splunk-security_content/notebooks/detect_pass_hash__ssa.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {
    "execution": {
     "iopub.execute_input": "2020-10-14T00:24:08.027638Z",
     "iopub.status.busy": "2020-10-14T00:24:08.027292Z",
     "iopub.status.idle": "2020-10-14T00:24:08.030791Z",
     "shell.execute_reply": "2020-10-14T00:24:08.030084Z",
     "shell.execute_reply.started": "2020-10-14T00:24:08.027607Z"
    }
   },
   "source": [
    "# Detect Pass the Hash\n",
    "### This is the SPL2 to test content: detections/endpoint/detect_pass_hash__ssa.yml"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2020-10-28T22:35:49.966691Z",
     "iopub.status.busy": "2020-10-28T22:35:49.966422Z",
     "iopub.status.idle": "2020-10-28T22:35:51.544851Z",
     "shell.execute_reply": "2020-10-28T22:35:51.543629Z",
     "shell.execute_reply.started": "2020-10-28T22:35:49.966620Z"
    }
   },
   "outputs": [
    {
     "data": {
      "application/vnd.jupyter.widget-view+json": {
       "model_id": "bc96630916c54e68bc29ac51a679c08e",
       "version_major": 2,
       "version_minor": 0
      },
      "text/plain": [
       "HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=5.0), HTML(value='')))"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      " Finished.                     "
     ]
    },
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>end_time</th>\n",
       "      <th>start_time</th>\n",
       "      <th>body</th>\n",
       "      <th>entities</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>6</td>\n",
       "      <td>6</td>\n",
       "      <td>TBD</td>\n",
       "      <td>TBD</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>8</td>\n",
       "      <td>8</td>\n",
       "      <td>TBD</td>\n",
       "      <td>TBD</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "   end_time  start_time body entities\n",
       "0         6           6  TBD      TBD\n",
       "1         8           8  TBD      TBD"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "\n"
     ]
    },
    {
     "data": {
      "text/plain": [
       "<spl2_kernel.spl2_runner.SPL2Job at 0x7f9335390a90>"
      ]
     },
     "execution_count": 1,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "| from read_text(\"s3://smle-experiments/datasets/ssa/T1550.002.json\")\n",
    "| eval input_event=from_json_object(value)\n",
    "| eval _time=map_get(input_event, \"_time\"), EventCode=map_get(input_event, \"event_code\"), LogonType=map_get(input_event, \"logon_type\"), LogonProcess=map_get(input_event, \"logon_process\"), ComputerName=map_get(input_event, \"dest_ip_primary_artifact\"), AccountName=map_get(input_event, \"dest_user_primary_artifact\")\n",
    "| where (LogonType=\"3\" AND LogonProcess=\"NtLmSsp\" AND AccountName IS NOT NULL) OR (LogonType=\"9\" AND LogonProcess=\"seclogo\")\n",
    "| first_time_event cache_partitions=1 input_columns=\"EventCode,LogonProcess,ComputerName\"\n",
    "| where first_time_EventCode_LogonProcess_ComputerName\n",
    "| eval start_time=_time, end_time=_time, body=\"TBD\", entities=\"TBD\"\n",
    "| select start_time, end_time, entities, body \n",
    ";"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": []
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "SPL2",
   "language": "SPL",
   "name": "spl2"
  },
  "language_info": {
   "mimetype": "text/spl",
   "name": "SPL"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 4
}