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), \n",
    "                            ucast(map_get(input_event, \"dest_device_id\"), \"string\", null));"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### LaZagne"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 209,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2020-10-16T11:11:37.602675Z",
     "iopub.status.busy": "2020-10-16T11:11:37.602388Z",
     "iopub.status.idle": "2020-10-16T11:11:38.897829Z",
     "shell.execute_reply": "2020-10-16T11:11:38.897200Z",
     "shell.execute_reply.started": "2020-10-16T11:11:37.602651Z"
    }
   },
   "outputs": [
    {
     "data": {
      "application/vnd.jupyter.widget-view+json": {
       "model_id": "ea6d405d5dbb45fbbdcccd118a5a74fa",
       "version_major": 2,
       "version_minor": 0
      },
      "text/plain": [
       "HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=5.0), HTML(value='')))"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      " Finished.                     "
     ]
    },
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>end_time</th>\n",
       "      <th>start_time</th>\n",
       "      <th>entities</th>\n",
       "      <th>process_name</th>\n",
       "      <th>input_event</th>\n",
       "      <th>timestamp</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>2020-09-12 01:25:41</td>\n",
       "      <td>2020-09-12 01:25:41</td>\n",
       "      <td>[eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZ...</td>\n",
       "      <td>lazagne.exe</td>\n",
       "      <td>{'_tenant': 'test', '_time': '1599873941000', ...</td>\n",
       "      <td>2020-09-12 01:25:41</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>2020-09-12 01:25:41</td>\n",
       "      <td>2020-09-12 01:25:41</td>\n",
       "      <td>[eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZ...</td>\n",
       "      <td>lazagne.exe</td>\n",
       "      <td>{'_tenant': 'test', '_time': '1599873941000', ...</td>\n",
       "      <td>2020-09-12 01:25:41</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "             end_time  ...           timestamp\n",
       "0 2020-09-12 01:25:41  ... 2020-09-12 01:25:41\n",
       "1 2020-09-12 01:25:41  ... 2020-09-12 01:25:41\n",
       "\n",
       "[2 rows x 6 columns]"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "\n"
     ]
    },
    {
     "data": {
      "text/plain": [
       "<spl2_kernel.spl2_runner.SPL2Job at 0x7fc413a60c50>"
      ]
     },
     "execution_count": 209,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "%%spl2 --parallelism=7\n",
    "| from read_text(\"s3://smle-experiments/datasets/ssa/misko_ssa_detections/logLazagneCredDump.log\")\n",
    "| select from_json_object(value) as input_event\n",
    "| eval timestamp=parse_long(ucast(map_get(input_event, \"_time\"), \"string\", null)),\n",
    "       process_name=ucast(map_get(input_event, \"process_name\"), \"string\", null)\n",
    "| where process_name != null AND\n",
    "        match_regex(process_name, /(?i)lazagne.exe/)=true  \n",
    "| eval start_time = timestamp,\n",
    "       end_time = timestamp,\n",
    "       entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), \n",
    "                            ucast(map_get(input_event, \"dest_device_id\"), \"string\", null));"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 5,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2020-10-19T06:44:15.842408Z",
     "iopub.status.busy": "2020-10-19T06:44:15.842154Z",
     "iopub.status.idle": "2020-10-19T06:44:17.835759Z",
     "shell.execute_reply": "2020-10-19T06:44:17.835188Z",
     "shell.execute_reply.started": "2020-10-19T06:44:15.842387Z"
    }
   },
   "outputs": [
    {
     "data": {
      "application/vnd.jupyter.widget-view+json": {
       "model_id": "d20cc7f7621b4e449419b4216187807c",
       "version_major": 2,
       "version_minor": 0
      },
      "text/plain": [
       "HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=5.0), HTML(value='')))"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      " Finished.                     "
     ]
    },
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>end_time</th>\n",
       "      <th>start_time</th>\n",
       "      <th>cmd_line</th>\n",
       "      <th>entities</th>\n",
       "      <th>input_event</th>\n",
       "      <th>timestamp</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>2020-09-12 01:25:41</td>\n",
       "      <td>2020-09-12 01:25:41</td>\n",
       "      <td>lazagne  all -oA -output lazDump.txt</td>\n",
       "      <td>[eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZ...</td>\n",
       "      <td>{'_tenant': 'test', '_time': '1599873941000', ...</td>\n",
       "      <td>2020-09-12 01:25:41</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>2020-09-12 01:25:41</td>\n",
       "      <td>2020-09-12 01:25:41</td>\n",
       "      <td>lazagne  all -oA -output lazDump.txt</td>\n",
       "      <td>[eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZ...</td>\n",
       "      <td>{'_tenant': 'test', '_time': '1599873941000', ...</td>\n",
       "      <td>2020-09-12 01:25:41</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "             end_time  ...           timestamp\n",
       "0 2020-09-12 01:25:41  ... 2020-09-12 01:25:41\n",
       "1 2020-09-12 01:25:41  ... 2020-09-12 01:25:41\n",
       "\n",
       "[2 rows x 6 columns]"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "\n"
     ]
    },
    {
     "data": {
      "text/plain": [
       "<spl2_kernel.spl2_runner.SPL2Job at 0x7f1180b42bd0>"
      ]
     },
     "execution_count": 5,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "%%spl2 --parallelism=7\n",
    "| from read_text(\"s3://smle-experiments/datasets/ssa/misko_ssa_detections/logLazagneCredDump.log\")\n",
    "| select from_json_object(value) as input_event\n",
    "| eval timestamp=parse_long(ucast(map_get(input_event, \"_time\"), \"string\", null)),\n",
    "       cmd_line=ucast(map_get(input_event, \"process\"), \"string\", null)\n",
    "| where cmd_line != null AND\n",
    "        match_regex(cmd_line, /(?i)all\\s+\\-oA\\s+\\-output/)=true  \n",
    "| eval start_time = timestamp,\n",
    "       end_time = timestamp,\n",
    "       entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), \n",
    "                            ucast(map_get(input_event, \"dest_device_id\"), \"string\", null));"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### PowerSploit/DSInternals"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 6,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2020-10-19T06:44:32.330847Z",
     "iopub.status.busy": "2020-10-19T06:44:32.330579Z",
     "iopub.status.idle": "2020-10-19T06:44:34.317758Z",
     "shell.execute_reply": "2020-10-19T06:44:34.317168Z",
     "shell.execute_reply.started": "2020-10-19T06:44:32.330825Z"
    }
   },
   "outputs": [
    {
     "data": {
      "application/vnd.jupyter.widget-view+json": {
       "model_id": "55e657aa20074cbaa58dfbcc45ca5ec0",
       "version_major": 2,
       "version_minor": 0
      },
      "text/plain": [
       "HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=5.0), HTML(value='')))"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      " Finished.                     "
     ]
    },
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>end_time</th>\n",
       "      <th>start_time</th>\n",
       "      <th>cmd_line</th>\n",
       "      <th>entities</th>\n",
       "      <th>input_event</th>\n",
       "      <th>timestamp</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>2020-09-17 18:59:05</td>\n",
       "      <td>2020-09-17 18:59:05</td>\n",
       "      <td>powershell  -command \"\"Get-ADDBAccount -All -D...</td>\n",
       "      <td>[eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZ...</td>\n",
       "      <td>{'_tenant': 'test', '_time': '1600369145000', ...</td>\n",
       "      <td>2020-09-17 18:59:05</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "             end_time  ...           timestamp\n",
       "0 2020-09-17 18:59:05  ... 2020-09-17 18:59:05\n",
       "\n",
       "[1 rows x 6 columns]"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "\n"
     ]
    },
    {
     "data": {
      "text/plain": [
       "<spl2_kernel.spl2_runner.SPL2Job at 0x7f1180b36c90>"
      ]
     },
     "execution_count": 6,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "%%spl2 --parallelism=7\n",
    "| from read_text(\"s3://smle-experiments/datasets/ssa/misko_ssa_detections/logPowerShellModule.log\")\n",
    "| select from_json_object(value) as input_event\n",
    "| eval timestamp=parse_long(ucast(map_get(input_event, \"_time\"), \"string\", null)),\n",
    "       cmd_line=ucast(map_get(input_event, \"process\"), \"string\", null)\n",
    "| where cmd_line != null AND\n",
    "        match_regex(cmd_line, /(?i)Get-ADDBAccount/)=true AND\n",
    "        match_regex(cmd_line, /(?i)\\-dbpath[\\s;:\\.\\|]+/)=true\n",
    "| eval start_time = timestamp,\n",
    "       end_time = timestamp,\n",
    "       entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), \n",
    "                            ucast(map_get(input_event, \"dest_device_id\"), \"string\", null));"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "execution": {
     "iopub.execute_input": "2020-10-16T18:40:38.543645Z",
     "iopub.status.busy": "2020-10-16T18:40:38.543331Z",
     "iopub.status.idle": "2020-10-16T18:40:38.546643Z",
     "shell.execute_reply": "2020-10-16T18:40:38.545902Z",
     "shell.execute_reply.started": "2020-10-16T18:40:38.543617Z"
    }
   },
   "source": [
    "### Windows-native debuggers: NTKD, LiveKD"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 7,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2020-10-19T06:44:40.113042Z",
     "iopub.status.busy": "2020-10-19T06:44:40.112773Z",
     "iopub.status.idle": "2020-10-19T06:44:42.191978Z",
     "shell.execute_reply": "2020-10-19T06:44:42.191344Z",
     "shell.execute_reply.started": "2020-10-19T06:44:40.113019Z"
    }
   },
   "outputs": [
    {
     "data": {
      "application/vnd.jupyter.widget-view+json": {
       "model_id": "71f723f491ba4ba29302108a6b3119b8",
       "version_major": 2,
       "version_minor": 0
      },
      "text/plain": [
       "HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=5.0), HTML(value='')))"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      " Finished.                     "
     ]
    },
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>start_time</th>\n",
       "      <th>cmd_line</th>\n",
       "      <th>entities</th>\n",
       "      <th>process_name</th>\n",
       "      <th>end_time</th>\n",
       "      <th>input_event</th>\n",
       "      <th>timestamp</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>2020-09-14 17:31:20</td>\n",
       "      <td>\"C:\\Program Files (x86)\\Windows Kits\\10\\Debugg...</td>\n",
       "      <td>[eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZ...</td>\n",
       "      <td>ntkd.exe</td>\n",
       "      <td>2020-09-14 17:31:20</td>\n",
       "      <td>{'_tenant': 'test', '_time': '1600104680000', ...</td>\n",
       "      <td>2020-09-14 17:31:20</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "           start_time  ...           timestamp\n",
       "0 2020-09-14 17:31:20  ... 2020-09-14 17:31:20\n",
       "\n",
       "[1 rows x 7 columns]"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "\n"
     ]
    },
    {
     "data": {
      "text/plain": [
       "<spl2_kernel.spl2_runner.SPL2Job at 0x7f1180b71d10>"
      ]
     },
     "execution_count": 7,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "%%spl2 --parallelism=7\n",
    "| from read_text(\"s3://smle-experiments/datasets/ssa/misko_ssa_detections/logNtkdDump.log\")\n",
    "| select from_json_object(value) as input_event\n",
    "| eval timestamp=parse_long(ucast(map_get(input_event, \"_time\"), \"string\", null)),\n",
    "       cmd_line=ucast(map_get(input_event, \"process\"), \"string\", null),\n",
    "       process_name=ucast(map_get(input_event, \"process_name\"), \"string\", null)\n",
    "| where cmd_line != null AND process_name != null AND \n",
    "          ( \n",
    "            match_regex(process_name, /^(?i)ntkd\\.exe/)=true OR\n",
    "            match_regex(process_name, /^(?i)kd\\.exe/)=true \n",
    "          ) AND \n",
    "          match_regex(cmd_line, /(?i)\\-z\\s+/)=true\n",
    "| eval start_time = timestamp,\n",
    "       end_time = timestamp,\n",
    "       entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), \n",
    "                            ucast(map_get(input_event, \"dest_device_id\"), \"string\", null));"
   ]
  },
  {
   "cell_type": "raw",
   "metadata": {},
   "source": [
    "------------------------------------------------\n",
    "SAME DETECTION ON LiveKD's DATASET\n",
    "------------------------------------------------"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 9,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2020-10-19T06:44:58.570342Z",
     "iopub.status.busy": "2020-10-19T06:44:58.570056Z",
     "iopub.status.idle": "2020-10-19T06:44:59.753230Z",
     "shell.execute_reply": "2020-10-19T06:44:59.752699Z",
     "shell.execute_reply.started": "2020-10-19T06:44:58.570317Z"
    }
   },
   "outputs": [
    {
     "data": {
      "application/vnd.jupyter.widget-view+json": {
       "model_id": "ef72e8a6d72d41b3b8f3c231d0c74e24",
       "version_major": 2,
       "version_minor": 0
      },
      "text/plain": [
       "HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=5.0), HTML(value='')))"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      " Finished.                     "
     ]
    },
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>start_time</th>\n",
       "      <th>cmd_line</th>\n",
       "      <th>entities</th>\n",
       "      <th>process_name</th>\n",
       "      <th>end_time</th>\n",
       "      <th>input_event</th>\n",
       "      <th>timestamp</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>2020-09-12 23:25:47</td>\n",
       "      <td>kd.exe      -z C:\\Windows\\livekd.dmp</td>\n",
       "      <td>[eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZ...</td>\n",
       "      <td>kd.exe</td>\n",
       "      <td>2020-09-12 23:25:47</td>\n",
       "      <td>{'_tenant': 'test', '_time': '1599953147000', ...</td>\n",
       "      <td>2020-09-12 23:25:47</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "           start_time  ...           timestamp\n",
       "0 2020-09-12 23:25:47  ... 2020-09-12 23:25:47\n",
       "\n",
       "[1 rows x 7 columns]"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "\n"
     ]
    },
    {
     "data": {
      "text/plain": [
       "<spl2_kernel.spl2_runner.SPL2Job at 0x7f1180b06710>"
      ]
     },
     "execution_count": 9,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "%%spl2 --parallelism=7\n",
    "| from read_text(\"s3://smle-experiments/datasets/ssa/misko_ssa_detections/logLiveKDFullKernelDump.log\")\n",
    "| select from_json_object(value) as input_event\n",
    "| eval timestamp=parse_long(ucast(map_get(input_event, \"_time\"), \"string\", null)),\n",
    "       cmd_line=ucast(map_get(input_event, \"process\"), \"string\", null),\n",
    "       process_name=ucast(map_get(input_event, \"process_name\"), \"string\", null)\n",
    "| where cmd_line != null AND process_name != null AND \n",
    "          ( \n",
    "            match_regex(process_name, /^(?i)ntkd\\.exe/)=true OR\n",
    "            match_regex(process_name, /^(?i)kd\\.exe/)=true \n",
    "          ) AND \n",
    "          match_regex(cmd_line, /(?i)\\-z\\s+/)=true  \n",
    "| eval start_time = timestamp,\n",
    "       end_time = timestamp,\n",
    "       entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), \n",
    "                            ucast(map_get(input_event, \"dest_device_id\"), \"string\", null));"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 10,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2020-10-19T06:45:22.643424Z",
     "iopub.status.busy": "2020-10-19T06:45:22.643152Z",
     "iopub.status.idle": "2020-10-19T06:45:23.764872Z",
     "shell.execute_reply": "2020-10-19T06:45:23.764356Z",
     "shell.execute_reply.started": "2020-10-19T06:45:22.643401Z"
    }
   },
   "outputs": [
    {
     "data": {
      "application/vnd.jupyter.widget-view+json": {
       "model_id": "83fc3507d11841139f30b4ff3d3fcf6c",
       "version_major": 2,
       "version_minor": 0
      },
      "text/plain": [
       "HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=5.0), HTML(value='')))"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      " Finished.                     "
     ]
    },
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>start_time</th>\n",
       "      <th>cmd_line</th>\n",
       "      <th>entities</th>\n",
       "      <th>process_name</th>\n",
       "      <th>parent_process_name</th>\n",
       "      <th>end_time</th>\n",
       "      <th>input_event</th>\n",
       "      <th>timestamp</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>2020-09-12 23:25:44</td>\n",
       "      <td>\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff...</td>\n",
       "      <td>[eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZ...</td>\n",
       "      <td>conhost.exe</td>\n",
       "      <td>C:\\Program Files (x86)\\Windows Kits\\10\\Debugge...</td>\n",
       "      <td>2020-09-12 23:25:44</td>\n",
       "      <td>{'_tenant': 'test', '_time': '1599953144000', ...</td>\n",
       "      <td>2020-09-12 23:25:44</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "           start_time  ...           timestamp\n",
       "0 2020-09-12 23:25:44  ... 2020-09-12 23:25:44\n",
       "\n",
       "[1 rows x 8 columns]"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "\n"
     ]
    },
    {
     "data": {
      "text/plain": [
       "<spl2_kernel.spl2_runner.SPL2Job at 0x7f1180ab5150>"
      ]
     },
     "execution_count": 10,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "%%spl2 --parallelism=7\n",
    "| from read_text(\"s3://smle-experiments/datasets/ssa/misko_ssa_detections/logLiveKDFullKernelDump.log\")\n",
    "| select from_json_object(value) as input_event\n",
    "| eval timestamp=parse_long(ucast(map_get(input_event, \"_time\"), \"string\", null)),\n",
    "       cmd_line=ucast(map_get(input_event, \"process\"), \"string\", null),\n",
    "       process_name=ucast(map_get(input_event, \"process_name\"), \"string\", null),\n",
    "       parent_process_name=ucast(map_get(input_event, \"parent_process_name\"), \"string\", null)\n",
    "| where cmd_line != null AND parent_process_name != null AND process_name != null  AND  \n",
    "          ( match_regex(parent_process_name, /(?i)ntkd\\.exe/)=true OR\n",
    "            match_regex(parent_process_name, /(?i)livekd\\.exe/)=true\n",
    "          ) AND\n",
    "          match_regex(process_name, /(?i)conhost\\.exe/)=true AND\n",
    "          match_regex(cmd_line, /(?i)0xffffffff/)=true AND\n",
    "          match_regex(cmd_line, /(?i)\\-ForceV1/)=true\n",
    "| eval start_time = timestamp,\n",
    "       end_time = timestamp,\n",
    "       entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), \n",
    "                            ucast(map_get(input_event, \"dest_device_id\"), \"string\", null));"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### PowerSploit modules"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 4,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2020-10-21T18:29:40.267475Z",
     "iopub.status.busy": "2020-10-21T18:29:40.267191Z",
     "iopub.status.idle": "2020-10-21T18:29:45.564872Z",
     "shell.execute_reply": "2020-10-21T18:29:45.564202Z",
     "shell.execute_reply.started": "2020-10-21T18:29:40.267450Z"
    }
   },
   "outputs": [
    {
     "data": {
      "application/vnd.jupyter.widget-view+json": {
       "model_id": "b33e383c863940a1968742c8886d5a37",
       "version_major": 2,
       "version_minor": 0
      },
      "text/plain": [
       "HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=5.0), HTML(value='')))"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      " Finished.                     "
     ]
    },
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>end_time</th>\n",
       "      <th>start_time</th>\n",
       "      <th>cmd_line</th>\n",
       "      <th>entities</th>\n",
       "      <th>input_event</th>\n",
       "      <th>timestamp</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>2020-09-17 18:59:05</td>\n",
       "      <td>2020-09-17 18:59:05</td>\n",
       "      <td>powershell  -command \"\"Import-Module PowerSplo...</td>\n",
       "      <td>[eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZ...</td>\n",
       "      <td>{'_tenant': 'test', '_time': '1600369145000', ...</td>\n",
       "      <td>2020-09-17 18:59:05</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>2020-09-17 18:59:04</td>\n",
       "      <td>2020-09-17 18:59:04</td>\n",
       "      <td>powershell  -command \"\"Install-SSP; Install-Se...</td>\n",
       "      <td>[eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZ...</td>\n",
       "      <td>{'_tenant': 'test', '_time': '1600369144000', ...</td>\n",
       "      <td>2020-09-17 18:59:04</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>2020-09-17 18:59:03</td>\n",
       "      <td>2020-09-17 18:59:03</td>\n",
       "      <td>powershell  -command \"\"Get-IPAddress; Convert-...</td>\n",
       "      <td>[eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZ...</td>\n",
       "      <td>{'_tenant': 'test', '_time': '1600369143000', ...</td>\n",
       "      <td>2020-09-17 18:59:03</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "             end_time  ...           timestamp\n",
       "0 2020-09-17 18:59:05  ... 2020-09-17 18:59:05\n",
       "1 2020-09-17 18:59:04  ... 2020-09-17 18:59:04\n",
       "2 2020-09-17 18:59:03  ... 2020-09-17 18:59:03\n",
       "\n",
       "[3 rows x 6 columns]"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "\n"
     ]
    },
    {
     "data": {
      "text/plain": [
       "<spl2_kernel.spl2_runner.SPL2Job at 0x7fc811a78250>"
      ]
     },
     "execution_count": 4,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "%%spl2 --parallelism=7\n",
    "| from read_text(\"s3://smle-experiments/datasets/ssa/misko_ssa_detections/logAllPowerSploitModulesWithOldNames.log\")\n",
    "| select from_json_object(value) as input_event\n",
    "| eval timestamp=parse_long(ucast(map_get(input_event, \"_time\"), \"string\", null)),\n",
    "       cmd_line=ucast(map_get(input_event, \"process\"), \"string\", null)\n",
    "| where cmd_line != null AND\n",
    "        ( match_regex(cmd_line, /(?i)Get-ApplicationHost/)=true OR\n",
    "          match_regex(cmd_line, /(?i)Get-CachedGPPPassword/)=true OR\n",
    "          match_regex(cmd_line, /(?i)Get-GPPAutologon/)=true OR\n",
    "          match_regex(cmd_line, /(?i)Get-GPPPassword/)=true OR\n",
    "          match_regex(cmd_line, /(?i)Get-RegistryAutoLogon/)=true OR\n",
    "          match_regex(cmd_line, /(?i)Get-SiteListPassword/)=true OR\n",
    "          match_regex(cmd_line, /(?i)Get-SPNTicket/)=true OR\n",
    "          match_regex(cmd_line, /(?i)Request-SPNTicket/)=true OR\n",
    "          match_regex(cmd_line, /(?i)Get-VaultCredential/)=true OR\n",
    "          match_regex(cmd_line, /(?i)Invoke-Kerberoast/)=true       \n",
    "        )\n",
    "| eval start_time = timestamp,\n",
    "       end_time = timestamp,\n",
    "       entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), \n",
    "                            ucast(map_get(input_event, \"dest_device_id\"), \"string\", null));"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### DSInternals"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 5,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2020-10-21T18:29:49.499740Z",
     "iopub.status.busy": "2020-10-21T18:29:49.499462Z",
     "iopub.status.idle": "2020-10-21T18:29:50.727426Z",
     "shell.execute_reply": "2020-10-21T18:29:50.726855Z",
     "shell.execute_reply.started": "2020-10-21T18:29:49.499716Z"
    }
   },
   "outputs": [
    {
     "data": {
      "application/vnd.jupyter.widget-view+json": {
       "model_id": "d1d8d5a4f8184b47a32e8d3fa710d245",
       "version_major": 2,
       "version_minor": 0
      },
      "text/plain": [
       "HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=5.0), HTML(value='')))"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      " Finished.                     "
     ]
    },
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>start_time</th>\n",
       "      <th>cmd_line</th>\n",
       "      <th>entities</th>\n",
       "      <th>process_name</th>\n",
       "      <th>parent_process_name</th>\n",
       "      <th>end_time</th>\n",
       "      <th>process_path</th>\n",
       "      <th>input_event</th>\n",
       "      <th>timestamp</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>2020-09-17 18:59:02</td>\n",
       "      <td>powershell  -command \"\"Install-Module DSIntern...</td>\n",
       "      <td>[eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZ...</td>\n",
       "      <td>powershell.exe</td>\n",
       "      <td>C:\\Windows\\System32\\cmd.exe</td>\n",
       "      <td>2020-09-17 18:59:02</td>\n",
       "      <td>c:\\windows\\system32\\windowspowershell\\v1.0</td>\n",
       "      <td>{'_tenant': 'test', '_time': '1600369142000', ...</td>\n",
       "      <td>2020-09-17 18:59:02</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "           start_time  ...           timestamp\n",
       "0 2020-09-17 18:59:02  ... 2020-09-17 18:59:02\n",
       "\n",
       "[1 rows x 9 columns]"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "\n"
     ]
    },
    {
     "data": {
      "text/plain": [
       "<spl2_kernel.spl2_runner.SPL2Job at 0x7fc811a94410>"
      ]
     },
     "execution_count": 5,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "%%spl2 --parallelism=7\n",
    "| from read_text(\"s3://smle-experiments/datasets/ssa/misko_ssa_detections/logAllDSInternalsModules.log\")\n",
    "| select from_json_object(value) as input_event\n",
    "| eval timestamp=parse_long(ucast(map_get(input_event, \"_time\"), \"string\", null)),\n",
    "       process_name=ucast(map_get(input_event, \"process_name\"), \"string\", null),\n",
    "       process_path=ucast(map_get(input_event, \"process_path\"), \"string\", null),\n",
    "       cmd_line=ucast(map_get(input_event, \"process\"), \"string\", null),\n",
    "       parent_process_name=ucast(map_get(input_event, \"parent_process_name\"), \"string\", null)\n",
    "| where cmd_line != null AND (           \n",
    "           match_regex(cmd_line, /(?i)Get-ADDBBackupKey/)=true OR\n",
    "           match_regex(cmd_line, /(?i)Get-ADDBDomainController/)=true OR\n",
    "           match_regex(cmd_line, /(?i)Get-ADDBKdsRootKey/)=true OR\n",
    "           match_regex(cmd_line, /(?i)Get-ADDBSchemaAttribute/)=true OR\n",
    "           match_regex(cmd_line, /(?i)Get-ADKeyCredential/)=true OR\n",
    "           match_regex(cmd_line, /(?i)Get-ADReplAccount/)=true OR\n",
    "           match_regex(cmd_line, /(?i)Get-ADReplBackupKey/)=true OR\n",
    "           match_regex(cmd_line, /(?i)Get-ADSIAccount/)=true OR\n",
    "           match_regex(cmd_line, /(?i)Get-AzureADUserEx/)=true OR\n",
    "           match_regex(cmd_line, /(?i)Get-BootKey/)=true OR\n",
    "           match_regex(cmd_line, /(?i)Get-LsaBackupKey/)=true OR\n",
    "           match_regex(cmd_line, /(?i)Get-LsaPolicyInformation/)=true OR\n",
    "           match_regex(cmd_line, /(?i)Get-SamPasswordPolicy/)=true\n",
    "        )    \n",
    "| eval start_time = timestamp,\n",
    "       end_time = timestamp,\n",
    "       entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), \n",
    "                            ucast(map_get(input_event, \"dest_device_id\"), \"string\", null));"
   ]
  },
  {
   "cell_type": "raw",
   "metadata": {},
   "source": [
    "------------------------------------------------\n",
    "DSInternals credential converters and decryptors\n",
    "------------------------------------------------"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 6,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2020-10-21T18:29:54.881202Z",
     "iopub.status.busy": "2020-10-21T18:29:54.880838Z",
     "iopub.status.idle": "2020-10-21T18:29:58.846049Z",
     "shell.execute_reply": "2020-10-21T18:29:58.845520Z",
     "shell.execute_reply.started": "2020-10-21T18:29:54.881168Z"
    }
   },
   "outputs": [
    {
     "data": {
      "application/vnd.jupyter.widget-view+json": {
       "model_id": "f130a73e8b384980ac1998d2fea445f7",
       "version_major": 2,
       "version_minor": 0
      },
      "text/plain": [
       "HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=4.0), HTML(value='')))"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      " Finished.                     "
     ]
    },
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>start_time</th>\n",
       "      <th>cmd_line</th>\n",
       "      <th>entities</th>\n",
       "      <th>process_name</th>\n",
       "      <th>parent_process_name</th>\n",
       "      <th>end_time</th>\n",
       "      <th>process_path</th>\n",
       "      <th>input_event</th>\n",
       "      <th>timestamp</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>2020-09-17 18:59:02</td>\n",
       "      <td>powershell  -command \"\"Install-Module DSIntern...</td>\n",
       "      <td>[eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZ...</td>\n",
       "      <td>powershell.exe</td>\n",
       "      <td>C:\\Windows\\System32\\cmd.exe</td>\n",
       "      <td>2020-09-17 18:59:02</td>\n",
       "      <td>c:\\windows\\system32\\windowspowershell\\v1.0</td>\n",
       "      <td>{'_tenant': 'test', '_time': '1600369142000', ...</td>\n",
       "      <td>2020-09-17 18:59:02</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "           start_time  ...           timestamp\n",
       "0 2020-09-17 18:59:02  ... 2020-09-17 18:59:02\n",
       "\n",
       "[1 rows x 9 columns]"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "\n"
     ]
    },
    {
     "data": {
      "text/plain": [
       "<spl2_kernel.spl2_runner.SPL2Job at 0x7fc811a94f10>"
      ]
     },
     "execution_count": 6,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "%%spl2 --parallelism=7\n",
    "| from read_text(\"s3://smle-experiments/datasets/ssa/misko_ssa_detections/logAllDSInternalsModules.log\")\n",
    "| select from_json_object(value) as input_event\n",
    "| eval timestamp=parse_long(ucast(map_get(input_event, \"_time\"), \"string\", null)),\n",
    "       process_name=ucast(map_get(input_event, \"process_name\"), \"string\", null),\n",
    "       process_path=ucast(map_get(input_event, \"process_path\"), \"string\", null),\n",
    "       cmd_line=ucast(map_get(input_event, \"process\"), \"string\", null),\n",
    "       parent_process_name=ucast(map_get(input_event, \"parent_process_name\"), \"string\", null)\n",
    "| where cmd_line != null AND ( \n",
    "           match_regex(cmd_line, /(?i)ConvertFrom-ADManagedPasswordBlob/)=true OR\n",
    "           match_regex(cmd_line, /(?i)ConvertFrom-GPPrefPassword/)=true OR\n",
    "           match_regex(cmd_line, /(?i)ConvertFrom-UnicodePassword/)=true OR\n",
    "           match_regex(cmd_line, /(?i)ConvertTo-GPPrefPassword/)=true OR\n",
    "           match_regex(cmd_line, /(?i)ConvertTo-KerberosKey/)=true OR\n",
    "           match_regex(cmd_line, /(?i)ConvertTo-LMHash/)=true OR\n",
    "           match_regex(cmd_line, /(?i)ConvertTo-NTHash/)=true OR\n",
    "           match_regex(cmd_line, /(?i)ConvertTo-OrgIdHash/)=true OR\n",
    "           match_regex(cmd_line, /(?i)ConvertTo-UnicodePassword/)=true\n",
    "        )       \n",
    "| eval start_time = timestamp,\n",
    "       end_time = timestamp,\n",
    "       entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), \n",
    "                            ucast(map_get(input_event, \"dest_device_id\"), \"string\", null));"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Mimikatz"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 7,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2020-10-21T18:30:01.383334Z",
     "iopub.status.busy": "2020-10-21T18:30:01.383060Z",
     "iopub.status.idle": "2020-10-21T18:30:03.190514Z",
     "shell.execute_reply": "2020-10-21T18:30:03.189720Z",
     "shell.execute_reply.started": "2020-10-21T18:30:01.383303Z"
    }
   },
   "outputs": [
    {
     "data": {
      "application/vnd.jupyter.widget-view+json": {
       "model_id": "04cf984d9740472dba04265122bc549d",
       "version_major": 2,
       "version_minor": 0
      },
      "text/plain": [
       "HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=5.0), HTML(value='')))"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      " Finished.                     "
     ]
    },
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>end_time</th>\n",
       "      <th>start_time</th>\n",
       "      <th>cmd_line</th>\n",
       "      <th>entities</th>\n",
       "      <th>input_event</th>\n",
       "      <th>timestamp</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>2020-09-11 23:45:19</td>\n",
       "      <td>2020-09-11 23:45:19</td>\n",
       "      <td>mimikatz  \"\"kerberos::ptt kerberos::golden ker...</td>\n",
       "      <td>[eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZ...</td>\n",
       "      <td>{'_tenant': 'test', '_time': '1599867919000', ...</td>\n",
       "      <td>2020-09-11 23:45:19</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>2020-09-11 23:45:21</td>\n",
       "      <td>2020-09-11 23:45:21</td>\n",
       "      <td>mimikatz  \"\"crypto::capi crypto::cng crypto::c...</td>\n",
       "      <td>[eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZ...</td>\n",
       "      <td>{'_tenant': 'test', '_time': '1599867921000', ...</td>\n",
       "      <td>2020-09-11 23:45:21</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>2020-09-11 23:45:17</td>\n",
       "      <td>2020-09-11 23:45:17</td>\n",
       "      <td>mimikatz  \"\"lsadump::sam  lsadump::secrets lsa...</td>\n",
       "      <td>[eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZ...</td>\n",
       "      <td>{'_tenant': 'test', '_time': '1599867917000', ...</td>\n",
       "      <td>2020-09-11 23:45:17</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "             end_time  ...           timestamp\n",
       "0 2020-09-11 23:45:19  ... 2020-09-11 23:45:19\n",
       "1 2020-09-11 23:45:21  ... 2020-09-11 23:45:21\n",
       "2 2020-09-11 23:45:17  ... 2020-09-11 23:45:17\n",
       "\n",
       "[3 rows x 6 columns]"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "\n"
     ]
    },
    {
     "data": {
      "text/plain": [
       "<spl2_kernel.spl2_runner.SPL2Job at 0x7fc811a4cc10>"
      ]
     },
     "execution_count": 7,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "%%spl2 --parallelism=7\n",
    "| from read_text(\"s3://smle-experiments/datasets/ssa/misko_ssa_detections/logAllMimikatzModules.log\")\n",
    "| select from_json_object(value) as input_event\n",
    "| eval timestamp=parse_long(ucast(map_get(input_event, \"_time\"), \"string\", null)),\n",
    "       cmd_line=ucast(map_get(input_event, \"process\"), \"string\", null)\n",
    "| where cmd_line != null AND (\n",
    "           match_regex(cmd_line, /(?i)CRYPTO::Certificates/)=true OR\n",
    "           match_regex(cmd_line, /(?i)CRYPTO::keys/)=true OR\n",
    "           match_regex(cmd_line, /(?i)kerberos::list/)=true OR\n",
    "           match_regex(cmd_line, /(?i)kerberos::tgt/)=true OR\n",
    "           match_regex(cmd_line, /(?i)lsadump::sam/)=true OR\n",
    "           match_regex(cmd_line, /(?i)lsadump::secrets/)=true OR\n",
    "           match_regex(cmd_line, /(?i)lsadump::cache/)=true OR\n",
    "           match_regex(cmd_line, /(?i)lsadump::lsa/)=true OR\n",
    "           match_regex(cmd_line, /(?i)lsadump::trust/)=true OR\n",
    "           match_regex(cmd_line, /(?i)lsadump::backupkeys/)=true \n",
    "        )\n",
    "| eval start_time = timestamp,\n",
    "       end_time = timestamp,\n",
    "       entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), \n",
    "                            ucast(map_get(input_event, \"dest_device_id\"), \"string\", null));"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": []
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "SPL2",
   "language": "SPL",
   "name": "spl2"
  },
  "language_info": {
   "mimetype": "text/spl",
   "name": "SPL"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 4
}