Guided Investigation - Solarwinds Post Compromise Activity.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {
    "toc": true
   },
   "source": [
    "<h1>Table of Contents<span class=\"tocSkip\"></span></h1>\n",
    "<div class=\"toc\"><ul class=\"toc-item\"><li><span><a href=\"#Guided-Hunting---Solarwinds-Post-Compromise\" data-toc-modified-id=\"Guided-Hunting---Solarwinds-Post-Compromise-1\">Guided Hunting - Solarwinds Post Compromise</a></span><ul class=\"toc-item\"><li><span><a href=\"#Notebook-initialization\" data-toc-modified-id=\"Notebook-initialization-1.1\">Notebook initialization</a></span></li><li><span><a href=\"#Setup\" data-toc-modified-id=\"Setup-1.2\">Setup</a></span><ul class=\"toc-item\"><li><span><a href=\"#Configuration\" data-toc-modified-id=\"Configuration-1.2.1\">Configuration</a></span><ul class=\"toc-item\"><li><span><a href=\"#msticpyconfig.yaml-configuration-File\" data-toc-modified-id=\"msticpyconfig.yaml-configuration-File-1.2.1.1\"><code>msticpyconfig.yaml</code> configuration File</a></span></li></ul></li></ul></li></ul></li><li><span><a href=\"#IOC-Hunt\" data-toc-modified-id=\"IOC-Hunt-2\">IOC Hunt</a></span><ul class=\"toc-item\"><li><span><a href=\"#TearDrop-Memory-Only-Dropper\" data-toc-modified-id=\"TearDrop-Memory-Only-Dropper-2.1\">TearDrop Memory Only Dropper</a></span></li><li><span><a href=\"#SUNBURST-and-SUPERNOVA-backdoor-hashes\" data-toc-modified-id=\"SUNBURST-and-SUPERNOVA-backdoor-hashes-2.2\">SUNBURST and SUPERNOVA backdoor hashes</a></span></li><li><span><a href=\"#SUNBURST-network-beacons\" data-toc-modified-id=\"SUNBURST-network-beacons-2.3\">SUNBURST network beacons</a></span></li><li><span><a href=\"#SUNBURST-suspicious-SolarWinds-child-processes\" data-toc-modified-id=\"SUNBURST-suspicious-SolarWinds-child-processes-2.4\">SUNBURST suspicious SolarWinds child processes</a></span></li></ul></li><li><span><a href=\"#Checking-for-Solarwinds-Servers\" data-toc-modified-id=\"Checking-for-Solarwinds-Servers-3\">Checking for Solarwinds Servers</a></span><ul class=\"toc-item\"><li><span><a href=\"#Asset-Inventory\" data-toc-modified-id=\"Asset-Inventory-3.1\">Asset Inventory</a></span></li></ul></li><li><span><a href=\"#Lateral-Movement\" data-toc-modified-id=\"Lateral-Movement-4\">Lateral Movement</a></span><ul class=\"toc-item\"><li><ul class=\"toc-item\"><li><span><a href=\"#Hosts-with-New-Logons\" data-toc-modified-id=\"Hosts-with-New-Logons-4.0.1\">Hosts with New Logons</a></span></li><li><span><a href=\"#Rare-RDP-Connections\" data-toc-modified-id=\"Rare-RDP-Connections-4.0.2\">Rare RDP Connections</a></span></li><li><span><a href=\"#RDP-Nesting\" data-toc-modified-id=\"RDP-Nesting-4.0.3\">RDP Nesting</a></span></li><li><span><a href=\"#Rare-application-consent\" data-toc-modified-id=\"Rare-application-consent-4.0.4\">Rare application consent</a></span></li><li><span><a href=\"#Rare-activity--by-High-Value-Account\" data-toc-modified-id=\"Rare-activity--by-High-Value-Account-4.0.5\">Rare activity  by High Value Account</a></span></li></ul></li><li><span><a href=\"#Suspicious--Logons\" data-toc-modified-id=\"Suspicious--Logons-4.1\">Suspicious  Logons</a></span></li></ul></li><li><span><a href=\"#Privilege-Escalation\" data-toc-modified-id=\"Privilege-Escalation-5\">Privilege Escalation</a></span><ul class=\"toc-item\"><li><span><a href=\"#New-Account-Creation-and-Addition-to-Privileged-groups\" data-toc-modified-id=\"New-Account-Creation-and-Addition-to-Privileged-groups-5.1\">New Account Creation and Addition to Privileged groups</a></span></li><li><span><a href=\"#User-Added-to-Azure-Active-Directory-Privileged-Groups\" data-toc-modified-id=\"User-Added-to-Azure-Active-Directory-Privileged-Groups-5.2\">User Added to Azure Active Directory Privileged Groups</a></span></li><li><span><a href=\"#ADFS-Hunting\" data-toc-modified-id=\"ADFS-Hunting-5.3\">ADFS Hunting</a></span><ul class=\"toc-item\"><li><span><a href=\"#Uncommon-processes\" data-toc-modified-id=\"Uncommon-processes-5.3.1\">Uncommon processes</a></span></li><li><span><a href=\"#Rare-processes-run-by-Service-Accounts\" data-toc-modified-id=\"Rare-processes-run-by-Service-Accounts-5.3.2\">Rare processes run by Service Accounts</a></span></li><li><span><a href=\"#Fireeye-Red-Team-Tools\" data-toc-modified-id=\"Fireeye-Red-Team-Tools-5.3.3\">Fireeye Red Team Tools</a></span></li></ul></li></ul></li><li><span><a href=\"#Azure-Active-Directory-Hunting\" data-toc-modified-id=\"Azure-Active-Directory-Hunting-6\">Azure Active Directory Hunting</a></span><ul class=\"toc-item\"><li><ul class=\"toc-item\"><li><span><a href=\"#Domain-Federation-trust-Settings-modification\" data-toc-modified-id=\"Domain-Federation-trust-Settings-modification-6.0.1\">Domain Federation trust Settings modification</a></span></li><li><span><a href=\"#Addition-of-New-Key-Credentials-to-an-Application-or-Service-Principal\" data-toc-modified-id=\"Addition-of-New-Key-Credentials-to-an-Application-or-Service-Principal-6.0.2\">Addition of New Key Credentials to an Application or Service Principal</a></span></li><li><span><a href=\"#Suspicious-Application-Consent\" data-toc-modified-id=\"Suspicious-Application-Consent-6.0.3\">Suspicious Application Consent</a></span></li></ul></li></ul></li><li><span><a href=\"#Data-Acccess-and-Exfiltration\" data-toc-modified-id=\"Data-Acccess-and-Exfiltration-7\">Data Acccess and Exfiltration</a></span><ul class=\"toc-item\"><li><ul class=\"toc-item\"><li><span><a href=\"#Azure-Active-Directory-PowerShell-to-access-non-Active-Directory-Resources\" data-toc-modified-id=\"Azure-Active-Directory-PowerShell-to-access-non-Active-Directory-Resources-7.0.1\">Azure Active Directory PowerShell to access non-Active Directory Resources</a></span></li><li><span><a href=\"#Anomalous-increase-in-Exchange-Mail-Items-Accesed\" data-toc-modified-id=\"Anomalous-increase-in-Exchange-Mail-Items-Accesed-7.0.2\">Anomalous increase in Exchange Mail Items Accesed</a></span></li></ul></li></ul></li><li><span><a href=\"#Resources\" data-toc-modified-id=\"Resources-8\">Resources</a></span></li></ul></div>"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Guided Hunting - Solarwinds Post Compromise\n",
    "<details>\n",
    "    <summary> <u>Details...</u></summary>\n",
    "    \n",
    "**Notebook Version:** 1.0<br>\n",
    "**Python Version:** Python 3.7 (including Python 3.6 - AzureML)<br>\n",
    "**Required Packages**: kqlmagic, msticpy, pandas, numpy, matplotlib, networkx, ipywidgets, ipython, scikit_learn, dnspython, ipwhois, folium, holoviews<br>\n",
    "**Platforms Supported**:\n",
    "- Azure Notebooks Free Compute\n",
    "- Azure Notebooks DSVM\n",
    "- OS Independent\n",
    "\n",
    "**Data Sources Required**:\n",
    "- Log Analytics \n",
    "    - Heartbeat\n",
    "    - SecurityAlert\n",
    "    - SecurityEvent\n",
    "    - DeviceProcessEvents\n",
    "    - DeviceNetworkEvents\n",
    "    - DeviceFileEvents\n",
    "    - SigninEvents\n",
    "    - AuditLogs\n",
    "    - AzureNetworkAnalytics_CL\n",
    "    \n",
    "    \n",
    "- (Optional)  \n",
    "    - VirusTotal (with API key)\n",
    "    - Alienvault OTX (with API key) \n",
    "    - IBM Xforce (with API key) \n",
    "    - CommonSecurityLog\n",
    "</details>\n",
    "\n",
    "This Notebook assists defenders in hunting for Solarwinds Post compromise Tactics , Tools and Procedures (TTPs) across different environments both on-prem and cloud data sources. \n",
    "\n",
    "You can read more about the attack in below technical blogs\n",
    "\n",
    "**References :**\n",
    "\n",
    "- https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/\n",
    "- https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html\n",
    "- <TechCommunityBlog>\n",
    "\n",
    "**How to use:**<br>\n",
    "Run the cells in this Notebook in order, at various points in the Notebook flow you will be prompted to enter or select options relevant to the scope of your triage.<br>\n",
    "This Notebook presumes you have Azure Sentinel Workspace settings and Threat Intelligence providers configured in a config file. If you do not have this in place please refer https://msticpy.readthedocs.io/en/latest/data_acquisition/TIProviders.html#configuration-file to https://github.com/Azure/Azure-Sentinel-Notebooks/blob/master/ConfiguringNotebookEnvironment.ipynb  and to set this up."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "ExecuteTime": {
     "end_time": "2020-12-15T21:39:44.390403Z",
     "start_time": "2020-12-15T21:39:44.380860Z"
    }
   },
   "source": [
    "---\n",
    "## Notebook initialization\n",
    "The next cell:\n",
    "- Checks for the correct Python version\n",
    "- Checks versions and optionally installs required packages\n",
    "- Imports the required packages into the notebook\n",
    "- Sets a number of configuration options.\n",
    "\n",
    "This should complete without errors. If you encounter errors or warnings look at the following two notebooks:\n",
    "- [TroubleShootingNotebooks](https://github.com/Azure/Azure-Sentinel-Notebooks/blob/master/TroubleShootingNotebooks.ipynb)\n",
    "- [ConfiguringNotebookEnvironment](https://github.com/Azure/Azure-Sentinel-Notebooks/blob/master/ConfiguringNotebookEnvironment.ipynb)\n",
    "\n",
    "If you are running in the Azure Sentinel Notebooks environment (Azure Notebooks or Azure ML) you can run live versions of these notebooks:\n",
    "- [Run TroubleShootingNotebooks](./TroubleShootingNotebooks.ipynb)\n",
    "- [Run ConfiguringNotebookEnvironment](./ConfiguringNotebookEnvironment.ipynb)\n",
    "\n",
    "You may also need to do some additional configuration to successfully use functions such as Threat Intelligence service lookup and Geo IP lookup. \n",
    "There are more details about this in the `ConfiguringNotebookEnvironment` notebook and in these documents:\n",
    "- [msticpy configuration](https://msticpy.readthedocs.io/en/latest/getting_started/msticpyconfig.html)\n",
    "- [Threat intelligence provider configuration](https://msticpy.readthedocs.io/en/latest/data_acquisition/TIProviders.html#configuration-file)\n"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Setup"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "ExecuteTime": {
     "end_time": "2020-12-16T17:26:20.819278Z",
     "start_time": "2020-12-16T17:26:20.784441Z"
    }
   },
   "outputs": [],
   "source": [
    "from pathlib import Path\n",
    "import os\n",
    "import sys\n",
    "import warnings\n",
    "from IPython.display import display, HTML, Markdown\n",
    "from ipywidgets import widgets, Layout\n",
    "\n",
    "REQ_PYTHON_VER=(3, 6)\n",
    "REQ_MSTICPY_VER=(0, 6, 0)\n",
    "\n",
    "display(HTML(\"<h3>Starting Notebook setup...</h3>\"))\n",
    "if Path(\"./utils/nb_check.py\").is_file():\n",
    "    from utils.nb_check import check_python_ver, check_mp_ver\n",
    "\n",
    "    check_python_ver(min_py_ver=REQ_PYTHON_VER)\n",
    "    try:\n",
    "        check_mp_ver(min_msticpy_ver=REQ_MSTICPY_VER)\n",
    "    except ImportError:\n",
    "        !pip install --upgrade msticpy\n",
    "        if \"msticpy\" in sys.modules:\n",
    "            importlib.reload(sys.modules[\"msticpy\"])\n",
    "        else:\n",
    "            import msticpy\n",
    "        check_mp_ver(REQ_MSTICPY_VER)\n",
    "            \n",
    "\n",
    "# If not using Azure Notebooks, install msticpy with\n",
    "# !pip install msticpy\n",
    "from msticpy.nbtools import nbinit\n",
    "extra_imports = [\n",
    "    \"tqdm.notebook, tqdm\",\n",
    "    \"whois\",\n",
    "    \"dns\",\n",
    "    \"tldextract\",\n",
    "    \"datetime, date\",\n",
    "    \"pandas, ,pd\",\n",
    "    \"requests\",\n",
    "    \"zipfile\",\n",
    "    \"io\",\n",
    "    \"re\",\n",
    "    \"glob\",\n",
    "    \"IPython\",\n",
    "    \"json\",\n",
    "    \"csv\",\n",
    "    \"ipywidgets,,widgets\",\n",
    "    \"msticpy.nbtools.foliummap, get_map_center\",\n",
    "    \"msticpy.nbtools.foliummap, get_center_ip_entities\",\n",
    "    \"pandas, json_normalize\",\n",
    "    \"ruamel.yaml, YAML\",\n",
    "    \"functools, lru_cache\",\n",
    "]\n",
    "\n",
    "additional_packages = [\n",
    "    \"tldextract\", \"IPWhois\", \"python-whois\"\n",
    "]\n",
    "nbinit.init_notebook(\n",
    "    namespace=globals(),\n",
    "    additional_packages=additional_packages,\n",
    "    extra_imports=extra_imports,\n",
    ");\n",
    "\n",
    "WIDGET_DEFAULTS = {\n",
    "    \"layout\": widgets.Layout(width=\"95%\"),\n",
    "    \"style\": {\"description_width\": \"initial\"},\n",
    "}\n",
    "from bokeh.plotting import figure"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "ExecuteTime": {
     "end_time": "2020-12-15T22:51:35.883260Z",
     "start_time": "2020-12-15T22:51:17.531950Z"
    }
   },
   "outputs": [],
   "source": [
    "#Collect Azure Sentinel Workspace Details from our config file and use them to connect\n",
    "try:\n",
    "    #Update to WorkspaceConfig(workspace=\"WORKSPACE_NAME\") to get alerts from a Workspace other than your default one.\n",
    "    ws_config = WorkspaceConfig()\n",
    "    ws_id = ws_config['workspace_id']\n",
    "    ten_id = ws_config['tenant_id']\n",
    "    md(\"Workspace details collected from config file\")\n",
    "    qry_prov = QueryProvider('LogAnalytics')\n",
    "    qry_prov.connect(connection_str=ws_config.code_connect_str)\n",
    "except RuntimeError:\n",
    "    md(\"\"\"You do not have any Workspaces configured in your config files.\n",
    "       Please run the https://github.com/Azure/Azure-Sentinel-Notebooks/blob/master/ConfiguringNotebookEnvironment.ipynb\n",
    "       to setup these files before proceeding\"\"\" ,'bold')\n",
    "    \n",
    "ti = TILookup()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Configuration\n",
    "\n",
    "#### `msticpyconfig.yaml` configuration File\n",
    "You can configure primary and secondary TI providers and any required parameters in the `msticpyconfig.yaml` file. This is read from the current directory or you can set an environment variable (`MSTICPYCONFIG`) pointing to its location.\n",
    "\n",
    "To configure this file see the [ConfigureNotebookEnvironment notebook](https://github.com/Azure/Azure-Sentinel-Notebooks/blob/master/ConfiguringNotebookEnvironment.ipynb)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "ExecuteTime": {
     "end_time": "2020-12-16T18:00:53.013979Z",
     "start_time": "2020-12-16T18:00:53.008322Z"
    }
   },
   "outputs": [],
   "source": [
    "def get_solarwinds_queries_from_github(git_url, outputdir):\n",
    "    r = requests.get(git_url)\n",
    "\n",
    "    repo_zip = io.BytesIO(r.content)\n",
    "\n",
    "    archive = zipfile.ZipFile(repo_zip, mode=\"r\")\n",
    "\n",
    "    # Only extract Detections and Hunting Queries Folder\n",
    "    for file in archive.namelist():\n",
    "        if file.startswith(\n",
    "            (\n",
    "                \"Azure-Sentinel-master/Detections/DeviceEvents/SolarWinds_TEARDROP_Process-IOCs.yaml\",\n",
    "                \"Azure-Sentinel-master/Detections/DeviceNetworkEvents/SolarWinds_SUNBURST_Network-IOCs.yaml\",\n",
    "                \"Azure-Sentinel-master/Detections/DeviceProcessEvents/SolarWinds_SUNBURST_Process-IOCs.yaml\",\n",
    "                \"Azure-Sentinel-master/Detections/DeviceFileEvents/SolarWinds_SUNBURST_&_SUPERNOVA_File-IOCs.yaml\",\n",
    "                \"Azure-Sentinel-master/Detections/AuditLogs/MaliciousOAuthApp_O365AttackToolkit.yaml\",\n",
    "                \"Azure-Sentinel-master/Detections/AuditLogs/MaliciousOAuthApp_PwnAuth.yaml\",\n",
    "                \"Azure-Sentinel-master/Detections/AuditLogs/UseraddedtoPrivilgedGroups.yaml\",\n",
    "                \"Azure-Sentinel-master/Detections/AuditLogs/ADFSDomainTrustMods.yaml\",\n",
    "                \"Azure-Sentinel-master/Detections/AuditLogs/RareApplicationConsent.yaml\",\n",
    "                \"Azure-Sentinel-master/Detections/SigninLogs/AzureAADPowerShellAnomaly.yaml\",\n",
    "                \"Azure-Sentinel-master/Detections/OfficeActivity/MailItemsAccessedTimeSeries.yaml\",\n",
    "                \"Azure-Sentinel-master/Detections/SecurityEvent/RDP_RareConnection.yaml\",\n",
    "                \"Azure-Sentinel-master/Detections/SecurityEvent/RDP_Nesting.yaml\",\n",
    "                \"Azure-Sentinel-master/Detections/SecurityEvent/UserCreatedAddedToBuiltinAdmins_1d.yaml\",\n",
    "                \"Azure-Sentinel-master/Hunting Queries/SecurityEvent/HostsWithNewLogons.yaml\",\n",
    "                \"Azure-Sentinel-master/Hunting Queries/MultipleDataSources/TrackingPrivAccounts.yaml\",\n",
    "                \"Azure-Sentinel-master/Hunting Queries/SecurityEvent/ProcessEntropy.yaml\",\n",
    "                \"Azure-Sentinel-master/Hunting Queries/SecurityEvent/RareProcbyServiceAccount.yaml\",\n",
    "                \"Azure-Sentinel-master/Hunting Queries/SecurityEvent/uncommon_processes.yaml\"\n",
    "            )\n",
    "        ):\n",
    "            archive.extract(file, path=outputdir)\n",
    "    print(\"Downloaded and Extracted Files successfully\")"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "ExecuteTime": {
     "end_time": "2020-12-16T18:00:53.848269Z",
     "start_time": "2020-12-16T18:00:53.834945Z"
    }
   },
   "outputs": [],
   "source": [
    "def_path = Path.joinpath(Path(os.getcwd()))\n",
    "path_wgt = widgets.Text(value=str(def_path), \n",
    "                        description='Path to extract to zipped repo files: ', \n",
    "                        layout=Layout(width='50%'),\n",
    "                        style={'description_width': 'initial'})\n",
    "path_wgt"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "ExecuteTime": {
     "end_time": "2020-12-16T18:01:10.466863Z",
     "start_time": "2020-12-16T18:00:54.639740Z"
    }
   },
   "outputs": [],
   "source": [
    "# Download the Azure Sentinel Github repo as ZIP\n",
    "azsentinel_git_url = 'https://github.com/Azure/Azure-Sentinel/archive/master.zip'\n",
    "\n",
    "get_solarwinds_queries_from_github(git_url=azsentinel_git_url, outputdir=path_wgt.value)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "ExecuteTime": {
     "end_time": "2020-12-16T18:01:11.494383Z",
     "start_time": "2020-12-16T18:01:10.838554Z"
    }
   },
   "outputs": [],
   "source": [
    "QUERIES_PATH = 'Azure-Sentinel-master'\n",
    "sentinel_root = Path(path_wgt.value) / QUERIES_PATH\n",
    "\n",
    "display(HTML(\"<h3>Listings under Detections...</h2>\"))\n",
    "%ls '{sentinel_root}/Detections/'\n",
    "\n",
    "display(HTML(\"<h3>Listings under Hunting Queries...</h2>\"))\n",
    "%ls '{sentinel_root}/Hunting Queries/'"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "ExecuteTime": {
     "end_time": "2020-12-16T18:01:26.869159Z",
     "start_time": "2020-12-16T18:01:26.862783Z"
    }
   },
   "outputs": [],
   "source": [
    "def parse_yaml(parent_dir, child_dir):\n",
    "\n",
    "    sentinel_repourl = \"https://github.com/Azure/Azure-Sentinel/blob/master\"\n",
    "    \n",
    "    # Collect list of files recusrively uinder a folder\n",
    "    yaml_queries = glob.glob(f\"{parent_dir}/{child_dir}/**/*.yaml\", recursive=True)\n",
    "    df = pd.DataFrame()\n",
    "\n",
    "    # Parse and load yaml\n",
    "    parsed_yaml = YAML(typ=\"safe\")\n",
    "\n",
    "    # Recursively load yaml Files and append to dataframe\n",
    "    for query in yaml_queries:\n",
    "        with open(query, \"r\", encoding=\"utf-8\", errors=\"ignore\") as f:\n",
    "            parsed_yaml_df = json_normalize(parsed_yaml.load(f))\n",
    "            parsed_yaml_df[\"DetectionURL\"] = query.replace(parent_dir, sentinel_repourl)\n",
    "            df = df.append(parsed_yaml_df, ignore_index=True, sort=True)\n",
    "\n",
    "    if child_dir == \"Detections\":\n",
    "        df[\"DetectionType\"] = \"Analytics\"\n",
    "    elif child_dir == \"Hunting Queries\":\n",
    "        df[\"DetectionType\"] = \"Hunting\"\n",
    "\n",
    "    df[\"DetectionService\"] = \"Azure Sentinel Community Github\"\n",
    "\n",
    "    return df"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "ExecuteTime": {
     "end_time": "2020-12-16T18:36:10.907807Z",
     "start_time": "2020-12-16T18:36:10.813688Z"
    }
   },
   "outputs": [],
   "source": [
    "base_dir = path_wgt.value + \"/Azure-Sentinel-master\"\n",
    "detections_df = parse_yaml(parent_dir=base_dir, child_dir=\"Detections\")\n",
    "hunting_df = parse_yaml(parent_dir=base_dir, child_dir=\"Hunting Queries\")\n",
    "\n",
    "frames = [detections_df, hunting_df]\n",
    "sentinel_github_df = pd.concat(frames).reset_index(drop=True)\n",
    "sentinel_github_df = sentinel_github_df.copy()\n",
    "sentinel_github_df[\"DetectionURL\"] = sentinel_github_df[\"DetectionURL\"].str.replace(\n",
    "    \" \", \"%20\", regex=True\n",
    ")\n",
    "sentinel_github_df[\"IngestedDate\"] = date.today()\n",
    "\n",
    "# Displaying basic statistics of yaml files\n",
    "display(HTML(\"<h3>Azure Sentinel Github Stats...</h3>\"))\n",
    "print(\n",
    "    f\"\"\"Total Queries in Azure Sentinel Github:: {len(sentinel_github_df)} \n",
    "    No of Detections :: {len(detections_df)} \n",
    "    No of Hunting Queries:: {len(hunting_df)}\n",
    "    \"\"\"\n",
    ") \n",
    "\n",
    "display(sentinel_github_df.head())"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# IOC Hunt\n",
    "\n",
    "## TearDrop Memory Only Dropper\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "ExecuteTime": {
     "end_time": "2020-12-16T18:01:33.612818Z",
     "start_time": "2020-12-16T18:01:31.619663Z"
    }
   },
   "outputs": [],
   "source": [
    "query = sentinel_github_df.loc[\n",
    "    sentinel_github_df[\"name\"] == \"TEARDROP memory-only dropper\"\n",
    "][\"query\"].reset_index(drop=True)[0]\n",
    "print(\"Collecting data...\")\n",
    "teardrop_df = qry_prov.exec_query(query)\n",
    "teardrop_df"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## SUNBURST and SUPERNOVA backdoor hashes"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "ExecuteTime": {
     "end_time": "2020-12-16T18:01:45.975680Z",
     "start_time": "2020-12-16T18:01:44.602010Z"
    }
   },
   "outputs": [],
   "source": [
    "query = sentinel_github_df.loc[\n",
    "    sentinel_github_df[\"name\"] == \"SUNBURST and SUPERNOVA backdoor hashes\"\n",
    "][\"query\"].reset_index(drop=True)[0]\n",
    "print(\"Collecting data...\")\n",
    "backdoor_df = qry_prov.exec_query(query)\n",
    "backdoor_df"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## SUNBURST network beacons"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "ExecuteTime": {
     "end_time": "2020-12-16T18:18:53.485809Z",
     "start_time": "2020-12-16T18:18:52.505866Z"
    }
   },
   "outputs": [],
   "source": [
    "query = sentinel_github_df.loc[\n",
    "    sentinel_github_df[\"name\"] == \"SUNBURST network beacons\"\n",
    "][\"query\"].reset_index(drop=True)[0]\n",
    "print(\"Collecting data...\")\n",
    "nwbeacon_df = qry_prov.exec_query(query)\n",
    "nwbeacon_df"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## SUNBURST suspicious SolarWinds child processes"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "ExecuteTime": {
     "end_time": "2020-12-16T18:20:04.300657Z",
     "start_time": "2020-12-16T18:20:03.722124Z"
    }
   },
   "outputs": [],
   "source": [
    "query = sentinel_github_df.loc[\n",
    "    sentinel_github_df[\"name\"] == \"SUNBURST suspicious SolarWinds child processes\"\n",
    "][\"query\"].reset_index(drop=True)[0]\n",
    "print(\"Collecting data...\")\n",
    "swprocess_df = qry_prov.exec_query(query)\n",
    "swprocess_df"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Checking for Solarwinds Servers \n",
    "\n",
    "To hunt for similar TTPs used in this attack, a good place to start is to build an inventory of the machines that have SolarWinds Orion components. Organizations might already have a software inventory management system to indicate hosts where the SolarWinds application is installed. Alternatively, Azure Sentinel could be leveraged to run a simple query to gather similar details. Below query will pull the hosts with SolarWinds process running in last 30 days based on Process execution/Sysmon logs either via host onboarded to Sentinel or onboarded via Microsoft Defender for Endpoints (MDE)\n",
    "\n",
    "## Asset Inventory \n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "ExecuteTime": {
     "end_time": "2020-12-15T22:51:51.988656Z",
     "start_time": "2020-12-15T22:51:48.660679Z"
    }
   },
   "outputs": [],
   "source": [
    "# Gather Solarwinds details based on Process execution Logs from diverse data sources\n",
    "solarwinds_query = f\"\"\"\n",
    "let timeframe = 30d;\n",
    "(union isfuzzy=true\n",
    "  (\n",
    "  SecurityEvent\n",
    "  | where TimeGenerated >= ago(timeframe)\n",
    "  | where EventID == '4688'\n",
    "  | where tolower(NewProcessName) has 'solarwinds'\n",
    "  | extend MachineName = Computer , Process = NewProcessName\n",
    "  ),\n",
    "  (\n",
    "  DeviceProcessEvents\n",
    "  | where TimeGenerated >= ago(timeframe)\n",
    "  | where tolower(InitiatingProcessFolderPath) has 'solarwinds'\n",
    "  | extend MachineName = DeviceName , Process = InitiatingProcessFolderPath\n",
    "  ),\n",
    "  (\n",
    "  Event\n",
    "  | where TimeGenerated >= ago(timeframe)\n",
    "  | where Source == \"Microsoft-Windows-Sysmon\"\n",
    "  | where EventID == 1\n",
    "  | extend Image = EventDetail.[4].[\"#text\"]\n",
    "  | where tolower(Image) has 'solarwinds'\n",
    "  | extend MachineName = Computer , Process = Image\n",
    "  )\n",
    "  )\n",
    "  | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), make_set(Process) by MachineName\n",
    "\"\"\"\n",
    "print(\"Collecting data...\")\n",
    "solarwinds_assets = qry_prov.exec_query(solarwinds_query)\n",
    "md(f'Solarwinds Server Details Gathered', styles=[\"bold\", \"large\"])\n",
    "display(solarwinds_assets)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Lateral Movement"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Hosts with New Logons"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "query = sentinel_github_df.loc[\n",
    "    sentinel_github_df[\"name\"] == \"Hosts with new logons\"\n",
    "][\"query\"].reset_index(drop=True)[0]\n",
    "print(\"Collecting data...\")\n",
    "hostswithnewlogons_df = qry_prov.exec_query(query)\n",
    "hostswithnewlogons_df"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Rare RDP Connections"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "query = sentinel_github_df.loc[\n",
    "    sentinel_github_df[\"name\"] == \"Rare RDP Connections\"\n",
    "][\"query\"].reset_index(drop=True)[0]\n",
    "print(\"Collecting data...\")\n",
    "rarerdp_df = qry_prov.exec_query(query)\n",
    "rarerdp_df"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### RDP Nesting"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "query = sentinel_github_df.loc[\n",
    "    sentinel_github_df[\"name\"] == \"RDP Nesting\"\n",
    "][\"query\"].reset_index(drop=True)[0]\n",
    "print(\"Collecting data...\")\n",
    "rdpnest_df = qry_prov.exec_query(query)\n",
    "rdpnest_df"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "ExecuteTime": {
     "end_time": "2020-12-16T19:23:08.425483Z",
     "start_time": "2020-12-16T19:23:08.423000Z"
    }
   },
   "source": [
    "### Rare application consent"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "ExecuteTime": {
     "end_time": "2020-12-16T19:27:18.186385Z",
     "start_time": "2020-12-16T19:27:16.556190Z"
    }
   },
   "outputs": [],
   "source": [
    "query = sentinel_github_df.loc[\n",
    "    sentinel_github_df[\"name\"] == \"Rare application consent\"\n",
    "][\"query\"].reset_index(drop=True)[0]\n",
    "print(\"Collecting data...\")\n",
    "rareappconsent_df = qry_prov.exec_query(query)\n",
    "rareappconsent_df"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Rare activity  by High Value Account"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "query = sentinel_github_df.loc[\n",
    "    sentinel_github_df[\"name\"] == \"Rare processes run by Service accounts\"\n",
    "][\"query\"].reset_index(drop=True)[0]\n",
    "print(\"Collecting data...\")\n",
    "serviceaccproc_df = qry_prov.exec_query(query)\n",
    "serviceaccproc_df"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Suspicious  Logons\n",
    "\n",
    "If you have suspicious Netblocks not expected in your organization(e.g.VPS Netblocks or Proxy severs) that you want to monior , define it in IP_Data and run below query using `ipv4_lookup` kql function\n",
    "\n",
    "\n",
    "```\n",
    "query = \"\"\"\n",
    "\n",
    "SigninLogs \n",
    "| where TimeGenerated > ago(360d) \n",
    "| where ResultType == 0 \n",
    "| extend additionalDetails = tostring(Status.additionalDetails) \n",
    "| evaluate ipv4_lookup(IP_Data, IPAddress, network, return_unmatched = false) \n",
    "| summarize make_set(additionalDetails), min(TimeGenerated), max(TimeGenerated) by IPAddress, UserPrincipalName \n",
    "| where array_length(set_additionalDetails) == 2 \n",
    "| where (set_additionalDetails[1] == \"MFA requirement satisfied by claim in the token\" and set_additionalDetails[0] == \"MFA requirement satisfied by claim provided by external provider\") or (set_additionalDetails[0] == \"MFA requirement satisfied by claim in the token\" and set_additionalDetails[1] == \"MFA requirement satisfied by claim provided by external provider\") \n",
    "| project IPAddress, UserPrincipalName, min_TimeGenerated, max_TimeGenerated\n",
    "\"\"\"\n",
    "print(\"Collecting data...\")\n",
    "suspmfalogons_df = qry_prov.exec_query(query)\n",
    "suspmfalogons_df\n",
    "```"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Privilege Escalation\n",
    "## New Account Creation and Addition to Privileged groups"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "ExecuteTime": {
     "end_time": "2020-12-16T19:20:30.396779Z",
     "start_time": "2020-12-16T19:20:29.715590Z"
    }
   },
   "outputs": [],
   "source": [
    "query = sentinel_github_df.loc[\n",
    "    sentinel_github_df[\"name\"] == \"New user created and added to the built-in administrators group\"\n",
    "][\"query\"].reset_index(drop=True)[0]\n",
    "print(\"Collecting data...\")\n",
    "newaccprivgroups_df = qry_prov.exec_query(query)\n",
    "newaccprivgroups_df"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## User Added to Azure Active Directory Privileged Groups"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "ExecuteTime": {
     "end_time": "2020-12-16T19:13:57.710595Z",
     "start_time": "2020-12-16T19:13:56.352902Z"
    }
   },
   "outputs": [],
   "source": [
    "query = sentinel_github_df.loc[\n",
    "    sentinel_github_df[\"name\"] == \"User added to Azure Active Directory Privileged Groups\"\n",
    "][\"query\"].reset_index(drop=True)[0]\n",
    "print(\"Collecting data...\")\n",
    "aadprivgroups_df = qry_prov.exec_query(query)\n",
    "aadprivgroups_df"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## ADFS Hunting\n",
    "\n",
    "Below Queries produces results from all Servers. Its is advisable to filter the results for ADFS servers in scope. \n",
    "\n",
    "### Uncommon processes "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "query = sentinel_github_df.loc[\n",
    "    sentinel_github_df[\"name\"] == \"Uncommon processes - bottom 5%\"\n",
    "][\"query\"].reset_index(drop=True)[0]\n",
    "print(\"Collecting data...\")\n",
    "domain_trust_df = qry_prov.exec_query(query)\n",
    "domain_trust_df"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Rare processes run by Service Accounts"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "query = sentinel_github_df.loc[\n",
    "    sentinel_github_df[\"name\"] == \"Rare processes run by Service accounts\"\n",
    "][\"query\"].reset_index(drop=True)[0]\n",
    "print(\"Collecting data...\")\n",
    "serviceaccproc_df = qry_prov.exec_query(query)\n",
    "serviceaccproc_df"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Fireeye Red Team Tools\n",
    "Check out  KQL queries published by Sentinel Community at \n",
    " - https://github.com/FalconForceTeam/FalconFriday/blob/master/Uncategorized/FireEye_red_team_tool_countermeasures.md"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Azure Active Directory Hunting\n",
    "\n",
    "### Domain Federation trust Settings modification\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "ExecuteTime": {
     "end_time": "2020-12-16T18:45:54.742556Z",
     "start_time": "2020-12-16T18:45:52.967980Z"
    }
   },
   "outputs": [],
   "source": [
    "query = sentinel_github_df.loc[\n",
    "    sentinel_github_df[\"name\"] == \"Modified domain federation trust settings\"\n",
    "][\"query\"].reset_index(drop=True)[0]\n",
    "print(\"Collecting data...\")\n",
    "domain_trust_df = qry_prov.exec_query(query)\n",
    "domain_trust_df"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Addition of New Key Credentials to an Application or Service Principal"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "ExecuteTime": {
     "end_time": "2020-12-16T18:48:33.559077Z",
     "start_time": "2020-12-16T18:48:32.554255Z"
    }
   },
   "outputs": [],
   "source": [
    "query = \"\"\"\n",
    "  let auditLookback = 1h;\n",
    "  AuditLogs\n",
    "  | where TimeGenerated > ago(auditLookback)\n",
    "  | where OperationName has_any (\"Add service principal\", \"Certificates and secrets management\") // captures \"Add service principal\", \"Add service principal credentials\", and \"Update application – Certificates and secrets management\" events\n",
    "  | extend targetDisplayName = TargetResources[0].displayName\n",
    "  | extend targetId = TargetResources[0].id\n",
    "  | extend targetType = TargetResources[0].type\n",
    "  | extend keyEvents = TargetResources[0].modifiedProperties\n",
    "  | where keyEvents has \"KeyIdentifier=\" and keyEvents has \"KeyUsage=Verify\"\n",
    "  | where Result =~ \"success\"\n",
    "  | mv-expand keyEvents\n",
    "  | where keyEvents.displayName =~ \"KeyDescription\"\n",
    "  | parse keyEvents.newValue with * \"KeyIdentifier=\" keyIdentifier:string \",KeyType=\" keyType:string \",KeyUsage=\" keyUsage:string \",DisplayName=\" keyDisplayName:string \"]\" *\n",
    "  | parse keyEvents.oldValue with * \"KeyIdentifier=\" keyIdentifierOld:string \",\" *\n",
    "  | where keyEvents.oldValue == \"[]\" or keyIdentifier != keyIdentifierOld\n",
    "  | where keyUsage == \"Verify\"\n",
    "  | extend UserAgent = iff(AdditionalDetails[0].key == \"User-Agent\",AdditionalDetails[0].value,\"\")\n",
    "  | extend InitiatingUser = iff(isnotempty(InitiatedBy.user.userPrincipalName),InitiatedBy.user.userPrincipalName, InitiatedBy.app.displayName)\n",
    "  | extend InitiatingIpAddress = iff(isnotempty(InitiatedBy.user.ipAddress), InitiatedBy.user.ipAddress, InitiatedBy.app.ipAddress)\n",
    "  // \n",
    "  // Adding the below filter for detection-quality events; Sentinel users can comment out this line and tune additional service principal events for their environment\n",
    "  | where targetType =~ \"Application\"\n",
    "\"\"\"\n",
    "print(\"Collecting data...\")\n",
    "newkeycreds_df = qry_prov.exec_query(query)\n",
    "newkeycreds_df"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Suspicious Application Consent"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "ExecuteTime": {
     "end_time": "2020-12-16T18:50:45.580748Z",
     "start_time": "2020-12-16T18:50:44.389349Z"
    }
   },
   "outputs": [],
   "source": [
    "query = sentinel_github_df.loc[\n",
    "    sentinel_github_df[\"name\"] == \"Suspicious application consent similar to O365 Attack Toolkit\"\n",
    "][\"query\"].reset_index(drop=True)[0]\n",
    "print(\"Collecting data...\")\n",
    "o365toolkit_df = qry_prov.exec_query(query)\n",
    "o365toolkit_df"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "ExecuteTime": {
     "end_time": "2020-12-16T18:51:22.522931Z",
     "start_time": "2020-12-16T18:51:21.424873Z"
    }
   },
   "outputs": [],
   "source": [
    "query = sentinel_github_df.loc[\n",
    "    sentinel_github_df[\"name\"] == \"Suspicious application consent similar to PwnAuth\"\n",
    "][\"query\"].reset_index(drop=True)[0]\n",
    "print(\"Collecting data...\")\n",
    "o365pwnauth_df = qry_prov.exec_query(query)\n",
    "o365pwnauth_df"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Data Acccess and Exfiltration\n",
    "\n",
    "### Azure Active Directory PowerShell to access non-Active Directory Resources"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "ExecuteTime": {
     "end_time": "2020-12-16T18:30:43.152632Z",
     "start_time": "2020-12-16T18:30:41.130766Z"
    }
   },
   "outputs": [],
   "source": [
    "query = sentinel_github_df.loc[\n",
    "    sentinel_github_df[\"name\"] == \"Azure Active Directory PowerShell accessing non-AAD resources\"\n",
    "][\"query\"].reset_index(drop=True)[0]\n",
    "print(\"Collecting data...\")\n",
    "adpowershell_df = qry_prov.exec_query(query)\n",
    "adpowershell_df"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Anomalous increase in Exchange Mail Items Accesed"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "ExecuteTime": {
     "end_time": "2020-12-16T18:42:22.052149Z",
     "start_time": "2020-12-16T18:42:19.877046Z"
    }
   },
   "outputs": [],
   "source": [
    "query = sentinel_github_df.loc[\n",
    "    sentinel_github_df[\"id\"] == \"b4ceb583-4c44-4555-8ecf-39f572e827ba\"\n",
    "][\"query\"].reset_index(drop=True)[0]\n",
    "print(\"Collecting data...\")\n",
    "timeseriesmail_df = qry_prov.exec_query(query)\n",
    "timeseriesmail_df"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Resources\n",
    "\n",
    "- Read the [Get Started](https://nbviewer.jupyter.org/github/Azure/Azure-Sentinel-Notebooks/blob/master/A%20Getting%20Started%20Guide%20For%20Azure%20Sentinel%20ML%20Notebooks.ipynb) notebook.\n",
    "- View sample notebooks in the [Sample-Notebooks](https://github.com/Azure/Azure-Sentinel-Notebooks/tree/master/Sample-Notebooks) folder\n",
    "- View How-tos and Troubleshooting in the [HowTos](https://github.com/Azure/Azure-Sentinel-Notebooks/tree/master/HowTos) folder\n",
    "- https://msticpy.readthedocs.io/en/latest/GettingStarted.html\n",
    "- https://msticnb.readthedocs.io/en/latest/notebooklets.html#current-notebooklets\n",
    "\n",
    "- [Recent Nation-State Cyber Attacks](https://blogs.microsoft.com/on-the-issues/2020/12/13/customers-protect-nation-state-cyberattacks/)\n",
    "\n",
    "- [Behavior:Win32/Solorigate.C!dha threat description - Microsoft Security Intelligence ](https://blogs.microsoft.com/on-the-issues/2020/12/13/customers-protect-nation-state-cyberattacks/)\n",
    "\n",
    "- [Customer guidance on recent nation-state cyberattacks](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Behavior:Win32/Solorigate.C!dha&ThreatID=2147771132)\n",
    "\n",
    "- [FireEye Advisory: Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims With SUNBURST Backdoor ](https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html)\n",
    "\n",
    "- [FireEye GitHub page: Sunburst Countermeasures  ](https://github.com/fireeye/sunburst_countermeasures)\n",
    "\n",
    "- [DHS Directive ](https://cyber.dhs.gov/ed/21-01/)\n",
    "\n",
    "- [SolarWinds Security Advisory ](https://www.solarwinds.com/securityadvisory)\n",
    "\n",
    "- [FalconFriday – Fireeye Red Team Tool Countermeasures KQL Queries   ](https://github.com/FalconForceTeam/FalconFriday/blob/master/Uncategorized/FireEye_red_team_tool_countermeasures.md)\n",
    "\n",
    "- [microsoft/Microsoft-365-Defender-Hunting-Queries: Sample queries for Advanced hunting in Microsoft 365 Defender (github.com) ](https://github.com/microsoft/Microsoft-365-Defender-Hunting-Queries)\n",
    "\n",
    "- [Azure Sentinel SolarWinds Post Compromise Hunting Workbook](https://github.com/Azure/Azure-Sentinel/blob/master/Workbooks/SolarWindsPostCompromiseHunting.json)\n",
    "\n",
    "- [https://security.microsoft.com/threatanalytics3/2b74f636-146e-48dd-94f6-5cb5132467ca/overview]"
   ]
  }
 ],
 "metadata": {
  "hide_input": false,
  "kernelspec": {
   "display_name": "Python 3",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.7.6"
  },
  "toc": {
   "base_numbering": 1,
   "nav_menu": {},
   "number_sections": false,
   "sideBar": true,
   "skip_h1_title": false,
   "title_cell": "Table of Contents",
   "title_sidebar": "Contents",
   "toc_cell": true,
   "toc_position": {
    "height": "calc(100% - 180px)",
    "left": "10px",
    "top": "150px",
    "width": "257.323px"
   },
   "toc_section_display": true,
   "toc_window_display": true
  },
  "varInspector": {
   "cols": {
    "lenName": 16,
    "lenType": 16,
    "lenVar": 40
   },
   "kernels_config": {
    "python": {
     "delete_cmd_postfix": "",
     "delete_cmd_prefix": "del ",
     "library": "var_list.py",
     "varRefreshCmd": "print(var_dic_list())"
    },
    "r": {
     "delete_cmd_postfix": ") ",
     "delete_cmd_prefix": "rm(",
     "library": "var_list.r",
     "varRefreshCmd": "cat(var_dic_list()) "
    }
   },
   "types_to_exclude": [
    "module",
    "function",
    "builtin_function_or_method",
    "instance",
    "_Feature"
   ],
   "window_display": false
  }
 },
 "nbformat": 4,
 "nbformat_minor": 4
}