Import, browse, convert and run Sigma rules in Azure Sentinel
This commit is contained in:
Ian Hellen
Родитель
c6257eac5e
Коммит
ed682b155f
|
|
@ -0,0 +1,958 @@
|
|||
{
|
||||
"cells": [
|
||||
{
|
||||
"cell_type": "markdown",
|
||||
"metadata": {},
|
||||
"source": [
|
||||
"# Import and convert Neo23x0 Sigma scripts\n",
|
||||
"ianhelle@microsoft.com\n",
|
||||
"\n",
|
||||
"This notebook is a is a quick and dirty Sigma to Log Analytics converter.\n",
|
||||
"It uses the modules from sigmac package to do the conversion.\n",
|
||||
"\n",
|
||||
"Only a subset of the Sigma rules are convertible currently. Failure to convert\n",
|
||||
"could be for one or more of these reasons:\n",
|
||||
"- known limitations of the converter\n",
|
||||
"- mismatch between the syntax expressible in Sigma and KQL\n",
|
||||
"- data sources referenced in Sigma rules do not yet exist in Azure Sentinel\n",
|
||||
"\n",
|
||||
"The sigmac tool is downloadable as a package from PyPi but since we are downloading\n",
|
||||
"the rules from the repo, we also copy and import the package from the repo source.\n",
|
||||
"\n",
|
||||
"After conversion you can use an interactive browser to step through the rules and\n",
|
||||
"view (and copy/save) the KQL equivalents. You can also take the conversion results and \n",
|
||||
"use them in another way (e.g.bulk save to files).\n",
|
||||
"\n",
|
||||
"The notebook is all somewhat experimental and offered as-is without any guarantees"
|
||||
]
|
||||
},
|
||||
{
|
||||
"cell_type": "markdown",
|
||||
"metadata": {},
|
||||
"source": [
|
||||
"## Download and unzip the Sigma repo"
|
||||
]
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"execution_count": 2,
|
||||
"metadata": {},
|
||||
"outputs": [],
|
||||
"source": [
|
||||
"import requests\n",
|
||||
"# Download the repo ZIP\n",
|
||||
"sigma_git_url = 'https://github.com/Neo23x0/sigma/archive/master.zip'\n",
|
||||
"r = requests.get(sigma_git_url)"
|
||||
]
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"execution_count": 3,
|
||||
"metadata": {},
|
||||
"outputs": [
|
||||
{
|
||||
"data": {
|
||||
"application/vnd.jupyter.widget-view+json": {
|
||||
"model_id": "4d332db3f9434666b2898672c678019d",
|
||||
"version_major": 2,
|
||||
"version_minor": 0
|
||||
},
|
||||
"text/plain": [
|
||||
"Text(value='e:\\\\src\\\\notebooks\\\\experimental\\\\sigma', description='Path to extract to zipped repo files: ', la…"
|
||||
]
|
||||
},
|
||||
"metadata": {},
|
||||
"output_type": "display_data"
|
||||
}
|
||||
],
|
||||
"source": [
|
||||
"from ipywidgets import widgets, Layout\n",
|
||||
"import os\n",
|
||||
"from pathlib import Path\n",
|
||||
"def_path = Path.joinpath(Path(os.getcwd()), \"sigma\")\n",
|
||||
"path_wgt = widgets.Text(value=str(def_path), \n",
|
||||
" description='Path to extract to zipped repo files: ', \n",
|
||||
" layout=Layout(width='50%'),\n",
|
||||
" style={'description_width': 'initial'})\n",
|
||||
"path_wgt"
|
||||
]
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"execution_count": 4,
|
||||
"metadata": {},
|
||||
"outputs": [],
|
||||
"source": [
|
||||
"import zipfile\n",
|
||||
"import io\n",
|
||||
"repo_zip = io.BytesIO(r.content)\n",
|
||||
"\n",
|
||||
"zip_archive = zipfile.ZipFile(repo_zip, mode='r')\n",
|
||||
"zip_archive.extractall(path=path_wgt.value)\n",
|
||||
"RULES_REL_PATH = 'sigma-master/rules'\n",
|
||||
"rules_root = Path(path_wgt.value) / RULES_REL_PATH"
|
||||
]
|
||||
},
|
||||
{
|
||||
"cell_type": "markdown",
|
||||
"metadata": {},
|
||||
"source": [
|
||||
"### Check that we have the files\n",
|
||||
"You should see a folder with folders such as application, apt, windows..."
|
||||
]
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"execution_count": 5,
|
||||
"metadata": {
|
||||
"scrolled": true
|
||||
},
|
||||
"outputs": [
|
||||
{
|
||||
"name": "stdout",
|
||||
"output_type": "stream",
|
||||
"text": [
|
||||
" Volume in drive E is DATADRIVE1\n",
|
||||
" Volume Serial Number is 58A4-793E\n",
|
||||
"\n",
|
||||
" Directory of e:\\src\\notebooks\\experimental\\sigma\\sigma-master\\rules\n",
|
||||
"\n",
|
||||
"05/29/2019 10:17 <DIR> .\n",
|
||||
"05/29/2019 10:17 <DIR> ..\n",
|
||||
"05/29/2019 10:17 <DIR> application\n",
|
||||
"05/29/2019 10:17 <DIR> apt\n",
|
||||
"05/29/2019 10:17 <DIR> linux\n",
|
||||
"05/29/2019 10:17 <DIR> network\n",
|
||||
"05/29/2019 10:17 <DIR> proxy\n",
|
||||
"05/29/2019 10:17 <DIR> web\n",
|
||||
"05/29/2019 10:17 <DIR> windows\n",
|
||||
" 0 File(s) 0 bytes\n",
|
||||
" 9 Dir(s) 682,085,724,160 bytes free\n"
|
||||
]
|
||||
}
|
||||
],
|
||||
"source": [
|
||||
"%ls {rules_root}"
|
||||
]
|
||||
},
|
||||
{
|
||||
"cell_type": "markdown",
|
||||
"metadata": {},
|
||||
"source": [
|
||||
"## Convert Sigma Files to Log Analytics Kql queries"
|
||||
]
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"execution_count": 43,
|
||||
"metadata": {
|
||||
"scrolled": false
|
||||
},
|
||||
"outputs": [],
|
||||
"source": [
|
||||
"# Read the Sigma YAML file paths into a dict and make a\n",
|
||||
"# a copy for the target Kql queries\n",
|
||||
"from pathlib import Path\n",
|
||||
"from collections import defaultdict\n",
|
||||
"import copy\n",
|
||||
"\n",
|
||||
"def get_rule_files(rules_root):\n",
|
||||
" file_dict = defaultdict(dict)\n",
|
||||
" for file in Path(rules_root).resolve().rglob(\"*.yml\"):\n",
|
||||
" rel_path = Path(file).relative_to(rules_root)\n",
|
||||
" path_key = '.'.join(rel_path.parent.parts)\n",
|
||||
" file_dict[path_key][rel_path.name] = file\n",
|
||||
" return file_dict\n",
|
||||
" \n",
|
||||
"sigma_dict = get_rule_files(rules_root)\n",
|
||||
"kql_dict = copy.deepcopy(sigma_dict)\n"
|
||||
]
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"execution_count": 7,
|
||||
"metadata": {},
|
||||
"outputs": [],
|
||||
"source": [
|
||||
"# Add downloaded sigmac tool to sys.path and import Sigmac functions\n",
|
||||
"import os\n",
|
||||
"import sys\n",
|
||||
"module_path = os.path.abspath(os.path.join('sigma/sigma-master/tools'))\n",
|
||||
"if module_path not in sys.path:\n",
|
||||
" sys.path.append(module_path)\n",
|
||||
"from sigma.parser.collection import SigmaCollectionParser\n",
|
||||
"from sigma.parser.exceptions import SigmaCollectionParseError, SigmaParseError\n",
|
||||
"from sigma.configuration import SigmaConfiguration, SigmaConfigurationChain\n",
|
||||
"from sigma.config.exceptions import SigmaConfigParseError, SigmaRuleFilterParseException\n",
|
||||
"from sigma.filter import SigmaRuleFilter\n",
|
||||
"import sigma.backends.discovery as backends\n",
|
||||
"from sigma.backends.base import BackendOptions\n",
|
||||
"from sigma.backends.exceptions import BackendError, NotSupportedError, PartialMatchError, FullMatchError"
|
||||
]
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"execution_count": 57,
|
||||
"metadata": {
|
||||
"scrolled": false
|
||||
},
|
||||
"outputs": [
|
||||
{
|
||||
"name": "stdout",
|
||||
"output_type": "stream",
|
||||
"text": [
|
||||
"Conversion statistics\n",
|
||||
"---------------------\n",
|
||||
"application: rules: 5, converted: 0\n",
|
||||
"apt: rules: 29, converted: 21\n",
|
||||
"linux: rules: 14, converted: 0\n",
|
||||
"linux.auditd: rules: 2, converted: 0\n",
|
||||
"linux.modsecurity: rules: 1, converted: 0\n",
|
||||
"network: rules: 6, converted: 0\n",
|
||||
"proxy: rules: 18, converted: 0\n",
|
||||
"web: rules: 5, converted: 0\n",
|
||||
"windows.builtin: rules: 57, converted: 37\n",
|
||||
"windows.malware: rules: 5, converted: 1\n",
|
||||
"windows.other: rules: 3, converted: 0\n",
|
||||
"windows.powershell: rules: 12, converted: 0\n",
|
||||
"windows.process_creation: rules: 94, converted: 92\n",
|
||||
"windows.sysmon: rules: 46, converted: 41\n"
|
||||
]
|
||||
}
|
||||
],
|
||||
"source": [
|
||||
"# Sigma to Log Analytics Conversion\n",
|
||||
"import yaml\n",
|
||||
"_LA_MAPPINGS = '''\n",
|
||||
"fieldmappings:\n",
|
||||
" Image: NewProcessName\n",
|
||||
" ParentImage: ProcessName\n",
|
||||
" ParentCommandLine: NO_MAPPING\n",
|
||||
"'''\n",
|
||||
"\n",
|
||||
"NOT_CONVERTIBLE = 'Not convertible'\n",
|
||||
"\n",
|
||||
"def sigma_to_la(file_path):\n",
|
||||
" with open(file_path, 'r') as input_file:\n",
|
||||
" try:\n",
|
||||
" sigmaconfigs = SigmaConfigurationChain()\n",
|
||||
" sigmaconfig = SigmaConfiguration(_LA_MAPPINGS)\n",
|
||||
" sigmaconfigs.append(sigmaconfig)\n",
|
||||
" backend_options = BackendOptions(None, None)\n",
|
||||
" backend = backends.getBackend('ala')(sigmaconfigs, backend_options)\n",
|
||||
" parser = SigmaCollectionParser(input_file, sigmaconfigs, None)\n",
|
||||
" results = parser.generate(backend)\n",
|
||||
" kql_result = ''\n",
|
||||
" for result in results:\n",
|
||||
" kql_result += result\n",
|
||||
" except (NotImplementedError, NotSupportedError):\n",
|
||||
" kql_result = NOT_CONVERTIBLE\n",
|
||||
" input_file.seek(0,0)\n",
|
||||
" sigma_txt = input_file.read()\n",
|
||||
" if not kql_result == NOT_CONVERTIBLE:\n",
|
||||
" try:\n",
|
||||
" kql_header = \"\\n\".join(get_sigma_properties(sigma_txt))\n",
|
||||
" kql_result = kql_header + \"\\n\" + kql_result\n",
|
||||
" except Exception as e:\n",
|
||||
" print(\"exception reading sigma YAML: \", e)\n",
|
||||
" print(sigma_txt, kql_result, sep='\\n')\n",
|
||||
" return sigma_txt, kql_result\n",
|
||||
"\n",
|
||||
"sigma_keys = ['title', 'description', 'tags', 'status', \n",
|
||||
" 'author', 'logsource', 'falsepositives', 'level']\n",
|
||||
"\n",
|
||||
"def get_sigma_properties(sigma_rule):\n",
|
||||
" sigma_docs = yaml.load_all(sigma_rule, Loader=yaml.SafeLoader)\n",
|
||||
" sigma_rule_dict = next(sigma_docs)\n",
|
||||
" for prop in sigma_keys:\n",
|
||||
" yield get_property(prop, sigma_rule_dict)\n",
|
||||
"\n",
|
||||
"def get_property(name, sigma_rule_dict):\n",
|
||||
" sig_prop = sigma_rule_dict.get(name, 'na')\n",
|
||||
" if isinstance(sig_prop, dict):\n",
|
||||
" sig_prop = ' '.join([f\"{k}: {v}\" for k, v in sig_prop.items()])\n",
|
||||
" return f\"// {name}: {sig_prop}\"\n",
|
||||
" \n",
|
||||
" \n",
|
||||
"_KQL_FILTERS = {\n",
|
||||
" 'date': ' | where TimeGenerated >= datetime({start}) and TimeGenerated <= datetime({end}) ',\n",
|
||||
" 'host': ' | where Computer has {host_name} '\n",
|
||||
"}\n",
|
||||
"\n",
|
||||
"def insert_at(source, insert, find_sub):\n",
|
||||
" pos = source.find(find_sub)\n",
|
||||
" if pos != -1:\n",
|
||||
" return source[:pos] + insert + source[pos:]\n",
|
||||
" else:\n",
|
||||
" return source + insert\n",
|
||||
" \n",
|
||||
"def add_filter_clauses(source, **kwargs):\n",
|
||||
" if \"{\" in source or \"}\" in source:\n",
|
||||
" source = (\"// Warning: embedded braces in source. Please edit if necessary.\\n\"\n",
|
||||
" + source)\n",
|
||||
" source = source.replace('{', '{{').replace('}', '}}')\n",
|
||||
" if kwargs.get('host', False):\n",
|
||||
" source = insert_at(source, _KQL_FILTERS['host'], '|')\n",
|
||||
" if kwargs.get('date', False):\n",
|
||||
" source = insert_at(source, _KQL_FILTERS['date'], '|')\n",
|
||||
" return source\n",
|
||||
"\n",
|
||||
"\n",
|
||||
"# Run the conversion\n",
|
||||
"conv_counter = {}\n",
|
||||
"for categ, sources in sigma_dict.items():\n",
|
||||
" src_converted = 0\n",
|
||||
" for file_name, file_path in sources.items():\n",
|
||||
" sigma, kql = sigma_to_la(file_path)\n",
|
||||
" kql_dict[categ][file_name] = (sigma, kql)\n",
|
||||
" if not kql == NOT_CONVERTIBLE:\n",
|
||||
" src_converted += 1\n",
|
||||
" conv_counter[categ] = (len(sources), src_converted)\n",
|
||||
" \n",
|
||||
"print(\"Conversion statistics\")\n",
|
||||
"print(\"-\" * len(\"Conversion statistics\"))\n",
|
||||
"print('\\n'.join([f'{categ}: rules: {counter[0]}, converted: {counter[1]}'\n",
|
||||
" for categ, counter in conv_counter.items()]))"
|
||||
]
|
||||
},
|
||||
{
|
||||
"cell_type": "markdown",
|
||||
"metadata": {},
|
||||
"source": [
|
||||
"## Display the results in an interactive browser"
|
||||
]
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"execution_count": 62,
|
||||
"metadata": {
|
||||
"scrolled": false
|
||||
},
|
||||
"outputs": [
|
||||
{
|
||||
"data": {
|
||||
"application/vnd.jupyter.widget-view+json": {
|
||||
"model_id": "971c97b3cd804e51bd28a1de94be2bdb",
|
||||
"version_major": 2,
|
||||
"version_minor": 0
|
||||
},
|
||||
"text/plain": [
|
||||
"VBox(children=(HBox(children=(Select(description='Category : ', layout=Layout(height='120px', width='30%'), …"
|
||||
]
|
||||
},
|
||||
"metadata": {},
|
||||
"output_type": "display_data"
|
||||
}
|
||||
],
|
||||
"source": [
|
||||
"from ipywidgets import widgets, Layout\n",
|
||||
"\n",
|
||||
"# Browser Functions\n",
|
||||
"def on_cat_value_change(change):\n",
|
||||
" queries_w.options = kql_dict[change['new']].keys()\n",
|
||||
" queries_w.value = queries_w.options[0]\n",
|
||||
"\n",
|
||||
"def on_query_value_change(change):\n",
|
||||
" if view_qry_check.value:\n",
|
||||
" qry_text = kql_dict[sub_cats_w.value][queries_w.value][1]\n",
|
||||
" if \"Not convertible\" not in qry_text:\n",
|
||||
" qry_text = add_filter_clauses(qry_text,\n",
|
||||
" date=add_date_filter_check.value,\n",
|
||||
" host=add_host_filter_check.value)\n",
|
||||
" query_text_w.value = qry_text.replace('|', '\\n|')\n",
|
||||
" orig_text_w.value = kql_dict[sub_cats_w.value][queries_w.value][0]\n",
|
||||
"\n",
|
||||
"def on_view_query_value_change(change):\n",
|
||||
" vis = 'visible' if view_qry_check.value else 'hidden'\n",
|
||||
" on_query_value_change(None)\n",
|
||||
" query_text_w.layout.visibility = vis\n",
|
||||
" orig_text_w.layout.visibility = vis\n",
|
||||
"\n",
|
||||
"# Function defs for ExecuteQuery cell below\n",
|
||||
"def click_exec_hqry(b):\n",
|
||||
" global qry_results\n",
|
||||
" query_name = queries_w.value\n",
|
||||
" query_cat = sub_cats_w.value\n",
|
||||
" query_text = query_text_w.value\n",
|
||||
" query_text = query_text.format(**qry_wgt.query_params)\n",
|
||||
"\n",
|
||||
" disp_results(query_text)\n",
|
||||
" \n",
|
||||
"def disp_results(query_text):\n",
|
||||
" out_wgt.clear_output()\n",
|
||||
" with out_wgt:\n",
|
||||
" print(\"Running query...\", end=' ')\n",
|
||||
" qry_results = execute_kql_query(query_text)\n",
|
||||
" print(f'done. {len(qry_results)} rows returned.')\n",
|
||||
" display(qry_results)\n",
|
||||
" \n",
|
||||
"exec_hqry_button = widgets.Button(description=\"Execute query..\")\n",
|
||||
"out_wgt = widgets.Output() #layout=Layout(width='100%', height='200px', visiblity='visible'))\n",
|
||||
"exec_hqry_button.on_click(click_exec_hqry)\n",
|
||||
"\n",
|
||||
"# Browser widget setup\n",
|
||||
"categories = list(sorted(kql_dict.keys()))\n",
|
||||
"sub_cats_w = widgets.Select(options=categories, \n",
|
||||
" description='Category : ',\n",
|
||||
" layout=Layout(width='30%', height='120px'),\n",
|
||||
" style = {'description_width': 'initial'})\n",
|
||||
"\n",
|
||||
"queries_w = widgets.Select(options = kql_dict[categories[0]].keys(),\n",
|
||||
" description='Query : ',\n",
|
||||
" layout=Layout(width='30%', height='120px'),\n",
|
||||
" style = {'description_width': 'initial'})\n",
|
||||
"\n",
|
||||
"query_text_w = widgets.Textarea(\n",
|
||||
" value='',\n",
|
||||
" description='Kql Query:',\n",
|
||||
" layout=Layout(width='100%', height='300px', visiblity='hidden'),\n",
|
||||
" disabled=False)\n",
|
||||
"orig_text_w = widgets.Textarea(\n",
|
||||
" value='',\n",
|
||||
" description='Sigma Query:',\n",
|
||||
" layout=Layout(width='100%', height='250px', visiblity='hidden'),\n",
|
||||
" disabled=False)\n",
|
||||
"\n",
|
||||
"query_text_w.layout.visibility = 'hidden'\n",
|
||||
"orig_text_w.layout.visibility = 'hidden'\n",
|
||||
"sub_cats_w.observe(on_cat_value_change, names='value')\n",
|
||||
"queries_w.observe(on_query_value_change, names='value')\n",
|
||||
"\n",
|
||||
"view_qry_check = widgets.Checkbox(description=\"View query\", value=True)\n",
|
||||
"add_date_filter_check = widgets.Checkbox(description=\"Add date filter\", value=False)\n",
|
||||
"add_host_filter_check = widgets.Checkbox(description=\"Add host filter\", value=False)\n",
|
||||
"\n",
|
||||
"view_qry_check.observe(on_view_query_value_change, names='value')\n",
|
||||
"add_date_filter_check.observe(on_view_query_value_change, names='value')\n",
|
||||
"add_host_filter_check.observe(on_view_query_value_change, names='value')\n",
|
||||
"# view_qry_button.on_click(click_exec_hqry)\n",
|
||||
"# display(exec_hqry_button);\n",
|
||||
"\n",
|
||||
"vbox_opts = widgets.VBox([view_qry_check, add_date_filter_check, add_host_filter_check])\n",
|
||||
"hbox = widgets.HBox([sub_cats_w, queries_w, vbox_opts])\n",
|
||||
"vbox = widgets.VBox([hbox, orig_text_w, query_text_w])\n",
|
||||
"on_view_query_value_change(None)\n",
|
||||
"display(vbox)"
|
||||
]
|
||||
},
|
||||
{
|
||||
"cell_type": "markdown",
|
||||
"metadata": {},
|
||||
"source": [
|
||||
"## Click the `Execute query` button to run the currently display query\n",
|
||||
"**Notes:**\n",
|
||||
"- To run the queries, first authenticate to Log Analytics (scroll down and execute remaining cells in the notebook)\n",
|
||||
"- If you added a date filter to the query set the date range below"
|
||||
]
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"execution_count": 68,
|
||||
"metadata": {
|
||||
"scrolled": true
|
||||
},
|
||||
"outputs": [
|
||||
{
|
||||
"data": {
|
||||
"application/vnd.jupyter.widget-view+json": {
|
||||
"model_id": "99f3405c7f3c43239ad46ceac5c9c98c",
|
||||
"version_major": 2,
|
||||
"version_minor": 0
|
||||
},
|
||||
"text/plain": [
|
||||
"VBox(children=(Button(description='Execute query..', style=ButtonStyle()), Output(outputs=({'output_type': 'st…"
|
||||
]
|
||||
},
|
||||
"metadata": {},
|
||||
"output_type": "display_data"
|
||||
}
|
||||
],
|
||||
"source": [
|
||||
"from msticpy.nbtools.nbwidgets import QueryTime\n",
|
||||
"qry_wgt = QueryTime(units='days', before=5, after=0, max_before=30, max_after=10)\n",
|
||||
"vbox = widgets.VBox([exec_hqry_button, out_wgt])\n",
|
||||
"display(vbox)"
|
||||
]
|
||||
},
|
||||
{
|
||||
"cell_type": "markdown",
|
||||
"metadata": {},
|
||||
"source": [
|
||||
"### Set Query Time bounds"
|
||||
]
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"execution_count": 90,
|
||||
"metadata": {
|
||||
"scrolled": true
|
||||
},
|
||||
"outputs": [
|
||||
{
|
||||
"data": {
|
||||
"application/vnd.jupyter.widget-view+json": {
|
||||
"model_id": "834ec6d603cf4cd3879e44ae70361135",
|
||||
"version_major": 2,
|
||||
"version_minor": 0
|
||||
},
|
||||
"text/plain": [
|
||||
"HTML(value='<h4>Set query time boundaries</h4>')"
|
||||
]
|
||||
},
|
||||
"metadata": {},
|
||||
"output_type": "display_data"
|
||||
},
|
||||
{
|
||||
"data": {
|
||||
"application/vnd.jupyter.widget-view+json": {
|
||||
"model_id": "50f46f91539344cab8e73028d929a8fd",
|
||||
"version_major": 2,
|
||||
"version_minor": 0
|
||||
},
|
||||
"text/plain": [
|
||||
"HBox(children=(DatePicker(value=datetime.date(2019, 5, 30), description='Origin Date'), Text(value='22:39:49.1…"
|
||||
]
|
||||
},
|
||||
"metadata": {},
|
||||
"output_type": "display_data"
|
||||
},
|
||||
{
|
||||
"data": {
|
||||
"application/vnd.jupyter.widget-view+json": {
|
||||
"model_id": "a3d40887bebe409a84e7b648bf0c52ed",
|
||||
"version_major": 2,
|
||||
"version_minor": 0
|
||||
},
|
||||
"text/plain": [
|
||||
"VBox(children=(IntRangeSlider(value=(-5, 0), description='Time Range (day):', layout=Layout(width='80%'), max=…"
|
||||
]
|
||||
},
|
||||
"metadata": {},
|
||||
"output_type": "display_data"
|
||||
}
|
||||
],
|
||||
"source": [
|
||||
"qry_wgt.display()"
|
||||
]
|
||||
},
|
||||
{
|
||||
"cell_type": "markdown",
|
||||
"metadata": {},
|
||||
"source": [
|
||||
"### Authenticate to Azure Sentinel"
|
||||
]
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"execution_count": 93,
|
||||
"metadata": {},
|
||||
"outputs": [],
|
||||
"source": [
|
||||
"def clean_kql_comments(query_string):\n",
|
||||
" \"\"\"Cleans\"\"\"\n",
|
||||
" import re\n",
|
||||
" return re.sub(r'(//[^\\n]+)', '', query_string, re.MULTILINE).replace('\\n', '').strip()\n",
|
||||
"\n",
|
||||
"def execute_kql_query(query_string):\n",
|
||||
" if not query_string or len(query_string.strip()) == 0:\n",
|
||||
" print('No query supplied')\n",
|
||||
" return None\n",
|
||||
" src_query = clean_kql_comments(query_string)\n",
|
||||
" result = get_ipython().run_cell_magic('kql', line='', cell=src_query)\n",
|
||||
" \n",
|
||||
" if result is not None and result.completion_query_info['StatusCode'] == 0:\n",
|
||||
" results_frame = result.to_dataframe()\n",
|
||||
" return results_frame\n",
|
||||
" return []"
|
||||
]
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"execution_count": 64,
|
||||
"metadata": {},
|
||||
"outputs": [
|
||||
{
|
||||
"data": {
|
||||
"application/vnd.jupyter.widget-view+json": {
|
||||
"model_id": "fe1f16333290437aad192d19d9a0b2e8",
|
||||
"version_major": 2,
|
||||
"version_minor": 0
|
||||
},
|
||||
"text/plain": [
|
||||
"HBox(children=(Text(value='52b1ab41-869e-4138-9e40-2a4457f09bf0', description='Log Analytics Workspace Id:', l…"
|
||||
]
|
||||
},
|
||||
"metadata": {},
|
||||
"output_type": "display_data"
|
||||
}
|
||||
],
|
||||
"source": [
|
||||
"import os\n",
|
||||
"from msticpy.nbtools.wsconfig import WorkspaceConfig\n",
|
||||
"from msticpy.nbtools import kql, GetEnvironmentKey\n",
|
||||
"\n",
|
||||
"ws_config_file = 'config.json'\n",
|
||||
"try:\n",
|
||||
" ws_config = WorkspaceConfig(ws_config_file)\n",
|
||||
" print('Found config file')\n",
|
||||
" for cf_item in ['tenant_id', 'subscription_id', 'resource_group', 'workspace_id', 'workspace_name']:\n",
|
||||
" print(cf_item, ws_config[cf_item])\n",
|
||||
"except:\n",
|
||||
" ws_config = None\n",
|
||||
"\n",
|
||||
"ws_id = GetEnvironmentKey(env_var='WORKSPACE_ID',\n",
|
||||
" prompt='Log Analytics Workspace Id:')\n",
|
||||
"if ws_config:\n",
|
||||
" ws_id.value = ws_config['workspace_id']\n",
|
||||
"ws_id.display()"
|
||||
]
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"execution_count": 65,
|
||||
"metadata": {},
|
||||
"outputs": [],
|
||||
"source": [
|
||||
"try:\n",
|
||||
" WORKSPACE_ID = select_ws.value\n",
|
||||
"except NameError:\n",
|
||||
" try:\n",
|
||||
" WORKSPACE_ID = ws_id.value\n",
|
||||
" except NameError:\n",
|
||||
" WORKSPACE_ID = None\n",
|
||||
" \n",
|
||||
"if not WORKSPACE_ID:\n",
|
||||
" raise ValueError('No workspace selected.')\n",
|
||||
"\n",
|
||||
"kql.load_kql_magic()\n",
|
||||
"\n",
|
||||
"%kql loganalytics://code().workspace(WORKSPACE_ID)"
|
||||
]
|
||||
},
|
||||
{
|
||||
"cell_type": "markdown",
|
||||
"metadata": {},
|
||||
"source": [
|
||||
"## Save All Converted Files"
|
||||
]
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"execution_count": 79,
|
||||
"metadata": {},
|
||||
"outputs": [
|
||||
{
|
||||
"data": {
|
||||
"application/vnd.jupyter.widget-view+json": {
|
||||
"model_id": "b6ecc7d1aac04170868a2c4b4c4c3e30",
|
||||
"version_major": 2,
|
||||
"version_minor": 0
|
||||
},
|
||||
"text/plain": [
|
||||
"Text(value='e:\\\\src\\\\notebooks\\\\experimental\\\\sigma_kql_out', description='Path to save KQL files: ', layout=L…"
|
||||
]
|
||||
},
|
||||
"metadata": {},
|
||||
"output_type": "display_data"
|
||||
}
|
||||
],
|
||||
"source": [
|
||||
"path_save_wgt = widgets.Text(value=str(def_path) + \"_kql_out\",\n",
|
||||
" description='Path to save KQL files: ',\n",
|
||||
" layout=Layout(width='50%'),\n",
|
||||
" style={'description_width': 'initial'})\n",
|
||||
"path_save_wgt"
|
||||
]
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"execution_count": 84,
|
||||
"metadata": {},
|
||||
"outputs": [
|
||||
{
|
||||
"name": "stdout",
|
||||
"output_type": "stream",
|
||||
"text": [
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\apt\\apt_apt29_thinktanks.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\apt\\apt_babyshark.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\apt\\apt_bear_activity_gtr19.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\apt\\apt_cloudhopper.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\apt\\apt_dragonfly.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\apt\\apt_elise.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\apt\\apt_empiremonkey.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\apt\\apt_equationgroup_dll_u_load.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\apt\\apt_hurricane_panda.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\apt\\apt_judgement_panda_gtr19.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\apt\\apt_oceanlotus_registry.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\apt\\apt_pandemic.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\apt\\apt_slingshot.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\apt\\apt_sofacy.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\apt\\apt_sofacy_zebrocy.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\apt\\apt_ta17_293a_ps.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\apt\\apt_tropictrooper.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\apt\\apt_turla_namedpipes.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\apt\\apt_unidentified_nov_18.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\apt\\apt_zxshell.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\apt\\crime_fireball.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.builtin\\win_account_backdoor_dcsync_rights.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.builtin\\win_account_discovery.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.builtin\\win_admin_rdp_login.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.builtin\\win_admin_share_access.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.builtin\\win_alert_active_directory_user_control.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.builtin\\win_alert_ad_user_backdoors.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.builtin\\win_alert_enable_weak_encryption.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.builtin\\win_alert_hacktool_use.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.builtin\\win_atsvc_task.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.builtin\\win_dcsync.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.builtin\\win_disable_event_logging.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.builtin\\win_GPO_scheduledtasks.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.builtin\\win_impacket_secretdump.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.builtin\\win_lm_namedpipe.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.builtin\\win_mal_wceaux_dll.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.builtin\\win_net_ntlm_downgrade.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.builtin\\win_overpass_the_hash.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.builtin\\win_pass_the_hash.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.builtin\\win_rdp_localhost_login.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.builtin\\win_rdp_reverse_tunnel.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.builtin\\win_susp_add_sid_history.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.builtin\\win_susp_dsrm_password_change.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.builtin\\win_susp_failed_logon_reasons.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.builtin\\win_susp_interactive_logons.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.builtin\\win_susp_kerberos_manipulation.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.builtin\\win_susp_lsass_dump.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.builtin\\win_susp_mshta_execution.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.builtin\\win_susp_net_recon_activity.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.builtin\\win_susp_psexec.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.builtin\\win_susp_raccess_sensitive_fext.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.builtin\\win_susp_rc4_kerberos.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.builtin\\win_susp_sdelete.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.builtin\\win_susp_security_eventlog_cleared.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.builtin\\win_susp_time_modification.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.builtin\\win_svcctl_remote_service.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.builtin\\win_user_added_to_local_administrators.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.builtin\\win_user_creation.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.malware\\win_mal_ursnif.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\powershell_xor_commandline.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_attrib_hiding_files.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_bypass_squiblytwo.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_cmdkey_recon.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_cmstp_com_object_access.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_etw_trace_evasion.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_exploit_cve_2015_1641.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_exploit_cve_2017_0261.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_exploit_cve_2017_11882.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_exploit_cve_2017_8759.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_hack_rubeus.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_lethalhta.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_malware_dridex.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_malware_notpetya.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_malware_script_dropper.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_malware_wannacry.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_mal_adwind.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_mal_lockergoga.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_mavinject_proc_inj.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_mshta_spawn_shell.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_netsh_fw_add.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_netsh_port_fwd.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_netsh_port_fwd_3389.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_office_shell.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_office_spawn_exe_from_users_directory.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_plugx_susp_exe_locations.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_possible_applocker_bypass.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_powershell_amsi_bypass.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_powershell_b64_shellcode.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_powershell_dll_execution.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_powershell_download.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_powershell_renamed_ps.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_powershell_suspicious_parameter_variation.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_process_creation_bitsadmin_download.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_proc_wrong_parent.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_psexesvc_start.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_renamed_paexec.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_sdbinst_shim_persistence.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_shell_spawn_susp_program.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_spn_enum.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_susp_bcdedit.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_susp_calc.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_susp_certutil_command.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_susp_certutil_encode.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_susp_cli_escape.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_susp_cmd_http_appdata.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_susp_control_dll_load.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_susp_csc.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_susp_execution_path.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_susp_execution_path_webserver.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_susp_exec_folder.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_susp_gup.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_susp_iss_module_install.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_susp_mmc_source.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_susp_msiexec_web_install.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_susp_net_execution.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_susp_ntdsutil.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_susp_outlook.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_susp_ping_hex_ip.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_susp_powershell_empire_lanuch.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_susp_powershell_enc_cmd.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_susp_powershell_hidden_b64_cmd.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_susp_powershell_parent_combo.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_susp_procdump.kql\n"
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "stdout",
|
||||
"output_type": "stream",
|
||||
"text": [
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_susp_process_creations.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_susp_prog_location_process_starts.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_susp_ps_appdata.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_susp_rasdial_activity.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_susp_recon_activity.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_susp_regsvr32_anomalies.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_susp_rundll32_activity.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_susp_run_locations.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_susp_schtask_creation.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_susp_script_execution.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_susp_squirrel_lolbin.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_susp_svchost.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_susp_sysprep_appdata.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_susp_sysvol_access.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_susp_taskmgr_localsystem.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_susp_taskmgr_parent.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_susp_tscon_localsystem.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_susp_tscon_rdp_redirect.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_susp_vssadmin_ntds_activity.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_susp_whoami.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_susp_wmi_execution.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_system_exe_anomaly.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_vul_java_remote_debugging.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_webshell_detection.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_webshell_spawn.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_wmi_persistence_script_event_consumer.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_wmi_spwns_powershell.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.process_creation\\win_workflow_compiler.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.sysmon\\sysmon_ads_executable.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.sysmon\\sysmon_cactustorch.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.sysmon\\sysmon_cmstp_execution.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.sysmon\\sysmon_cobaltstrike_process_injection.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.sysmon\\sysmon_dhcp_calloutdll.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.sysmon\\sysmon_dns_serverlevelplugindll.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.sysmon\\sysmon_ghostpack_safetykatz.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.sysmon\\sysmon_logon_scripts_userinitmprlogonscript.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.sysmon\\sysmon_lsass_memdump.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.sysmon\\sysmon_malware_backconnect_ports.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.sysmon\\sysmon_malware_verclsid_shellcode.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.sysmon\\sysmon_mal_namedpipes.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.sysmon\\sysmon_mimikatz_detection_lsass.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.sysmon\\sysmon_password_dumper_lsass.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.sysmon\\sysmon_powershell_exploit_scripts.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.sysmon\\sysmon_powershell_network_connection.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.sysmon\\sysmon_quarkspw_filedump.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.sysmon\\sysmon_rdp_reverse_tunnel.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.sysmon\\sysmon_rdp_settings_hijack.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.sysmon\\sysmon_rundll32_net_connections.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.sysmon\\sysmon_ssp_added_lsa_config.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.sysmon\\sysmon_stickykey_like_backdoor.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.sysmon\\sysmon_susp_driver_load.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.sysmon\\sysmon_susp_image_load.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.sysmon\\sysmon_susp_powershell_rundll32.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.sysmon\\sysmon_susp_prog_location_network_connection.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.sysmon\\sysmon_susp_rdp.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.sysmon\\sysmon_susp_reg_persist_explorer_run.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.sysmon\\sysmon_susp_run_key_img_folder.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.sysmon\\sysmon_sysinternals_eula_accepted.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.sysmon\\sysmon_tsclient_filewrite_startup.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.sysmon\\sysmon_uac_bypass_eventvwr.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.sysmon\\sysmon_uac_bypass_sdclt.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.sysmon\\sysmon_win10_sched_task_0day.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.sysmon\\sysmon_win_binary_github_com.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.sysmon\\sysmon_win_binary_susp_com.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.sysmon\\sysmon_win_reg_persistence.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.sysmon\\sysmon_wmi_event_subscription.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.sysmon\\sysmon_wmi_persistence_commandline_event_consumer.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.sysmon\\sysmon_wmi_persistence_script_event_consumer_write.kql\n",
|
||||
"Saved e:\\src\\notebooks\\experimental\\sigma_kql_out\\windows.sysmon\\sysmon_wmi_susp_scripting.kql\n"
|
||||
]
|
||||
}
|
||||
],
|
||||
"source": [
|
||||
"root = Path(path_save_wgt.value)\n",
|
||||
"root.mkdir(exist_ok=True)\n",
|
||||
"for categ, kql_files in kql_dict.items():\n",
|
||||
" sub_dir = root.joinpath(categ)\n",
|
||||
" \n",
|
||||
" for file_name, contents in kql_files.items():\n",
|
||||
" kql_txt = contents[1]\n",
|
||||
" if not kql_txt == NOT_CONVERTIBLE:\n",
|
||||
" sub_dir.mkdir(exist_ok=True)\n",
|
||||
" file_path = sub_dir.joinpath(file_name.replace('.yml', '.kql'))\n",
|
||||
" with open(file_path, 'w') as output_file:\n",
|
||||
" output_file.write(kql_txt)\n",
|
||||
" print(f\"Saved {file_path}\")\n"
|
||||
]
|
||||
}
|
||||
],
|
||||
"metadata": {
|
||||
"hide_input": false,
|
||||
"kernelspec": {
|
||||
"display_name": "Python 3",
|
||||
"language": "python",
|
||||
"name": "python3"
|
||||
},
|
||||
"language_info": {
|
||||
"codemirror_mode": {
|
||||
"name": "ipython",
|
||||
"version": 3
|
||||
},
|
||||
"file_extension": ".py",
|
||||
"mimetype": "text/x-python",
|
||||
"name": "python",
|
||||
"nbconvert_exporter": "python",
|
||||
"pygments_lexer": "ipython3",
|
||||
"version": "3.7.3"
|
||||
},
|
||||
"toc": {
|
||||
"base_numbering": 1,
|
||||
"nav_menu": {},
|
||||
"number_sections": false,
|
||||
"sideBar": true,
|
||||
"skip_h1_title": false,
|
||||
"title_cell": "Table of Contents",
|
||||
"title_sidebar": "Contents",
|
||||
"toc_cell": false,
|
||||
"toc_position": {},
|
||||
"toc_section_display": true,
|
||||
"toc_window_display": false
|
||||
},
|
||||
"varInspector": {
|
||||
"cols": {
|
||||
"lenName": 16,
|
||||
"lenType": 16,
|
||||
"lenVar": 40
|
||||
},
|
||||
"kernels_config": {
|
||||
"python": {
|
||||
"delete_cmd_postfix": "",
|
||||
"delete_cmd_prefix": "del ",
|
||||
"library": "var_list.py",
|
||||
"varRefreshCmd": "print(var_dic_list())"
|
||||
},
|
||||
"r": {
|
||||
"delete_cmd_postfix": ") ",
|
||||
"delete_cmd_prefix": "rm(",
|
||||
"library": "var_list.r",
|
||||
"varRefreshCmd": "cat(var_dic_list()) "
|
||||
}
|
||||
},
|
||||
"types_to_exclude": [
|
||||
"module",
|
||||
"function",
|
||||
"builtin_function_or_method",
|
||||
"instance",
|
||||
"_Feature"
|
||||
],
|
||||
"window_display": false
|
||||
}
|
||||
},
|
||||
"nbformat": 4,
|
||||
"nbformat_minor": 2
|
||||
}
|
||||
Загрузка…
Ссылка в новой задаче