Skip to content

Navigation Menu

Sign in
Sign up

Chainsaw v2 - Pre-Release #77

Locked
Discussion options

Hi All,

So I have finally found time to do the major work for Chainsaw v2. As I am not a responder I would really love for feedback from everyone so that we can tweak any assumptions I have incorrectly made. I would also like to add that due to the new internals making tweaks and changes is much easier so discuss away. By keeping this as alpha it allows us to make rapid breaking changes.

Current Alpha: 2.0.0-alpha.0

The changes are as follows:

Added

Modified

Removed

  • Removed CSV as it does not make sense for the output provided by Chainsaw (CSV Files not generated correctly #35 ). I am more than happy to add this back in if its a must.
  • Removed builtin detection.

TODO

Notable Changes

Arguments

The arguments now look like so:

chainsaw 2.0.0-alpha.0
Rapidly Search and Hunt through windows event logs
USAGE:
 chainsaw [FLAGS] <SUBCOMMAND>
FLAGS:
 -h, --help Prints help information
 --no-banner Hide Chainsaw's banner
 -V, --version Prints version information
SUBCOMMANDS:
 help Prints this message or the help of the given subcommand(s)
 hunt Hunt through event logs using detection rules and builtin logic
 lint Lint provided rules to ensure that they load correctly
 search Search through event logs for specific event IDs and/or keywords

chainsaw-hunt 2.0.0-alpha.0
Hunt through event logs using detection rules and builtin logic
USAGE:
 chainsaw hunt [FLAGS] [OPTIONS] <rules> [--] [path]...
FLAGS:
 --full Print the full values for the tabular output
 -h, --help Prints help information
 --json Print the output in json format
 --load-unknown Allow chainsaw to try and load files it cannot identify
 --local Output the timestamp using the local machine's timestamp
 --metadata Apply addional metadata for the tablar output
 -q Supress informational output
 --skip-errors Continue to hunt when an error is encountered
 -V, --version Prints version information
OPTIONS:
 --column-width <column-width> Set the column width for the tabular output
 --extension <extension> Only hunt through files with the provided extension
 --from <from> The timestamp to hunt from. Drops any documents older than the value provided
 -m, --mapping <mapping>... A mapping file to hunt with
 -o, --output <output> The file to output to
 -r, --rule <rule>... Additional rules to hunt with
 --timezone <timezone> Output the timestamp using the timezone provided
 --to <to> The timestamp to hunt up to. Drops any documents newer than the value provided
ARGS:
 <rules> The path to a collection of rules
 <path>... The paths to hunt through

chainsaw-lint 2.0.0-alpha.0
Lint provided rules to ensure that they load correctly
USAGE:
 chainsaw lint [OPTIONS] <path>
FLAGS:
 -h, --help Prints help information
 -V, --version Prints version information
OPTIONS:
 --kind <kind> The kind of rule to lint [default: chainsaw]
ARGS:
 <path> The path to a collection of rules

chainsaw-search 2.0.0-alpha.0
Search through event logs for specific event IDs and/or keywords
USAGE:
 chainsaw search [FLAGS] [OPTIONS] <pattern> [--] [path]...
FLAGS:
 -h, --help Prints help information
 -i, --ignore-case Ignore the case when searching patterns
 --json Print the output in json format
 --load-unknown Allow chainsaw to try and load files it cannot identify
 --local Output the timestamp using the local machine's timestamp
 -q Supress informational output
 --skip-errors Continue to search when an error is encountered
 -V, --version Prints version information
OPTIONS:
 --extension <extension> Only search through files with the provided extension
 --from <from> The timestamp to search from. Drops any documents older than the value provided
 -o, --output <output> The file to output to
 -e, --regexp <regexp>... A pattern to search for
 -t, --tau <tau>... Tau expressions to search with
 --timestamp <timestamp> The field that contains the timestamp
 --timezone <timezone> Output the timestamp using the timezone provided
 --to <to> The timestamp to search up to. Drops any documents newer than the value provided
ARGS:
 <pattern> A pattern to search for
 <path>... The paths to search through

Output

Tabluar with metadata

[+] Group: Suspicious Scheduled Task Created
┌──────────────────────────────────┬─────────────────────────────────────────────────────────────────────────────┬─────────┬──────────────────────────────┬──────────────────────────────────────────┬───────────────┐
│ timestamp │ detections │ EventID │ Computer │ CommandLine │ UserName │
├──────────────────────────────────┼─────────────────────────────────────────────────────────────────────────────┼─────────┼──────────────────────────────┼──────────────────────────────────────────┼───────────────┤
│ 2019年03月19日T00:02:04.319945+00:00 │ +---------------------------------------+----------+-------+--------------+ │ 4698 │ WIN-77LTAPHIQ1R.example.corp │ <?xml version="1.0" encoding="UTF-16"?>< │ Administrator │
│ │ | name | authors | level | status | │ │ │ Task version="1.2" xmlns="http://schemas │ │
│ │ +---------------------------------------+----------+-------+--------------+ │ │ │ .microsoft.com/windows/2004/02/mit/task" │ │
│ │ | Suspicious Tasklist Discovery Command | frack113 | low | experimental | │ │ │ > <Triggers> <CalendarTrigger> <Start │ │
│ │ +---------------------------------------+----------+-------+--------------+ │ │ │ Boundary>2015年07月15日T20:35:13.2757294</St │ │
│ │ │ │ │ artBoundary> <Enabled>true</Enabled> │ │
│ │ │ │ │ <ScheduleByDay> <DaysInterval>1</Day │ │
│ │ │ │ │ sInterval> </ScheduleByDay> </Calenda │ │
│ │ │ │ │ rTrigger> </Triggers> <Principals> <Pri │ │
│ │ │ │ │ ncipal id="LocalSystem"> <UserId>S-1-5 │ │
│ │ │ │ │ -18</UserId> <RunLevel>HighestAvailabl │ │
│ │ │ │ │ e</RunLevel> <LogonType>InteractiveTok │ │
│ │ │ │ │ en</LogonType> </Principal> </Principal │ │
│ │ │ │ │ s> <Settings> <MultipleInstancesPolicy> │ │
│ │ │ │ │ IgnoreNew</MultipleInstancesPolicy> <Di │ │
│ │ │ │ │ sallowStartIfOnBatteries>false</Disallow │ │
│ │ │ │ │ StartIfOnBatteries> <StopIfGoingOnBatte │ │
│ │ │ │ │ ries>false</StopIfGoingOnBatteries> <Al │ │
│ │ │ │ │ lowHardTerminate>true</AllowHardTerminat │ │
│ │ │ │ │ e> <RunOnlyIfNetworkAvailable>false</Ru │ │
│ │ │ │ │ nOnlyIfNetworkAvailable> <IdleSettings> │ │
│ │ │ │ │ <StopOnIdleEnd>true</StopOnIdleEnd> │ │
│ │ │ │ │ <RestartOnIdle>false</RestartOnIdle> < │ │
│ │ │ │ │ /IdleSettings> <AllowStartOnDemand>true │ │
│ │ │ │ │ </AllowStartOnDe... │ │
│ │ │ │ │ │ │
│ │ │ │ │ (use --full to show all content) │ │
├──────────────────────────────────┼─────────────────────────────────────────────────────────────────────────────┼─────────┼──────────────────────────────┼──────────────────────────────────────────┼───────────────┤
│ 2019年03月19日T00:02:04.319945+00:00 │ +---------------------------------------+----------+-------+--------------+ │ 4698 │ WIN-77LTAPHIQ1R.example.corp │ <?xml version="1.0" encoding="UTF-16"?>< │ Administrator │
│ │ | name | authors | level | status | │ │ │ Task version="1.2" xmlns="http://schemas │ │
│ │ +---------------------------------------+----------+-------+--------------+ │ │ │ .microsoft.com/windows/2004/02/mit/task" │ │
│ │ | Suspicious Tasklist Discovery Command | frack113 | low | experimental | │ │ │ > <Triggers> <CalendarTrigger> <Start │ │
│ │ +---------------------------------------+----------+-------+--------------+ │ │ │ Boundary>2015年07月15日T20:35:13.2757294</St │ │
│ │ │ │ │ artBoundary> <Enabled>true</Enabled> │ │
│ │ │ │ │ <ScheduleByDay> <DaysInterval>1</Day │ │
│ │ │ │ │ sInterval> </ScheduleByDay> </Calenda │ │
│ │ │ │ │ rTrigger> </Triggers> <Principals> <Pri │ │
│ │ │ │ │ ncipal id="LocalSystem"> <UserId>S-1-5 │ │
│ │ │ │ │ -18</UserId> <RunLevel>HighestAvailabl │ │
│ │ │ │ │ e</RunLevel> <LogonType>InteractiveTok │ │
│ │ │ │ │ en</LogonType> </Principal> </Principal │ │
│ │ │ │ │ s> <Settings> <MultipleInstancesPolicy> │ │
│ │ │ │ │ IgnoreNew</MultipleInstancesPolicy> <Di │ │
│ │ │ │ │ sallowStartIfOnBatteries>false</Disallow │ │
│ │ │ │ │ StartIfOnBatteries> <StopIfGoingOnBatte │ │
│ │ │ │ │ ries>false</StopIfGoingOnBatteries> <Al │ │
│ │ │ │ │ lowHardTerminate>true</AllowHardTerminat │ │
│ │ │ │ │ e> <RunOnlyIfNetworkAvailable>false</Ru │ │
│ │ │ │ │ nOnlyIfNetworkAvailable> <IdleSettings> │ │
│ │ │ │ │ <StopOnIdleEnd>true</StopOnIdleEnd> │ │
│ │ │ │ │ <RestartOnIdle>false</RestartOnIdle> < │ │
│ │ │ │ │ /IdleSettings> <AllowStartOnDemand>true │ │
│ │ │ │ │ </AllowStartOnDe... │ │
│ │ │ │ │ │ │
│ │ │ │ │ (use --full to show all content) │ │
└──────────────────────────────────┴─────────────────────────────────────────────────────────────────────────────┴─────────┴──────────────────────────────┴──────────────────────────────────────────┴───────────────┘

JSON

[
 {
 "authors": [
 "Daniil Yugoslavskiy",
 "oscd.community"
 ],
 "group": "Suspicious Command Line",
 "kind": "individual",
 "document": {
 "kind": "evtx",
 "data": {
 "Event": {
 "EventData": {
 "CommandLine": "",
 "NewProcessId": "0xcfc",
 "NewProcessName": "C:\\Users\\user01\\Desktop\\plink.exe",
 "ProcessId": "0xe60",
 "SubjectDomainName": "EXAMPLE",
 "SubjectLogonId": "0x2ed80",
 "SubjectUserName": "user01",
 "SubjectUserSid": "S-1-5-21-1587066498-1489273250-1035260531-1106",
 "TokenElevationType": "%%1936"
 },
 "System": {
 "Channel": "Security",
 "Computer": "PC01.example.corp",
 "Correlation": null,
 "EventID": 4688,
 "EventRecordID": 227714,
 "Execution_attributes": {
 "ProcessID": 4,
 "ThreadID": 56
 },
 "Keywords": "0x8020000000000000",
 "Level": 0,
 "Opcode": 0,
 "Provider_attributes": {
 "Guid": "54849625-5478-4994-A5BA-3E3B0328C30D",
 "Name": "Microsoft-Windows-Security-Auditing"
 },
 "Security": null,
 "Task": 13312,
 "TimeCreated_attributes": {
 "SystemTime": "2019-02-13T18:03:28.318440Z"
 },
 "Version": 1
 }
 },
 "Event_attributes": {
 "xmlns": "http://schemas.microsoft.com/win/2004/08/events/event"
 }
 }
 },
 "level": "medium",
 "name": "Exfiltration and Tunneling Tools Execution",
 "source": "sigma",
 "status": "test",
 "timestamp": "2019-02-13T18:03:28.318440+00:00"
 },
 {
 "authors": [
 "Daniil Yugoslavskiy",
 "oscd.community"
 ],
...

Tau

With the event_id field removed we can now use tau to provide the same functionality

./chainsaw search -t "Event.System.EventID: =1" -e Sysmon -e ScriptBlock /tmp/EVTX-ATTACK-SAMPLES
 ██████╗██╗ ██╗ █████╗ ██╗███╗ ██╗███████╗ █████╗ ██╗ ██╗
██╔════╝██║ ██║██╔══██╗██║████╗ ██║██╔════╝██╔══██╗██║ ██║
██║ ███████║███████║██║██╔██╗ ██║███████╗███████║██║ █╗ ██║
██║ ██╔══██║██╔══██║██║██║╚██╗██║╚════██║██╔══██║██║███╗██║
╚██████╗██║ ██║██║ ██║██║██║ ╚████║███████║██║ ██║╚███╔███╔╝
 ╚═════╝╚═╝ ╚═╝╚═╝ ╚═╝╚═╝╚═╝ ╚═══╝╚══════╝╚═╝ ╚═╝ ╚══╝╚══╝
 By F-Secure Countercept (@FranticTyping, @AlexKornitzer)
[+] Searching event logs...
---
Event:
 EventData:
 CommandLine: "plink.exe 10.0.2.18 -P 80 -C -R 127.0.0.3:4444:127.0.0.2:3389 -l test -pw test"
 Company: Simon Tatham
 CurrentDirectory: "C:\\Users\\IEUser\\Desktop\\"
 Description: "Command-line SSH, Telnet, and Rlogin client"
 FileVersion: Release 0.70
 Hashes: SHA1=7806AD24F669CD8BB9EBE16F87E90173047F8EE4
 Image: "C:\\Users\\IEUser\\Desktop\\plink.exe"
You must be logged in to vote

Replies: 6 comments 10 replies

Comment options

Most of us in incident response live in CSV output so losing CSV is very unfortunate. That also breaks the KAPE Module for Chainsaw, which I know a lot of people use - https://github.com/EricZimmerman/KapeFiles/blob/master/Modules/Apps/GitHub/Chainsaw.mkape

You must be logged in to vote
8 replies
Comment options

alexkornitzer Jun 2, 2022
Collaborator Author

Ah no worries its very easy to add back in, I assumed this might be the case. So on a whole are people happy with how csv worked in v1? As in it dumping multiple files into a folder?

Do people want it putting multiple detections in one row? For example in the json, detections are now broken out.
Comment options

I personally don't see anything needing to change with the CSVs. I liked how each of the detections were in their own appropriately named CSVs. That's just my $.02.
Comment options

I feel the same way Andrew does. The CSVs were completely fine the way they were in v1.
Comment options

alexkornitzer Jun 2, 2022
Collaborator Author

Thanks for the feedback everyone, super appreciate it can't wait for the rest when you have time to dig in. Anyways CSV is back with alpha.1. One change I have made (again we can revert it) is to join the rule name with ; instead of \n

./chainsaw hunt /tmp/sigma/rules -m ./mappings/sigma-event-logs.yml /tmp/EVTX-ATTACK-SAMPLES --csv -o /tmp/csv
 ██████╗██╗ ██╗ █████╗ ██╗███╗ ██╗███████╗ █████╗ ██╗ ██╗
██╔════╝██║ ██║██╔══██╗██║████╗ ██║██╔════╝██╔══██╗██║ ██║
██║ ███████║███████║██║██╔██╗ ██║███████╗███████║██║ █╗ ██║
██║ ██╔══██║██╔══██║██║██║╚██╗██║╚════██║██╔══██║██║███╗██║
╚██████╗██║ ██║██║ ██║██║██║ ╚████║███████║██║ ██║╚███╔███╔╝
 ╚═════╝╚═╝ ╚═╝╚═╝ ╚═╝╚═╝╚═╝ ╚═══╝╚══════╝╚═╝ ╚═╝ ╚══╝╚══╝
 By F-Secure Countercept (@FranticTyping, @AlexKornitzer)
[+] Loading rules...
[+] Loaded 1441 detection rules (509 were not loaded)
[+] Hunting: [========================================] 277/277
[+] Created suspicious_command_line.csv
[+] Created suspicious_file_creation.csv
[+] Created suspicious_image_load.csv
[+] Created suspicious_network_connection.csv
[+] Created suspicious_powershell_scriptblock.csv
[+] Created suspicious_process_creation.csv
[+] Created suspicious_registry_event.csv
[+] Created suspicious_scheduled_task_created.csv
[+] 1374 Detections found on 746 documents

timestamp,detections,EventID,Computer,Image,CommandLine
2019年02月16日T10:02:21.934438+00:00,Exfiltration and Tunneling Tools Execution;Process Start From Suspicious Folder,1,PC01.example.corp,C:\Users\IEUser\Desktop\plink.exe,plink.exe 10.0.2.18 -P 80 -C -R 127.0.0.3:4444:127.0.0.2:3389 -l test -pw test
2019年02月16日T10:04:04.141404+00:00,Space After Filename - macOS,1,PC01.example.corp,C:\Windows\System32\smss.exe,\SystemRoot\System32\smss.exe 00000000 0000003c
2019年02月16日T10:04:04.892484+00:00,Space After Filename - macOS,1,PC01.example.corp,C:\Windows\System32\smss.exe,\SystemRoot\System32\smss.exe 00000000 0000003c
2019年03月17日T20:17:52.949107+00:00,Space After Filename - macOS,1,PC04.example.corp,C:\Windows\System32\cmd.exe,"""C:\Windows\System32\cmd.exe"" /C ""C:\Users\IEUser\Desktop\RDPWrap-v1.6.2\install.bat"" "
2019年03月17日T20:17:52.979150+00:00,Process Start From Suspicious Folder,1,PC04.example.corp,C:\Users\IEUser\Desktop\RDPWrap-v1.6.2\RDPWInst.exe,"""C:\Users\IEUser\Desktop\RDPWrap-v1.6.2\RDPWInst"" -i -o"
Comment options

Thank you so much @alexkornitzer and thanks for all your work on this tool. Really appreciate it!
Comment options

alexkornitzer
Jun 4, 2022
Collaborator Author

Hey all,

So alpha.2 adds builtins back in, but in the form of Chainsaw rules :O. There are still a few bits to iron out regarding internals and formatting, but I have designed these rules to run without the need for a mapping. Its hard to know how viable these will be due to potential group field conflicts, but lets see how the mileage goes :)

ls -laR rules
total 0
drwxr-xr-x 8 alex staff 256 4 Jun 19:58 .
drwxr-xr-x 16 alex staff 512 4 Jun 20:04 ..
drwxr-xr-x 6 alex staff 192 4 Jun 20:03 account_tampering
drwxr-xr-x 6 alex staff 192 4 Jun 20:03 antivirus
drwxr-xr-x 8 alex staff 256 4 Jun 20:03 lateral_movement
drwxr-xr-x 4 alex staff 128 4 Jun 20:02 log_tampering
drwxr-xr-x 3 alex staff 96 4 Jun 20:04 login_attacks
drwxr-xr-x 3 alex staff 96 4 Jun 20:03 service_tampering
rules/account_tampering:
total 32
drwxr-xr-x 6 alex staff 192 4 Jun 20:03 .
drwxr-xr-x 8 alex staff 256 4 Jun 19:58 ..
-rw-r--r-- 1 alex staff 501 4 Jun 20:03 new_user_created.yml
-rw-r--r-- 1 alex staff 669 4 Jun 20:02 user_added_to_global_group.yml
-rw-r--r-- 1 alex staff 666 4 Jun 20:02 user_added_to_local_group.yml
-rw-r--r-- 1 alex staff 674 4 Jun 20:02 user_added_to_universal_group.yml
rules/antivirus:
total 32
drwxr-xr-x 6 alex staff 192 4 Jun 20:03 .
drwxr-xr-x 8 alex staff 256 4 Jun 19:58 ..
-rw-r--r-- 1 alex staff 790 4 Jun 20:03 f-secure.yml
-rw-r--r-- 1 alex staff 564 4 Jun 20:03 kaspersky.yml
-rw-r--r-- 1 alex staff 578 4 Jun 20:03 sophos.yml
-rw-r--r-- 1 alex staff 586 4 Jun 20:03 windows_defender.yml
rules/lateral_movement:
total 48
drwxr-xr-x 8 alex staff 256 4 Jun 20:03 .
drwxr-xr-x 8 alex staff 256 4 Jun 19:58 ..
-rw-r--r-- 1 alex staff 807 4 Jun 20:03 batch_logon.yml
-rw-r--r-- 1 alex staff 831 4 Jun 20:03 interactive_logon.yml
-rw-r--r-- 1 alex staff 814 4 Jun 20:03 network_logon.yml
-rw-r--r-- 1 alex staff 800 4 Jun 20:03 rdp_logon.yml
-rw-r--r-- 1 alex staff 814 4 Jun 20:03 service_logon.yml
-rw-r--r-- 1 alex staff 775 4 Jun 20:03 unlock_logon.yml
rules/log_tampering:
total 16
drwxr-xr-x 4 alex staff 128 4 Jun 20:02 .
drwxr-xr-x 8 alex staff 256 4 Jun 19:58 ..
-rw-r--r-- 1 alex staff 619 4 Jun 20:02 security_audit_log_was_cleared.yml
-rw-r--r-- 1 alex staff 598 4 Jun 20:02 system_log_was_cleared.yml
rules/login_attacks:
total 8
drwxr-xr-x 3 alex staff 96 4 Jun 20:04 .
drwxr-xr-x 8 alex staff 256 4 Jun 19:58 ..
-rw-r--r-- 1 alex staff 612 4 Jun 20:02 account_brute_force.yml
rules/service_tampering:
total 8
drwxr-xr-x 3 alex staff 96 4 Jun 20:03 .
drwxr-xr-x 8 alex staff 256 4 Jun 19:58 ..
-rw-r--r-- 1 alex staff 608 4 Jun 20:03 event_log.yml

---
title: Account Brute Force
group: Login Attacks
description: An account that appears to have been brute forced.
authors:
 - FranticTyping
kind: evtx
level: info
status: stable
timestamp: Event.System.TimeCreated
fields:
 - name: Event ID
 to: Event.System.EventID
 - name: Record ID
 to: Event.System.EventRecordID
 - name: User
 to: Event.EventData.TargetUserName
filter:
 condition: failed_logons and not empty
 failed_logons:
 Event.System.EventID: 4625
 empty:
 Event.EventData.TargetUserName: 'null'
aggregate:
 count: '>5'
 fields:
 - Event.EventData.TargetUserName

./chainsaw hunt ./rules /tmp/EVTX-ATTACK-SAMPLES
 ██████╗██╗ ██╗ █████╗ ██╗███╗ ██╗███████╗ █████╗ ██╗ ██╗
██╔════╝██║ ██║██╔══██╗██║████╗ ██║██╔════╝██╔══██╗██║ ██║
██║ ███████║███████║██║██╔██╗ ██║███████╗███████║██║ █╗ ██║
██║ ██╔══██║██╔══██║██║██║╚██╗██║╚════██║██╔══██║██║███╗██║
╚██████╗██║ ██║██║ ██║██║██║ ╚████║███████║██║ ██║╚███╔███╔╝
 ╚═════╝╚═╝ ╚═╝╚═╝ ╚═╝╚═╝╚═╝ ╚═══╝╚══════╝╚═╝ ╚═╝ ╚══╝╚══╝
 By F-Secure Countercept (@FranticTyping, @AlexKornitzer)
[+] Loading rules...
[+] Loaded 18 detection rules
[+] Hunting: [========================================] 341/341
[+] Group: Account Tampering
┌──────────────────────────────────┬─────────────────────────────┬──────────┬───────────┬─────────────────────────────────┬────────────────┬──────────────────────────────────────────┬──────────────────────────────────────────┐
│ timestamp │ detections │ Event ID │ Record ID │ Computer │ User │ User SID │ Member SID │
├──────────────────────────────────┼─────────────────────────────┼──────────┼───────────┼─────────────────────────────────┼────────────────┼──────────────────────────────────────────┼──────────────────────────────────────────┤
│ 2019年09月22日T11:22:05.201727+00:00 │ ‣ User Added to Local Group │ 4732 │ 191029 │ MSEDGEWIN10 │ Administrators │ │ S-1-5-21-3461203602-4096304019-226908006 │
│ │ │ │ │ │ │ │ 9-501 │
├──────────────────────────────────┼─────────────────────────────┼──────────┼───────────┼─────────────────────────────────┼────────────────┼──────────────────────────────────────────┼──────────────────────────────────────────┤
│ 2019年09月22日T11:23:19.251925+00:00 │ ‣ User Added to Local Group │ 4732 │ 191030 │ MSEDGEWIN10 │ Administrators │ │ S-1-5-20 │
├──────────────────────────────────┼─────────────────────────────┼──────────┼───────────┼─────────────────────────────────┼────────────────┼──────────────────────────────────────────┼──────────────────────────────────────────┤
│ 2020年09月16日T09:31:19.133272+00:00 │ ‣ New User Created │ 4720 │ 769629 │ 01566s-win16-ir.threebeesco.com │ $ │ S-1-5-21-308926384-506822093-3341789130- │ │
│ │ │ │ │ │ │ 107103 │ │
├──────────────────────────────────┼─────────────────────────────┼──────────┼───────────┼─────────────────────────────────┼────────────────┼──────────────────────────────────────────┼──────────────────────────────────────────┤
│ 2020年09月16日T09:32:13.647155+00:00 │ ‣ New User Created │ 4720 │ 769634 │ 01566s-win16-ir.threebeesco.com │ $ │ S-1-5-21-308926384-506822093-3341789130- │ │
│ │ │ │ │ │ │ 107104 │ │
└──────────────────────────────────┴─────────────────────────────┴──────────┴───────────┴─────────────────────────────────┴────────────────┴──────────────────────────────────────────┴──────────────────────────────────────────┘
[+] Group: Antivirus
┌──────────────────────────────────┬────────────────────┬──────────┬───────────┬─────────────┬─────────────────────────────────┬──────────────────────────────────────────┬─────────────┬────────────────────┐
│ timestamp │ detections │ Event ID │ Record ID │ Computer │ Threat Name │ Threat Path │ Threat Type │ User │
├──────────────────────────────────┼────────────────────┼──────────┼───────────┼─────────────┼─────────────────────────────────┼──────────────────────────────────────────┼─────────────┼────────────────────┤
│ 2019年07月18日T20:40:00.730676+00:00 │ ‣ Windows Defender │ 1116 │ 37 │ MSEDGEWIN10 │ Trojan:PowerShell/Powersploit.M │ file:_C:\AtomicRedTeam\atomic-red-team-m │ │ MSEDGEWIN10\IEUser │
│ │ │ │ │ │ │ aster\atomics\T1056\Get-Keystrokes.ps1 │ │ │
├──────────────────────────────────┼────────────────────┼──────────┼───────────┼─────────────┼─────────────────────────────────┼──────────────────────────────────────────┼─────────────┼────────────────────┤
│ 2019年07月18日T20:40:16.396422+00:00 │ ‣ Windows Defender │ 1116 │ 48 │ MSEDGEWIN10 │ Trojan:XML/Exeselrun.gen!A │ file:_C:\AtomicRedTeam\atomic-red-team-m │ │ MSEDGEWIN10\IEUser │
│ │ │ │ │ │ │ aster\atomics\T1086\payloads\test.xsl │ │ │
├──────────────────────────────────┼────────────────────┼──────────┼───────────┼─────────────┼─────────────────────────────────┼──────────────────────────────────────────┼─────────────┼────────────────────┤
│ 2019年07月18日T20:41:16.418508+00:00 │ ‣ Windows Defender │ 1116 │ 75 │ MSEDGEWIN10 │ HackTool:JS/Jsprat │ file:_C:\AtomicRedTeam\atomic-red-team-m │ │ MSEDGEWIN10\IEUser │
│ │ │ │ │ │ │ aster\atomics\T1100\shells\b.jsp->(SCRIP │ │ │
│ │ │ │ │ │ │ T0005) │ │ │
├──────────────────────────────────┼────────────────────┼──────────┼───────────┼─────────────┼─────────────────────────────────┼──────────────────────────────────────────┼─────────────┼────────────────────┤
│ 2019年07月18日T20:41:17.508276+00:00 │ ‣ Windows Defender │ 1116 │ 76 │ MSEDGEWIN10 │ Backdoor:ASP/Ace.T │ file:_C:\AtomicRedTeam\atomic-red-team-m │ │ MSEDGEWIN10\IEUser │
│ │ │ │ │ │ │ aster\atomics\T1100\shells\cmd.aspx │ │ │
├──────────────────────────────────┼────────────────────┼──────────┼───────────┼─────────────┼─────────────────────────────────┼──────────────────────────────────────────┼─────────────┼────────────────────┤
│ 2019年07月18日T20:41:48.236136+00:00 │ ‣ Windows Defender │ 1116 │ 95 │ MSEDGEWIN10 │ Trojan:Win32/Sehyioa.A!cl │ file:_C:\AtomicRedTeam\atomic-red-team-m │ │ MSEDGEWIN10\IEUser │
│ │ │ │ │ │ │ aster\atomics\T1218\src\Win32\T1218-2.dl │ │ │
│ │ │ │ │ │ │ l │ │ │
├──────────────────────────────────┼────────────────────┼──────────┼───────────┼─────────────┼─────────────────────────────────┼──────────────────────────────────────────┼─────────────┼────────────────────┤
│ 2019年07月18日T20:51:50.275470+00:00 │ ‣ Windows Defender │ 1117 │ 101 │ MSEDGEWIN10 │ Trojan:PowerShell/Powersploit.M │ file:_C:\AtomicRedTeam\atomic-red-team-m │ │ MSEDGEWIN10\IEUser │
│ │ │ │ │ │ │ aster\atomics\T1056\Get-Keystrokes.ps1 │ │ │
├──────────────────────────────────┼────────────────────┼──────────┼───────────┼─────────────┼─────────────────────────────────┼──────────────────────────────────────────┼─────────────┼────────────────────┤
│ 2019年07月18日T20:51:50.798994+00:00 │ ‣ Windows Defender │ 1116 │ 102 │ MSEDGEWIN10 │ HackTool:JS/Jsprat │ containerfile:_C:\AtomicRedTeam\atomic-r │ │ MSEDGEWIN10\IEUser │
│ │ │ │ │ │ │ ed-team-master\atomics\T1100\shells\b.js │ │ │
│ │ │ │ │ │ │ p; file:_C:\AtomicRedTeam\atomic-red-tea │ │ │
│ │ │ │ │ │ │ m-master\atomics\T1100\shells\b.jsp->(SC │ │ │
│ │ │ │ │ │ │ RIPT0005); file:_C:\AtomicRedTeam\atomic │ │ │
│ │ │ │ │ │ │ -red-team-master\atomics\T1100\shells\b. │ │ │
│ │ │ │ │ │ │ jsp->(SCRIPT0037); file:_C:\AtomicRedTea │ │ │
│ │ │ │ │ │ │ m\atomic-red-team-master\atomics\T1100\s │ │ │
│ │ │ │ │ │ │ hells\b.jsp->(SCRIPT0045); file:_C:\Atom │ │ │
│ │ │ │ │ │ │ icRedTeam\atomic-red-team-master\atomics │ │ │
│ │ │ │ │ │ │ \T1100\shells\b.jsp->(SCRIPT0065); file: │ │ │
│ │ │ │ │ │ │ _C:\AtomicRedTeam\atomic-red-team-master │ │ │
│ │ │ │ │ │ │ \atomics\T1100\shells\b.jsp->(SCRIPT0068 │ │ │
│ │ │ │ │ │ │ ) │ │ │
├──────────────────────────────────┼────────────────────┼──────────┼───────────┼─────────────┼─────────────────────────────────┼──────────────────────────────────────────┼─────────────┼────────────────────┤
│ 2019年07月18日T20:53:31.900809+00:00 │ ‣ Windows Defender │ 1117 │ 103 │ MSEDGEWIN10 │ Backdoor:ASP/Ace.T │ file:_C:\AtomicRedTeam\atomic-red-team-m │ │ MSEDGEWIN10\IEUser │
│ │ │ │ │ │ │ aster\atomics\T1100\shells\cmd.aspx │ │ │
├──────────────────────────────────┼────────────────────┼──────────┼───────────┼─────────────┼─────────────────────────────────┼──────────────────────────────────────────┼─────────────┼────────────────────┤
│ 2019年07月18日T20:53:31.902610+00:00 │ ‣ Windows Defender │ 1117 │ 104 │ MSEDGEWIN10 │ Trojan:Win32/Sehyioa.A!cl │ file:_C:\AtomicRedTeam\atomic-red-team-m │ │ MSEDGEWIN10\IEUser │
│ │ │ │ │ │ │ aster\atomics\T1218\src\Win32\T1218-2.dl │ │ │
│ │ │ │ │ │ │ l │ │ │
├──────────────────────────────────┼────────────────────┼──────────┼───────────┼─────────────┼─────────────────────────────────┼──────────────────────────────────────────┼─────────────┼────────────────────┤
│ 2019年07月18日T20:53:31.905406+00:00 │ ‣ Windows Defender │ 1117 │ 105 │ MSEDGEWIN10 │ HackTool:JS/Jsprat │ containerfile:_C:\AtomicRedTeam\atomic-r │ │ MSEDGEWIN10\IEUser │
│ │ │ │ │ │ │ ed-team-master\atomics\T1100\shells\b.js │ │ │
│ │ │ │ │ │ │ p; file:_C:\AtomicRedTeam\atomic-red-tea │ │ │
│ │ │ │ │ │ │ m-master\atomics\T1100\shells\b.jsp->(SC │ │ │
│ │ │ │ │ │ │ RIPT0005); file:_C:\AtomicRedTeam\atomic │ │ │
│ │ │ │ │ │ │ -red-team-master\atomics\T1100\shells\b. │ │ │
│ │ │ │ │ │ │ jsp->(SCRIPT0037); file:_C:\AtomicRedTea │ │ │
│ │ │ │ │ │ │ m\atomic-red-team-master\atomics\T1100\s │ │ │
│ │ │ │ │ │ │ hells\b.jsp->(SCRIPT0045); file:_C:\Atom │ │ │
│ │ │ │ │ │ │ icRedTeam\atomic-red-team-master\atomics │ │ │
│ │ │ │ │ │ │ \T1100\shells\b.jsp->(SCRIPT0065); file: │ │ │
│ │ │ │ │ │ │ _C:\AtomicRedTeam\atomic-red-team-master │ │ │
│ │ │ │ │ │ │ \atomics\T1100\shells\b.jsp->(SCRIPT0068 │ │ │
│ │ │ │ │ │ │ ) │ │ │
├──────────────────────────────────┼────────────────────┼──────────┼───────────┼─────────────┼─────────────────────────────────┼──────────────────────────────────────────┼─────────────┼────────────────────┤
│ 2019年07月18日T20:53:31.952568+00:00 │ ‣ Windows Defender │ 1117 │ 106 │ MSEDGEWIN10 │ Trojan:XML/Exeselrun.gen!A │ file:_C:\AtomicRedTeam\atomic-red-team-m │ │ MSEDGEWIN10\IEUser │
│ │ │ │ │ │ │ aster\atomics\T1086\payloads\test.xsl │ │ │
└──────────────────────────────────┴────────────────────┴──────────┴───────────┴─────────────┴─────────────────────────────────┴──────────────────────────────────────────┴─────────────┴────────────────────┘
[+] Group: Lateral Movement
┌──────────────────────────────────┬─────────────────┬──────────┬───────────┬─────────────────────────────────┬──────────────────┬────────────┬───────────────────────────┐
│ timestamp │ detections │ Event ID │ Record ID │ Computer │ User │ Logon Type │ IP Address │
├──────────────────────────────────┼─────────────────┼──────────┼───────────┼─────────────────────────────────┼──────────────────┼────────────┼───────────────────────────┤
│ 2019年02月02日T09:17:22.563018+00:00 │ ‣ Network Logon │ 4624 │ 65969 │ ICORP-DC.internal.corp │ EXCHANGE$ │ 3 │ 192.168.111.87 │
├──────────────────────────────────┼─────────────────┼──────────┼───────────┼─────────────────────────────────┼──────────────────┼────────────┼───────────────────────────┤
│ 2019年02月13日T15:31:19.529518+00:00 │ ‣ Network Logon │ 4624 │ 5322 │ PC02.example.corp │ ANONYMOUS LOGON │ 3 │ 10.0.2.17 │
├──────────────────────────────────┼─────────────────┼──────────┼───────────┼─────────────────────────────────┼──────────────────┼────────────┼───────────────────────────┤
│ 2019年02月13日T15:31:31.556812+00:00 │ ‣ Network Logon │ 4624 │ 5323 │ PC02.example.corp │ ANONYMOUS LOGON │ 3 │ 10.0.2.17 │
├──────────────────────────────────┼─────────────────┼──────────┼───────────┼─────────────────────────────────┼──────────────────┼────────────┼───────────────────────────┤
│ 2019年03月18日T22:15:36.036376+00:00 │ ‣ Network Logon │ 4624 │ 563265 │ WIN-77LTAPHIQ1R.example.corp │ WIN-77LTAPHIQ1R$ │ 3 │ fe80::79bf:8ee2:433c:2567 │
├──────────────────────────────────┼─────────────────┼──────────┼───────────┼─────────────────────────────────┼──────────────────┼────────────┼───────────────────────────┤
│ 2019年03月18日T22:15:49.583102+00:00 │ ‣ Network Logon │ 4624 │ 563285 │ WIN-77LTAPHIQ1R.example.corp │ Administrator │ 3 │ 10.0.2.17 │
├──────────────────────────────────┼─────────────────┼──────────┼───────────┼─────────────────────────────────┼──────────────────┼────────────┼───────────────────────────┤
│ 2019年03月18日T22:15:49.614293+00:00 │ ‣ Network Logon │ 4624 │ 563294 │ WIN-77LTAPHIQ1R.example.corp │ Administrator │ 3 │ 10.0.2.17 │
├──────────────────────────────────┼─────────────────┼──────────┼───────────┼─────────────────────────────────┼──────────────────┼────────────┼───────────────────────────┤
│ 2019年03月18日T22:15:49.614293+00:00 │ ‣ Network Logon │ 4624 │ 563297 │ WIN-77LTAPHIQ1R.example.corp │ Administrator │ 3 │ 10.0.2.17 │
├──────────────────────────────────┼─────────────────┼──────────┼───────────┼─────────────────────────────────┼──────────────────┼────────────┼───────────────────────────┤
│ 2019年03月18日T22:15:49.692401+00:00 │ ‣ Network Logon │ 4624 │ 563300 │ WIN-77LTAPHIQ1R.example.corp │ user01 │ 3 │ 10.0.2.17 │
├──────────────────────────────────┼─────────────────┼──────────┼───────────┼─────────────────────────────────┼──────────────────┼────────────┼───────────────────────────┤
│ 2019年03月18日T23:23:43.570212+00:00 │ ‣ Network Logon │ 4624 │ 565596 │ WIN-77LTAPHIQ1R.example.corp │ WIN-77LTAPHIQ1R$ │ 3 │ fe80::79bf:8ee2:433c:2567 │
├──────────────────────────────────┼─────────────────┼──────────┼───────────┼─────────────────────────────────┼──────────────────┼────────────┼───────────────────────────┤
│ 2019年03月18日T23:23:52.491923+00:00 │ ‣ Network Logon │ 4624 │ 565599 │ WIN-77LTAPHIQ1R.example.corp │ user01 │ 3 │ 10.0.2.17 │
├──────────────────────────────────┼─────────────────┼──────────┼───────────┼─────────────────────────────────┼──────────────────┼────────────┼───────────────────────────┤
│ 2019年03月18日T23:23:57.397648+00:00 │ ‣ Network Logon │ 4624 │ 565611 │ WIN-77LTAPHIQ1R.example.corp │ WIN-77LTAPHIQ1R$ │ 3 │ fe80::79bf:8ee2:433c:2567 │
├──────────────────────────────────┼─────────────────┼──────────┼───────────┼─────────────────────────────────┼──────────────────┼────────────┼───────────────────────────┤
│ 2019年03月19日T00:02:04.179623+00:00 │ ‣ Network Logon │ 4624 │ 566823 │ WIN-77LTAPHIQ1R.example.corp │ ANONYMOUS LOGON │ 3 │ 10.0.2.17 │
├──────────────────────────────────┼─────────────────┼──────────┼───────────┼─────────────────────────────────┼──────────────────┼────────────┼───────────────────────────┤
│ 2019年03月19日T00:02:04.210688+00:00 │ ‣ Network Logon │ 4624 │ 566826 │ WIN-77LTAPHIQ1R.example.corp │ Administrator │ 3 │ 10.0.2.17 │
├──────────────────────────────────┼─────────────────┼──────────┼───────────┼─────────────────────────────────┼──────────────────┼────────────┼───────────────────────────┤
│ 2019年03月19日T00:02:04.226251+00:00 │ ‣ Network Logon │ 4624 │ 566830 │ WIN-77LTAPHIQ1R.example.corp │ Administrator │ 3 │ 10.0.2.17 │
├──────────────────────────────────┼─────────────────┼──────────┼───────────┼─────────────────────────────────┼──────────────────┼────────────┼───────────────────────────┤
│ 2019年03月19日T00:02:21.929554+00:00 │ ‣ Network Logon │ 4624 │ 566894 │ WIN-77LTAPHIQ1R.example.corp │ WIN-77LTAPHIQ1R$ │ 3 │ fe80::79bf:8ee2:433c:2567 │
├──────────────────────────────────┼─────────────────┼──────────┼───────────┼─────────────────────────────────┼──────────────────┼────────────┼───────────────────────────┤
│ 2020年09月02日T11:47:48.570502+00:00 │ ‣ Network Logon │ 4624 │ 2171290 │ 01566s-win16-ir.threebeesco.com │ a-jbrown │ 3 │ 172.16.66.142 │
├──────────────────────────────────┼─────────────────┼──────────┼───────────┼─────────────────────────────────┼──────────────────┼────────────┼───────────────────────────┤
│ 2020年09月02日T11:47:48.823276+00:00 │ ‣ Network Logon │ 4624 │ 2171291 │ 01566s-win16-ir.threebeesco.com │ a-jbrown │ 3 │ 172.16.66.142 │
├──────────────────────────────────┼─────────────────┼──────────┼───────────┼─────────────────────────────────┼──────────────────┼────────────┼───────────────────────────┤
│ 2020年09月02日T11:47:48.842119+00:00 │ ‣ Network Logon │ 4624 │ 2171292 │ 01566s-win16-ir.threebeesco.com │ a-jbrown │ 3 │ 172.16.66.142 │
├──────────────────────────────────┼─────────────────┼──────────┼───────────┼─────────────────────────────────┼──────────────────┼────────────┼───────────────────────────┤
│ 2020年09月15日T19:29:51.507713+00:00 │ ‣ Network Logon │ 4624 │ 768620 │ 01566s-win16-ir.threebeesco.com │ ANONYMOUS LOGON │ 3 │ 172.16.66.37 │
├──────────────────────────────────┼─────────────────┼──────────┼───────────┼─────────────────────────────────┼──────────────────┼────────────┼───────────────────────────┤
│ 2020年09月15日T19:29:51.517594+00:00 │ ‣ Network Logon │ 4624 │ 768621 │ 01566s-win16-ir.threebeesco.com │ ANONYMOUS LOGON │ 3 │ 172.16.66.37 │
├──────────────────────────────────┼─────────────────┼──────────┼───────────┼─────────────────────────────────┼──────────────────┼────────────┼───────────────────────────┤
│ 2020年09月17日T10:57:44.270428+00:00 │ ‣ Network Logon │ 4624 │ 769794 │ 01566s-win16-ir.threebeesco.com │ Administrator │ 3 │ 172.16.66.37 │
├──────────────────────────────────┼─────────────────┼──────────┼───────────┼─────────────────────────────────┼──────────────────┼────────────┼───────────────────────────┤
│ 2020年09月23日T16:50:16.697736+00:00 │ ‣ Network Logon │ 4624 │ 772607 │ 01566s-win16-ir.threebeesco.com │ Administrator │ 3 │ 172.16.66.37 │
├──────────────────────────────────┼─────────────────┼──────────┼───────────┼─────────────────────────────────┼──────────────────┼────────────┼───────────────────────────┤
│ 2020年09月23日T16:50:17.194652+00:00 │ ‣ Network Logon │ 4624 │ 772611 │ 01566s-win16-ir.threebeesco.com │ Administrator │ 3 │ 172.16.66.37 │
├──────────────────────────────────┼─────────────────┼──────────┼───────────┼─────────────────────────────────┼──────────────────┼────────────┼───────────────────────────┤
│ 2021年12月12日T17:57:52.278193+00:00 │ ‣ Network Logon │ 4624 │ 2982084 │ 01566s-win16-ir.threebeesco.com │ lgrove │ 3 │ 172.16.66.19 │
├──────────────────────────────────┼─────────────────┼──────────┼───────────┼─────────────────────────────────┼──────────────────┼────────────┼───────────────────────────┤
│ 2021年12月12日T17:57:52.325837+00:00 │ ‣ Network Logon │ 4624 │ 2982089 │ 01566s-win16-ir.threebeesco.com │ lgrove │ 3 │ 172.16.66.19 │
├──────────────────────────────────┼─────────────────┼──────────┼───────────┼─────────────────────────────────┼──────────────────┼────────────┼───────────────────────────┤
│ 2021年12月12日T17:57:52.372001+00:00 │ ‣ Network Logon │ 4624 │ 2982092 │ 01566s-win16-ir.threebeesco.com │ lgrove │ 3 │ 172.16.66.19 │
├──────────────────────────────────┼─────────────────┼──────────┼───────────┼─────────────────────────────────┼──────────────────┼────────────┼───────────────────────────┤
│ 2021年12月12日T17:57:52.497329+00:00 │ ‣ Network Logon │ 4624 │ 2982097 │ 01566s-win16-ir.threebeesco.com │ lgrove │ 3 │ 172.16.66.19 │
├──────────────────────────────────┼─────────────────┼──────────┼───────────┼─────────────────────────────────┼──────────────────┼────────────┼───────────────────────────┤
│ 2022年02月16日T10:37:19.637236+00:00 │ ‣ Network Logon │ 4624 │ 2988522 │ 01566s-win16-ir.threebeesco.com │ 02694W-WIN10$ │ 3 │ 172.16.66.25 │
├──────────────────────────────────┼─────────────────┼──────────┼───────────┼─────────────────────────────────┼──────────────────┼────────────┼───────────────────────────┤
│ 2022年02月16日T10:37:20.450493+00:00 │ ‣ Network Logon │ 4624 │ 2988529 │ 01566s-win16-ir.threebeesco.com │ samir │ 3 │ 172.16.66.25 │
├──────────────────────────────────┼─────────────────┼──────────┼───────────┼─────────────────────────────────┼──────────────────┼────────────┼───────────────────────────┤
│ 2022年05月01日T04:41:37.642369+00:00 │ ‣ Network Logon │ 4624 │ 21367 │ wind10.winlab.local │ Administrator │ 3 │ 192.168.1.219 │
├──────────────────────────────────┼─────────────────┼──────────┼───────────┼─────────────────────────────────┼──────────────────┼────────────┼───────────────────────────┤
│ 2022年05月01日T04:41:47.653255+00:00 │ ‣ Network Logon │ 4624 │ 21369 │ wind10.winlab.local │ Administrator │ 3 │ 192.168.1.219 │
├──────────────────────────────────┼─────────────────┼──────────┼───────────┼─────────────────────────────────┼──────────────────┼────────────┼───────────────────────────┤
│ 2022年05月01日T04:41:54.272334+00:00 │ ‣ Network Logon │ 4624 │ 21371 │ wind10.winlab.local │ Administrator │ 3 │ 192.168.1.219 │
├──────────────────────────────────┼─────────────────┼──────────┼───────────┼─────────────────────────────────┼──────────────────┼────────────┼───────────────────────────┤
│ 2022年05月01日T04:42:00.800072+00:00 │ ‣ Network Logon │ 4624 │ 21373 │ wind10.winlab.local │ Administrator │ 3 │ 192.168.1.219 │
└──────────────────────────────────┴─────────────────┴──────────┴───────────┴─────────────────────────────────┴──────────────────┴────────────┴───────────────────────────┘
[+] Group: Log Tampering
┌──────────────────────────────────┬───────────────────────────────┬──────────┬───────────┬─────────────────────────────────┬───────────────┐
│ timestamp │ detections │ Event ID │ Record ID │ Computer │ User │
├──────────────────────────────────┼───────────────────────────────┼──────────┼───────────┼─────────────────────────────────┼───────────────┤
│ 2019年01月20日T07:00:50.800225+00:00 │ ‣ Security Audit Logs Cleared │ 1102 │ 32853 │ WIN-77LTAPHIQ1R.example.corp │ Administrator │
├──────────────────────────────────┼───────────────────────────────┼──────────┼───────────┼─────────────────────────────────┼───────────────┤
│ 2019年01月20日T07:29:57.863893+00:00 │ ‣ Security Audit Logs Cleared │ 1102 │ 32950 │ WIN-77LTAPHIQ1R.example.corp │ Administrator │
├──────────────────────────────────┼───────────────────────────────┼──────────┼───────────┼─────────────────────────────────┼───────────────┤
│ 2019年02月13日T18:01:41.593830+00:00 │ ‣ Security Audit Logs Cleared │ 1102 │ 227693 │ PC01.example.corp │ admin01 │
├──────────────────────────────────┼───────────────────────────────┼──────────┼───────────┼─────────────────────────────────┼───────────────┤
│ 2019年03月17日T19:26:42.116688+00:00 │ ‣ Security Audit Logs Cleared │ 1102 │ 6272 │ PC04.example.corp │ IEUser │
├──────────────────────────────────┼───────────────────────────────┼──────────┼───────────┼─────────────────────────────────┼───────────────┤
│ 2019年03月18日T11:06:25.485214+00:00 │ ‣ Security Audit Logs Cleared │ 1102 │ 432901 │ PC01.example.corp │ user01 │
├──────────────────────────────────┼───────────────────────────────┼──────────┼───────────┼─────────────────────────────────┼───────────────┤
│ 2019年03月18日T11:27:00.438449+00:00 │ ‣ Security Audit Logs Cleared │ 1102 │ 433307 │ PC01.example.corp │ user01 │
├──────────────────────────────────┼───────────────────────────────┼──────────┼───────────┼─────────────────────────────────┼───────────────┤
│ 2019年03月18日T23:23:37.147709+00:00 │ ‣ Security Audit Logs Cleared │ 1102 │ 565591 │ WIN-77LTAPHIQ1R.example.corp │ administrator │
├──────────────────────────────────┼───────────────────────────────┼──────────┼───────────┼─────────────────────────────────┼───────────────┤
│ 2019年03月19日T00:02:00.383090+00:00 │ ‣ Security Audit Logs Cleared │ 1102 │ 566821 │ WIN-77LTAPHIQ1R.example.corp │ administrator │
├──────────────────────────────────┼───────────────────────────────┼──────────┼───────────┼─────────────────────────────────┼───────────────┤
│ 2019年03月19日T23:34:25.894341+00:00 │ ‣ System Logs Cleared │ 104 │ 27736 │ PC01.example.corp │ user01 │
├──────────────────────────────────┼───────────────────────────────┼──────────┼───────────┼─────────────────────────────────┼───────────────┤
│ 2019年03月19日T23:35:07.524202+00:00 │ ‣ Security Audit Logs Cleared │ 1102 │ 452811 │ PC01.example.corp │ user01 │
├──────────────────────────────────┼───────────────────────────────┼──────────┼───────────┼─────────────────────────────────┼───────────────┤
│ 2019年03月25日T09:09:14.916619+00:00 │ ‣ Security Audit Logs Cleared │ 1102 │ 198238040 │ DC1.insecurebank.local │ bob │
├──────────────────────────────────┼───────────────────────────────┼──────────┼───────────┼─────────────────────────────────┼───────────────┤
│ 2019年03月25日T21:28:11.073626+00:00 │ ‣ Security Audit Logs Cleared │ 1102 │ 198242566 │ DC1.insecurebank.local │ bob │
├──────────────────────────────────┼───────────────────────────────┼──────────┼───────────┼─────────────────────────────────┼───────────────┤
│ 2019年04月27日T19:27:55.274060+00:00 │ ‣ Security Audit Logs Cleared │ 1102 │ 4987 │ IEWIN7 │ IEUser │
├──────────────────────────────────┼───────────────────────────────┼──────────┼───────────┼─────────────────────────────────┼───────────────┤
│ 2019年05月08日T03:00:11.778188+00:00 │ ‣ Security Audit Logs Cleared │ 1102 │ 203050 │ DC1.insecurebank.local │ administrator │
├──────────────────────────────────┼───────────────────────────────┼──────────┼───────────┼─────────────────────────────────┼───────────────┤
│ 2019年05月11日T17:10:06.342445+00:00 │ ‣ Security Audit Logs Cleared │ 1102 │ 18195 │ IEWIN7 │ IEUser │
├──────────────────────────────────┼───────────────────────────────┼──────────┼───────────┼─────────────────────────────────┼───────────────┤
│ 2019年11月15日T08:19:02.298512+00:00 │ ‣ Security Audit Logs Cleared │ 1102 │ 25048 │ alice.insecurebank.local │ bob │
├──────────────────────────────────┼───────────────────────────────┼──────────┼───────────┼─────────────────────────────────┼───────────────┤
│ 2020年07月22日T20:29:27.321769+00:00 │ ‣ Security Audit Logs Cleared │ 1102 │ 887106 │ 01566s-win16-ir.threebeesco.com │ a-jbrown │
├──────────────────────────────────┼───────────────────────────────┼──────────┼───────────┼─────────────────────────────────┼───────────────┤
│ 2020年09月02日T11:47:39.499106+00:00 │ ‣ Security Audit Logs Cleared │ 1102 │ 2171289 │ 01566s-win16-ir.threebeesco.com │ a-jbrown │
├──────────────────────────────────┼───────────────────────────────┼──────────┼───────────┼─────────────────────────────────┼───────────────┤
│ 2020年09月15日T18:04:36.333991+00:00 │ ‣ Security Audit Logs Cleared │ 1102 │ 161471 │ MSEDGEWIN10 │ IEUser │
├──────────────────────────────────┼───────────────────────────────┼──────────┼───────────┼─────────────────────────────────┼───────────────┤
│ 2020年09月15日T19:28:17.594374+00:00 │ ‣ Security Audit Logs Cleared │ 1102 │ 768617 │ 01566s-win16-ir.threebeesco.com │ a-jbrown │
├──────────────────────────────────┼───────────────────────────────┼──────────┼───────────┼─────────────────────────────────┼───────────────┤
│ 2020年09月15日T19:28:31.453647+00:00 │ ‣ System Logs Cleared │ 104 │ 63220 │ 01566s-win16-ir.threebeesco.com │ a-jbrown │
├──────────────────────────────────┼───────────────────────────────┼──────────┼───────────┼─────────────────────────────────┼───────────────┤
│ 2020年09月17日T10:57:37.013214+00:00 │ ‣ Security Audit Logs Cleared │ 1102 │ 769792 │ 01566s-win16-ir.threebeesco.com │ a-jbrown │
├──────────────────────────────────┼───────────────────────────────┼──────────┼───────────┼─────────────────────────────────┼───────────────┤
│ 2020年09月23日T16:49:41.578692+00:00 │ ‣ Security Audit Logs Cleared │ 1102 │ 772605 │ 01566s-win16-ir.threebeesco.com │ Administrator │
├──────────────────────────────────┼───────────────────────────────┼──────────┼───────────┼─────────────────────────────────┼───────────────┤
│ 2021年12月12日T17:57:17.006377+00:00 │ ‣ Security Audit Logs Cleared │ 1102 │ 2982081 │ 01566s-win16-ir.threebeesco.com │ a-jbrown │
├──────────────────────────────────┼───────────────────────────────┼──────────┼───────────┼─────────────────────────────────┼───────────────┤
│ 2022年02月16日T10:37:07.251285+00:00 │ ‣ Security Audit Logs Cleared │ 1102 │ 2988521 │ 01566s-win16-ir.threebeesco.com │ jbrown │
├──────────────────────────────────┼───────────────────────────────┼──────────┼───────────┼─────────────────────────────────┼───────────────┤
│ 2022年05月01日T04:40:18.084003+00:00 │ ‣ Security Audit Logs Cleared │ 1102 │ 21365 │ wind10.winlab.local │ admin │
└──────────────────────────────────┴───────────────────────────────┴──────────┴───────────┴─────────────────────────────────┴───────────────┘
[+] Group: Login Attacks
┌──────────────────────────────────┬───────────────────────┬──────────┬───────────┬────────┐
│ timestamp │ detections │ Event ID │ Record ID │ User │
├──────────────────────────────────┼───────────────────────┼──────────┼───────────┼────────┤
│ 2020年09月09日T13:18:23.627952+00:00 │ ‣ Account Brute Force │ 4625 │ 137222 │ IEUser │
└──────────────────────────────────┴───────────────────────┴──────────┴───────────┴────────┘
[+] 75 Detections found on 75 documents
You must be logged in to vote
0 replies
Comment options

alexkornitzer
Jun 7, 2022
Collaborator Author

Alpha 3 is out, apart from cleaning up the printing output, handling data conflicts and some fixes we now also have initial support for hunting and searching through json & xml files.
You must be logged in to vote
0 replies
Comment options

Hello @alexkornitzer , Could we add arbitrary sigma rule data to JSON result output? Example: I checked 2.0.0-alpha.0 version and I saw the new fields: level, source, and status. I am interested too in other fields like: sigma rule tags or sigma rule id.
My request: #68 was in order to get this.

I don't if it is difficult to implement, but: Can we add these specifications in the mapping file, or as another option from cmd line. Or, please consider add at least these sigma fields into the output. Sigma tags contain information useful to create ATT&CK Matrix
I miss --no-builtin option too.

Thanks a lot for your effort.
You must be logged in to vote
2 replies
Comment options

alexkornitzer Jun 23, 2022
Collaborator Author

Thanks for responding, does it need to be arbitrary support or are you just looking to have the tags and ids fields added. Since if it is only these fields I don't see a lot of value in bloating out the complexity to allow for fields that a lot of the time are empty as they are optional. I would rather we just always bring in tags, id, references, and description.

With regards to the --no-builtin there is no longer a need for this because the concept of builtin rules are gone, they are now Chainsaw Rules, so if there is a rule you don't wish to run then you can just exclude it. What exactly about this option are you missing?
Comment options

Hello Alex,
I need to show to our client more information about matched signatures than the signature title. Actually, I need the following fields values: title, id, description, author, status, references, falsepositives and tags. But, if you think that it is a lot of information for chainsaw output, can you include the signature yml file path? with this result, we'll be able to extract whatever I need now or in the future from source yml file directly. Please, consider to use json response for more extended results, because I understand that with console output is difficult to keep a nice output with much information.

About --no-builtin don't worry; I was unaware of what you explained. Sorry.

Thanks to the whole team for this excellent product.
Comment options

The latest alpha (v2.0.0-alpha.6) is now out. This alpha contains:

  • Improved error handling (no evtx files found, no mapping files provided, no rules found etc.)
  • Improved progress messages (total size of files loaded, where rules are being loaded from etc.)
  • General QoL improvements
  • Improved table output (splitting rule name, formatting datetime etc.)

Example - Improved Progress Messages:

-> % ./chainsaw hunt ../../sigma_rules/ ../../evtx_attack_samples -m ../../mappings/sigma-event-logs.yml
 ██████╗██╗ ██╗ █████╗ ██╗███╗ ██╗███████╗ █████╗ ██╗ ██╗
██╔════╝██║ ██║██╔══██╗██║████╗ ██║██╔════╝██╔══██╗██║ ██║
██║ ███████║███████║██║██╔██╗ ██║███████╗███████║██║ █╗ ██║
██║ ██╔══██║██╔══██║██║██║╚██╗██║╚════██║██╔══██║██║███╗██║
╚██████╗██║ ██║██║ ██║██║██║ ╚████║███████║██║ ██║╚███╔███╔╝
 ╚═════╝╚═╝ ╚═╝╚═╝ ╚═╝╚═╝╚═╝ ╚═══╝╚══════╝╚═╝ ╚═╝ ╚══╝╚══╝
 By F-Secure Countercept (@FranticTyping, @AlexKornitzer)
[+] Loading event logs from: ["../../evtx_attack_samples"]
[+] Loading detection rules from: ["../../sigma_rules/"]
[+] Loaded 1018 detection rules (348 not loaded)
[+] Loaded 288 EVTX files (42.9 MB)
[+] Hunting: [=========>------------------------------] 69/288

Example - Improved Error Messages:

-> % ./chainsaw hunt ../../sigma_rules/ ../../evtx_attack_samples
 ██████╗██╗ ██╗ █████╗ ██╗███╗ ██╗███████╗ █████╗ ██╗ ██╗
██╔════╝██║ ██║██╔══██╗██║████╗ ██║██╔════╝██╔══██╗██║ ██║
██║ ███████║███████║██║██╔██╗ ██║███████╗███████║██║ █╗ ██║
██║ ██╔══██║██╔══██║██║██║╚██╗██║╚════██║██╔══██║██║███╗██║
╚██████╗██║ ██║██║ ██║██║██║ ╚████║███████║██║ ██║╚███╔███╔╝
 ╚═════╝╚═╝ ╚═╝╚═╝ ╚═╝╚═╝╚═╝ ╚═══╝╚══════╝╚═╝ ╚═╝ ╚══╝╚══╝
 By F-Secure Countercept (@FranticTyping, @AlexKornitzer)
[+] Loading event logs from: ["../../evtx_attack_samples"]
[+] Loading detection rules from: ["../../sigma_rules/"]
[x] No mapping file specified for provided Sigma rules, specify one with the '-m' flag

We're nearly ready for the first beta release of Chainsaw v2 🎉 !
If anyone has any feedback on the current Alpha is would be really appreciated!
You must be logged in to vote
0 replies
Comment options

Hello everyone!

I'm excited to say that we have just released the first beta of Chainsaw v2! 🥳 🎉

Quite a lot has changed since the last Alpha and I think we've made several significant improvements.

The key changes to be aware of:

  1. Sigma rules are now specified using the -s flag to avoid argument confusion and to more cleanly load detection rules:
./chainsaw hunt rules/ evtx_attack_samples/ -s /tmp/sigma/rules --mapping mappings/sigma-event-logs-all.yml
  1. There's a new mapping file sigma-event-logs-all.yml which covers many more event log fields that the previous mapping file.

This means that Chainsaw can now apply the detection logic of significantly more Sigma rules on more event log types. You should now see detections for a variety of new event types, e.g. "Process Access" events. Running chainsaw against the same sample of event logs, you can see the difference this makes:

Legacy Mapping File: [+] 700 Detections found on 498 documents
New Mapping File: [+] 1396 Detections found on 881 documents

  1. The way that Chainsaw displays the event data for event logs containing detections has been redesigned.

In Version 1 the mapping file would specify which fields were displayed which meant that users would occasionally miss important information. In Version 2, Chainsaw outputs snippets from all fields in the relevant event log.

You can see an example of this by looking at the last column in the table output below. In Chainsaw v1, we would only show a few relevant fields for these detections, whereas now users get snippets of every field. This approach also allows Chainsaw to more generically support new event log types moving forwards, as we no longer have to manually specify each field to display for every log type.

[+] Group: Sigma
┌─────────────────────┬────────────────────────────────┬───────┬────────────────────────────────┬──────────┬───────────┬──────────────────────────┬──────────────────────────────────┐
│ timestamp │ detections │ count │ Event.System.Provider │ Event ID │ Record ID │ Computer │ Event Data │
├─────────────────────┼────────────────────────────────┼───────┼────────────────────────────────┼──────────┼───────────┼──────────────────────────┼──────────────────────────────────┤
│ 2019年04月29日 20:59:14 │ ‣ Malicious Named Pipe │ 1 │ Microsoft-Windows-Sysmon │ 18 │ 8046 │ IEWIN7 │ --- │
│ │ │ │ │ │ │ │ Image: System │
│ │ │ │ │ │ │ │ PipeName: "\46円a676ab7f179e511 │
│ │ │ │ │ │ │ │ e30dd2dc41bd388" │
│ │ │ │ │ │ │ │ ProcessGuid: 365ABB72-D9C4-5CC │
│ │ │ │ │ │ │ │ 7-0000-0010EA030000 │
│ │ │ │ │ │ │ │ ProcessId: 4 │
│ │ │ │ │ │ │ │ RuleName: "" │
│ │ │ │ │ │ │ │ UtcTime: "2019-04-29 20:59:14. │
│ │ │ │ │ │ │ │ 430" │
├─────────────────────┼────────────────────────────────┼───────┼────────────────────────────────┼──────────┼───────────┼──────────────────────────┼──────────────────────────────────┤
│ 2019年04月30日 20:26:51 │ ‣ CobaltStrike Service │ 1 │ Microsoft-Windows-Sysmon │ 13 │ 9806 │ IEWIN7 │ --- │
│ │ Installations in Registry │ │ │ │ │ │ Details: "%%COMSPEC%% /b /c st │
│ │ │ │ │ │ │ │ art /b /min powershell.exe -no │
│ │ │ │ │ │ │ │ p -w hidden -noni -c \"if([Int │
│ │ │ │ │ │ │ │ Ptr]::Size -eq 4){$b='powershe │
│ │ │ │ │ │ │ │ ll.exe'}else{$b=$env:windir+'\ │
│ │ │ │ │ │ │ │ \syswow64\\WindowsPowerShell\\ │
│ │ │ │ │ │ │ │ v1.0\\powershell.exe'};$s=New- │
│ │ │ │ │ │ │ │ Object System.Diagnostics.Proc │
│ │ │ │ │ │ │ │ essStartInfo;$s.FileName=$b;$s │
│ │ │ │ │ │ │ │ .Arguments='-noni -nop -w hidd │
│ │ │ │ │ │ │ │ en -c &([scriptblock]::create( │
│ │ │ │ │ │ │ │ (New-Object IO.StreamReader(Ne │
│ │ │ │ │ │ │ │ w-Object IO.Compression.GzipSt │
│ │ │ │ │ │ │ │ ream((New-Object IO.MemoryStre │
│ │ │ │ │ │ │ │ am(,[Convert]::FromBase64Strin │
│ │ │ │ │ │ │ │ g(''H4sIAIuvyFwCA7VW+2/aSBD+OZ │
│ │ │ │ │ │ │ │ H6P1... │
│ │ │ │ │ │ │ │ (use --full to show all content) │
│ │ │ │ │ │ │ │ EventType: SetValue │
│ │ │ │ │ │ │ │ Image: "C:\\Windows\\system32\ │
│ │ │ │ │ │ │ │ \services.exe" │
│ │ │ │ │ │ │ │ ProcessGuid: 365ABB72-2586-5CC │
│ │ │ │ │ │ │ │ 9-0000-0010DC530000 │
│ │ │ │ │ │ │ │ ProcessId: 460 │
│ │ │ │ │ │ │ │ RuleName: "" │
│ │ │ │ │ │ │ │ TargetObject: "HKLM\\System\\C │
│ │ │ │ │ │ │ │ urrentControlSet\\services\\he │
│ │ │ │ │ │ │ │ llo\\ImagePath" │
│ │ │ │ │ │ │ │ UtcTime: "2019-04-30 20:26:51. │
│ │ │ │ │ │ │ │ 934" │
  1. Table widths will now auto-scale to the size of your terminal window

A small final addition is that Chainsaw v2 will auto-adjust the column width of the table view when showing results. This means that you will see more information by default on larger screens, and on smaller screens you have a lower chance of the table output being broken due to over-running lines.

You can still use the --column-width option to specify your own width if you'd prefer, or if you find that the columns still overrun the screen when using small terminal windows.

I've updated the Readme file to reflect the changes made in Chainsaw v2, but please do let me know if anything is missing or if you think any usage information needs clarifying. We're also looking to add more information to the Wiki of this repo to help drive community support for Chainsaw.

The master branch now contains the v2 codebase and there are compiled releases available in the releases section. You may notice that we no longer submodule the Sigma Rules or the EVTX-Attack-Samples repositories, so you'll need to clone those separately or download the chainsaw_all_platforms+rules+examples.tar.gz archive if you still want them bundled.

If you still want to use Chainsaw v1, you can access it in the v1.x.x branch.

We would love to hear your feedback (positive or negative) about your experience with the beta of Chainsaw v2, and we're happy to tweak it as people wish!

Just as one final note, I would like to say a massive thank you to @alexkornitzer for all of his work on this project. He managed to take my "Lockdown Christmas Project" of 2020 and transform the cobbled together codebase into a much more polished product. (Oh and for being the mastermind behind the TAU engine which makes the detection speed of Chainsaw possible.)
You must be logged in to vote
0 replies
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

AltStyle によって変換されたページ (->オリジナル) /