splunk-security_content/notebooks/detect_kerberoasting__ssa.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Detect Kerberoasting\n",
    "### This is the SPL2 to test content: detections/endpoint/detect_kerberoasting__ssa.yml"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2020-10-28T22:35:40.972663Z",
     "iopub.status.busy": "2020-10-28T22:35:40.972286Z",
     "iopub.status.idle": "2020-10-28T22:35:42.632374Z",
     "shell.execute_reply": "2020-10-28T22:35:42.631440Z",
     "shell.execute_reply.started": "2020-10-28T22:35:40.972629Z"
    }
   },
   "outputs": [
    {
     "data": {
      "application/vnd.jupyter.widget-view+json": {
       "model_id": "2ea98fa914f748d487beaf1b4b188a4d",
       "version_major": 2,
       "version_minor": 0
      },
      "text/plain": [
       "HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=5.0), HTML(value='')))"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      " Finished.                     "
     ]
    },
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>end_time</th>\n",
       "      <th>start_time</th>\n",
       "      <th>body</th>\n",
       "      <th>entities</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>1119</td>\n",
       "      <td>1119</td>\n",
       "      <td>TBD</td>\n",
       "      <td>TBD</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "   end_time  start_time body entities\n",
       "0      1119        1119  TBD      TBD"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "\n"
     ]
    },
    {
     "data": {
      "text/plain": [
       "<spl2_kernel.spl2_runner.SPL2Job at 0x7efb7b3facd0>"
      ]
     },
     "execution_count": 1,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "| from read_text(\"s3://smle-experiments/datasets/ssa/T1558.003.json\")\n",
    "| eval input_event=from_json_object(value)\n",
    "| eval _time=map_get(input_event, \"_time\"), EventCode=map_get(input_event, \"event_code\"), TicketOptions=map_get(input_event, \"ticket_options\"), TicketEncryptionType=map_get(input_event, \"ticket_encryption_type\"), ServiceName=map_get(input_event, \"service_name\"), ServiceID=map_get(input_event, \"service_id\")\n",
    "| where EventCode=\"4769\" AND TicketOptions=\"0x40810000\" AND TicketEncryptionType=\"0x17\"\n",
    "| first_time_event cache_partitions=1 input_columns=\"EventCode,TicketOptions,TicketEncryptionType,ServiceName,ServiceID\"\n",
    "| where first_time_EventCode_TicketOptions_TicketEncryptionType_ServiceName_ServiceID\n",
    "| eval start_time=_time, end_time=_time, body=\"TBD\", entities=\"TBD\"\n",
    "| select start_time, end_time, entities, body \n",
    ";"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": []
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "SPL2",
   "language": "SPL",
   "name": "spl2"
  },
  "language_info": {
   "mimetype": "text/spl",
   "name": "SPL"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 4
}