mirror of https://github.com/infosecn1nja/HELK.git
157 lines
3.7 KiB
Plaintext
157 lines
3.7 KiB
Plaintext
{
|
|
"cells": [
|
|
{
|
|
"cell_type": "markdown",
|
|
"metadata": {},
|
|
"source": [
|
|
"# Kerberos Manipulation\n",
|
|
"This method triggers on rare Kerberos Failure Codes caused by manipulations of Kerberos messages"
|
|
]
|
|
},
|
|
{
|
|
"cell_type": "markdown",
|
|
"metadata": {},
|
|
"source": [
|
|
"## Rule Content\n",
|
|
"```\n",
|
|
"- title: Kerberos Manipulation\n",
|
|
" id: f7644214-0eb0-4ace-9455-331ec4c09253\n",
|
|
" description: This method triggers on rare Kerberos Failure Codes caused by manipulations\n",
|
|
" of Kerberos messages\n",
|
|
" author: Florian Roth\n",
|
|
" tags:\n",
|
|
" - attack.credential_access\n",
|
|
" - attack.t1212\n",
|
|
" logsource:\n",
|
|
" product: windows\n",
|
|
" service: security\n",
|
|
" category: null\n",
|
|
" detection:\n",
|
|
" selection:\n",
|
|
" EventID:\n",
|
|
" - 675\n",
|
|
" - 4768\n",
|
|
" - 4769\n",
|
|
" - 4771\n",
|
|
" FailureCode:\n",
|
|
" - '0x9'\n",
|
|
" - '0xA'\n",
|
|
" - '0xB'\n",
|
|
" - '0xF'\n",
|
|
" - '0x10'\n",
|
|
" - '0x11'\n",
|
|
" - '0x13'\n",
|
|
" - '0x14'\n",
|
|
" - '0x1A'\n",
|
|
" - '0x1F'\n",
|
|
" - '0x21'\n",
|
|
" - '0x22'\n",
|
|
" - '0x23'\n",
|
|
" - '0x24'\n",
|
|
" - '0x26'\n",
|
|
" - '0x27'\n",
|
|
" - '0x28'\n",
|
|
" - '0x29'\n",
|
|
" - '0x2C'\n",
|
|
" - '0x2D'\n",
|
|
" - '0x2E'\n",
|
|
" - '0x2F'\n",
|
|
" - '0x31'\n",
|
|
" - '0x32'\n",
|
|
" - '0x3E'\n",
|
|
" - '0x3F'\n",
|
|
" - '0x40'\n",
|
|
" - '0x41'\n",
|
|
" - '0x43'\n",
|
|
" - '0x44'\n",
|
|
" condition: selection\n",
|
|
" falsepositives:\n",
|
|
" - Faulty legacy applications\n",
|
|
" level: high\n",
|
|
"\n",
|
|
"```"
|
|
]
|
|
},
|
|
{
|
|
"cell_type": "markdown",
|
|
"metadata": {},
|
|
"source": [
|
|
"## Querying Elasticsearch"
|
|
]
|
|
},
|
|
{
|
|
"cell_type": "markdown",
|
|
"metadata": {},
|
|
"source": [
|
|
"### Import Libraries"
|
|
]
|
|
},
|
|
{
|
|
"cell_type": "code",
|
|
"execution_count": null,
|
|
"metadata": {},
|
|
"outputs": [],
|
|
"source": [
|
|
"from elasticsearch import Elasticsearch\n",
|
|
"from elasticsearch_dsl import Search\n",
|
|
"import pandas as pd"
|
|
]
|
|
},
|
|
{
|
|
"cell_type": "markdown",
|
|
"metadata": {},
|
|
"source": [
|
|
"### Initialize Elasticsearch client"
|
|
]
|
|
},
|
|
{
|
|
"cell_type": "code",
|
|
"execution_count": null,
|
|
"metadata": {},
|
|
"outputs": [],
|
|
"source": [
|
|
"es = Elasticsearch(['http://helk-elasticsearch:9200'])\n",
|
|
"searchContext = Search(using=es, index='logs-endpoint-winevent-security-*', doc_type='doc')"
|
|
]
|
|
},
|
|
{
|
|
"cell_type": "markdown",
|
|
"metadata": {},
|
|
"source": [
|
|
"### Run Elasticsearch Query"
|
|
]
|
|
},
|
|
{
|
|
"cell_type": "code",
|
|
"execution_count": null,
|
|
"metadata": {},
|
|
"outputs": [],
|
|
"source": [
|
|
"s = searchContext.query('query_string', query='(event_id:(\"675\" OR \"4768\" OR \"4769\" OR \"4771\") AND ticket_failure_code:(\"0x9\" OR \"0xA\" OR \"0xB\" OR \"0xF\" OR \"0x10\" OR \"0x11\" OR \"0x13\" OR \"0x14\" OR \"0x1A\" OR \"0x1F\" OR \"0x21\" OR \"0x22\" OR \"0x23\" OR \"0x24\" OR \"0x26\" OR \"0x27\" OR \"0x28\" OR \"0x29\" OR \"0x2C\" OR \"0x2D\" OR \"0x2E\" OR \"0x2F\" OR \"0x31\" OR \"0x32\" OR \"0x3E\" OR \"0x3F\" OR \"0x40\" OR \"0x41\" OR \"0x43\" OR \"0x44\"))')\n",
|
|
"response = s.execute()\n",
|
|
"if response.success():\n",
|
|
" df = pd.DataFrame((d.to_dict() for d in s.scan()))"
|
|
]
|
|
},
|
|
{
|
|
"cell_type": "markdown",
|
|
"metadata": {},
|
|
"source": [
|
|
"### Show Results"
|
|
]
|
|
},
|
|
{
|
|
"cell_type": "code",
|
|
"execution_count": null,
|
|
"metadata": {},
|
|
"outputs": [],
|
|
"source": [
|
|
"df.head()"
|
|
]
|
|
}
|
|
],
|
|
"metadata": {},
|
|
"nbformat": 4,
|
|
"nbformat_minor": 4
|
|
}
|