Let's look at the first of those with a password spray attack.
This is based on real customer data, but with the details masked.
Automated attacks against existing accounts are extremely common, and
these attacks can be launched with a variety of freely available tools
and techniques. Before we get into the demo, here is a quick overview of
what we're going to be seeing: firstly, using time series to do
detection; secondly, identifying the characteristics of the attack using
matrix plots,
then using some analysis and visualizations to isolate the attacker
activity from normal failed logon activity; and finally, we'll use
this knowledge to identify where the attacker may have been
successful and identify accounts that will need further
investigation and possible remediation.
Let's start with the first of our demos. At the start of every MSTICPy
notebook, there is a short initialization step to load the package.
I've included more details about the setup and
configuration of MSTICPy in the Notebook.
We start with a query. We want to retrieve a summary of logon failures
for the past 30 days using MSTICPy's data providers.
This is what the query would look like in Microsoft Sentinel, but most
query providers such as Splunk, Elastic, SQL, and so on, will have an
equivalent syntax. We're specifying our time range, filtering to use only
failed logons, and finally, summarizing the counts by each hour. You want
to do this kind of data crunching in your datastore rather than attempt to
bring hundreds of thousands of rows into the Notebook and summarize it
locally.
The query returns the data as a pandas DataFrame. We'll
use pandas frequently in these demos.
It's an essential tool for analyzing data in Python, and well worth
getting to know. Before analyzing it, we want to make sure that it is
indexed and sorted on the time column.
First we use the timeseries_anomalies_stl function from
MSTICPy to calculate the normal day‑to‑day patterns and
identify any anomalous periods.
The timeseries_anomalies_stl function works by
calculating a seasonal average for a value for fixed time
slices over a period such as a week.
Having calculated the average for each hour,
we can then use it to highlight any anomalies for values that
exceed the average by more than a certain threshold.
The value that we're using here is a simple count of failed logons per hour.
We can show the results graphically using the
display_timeseries_anomalies function.
You can see how the count goes up and down corresponding
to the daily activity of normal users.
In the plot,
you can see the anomalies where the count of failed
logons was significantly higher.
These are indicated by the red crosshair symbol.
We can see that there was a concentration of anomalous activity near the
middle of the period and two less significant outliers either side of it.
Zooming in on that middle period to look more closely,
we can see a sudden increase in the number of logon failures lasting for
several hours, and then a return to the normal pattern.
This is the period we want to examine more closely.