{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Kerberos Manipulation\n",
    "This method triggers on rare Kerberos Failure Codes caused by manipulations of Kerberos messages"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Rule Content\n",
    "```\n",
    "- title: Kerberos Manipulation\n",
    "  id: f7644214-0eb0-4ace-9455-331ec4c09253\n",
    "  description: This method triggers on rare Kerberos Failure Codes caused by manipulations\n",
    "    of Kerberos messages\n",
    "  author: Florian Roth\n",
    "  tags:\n",
    "  - attack.credential_access\n",
    "  - attack.t1212\n",
    "  logsource:\n",
    "    product: windows\n",
    "    service: security\n",
    "    category: null\n",
    "  detection:\n",
    "    selection:\n",
    "      EventID:\n",
    "      - 675\n",
    "      - 4768\n",
    "      - 4769\n",
    "      - 4771\n",
    "      FailureCode:\n",
    "      - '0x9'\n",
    "      - '0xA'\n",
    "      - '0xB'\n",
    "      - '0xF'\n",
    "      - '0x10'\n",
    "      - '0x11'\n",
    "      - '0x13'\n",
    "      - '0x14'\n",
    "      - '0x1A'\n",
    "      - '0x1F'\n",
    "      - '0x21'\n",
    "      - '0x22'\n",
    "      - '0x23'\n",
    "      - '0x24'\n",
    "      - '0x26'\n",
    "      - '0x27'\n",
    "      - '0x28'\n",
    "      - '0x29'\n",
    "      - '0x2C'\n",
    "      - '0x2D'\n",
    "      - '0x2E'\n",
    "      - '0x2F'\n",
    "      - '0x31'\n",
    "      - '0x32'\n",
    "      - '0x3E'\n",
    "      - '0x3F'\n",
    "      - '0x40'\n",
    "      - '0x41'\n",
    "      - '0x43'\n",
    "      - '0x44'\n",
    "    condition: selection\n",
    "  falsepositives:\n",
    "  - Faulty legacy applications\n",
    "  level: high\n",
    "\n",
    "```"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Querying Elasticsearch"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Import Libraries"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "from elasticsearch import Elasticsearch\n",
    "from elasticsearch_dsl import Search\n",
    "import pandas as pd"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Initialize Elasticsearch client"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "es = Elasticsearch(['http://helk-elasticsearch:9200'])\n",
    "searchContext = Search(using=es, index='logs-endpoint-winevent-security-*', doc_type='doc')"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Run Elasticsearch Query"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "s = searchContext.query('query_string', query='(event_id:(\"675\" OR \"4768\" OR \"4769\" OR \"4771\") AND ticket_failure_code:(\"0x9\" OR \"0xA\" OR \"0xB\" OR \"0xF\" OR \"0x10\" OR \"0x11\" OR \"0x13\" OR \"0x14\" OR \"0x1A\" OR \"0x1F\" OR \"0x21\" OR \"0x22\" OR \"0x23\" OR \"0x24\" OR \"0x26\" OR \"0x27\" OR \"0x28\" OR \"0x29\" OR \"0x2C\" OR \"0x2D\" OR \"0x2E\" OR \"0x2F\" OR \"0x31\" OR \"0x32\" OR \"0x3E\" OR \"0x3F\" OR \"0x40\" OR \"0x41\" OR \"0x43\" OR \"0x44\"))')\n",
    "response = s.execute()\n",
    "if response.success():\n",
    "    df = pd.DataFrame((d.to_dict() for d in s.scan()))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Show Results"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "df.head()"
   ]
  }
 ],
 "metadata": {},
 "nbformat": 4,
 "nbformat_minor": 4
}