Having established that our anomalous data shows this repeating pattern,
we can use some of these highly repeated values to filter
suspected attack events from the benign events.
We want to use a filter that includes multiple properties to
more accurately pinpoint anomalous data and separate it from the
background of normal user activity.
Combining multiple properties helps us exclude
benign login events from our filter.
We're picking two properties, UserAgent and AppId, to filter our data.
Here,
we find the most frequently used User Agents and App ID from our anomaly data.
Then we're going to use pandas to filter our data.
We define two pandas criteria that will select rows that match the AppId
and UserAgent from the values that we just identified.
Note here that we're creating our criteria as individual Python variables that
we can then combine into our more complex filter expression.
We combine these criteria with logical ends and apply
them to our failed_logon_details_df.
This gives us a set of logon failures with matching properties.
This is an unusually large number.
In most cases, the number of malicious events will be much smaller,
and you will need to do a bit more work to isolate them.
We can also do a quick sanity check here.
If we take the same filter, but invert it,
we'll get the events that we didn't think were anomalous.
Using the matrix plot again,
we can confirm that the remaining events look like our normal pattern.
Having isolated our attacker events,
we extract the unique IP addresses from the logon attempts.
Let's look up a sample of those IP addresses with one of
msticpy's threat intelligence providers.
Here, we're using AlienVault OTX,
but other providers, such as VirusTotal or RiskIQ, will also work.
You can also use msticpy to look up values in multiple providers
simultaneously and combine the results from all of them.
The results show that most of the IP addresses are high severity,
known, malicious addresses.
In this case, at least,
we can now be pretty sure that this traffic was malicious.
Now it's important to check whether any attacker logon
attempts resulted in a successful logon.
First,
we can take the source IP addresses that we just isolated
and see if we can find any successful logons that also
originated from these sources.
Here, we can see two successful logon events,
indicating the attacker was able to break into two accounts.
Although we are only querying here for the use of this
suspect IP addresses in Active Directory, we would, of
course, widen the search from here,
not only looking for IP addresses in other logs,
but also using the same techniques to isolate more properties from attack
events and using these to search in our other logs.
Then we want to investigate and remediate,
for example,
disabling accounts, investigating the resources that these
users have access to, isolating compromised machines, and so
on. So to summarize our first example,
we used time series to help us identify anomalies in bulk activity, we
used matrix plots to help identify common characteristics of an attack,
mapping to help visualize geographic anomalies,
threat intelligence to understand the origin and techniques of the attacker,
and finally,
damage assessment. Where did the Attackers breach,
and what do we need to do next?