HELK/docker/helk-jupyter/notebooks/sigma/win_user_creation.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Detects local user creation\n",
    "Detects local user creation on windows servers, which shouldn't happen in an Active Directory environment. Apply this Sigma Use Case on your windows server logs and not on your DC logs."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Rule Content\n",
    "```\n",
    "- title: Detects local user creation\n",
    "  id: 66b6be3d-55d0-4f47-9855-d69df21740ea\n",
    "  description: Detects local user creation on windows servers, which shouldn't happen\n",
    "    in an Active Directory environment. Apply this Sigma Use Case on your windows\n",
    "    server logs and not on your DC logs.\n",
    "  status: experimental\n",
    "  tags:\n",
    "  - attack.persistence\n",
    "  - attack.t1136\n",
    "  references:\n",
    "  - https://patrick-bareiss.com/detecting-local-user-creation-in-ad-with-sigma/\n",
    "  author: Patrick Bareiss\n",
    "  logsource:\n",
    "    product: windows\n",
    "    service: security\n",
    "    category: null\n",
    "  detection:\n",
    "    selection:\n",
    "      EventID: 4720\n",
    "    condition: selection\n",
    "  fields:\n",
    "  - EventCode\n",
    "  - AccountName\n",
    "  - AccountDomain\n",
    "  falsepositives:\n",
    "  - Domain Controller Logs\n",
    "  - Local accounts managed by privileged account management tools\n",
    "  level: low\n",
    "\n",
    "```"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Querying Elasticsearch"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Import Libraries"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "from elasticsearch import Elasticsearch\n",
    "from elasticsearch_dsl import Search\n",
    "import pandas as pd"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Initialize Elasticsearch client"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "es = Elasticsearch(['http://helk-elasticsearch:9200'])\n",
    "searchContext = Search(using=es, index='logs-endpoint-winevent-security-*', doc_type='doc')"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Run Elasticsearch Query"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "s = searchContext.query('query_string', query='event_id:\"4720\"')\n",
    "response = s.execute()\n",
    "if response.success():\n",
    "    df = pd.DataFrame((d.to_dict() for d in s.scan()))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Show Results"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "df.head()"
   ]
  }
 ],
 "metadata": {},
 "nbformat": 4,
 "nbformat_minor": 4
}