Log Analysis & SIEM Integration

pip install pandas pyyaml python-dateutil

# Failed SSH logins
grep "Failed password" /var/log/auth.log | awk '{print $1,$2,$3,$11}' | sort | uniq -c | sort -rn

# Successful logins after failures (brute force success)
grep "Accepted password\|Accepted publickey" /var/log/auth.log

# Sudo usage
grep "sudo:" /var/log/auth.log | grep -v "session"

# Cron job execution
grep CRON /var/log/syslog

# New user creation
grep "useradd\|usermod" /var/log/auth.log

# Privilege escalation
grep "su\b" /var/log/auth.log

python scripts/log_parser.py --input /var/log/auth.log --format json --output parsed.json
python scripts/log_parser.py --input events.evtx --normalize ecs --output normalized.json

// Brute force attack detection
index=windows EventCode=4625
| bin _time span=5m
| stats count as FailedLogins, values(Account_Name) as Accounts by src_ip, _time
| where FailedLogins > 20
| sort -FailedLogins

// Pass-the-Hash detection (Logon Type 3 with NTLM)
index=windows EventCode=4624 Logon_Type=3 Authentication_Package=NTLM
| where NOT (Account_Name="ANONYMOUS LOGON" OR Account_Name="*$")
| stats count by Account_Name, Workstation_Name, src_ip
| where count > 1

// Lateral movement via PsExec / admin shares
index=windows EventCode=5145
| where (ShareName="\\\\*\\ADMIN$" OR ShareName="\\\\*\\C$") 
    AND RelativeTargetName="*PSEXESVC*"
| table _time, SubjectUserName, IpAddress, ShareName

// PowerShell encoded command execution
index=windows (source="WinEventLog:Microsoft-Windows-PowerShell/Operational" EventCode=4104)
    OR (EventCode=4688 CommandLine="*powershell*")
| search CommandLine IN ("*-EncodedCommand*", "*-enc *", "*-e *", "*-nop*", 
                          "*DownloadString*", "*IEX*", "*Invoke-Expression*")
| table _time, ComputerName, User, CommandLine

// Scheduled task creation for persistence
index=windows EventCode=4698
| rex field=TaskContent "<Command>(?P<command>[^<]+)</Command>"
| where NOT match(command, "(?i)\\\\windows\\\\|\\\\microsoft\\\\|\\\\system32\\\\")
| table _time, ComputerName, SubjectUserName, TaskName, command

// LSASS memory access (credential dumping)
index=sysmon EventCode=10 TargetImage="*lsass.exe"
| where NOT (SourceImage IN 
    ("C:\\Windows\\System32\\*", "C:\\Windows\\SysWOW64\\*",
     "C:\\Program Files\\*", "C:\\Program Files (x86)\\*"))
| table _time, SourceImage, GrantedAccess, CallTrace

// DCSync detection
index=windows EventCode=4662 
    (ObjectType="*domainDNS*" OR ObjectType="*19195a5b-6da0-11d0-afd3-00c04fd930c9*")
    (Properties="*Replicating Directory Changes All*" OR Properties="*1131f6ad*")
| where NOT match(SubjectUserName, "(?i)^.*\$$") 
| table _time, SubjectUserName, SubjectDomainName, Properties

// Kerberoasting detection
index=windows EventCode=4769 Ticket_Encryption_Type=0x17
| where NOT (Account_Name="*$" OR Service_Name IN ("krbtgt", "kadmin/changepw"))
| stats count by Account_Name, Client_Address, Service_Name
| where count > 3

// Impossible Travel (logins from geographically impossible locations)
let TimeDelta = 2h;
SigninLogs
| where ResultType == 0  // Successful logins only
| where TimeGenerated > ago(7d)
| project UserPrincipalName, Location, TimeGenerated, IPAddress
| sort by UserPrincipalName asc, TimeGenerated asc
| serialize
| extend PreviousLogin = prev(TimeGenerated), PreviousLocation = prev(Location)
| where UserPrincipalName == prev(UserPrincipalName)
| extend TimeDiff = TimeGenerated - PreviousLogin
| where TimeDiff < TimeDelta and Location != PreviousLocation
| project UserPrincipalName, Location, PreviousLocation, TimeDiff, IPAddress

// Azure AD privilege escalation
AuditLogs
| where OperationName in ("Add member to role", "Add eligible member to role")
| extend TargetUser = tostring(TargetResources[0].userPrincipalName)
| extend RoleAdded = tostring(TargetResources[0].displayName)  
| where RoleAdded in ("Global Administrator", "Security Administrator", 
                       "Exchange Administrator", "SharePoint Administrator")
| project TimeGenerated, TargetUser, RoleAdded, 
           InitiatedBy=tostring(InitiatedBy.user.userPrincipalName)

// Suspicious PowerShell activity
SecurityEvent
| where EventID == 4104
| where TimeGenerated > ago(24h)
| where ScriptBlockText has_any("IEX", "DownloadString", "EncodedCommand", 
                                  "WebClient", "Invoke-Expression", "bypass", "-nop")
| project TimeGenerated, Computer, Account, ScriptBlockText
| extend RiskScore = case(
    ScriptBlockText has "IEX" and ScriptBlockText has "DownloadString", 10,
    ScriptBlockText has "EncodedCommand", 7,
    ScriptBlockText has "bypass", 5, 3)
| where RiskScore >= 5
| order by RiskScore desc

// Detect fileless malware execution chain
sequence by host.name with maxspan=5m
  [process where event.type == "start" and
   process.name in ("outlook.exe", "winword.exe", "excel.exe")]
  [process where event.type == "start" and
   process.name in ("powershell.exe", "cmd.exe", "wscript.exe", "cscript.exe")]
  [network where network.direction == "egress" and
   not network.destination.ip in ("127.0.0.0/8", "10.0.0.0/8", "192.168.0.0/16")]

// Ransomware detection: mass file extension changes + shadow copy deletion
sequence by host.name with maxspan=30m
  [file where event.type == "creation" and
   file.extension in ("locked", "encrypted", "crypted", "enc", "readme")]
  [file where event.type == "creation" and
   file.name in ("README.txt", "DECRYPT.txt", "HOW_TO_DECRYPT.txt")]
  [process where event.type == "start" and
   process.command_line : "* delete shadows *"]

# Claude's approach to analyzing log data for anomalies:
import pandas as pd
from datetime import timedelta

# 1. Volume anomalies
# Calculate rolling average, flag if current > mean + 3*stddev

# 2. Time-based anomalies (off-hours activity)
# Business hours: Mon-Fri 08:00-18:00 local time
# Flag: admin activities on weekends, logins at 03:00 UTC

# 3. Never-before-seen entities
# - New admin account created
# - First-time login from country
# - New process never seen before
# - New domain in DNS queries

# 4. Impossible travel
# Calculate geographic distance / time delta
# Flag if impossible to travel physically in the time window

python scripts/anomaly_detector.py --logs parsed.json --baseline baseline.json --output anomalies.json

title: Credential Dumping via Procdump
id: e5eb5a27-4a98-4c34-8b39-1fbe552d2aa4
status: stable
description: Detects the use of ProcDump to dump LSASS memory for credential theft
author: SOC Analyst
date: 2025/05/28
references:
  - https://attack.mitre.org/techniques/T1003/001/
  - https://docs.microsoft.com/en-us/sysinternals/downloads/procdump
tags:
  - attack.credential_access
  - attack.t1003.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_tool:
    Image|endswith:
      - '\procdump.exe'
      - '\procdump64.exe'
  selection_lsass:
    CommandLine|contains:
      - 'lsass'
      - '-ma 4'      # PID 4 = System, sometimes used
  selection_flags:
    CommandLine|contains|all:
      - '-accepteula'
      - '-ma'
  condition: selection_tool and (selection_lsass or selection_flags)
falsepositives:
  - Legitimate use by administrators for debugging (rare, should be investigated)
level: high

# Install sigma-cli
pip install sigma-cli

# Convert to Splunk SPL
sigma convert -t splunk -p splunk_windows sigma_rule.yml

# Convert to Elastic KQL
sigma convert -t elasticsearch -p ecs_windows sigma_rule.yml

# Convert to Microsoft Sentinel KQL  
sigma convert -t kusto sigma_rule.yml

## Correlation Rule: Brute Force → Successful Login → Lateral Movement

**Trigger:** 
  Event 1: 4625 (Failed Login) × 20+ in 5 minutes (same source IP)
  THEN Event 2: 4624 (Successful Login) from same source IP within 10 minutes
  THEN Event 3: 5145 (Admin Share Access) from same host within 30 minutes

**Logic:**

**Splunk Correlation (corr_rule.conf):**

**Suppression & De-duplication:**
- Suppress same correlation alert from same source IP for 1 hour after first fire
- Exclude known vulnerability scanners (add scanner IP ranges to exception list)
- Exclude service accounts with documented scheduled tasks

---

## Log Source Health Monitoring

**When the user asks about log source health:**

---

## Script Reference

### `log_parser.py`

### `anomaly_detector.py`

---

## Skill Integration

| Condition | Adjacent Skill |
|-----------|---------------|
| Anomaly found → escalate to SOC | → Skill 11 (CSOC Automation) |
| Anomaly is a hunt lead | → Skill 06 (Threat Hunting) |
| Build timeline from logs for IR | → Skill 07 (Incident Response) |
| Create detection rules from findings | → Skill 15 (Blue Team Defense) |

---

## References

- [Splunk SPL Reference](https://docs.splunk.com/Documentation/Splunk/latest/SearchReference)
- [Elastic EQL Documentation](https://www.elastic.co/guide/en/elasticsearch/reference/current/eql.html)
- [Microsoft Sentinel KQL](https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/)
- [Sigma Rules HQ Repository](https://github.com/SigmaHQ/sigma)
- [Windows Security Audit Policy](https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/)
- [OCSF Schema](https://schema.ocsf.io/)
- [SANS Windows Logging Cheat Sheet](https://www.malwarearchaeology.com/cheat-sheets)


---

## v3.0 Enhancements (2026 Update)

**Normalized, testable detection content:**

- **OCSF / ECS normalization** — map sources to the Open Cybersecurity Schema Framework (or Elastic Common Schema) so one detection works across feeds; state the schema in each rule.
- **Sigma correlation rules** — use Sigma's correlation extension (count/temporal/value-count) for multi-event detections (e.g., brute force → success, low-and-slow exfil), not just single-event matches.
- **Detection-as-code CI** — every rule has unit tests with positive/negative sample events; rules are linted and converted per-backend (`sigma convert`) in CI before deployment.
- **UEBA & identity analytics** — baseline per-user/host behavior; alert on deviation (new admin action, abnormal data volume, impossible travel) rather than fixed thresholds.
- **Platform currency** — examples for Splunk (`tstats`/data models), Microsoft Sentinel (KQL, ASIM functions), and Elastic (ES|QL/EQL).

**Precision rule:** each rule documents data source + schema, false-positive conditions, ATT&CK mapping, and a tested sample event.