勒索软件横向移动与数据渗出取证深度分析

Get-WinEvent -LogName "Microsoft-Windows-Sysmon/Operational" -FilterXPath "*[System[(EventID=10)]]" | Where-Object { $_.Properties[5].Value -match "lsass\.exe" -and $_.Properties[8].Value -ne "0x1010" -and $_.Properties[8].Value -ne "0x1410" } | Select-Object TimeCreated, @{N='SourceProcess';E={$_.Properties[1].Value}}, @{N='SourcePID';E={$_.Properties[3].Value}}, @{N='AccessMask';E={$_.Properties[8].Value}}, @{N='SourceUser';E={$_.Properties[13].Value}} | Format-Table -AutoSize

Get-WinEvent -FilterHashtable @{LogName='Security';ID=4662} | Where-Object { $_.Properties[8].Value -match '1131f6ad-9c07-11d1-f79f-00c04fc2dcd2' } | Select-Object TimeCreated, @{N='SubjectUser';E={$_.Properties[1].Value}}, @{N='SubjectDomain';E={$_.Properties[2].Value}}, @{N='SourceIP';E={$_.Properties[18].Value}}, @{N='ObjectDN';E={$_.Properties[7].Value}} | Format-Table -AutoSize

Get-WinEvent -FilterHashtable @{LogName='Security';ID=4768,4769,4771} | Where-Object { $_.Id -eq 4769 -and $_.Properties[8].Value -ne '0x0' -and ($_.Properties[8].Value -band 0x40000000 -ne 0) } | Select-Object TimeCreated, @{N='TargetUser';E={$_.Properties[0].Value}}, @{N='ServiceName';E={$_.Properties[2].Value}}, @{N='TicketEncryption';E={$_.Properties[8].Value}}, @{N='ClientAddress';E={$_.Properties[6].Value}} | Format-Table -AutoSize

Get-WinEvent -LogName "Microsoft-Windows-PowerShell/Operational" -FilterXPath "*[System[(EventID=4104)]]" | Where-Object { $_.Properties[2].Value -match 'Invoke-Command|Enter-PSSession|New-PSSession|Invoke-Expression' } | Select-Object TimeCreated, @{N='ScriptBlock';E={$_.Properties[2].Value}} | Format-List

#!/bin/bash
TARGET_DIR="${1:-.}"
OUTPUT_FILE="lateral_movement_iocs_$(date +%Y%m%d_%H%M%S).csv"
echo "Timestamp,EventID,LogonType,SourceIP,TargetUser,SourceProcess,CommandLine,Description" > "$OUTPUT_FILE"
find "$TARGET_DIR" -name "*.evtx" -type f 2>/dev/null | while read -r evtx_file; do
    python3 -c "
import subprocess, xml.etree.ElementTree as ET
ns = {'e': 'http://schemas.microsoft.com/win/2004/08/events/event'}
try:
    result = subprocess.run(['evtx_dump', '$evtx_file'], capture_output=True, text=True, timeout=30)
    if result.returncode != 0:
        result = subprocess.run(['python3', '-m', 'evtx', '$evtx_file'], capture_output=True, text=True, timeout=30)
except:
    pass
" 2>/dev/null
done
echo "[+] Lateral movement IOC extraction complete. Output: $OUTPUT_FILE"

import xml.etree.ElementTree as ET
import csv
import sys
import os
from datetime import datetime

NS = {'e': 'http://schemas.microsoft.com/win/2004/08/events/event'}
KNOWN_DC_IPS = set()
KNOWN_ADMIN_TERMINALS = set()
LATERAL_MOVEMENT_IICS = []

def parse_event_xml(xml_file):
    events = []
    try:
        tree = ET.parse(xml_file)
        root = tree.getroot()
        for event in root.findall('.//e:Event', NS):
            event_id = event.find('.//e:System/e:EventID', NS)
            if event_id is None:
                continue
            eid = int(event_id.text)
            time_created = event.find('.//e:System/e:TimeCreated', NS)
            timestamp = time_created.get('SystemTime') if time_created is not None else ''
            data_fields = {}
            for data in event.findall('.//e:EventData/e:Data', NS):
                name = data.get('Name', '')
                value = data.text if data.text else ''
                data_fields[name] = value
            events.append({'EventID': eid, 'Timestamp': timestamp, 'Data': data_fields})
    except Exception as e:
        print(f"Error parsing {xml_file}: {e}")
    return events

def detect_pth(events):
    findings = []
    for evt in events:
        if evt['EventID'] == 4624:
            data = evt['Data']
            logon_type = data.get('LogonType', '')
            auth_package = data.get('AuthenticationPackageName', '')
            src_ip = data.get('IpAddress', '')
            target_user = data.get('TargetUserName', '')
            if logon_type == '3' and auth_package == 'NTLM' and src_ip and src_ip != '-' and src_ip not in KNOWN_DC_IPS:
                findings.append({
                    'Timestamp': evt['Timestamp'],
                    'Type': 'Potential_PtH',
                    'SourceIP': src_ip,
                    'TargetUser': target_user,
                    'LogonType': logon_type,
                    'AuthPackage': auth_package,
                    'Severity': 'HIGH'
                })
    return findings

def detect_wmi_lateral(events):
    findings = []
    for evt in events:
        if evt['EventID'] == 4688:
            data = evt['Data']
            cmdline = data.get('NewProcessCommandLine', '')
            process_name = data.get('NewProcessName', '')
            if 'wmic.exe' in process_name.lower() and '/node:' in cmdline.lower():
                findings.append({
                    'Timestamp': evt['Timestamp'],
                    'Type': 'WMI_Lateral',
                    'CommandLine': cmdline[:200],
                    'ParentProcess': data.get('ParentProcessName', ''),
                    'Severity': 'HIGH'
                })
            elif 'powershell.exe' in process_name.lower() and ('invoke-command' in cmdline.lower() or 'invoke-wmimethod' in cmdline.lower()):
                findings.append({
                    'Timestamp': evt['Timestamp'],
                    'Type': 'PSRemoting_Lateral',
                    'CommandLine': cmdline[:200],
                    'ParentProcess': data.get('ParentProcessName', ''),
                    'Severity': 'MEDIUM'
                })
    return findings

def detect_psexec(events):
    findings = []
    service_events = [e for e in events if e['EventID'] in (4697, 7045)]
    for evt in service_events:
        data = evt['Data']
        svc_name = data.get('ServiceName', data.get('NewServiceName', ''))
        svc_path = data.get('ImagePath', data.get('NewProcessCommandLine', ''))
        if 'psexesvc' in svc_name.lower() or 'admin$' in svc_path.lower():
            findings.append({
                'Timestamp': evt['Timestamp'],
                'Type': 'PsExec_Detection',
                'ServiceName': svc_name,
                'ServicePath': svc_path[:200],
                'Severity': 'HIGH'
            })
    return findings

def main():
    if len(sys.argv) < 2:
        print(f"Usage: {sys.argv[0]} <evtx_file_or_directory>")
        sys.exit(1)
    target = sys.argv[1]
    all_events = []
    if os.path.isfile(target):
        all_events = parse_event_xml(target)
    elif os.path.isdir(target):
        for root_dir, dirs, files in os.walk(target):
            for f in files:
                if f.endswith('.evtx') or f.endswith('.xml'):
                    filepath = os.path.join(root_dir, files)
                    all_events.extend(parse_event_xml(filepath))
    print(f"[*] Parsed {len(all_events)} events total")
    all_findings = []
    all_findings.extend(detect_pth(all_events))
    all_findings.extend(detect_wmi_lateral(all_events))
    all_findings.extend(detect_psexec(all_events))
    output_csv = f"lateral_movement_findings_{datetime.now().strftime('%Y%m%d_%H%M%S')}.csv"
    if all_findings:
        with open(output_csv, 'w', newline='', encoding='utf-8') as csvfile:
            writer = csv.DictWriter(csvfile, fieldnames=all_findings[0].keys())
            writer.writeheader()
            writer.writerows(all_findings)
        print(f"[+] Found {len(all_findings)} potential lateral movement indicators")
        print(f"[+] Results saved to {output_csv}")
    else:
        print("[-] No lateral movement indicators found")

if __name__ == '__main__':
    main()

Get-WinEvent -FilterHashtable @{LogName='Security';ID=4769} | Group-Object { $_.Properties[0].Value } | Where-Object { $_.Count -gt 10 } | Select-Object Count, @{N='User';E={$_.Name}}, @{N='TimeRange';E={"$($_.Group[-1].TimeCreated) - $($_.Group[0].TimeCreated)"}} | Sort-Object Count -Descending | Format-Table -AutoSize

import-module ActiveDirectory
$high_priv_groups = @('Domain Admins','Enterprise Admins','Schema Admins','Administrators','Account Operators')
foreach ($group in $high_priv_groups) {
    $acl = Get-Acl "AD:\CN=$group,CN=Users,DC=domain,DC=com" -ErrorAction SilentlyContinue
    if ($acl) {
        foreach ($ace in $acl.Access) {
            $identity = $ace.IdentityReference.Translate([System.Security.Principal.NTAccount], $null)
            if ($identity -notmatch 'BUILTIN|NT AUTHORITY|Domain Admins|Enterprise Admins') {
                Write-Output "[ALERT] $group - $($identity.Value) - $($ace.ActiveDirectoryRights) - $($ace.AccessControlType)"
            }
        }
    }
}

import re
import sys
import json
from collections import defaultdict
from datetime import datetime

def calculate_entropy(s):
    if not s:
        return 0
    freq = defaultdict(int)
    for c in s:
        freq[c] += 1
    length = len(s)
    entropy = 0
    for count in freq.values():
        p = count / length
        if p > 0:
            import math
            entropy -= p * math.log2(p)
    return entropy

def detect_dns_tunnel(dns_log_file):
    findings = []
    domain_queries = defaultdict(lambda: {'count': 0, 'avg_length': 0, 'txt_count': 0, 'total_length': 0})
    suspicious_threshold_length = 60
    suspicious_threshold_entropy = 3.5
    suspicious_threshold_frequency = 500
    with open(dns_log_file, 'r') as f:
        for line in f:
            try:
                parts = line.strip().split('\t')
                if len(parts) < 5:
                    continue
                timestamp = parts[0]
                query_name = parts[3].rstrip('.')
                query_type = parts[4]
                parts_list = query_name.split('.')
                subdomain = '.'.join(parts_list[:-2]) if len(parts_list) > 2 else query_name
                parent_domain = '.'.join(parts_list[-2:]) if len(parts_list) > 2 else query_name
                domain_queries[parent_domain]['count'] += 1
                domain_queries[parent_domain]['total_length'] += len(subdomain)
                if query_type == 'TXT':
                    domain_queries[parent_domain]['txt_count'] += 1
            except Exception:
                continue
    for domain, stats in domain_queries.items():
        if stats['count'] > 0:
            stats['avg_length'] = stats['total_length'] / stats['count']
        txt_ratio = stats['txt_count'] / max(stats['count'], 1)
        alerts = []
        if stats['count'] > suspicious_threshold_frequency:
            alerts.append(f"高频查询: {stats['count']}次")
        if stats['avg_length'] > suspicious_threshold_length:
            alerts.append(f"子域名过长: 平均{stats['avg_length']:.0f}字符")
        if txt_ratio > 0.3:
            alerts.append(f"TXT记录占比高: {txt_ratio:.1%}")
        if alerts:
            avg_entropy = calculate_entropy(domain)
            findings.append({
                'domain': domain,
                'total_queries': stats['count'],
                'avg_subdomain_length': round(stats['avg_length'], 1),
                'txt_ratio': round(txt_ratio, 3),
                'entropy': round(avg_entropy, 2),
                'alerts': alerts
            })
    findings.sort(key=lambda x: x['total_queries'], reverse=True)
    return findings

if __name__ == '__main__':
    if len(sys.argv) < 2:
        print(f"Usage: {sys.argv[0]} <dns_log_file>")
        sys.exit(1)
    results = detect_dns_tunnel(sys.argv[1])
    if results:
        print(f"[+] Found {len(results)} potentially suspicious DNS domains:")
        for r in results[:20]:
            print(f"\n  Domain: {r['domain']}")
            print(f"    Queries: {r['total_queries']}, Avg Length: {r['avg_subdomain_length']}, TXT Ratio: {r['txt_ratio']}")
            print(f"    Alerts: {', '.join(r['alerts'])}")
    else:
        print("[-] No suspicious DNS tunnel indicators found")

import json
import sys
from collections import defaultdict

def analyze_ja3_from_zeek(ja3_log_file):
    ja3_clients = defaultdict(lambda: {'count': 0, 'dest_ips': set(), 'dest_ports': set(), 'first_seen': None, 'last_seen': None, 'total_bytes': 0})
    suspicious_ja3 = {
        '72a589da586844d7f0818ce684948eea': 'Cobalt Strike',
        'a0e9f5d64349fb13191bc781f81f42e1': 'Cobalt Strike (malleable)',
        '51c64c77e60f3980eea90869b68c58a8': 'Rclone',
    }
    with open(ja3_log_file, 'r') as f:
        for line in f:
            try:
                record = json.loads(line.strip())
                ja3_hash = record.get('ja3', {}).get('hash', record.get('ja3_hash', ''))
                src_ip = record.get('id.orig_h', record.get('src_ip', ''))
                dest_ip = record.get('id.resp_h', record.get('dest_ip', ''))
                dest_port = record.get('id.resp_p', record.get('dest_port', 0))
                ts = record.get('ts', record.get('timestamp', ''))
                if not ja3_hash:
                    continue
                ja3_clients[ja3_hash]['count'] += 1
                ja3_clients[ja3_hash]['dest_ips'].add(dest_ip)
                ja3_clients[ja3_hash]['dest_ports'].add(str(dest_port))
                if ja3_clients[ja3_hash]['first_seen'] is None or ts < ja3_clients[ja3_hash]['first_seen']:
                    ja3_clients[ja3_hash]['first_seen'] = ts
                if ja3_clients[ja3_hash]['last_seen'] is None or ts > ja3_clients[ja3_hash]['last_seen']:
                    ja3_clients[ja3_hash]['last_seen'] = ts
            except json.JSONDecodeError:
                continue
    print(f"[*] Analyzed {len(ja3_clients)} unique JA3 fingerprints\n")
    print(f"{'JA3 Hash':<40} {'Count':<10} {'Dest IPs':<10} {'Known Tool':<25}")
    print("-" * 95)
    for ja3_hash, stats in sorted(ja3_clients.items(), key=lambda x: x[1]['count'], reverse=True):
        known_tool = suspicious_ja3.get(ja3_hash, 'Unknown')
        flag = ' ***' if known_tool != 'Unknown' else ''
        print(f"{ja3_hash:<40} {stats['count']:<10} {len(stats['dest_ips']):<10} {known_tool}{flag}")

if __name__ == '__main__':
    if len(sys.argv) < 2:
        print(f"Usage: {sys.argv[0]} <zeek_ja3_log>")
        sys.exit(1)
    analyze_ja3_from_zeek(sys.argv[1])

import json
import hashlib
import sys
import os
from datetime import datetime

def extract_file_iocs(file_path):
    iocs = {
        'md5': set(),
        'sha1': set(),
        'sha256': set(),
        'filenames': set(),
        'mutexes': set(),
        'registry_keys': set(),
        'domains': set(),
        'ips': set(),
    }
    if os.path.isfile(file_path):
        with open(file_path, 'rb') as f:
            content = f.read()
            iocs['md5'].add(hashlib.md5(content).hexdigest())
            iocs['sha1'].add(hashlib.sha1(content).hexdigest())
            iocs['sha256'].add(hashlib.sha256(content).hexdigest())
    return iocs

def generate_stix_bundle(iocs, case_id, threat_actor):
    stix_bundle = {
        'type': 'bundle',
        'id': f"bundle--{hashlib.md5(case_id.encode()).hexdigest()}",
        'objects': []
    }
    threat_actor_obj = {
        'type': 'threat-actor',
        'id': f"threat-actor--{hashlib.md5(threat_actor.encode()).hexdigest()}",
        'created': datetime.utcnow().strftime('%Y-%m-%dT%H:%M:%SZ'),
        'modified': datetime.utcnow().strftime('%Y-%m-%dT%H:%M:%SZ'),
        'name': threat_actor,
        'threat_actor_types': ['criminal'],
        'first_seen': datetime.utcnow().strftime('%Y-%m-%dT%H:%M:%SZ'),
    }
    stix_bundle['objects'].append(threat_actor_obj)
    for sha256 in iocs.get('sha256', set()):
        malware_obj = {
            'type': 'malware',
            'id': f"malware--{sha256[:32]}",
            'created': datetime.utcnow().strftime('%Y-%m-%dT%H:%M:%SZ'),
            'modified': datetime.utcnow().strftime('%Y-%m-%dT%H:%M:%SZ'),
            'name': f"Ransomware_{case_id}",
            'is_family': False,
            'hashes': {'SHA-256': sha256},
            'object_marking_refs': ['marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9'],
        }
        stix_bundle['objects'].append(malware_obj)
    for domain in iocs.get('domains', set()):
        indicator_obj = {
            'type': 'indicator',
            'id': f"indicator--{hashlib.md5(domain.encode()).hexdigest()}",
            'created': datetime.utcnow().strftime('%Y-%m-%dT%H:%M:%SZ'),
            'modified': datetime.utcnow().strftime('%Y-%m-%dT%H:%M:%SZ'),
            'name': f"C2 Domain: {domain}",
            'pattern': f"[domain-name:value = '{domain}']",
            'pattern_type': 'stix',
            'valid_from': datetime.utcnow().strftime('%Y-%m-%dT%H:%M:%SZ'),
            'indicator_types': ['malicious-activity'],
        }
        stix_bundle['objects'].append(indicator_obj)
    for ip in iocs.get('ips', set()):
        indicator_obj = {
            'type': 'indicator',
            'id': f"indicator--{hashlib.md5(ip.encode()).hexdigest()}",
            'created': datetime.utcnow().strftime('%Y-%m-%dT%H:%M:%SZ'),
            'modified': datetime.utcnow().strftime('%Y-%m-%dT%H:%M:%SZ'),
            'name': f"C2 IP: {ip}",
            'pattern': f"[ipv4-addr:value = '{ip}']",
            'pattern_type': 'stix',
            'valid_from': datetime.utcnow().strftime('%Y-%m-%dT%H:%M:%SZ'),
            'indicator_types': ['malicious-activity'],
        }
        stix_bundle['objects'].append(indicator_obj)
    return stix_bundle

def main():
    if len(sys.argv) < 4:
        print(f"Usage: {sys.argv[0]} <case_id> <threat_actor> <ioc_file_or_dir>")
        sys.exit(1)
    case_id = sys.argv[1]
    threat_actor = sys.argv[2]
    target = sys.argv[3]
    all_iocs = {'md5': set(), 'sha1': set(), 'sha256': set()}
    if os.path.isfile(target):
        all_iocs = extract_file_iocs(target)
    elif os.path.isdir(target):
        for root_dir, dirs, files in os.walk(target):
            for f in files:
                fpath = os.path.join(root_dir, f)
                file_iocs = extract_file_iocs(fpath)
                for key in all_iocs:
                    all_iocs[key].update(file_iocs[key])
    stix = generate_stix_bundle(all_iocs, case_id, threat_actor)
    output_file = f"ioc_bundle_{case_id}_{datetime.now().strftime('%Y%m%d')}.json"
    with open(output_file, 'w') as f:
        json.dump(stix, f, indent=2)
    print(f"[+] Generated STIX bundle with {len(stix['objects'])} objects")
    print(f"[+] Output: {output_file}")
    for key, values in all_iocs.items():
        if values:
            print(f"    {key}: {len(values)} indicators")

if __name__ == '__main__':
    main()

title: Potential Pass-the-Hash Attack Detection
id: c3a7e5f2-8b1d-4a6e-9f3c-2d5e8a7b1c4d
status: experimental
description: Detects potential Pass-the-Hash lateral movement by identifying NTLM network logons from non-standard sources targeting privileged accounts
references:
  - https://attack.mitre.org/techniques/T1550/002/
author: x7peeps Forensics Team
date: 2026-07-16
modified: 2026-07-16
tags:
  - attack.lateral_movement
  - attack.t1550.002
  - attack.defense_evasion
  - credential_access
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4624
    LogonType: 3
    AuthenticationPackageName: NTLM
    LogonProcessName: NtLmSsp
  filter_known_dcs:
   IpAddress|endswith:
      - '.1'
      - '.2'
      - '.254'
  filter_anonymous:
    TargetUserName: 'ANONYMOUS LOGON'
  filter_system:
    TargetUserName|endswith:
      - '$'
  condition: selection and not filter_known_dcs and not filter_anonymous and not filter_system
level: high
falsepositives:
  - Legitimate NTLM authentication from application servers
  - SQL Server linked server connections
  - Exchange Server inter-server authentication

title: DNS Tunneling Data Exfiltration Detection
id: f8d2e1a3-5c7b-4f9e-a1d6-3b8c2e7f9a5d
status: experimental
description: Detects potential DNS tunneling for data exfiltration based on high-frequency DNS queries with unusually long subdomains
references:
  - https://attack.mitre.org/techniques/T1048/003/
author: x7peeps Forensics Team
date: 2026-07-16
modified: 2026-07-16
tags:
  - attack.exfiltration
  - attack.t1048.003
  - attack.command_and_control
logsource:
  product: windows
  service: sysmon
detection:
  selection_txt:
    EventID: 22
    QueryName|re: '^[a-zA-Z0-9+/=]{50,}\.'
  selection_high_freq:
    EventID: 22
    QueryType: 'TXT'
  condition: selection_txt or selection_high_freq
level: high
falsepositives:
  - Legitimate DNS-based services with long subdomain records
  - DKIM/SPF TXT record lookups

#!/bin/bash
LOG_DIR="${1:-/opt/forensics/logs}"
REPORT_DIR="/opt/forensics/reports/$(date +%Y%m%d_%H%M%S)"
mkdir -p "$REPORT_DIR"
LATERAL_IOC_FILE="$REPORT_DIR/lateral_movement.csv"
EXFIL_IOC_FILE="$REPORT_DIR/data_exfiltration.csv"
SUSPICIOUS_SVC_FILE="$REPORT_DIR/suspicious_services.csv"
echo "Timestamp,EventID,SourceIP,TargetUser,ProcessName,CommandLine,RiskLevel" > "$LATERAL_IOC_FILE"
echo "Timestamp,SourceHost,DestHost,Protocol,BytesTransferred,Domain,RiskLevel" > "$EXFIL_IOC_FILE"
echo "Timestamp,ServiceName,ServicePath,EventSource,RiskLevel" > "$SUSPICIOUS_SVC_FILE"
echo "[*] Starting ransomware lateral movement and exfiltration IOC extraction"
echo "[*] Log directory: $LOG_DIR"
echo "[*] Report directory: $REPORT_DIR"
LATERAL_COUNT=0
EXFIL_COUNT=0
SVC_COUNT=0
find "$LOG_DIR" -type f \( -name "*.xml" -o -name "*.evtx" \) 2>/dev/null | while read -r logfile; do
    if [[ "$logfile" == *.xml ]]; then
        grep -l "EventID" "$logfile" 2>/dev/null | head -1 > /dev/null
        grep -oP 'EventID>\K[0-9]+' "$logfile" 2>/dev/null | sort -u | while read -r eid; do
            case "$eid" in
                4624)
                    grep -A2 "LogonType.*>3<" "$logfile" 2>/dev/null | grep -q "NTLM" && {
                        src_ip=$(grep -oP 'IpAddress>\K[^<]+' "$logfile" 2>/dev/null | head -1)
                        target_user=$(grep -oP 'TargetUserName>\K[^<]+' "$logfile" 2>/dev/null | head -1)
                        echo "$(date -Iseconds),$eid,$src_ip,$target_user,,,,HIGH" >> "$LATERAL_IOC_FILE"
                        LATERAL_COUNT=$((LATERAL_COUNT + 1))
                    }
                    ;;
                4688)
                    cmdline=$(grep -oP 'NewProcessCommandLine>\K[^<]+' "$logfile" 2>/dev/null | grep -iE 'mimikatz|sekurlsa|reg\.exe.*save|vssadmin.*delete|wmic.*\/node|invoke-command|invoke-wmimethod' | head -1)
                    if [ -n "$cmdline" ]; then
                        process=$(grep -oP 'NewProcessName>\K[^<]+' "$logfile" 2>/dev/null | head -1)
                        echo "$(date -Iseconds),$eid,,$process,$cmdline,HIGH" >> "$LATERAL_IOC_FILE"
                        LATERAL_COUNT=$((LATERAL_COUNT + 1))
                    fi
                    ;;
                4662)
                    grep -q "1131f6ad-9c07-11d1-f79f-00c04fc2dcd2" "$logfile" 2>/dev/null && {
                        user=$(grep -oP 'SubjectUserName>\K[^<]+' "$logfile" 2>/dev/null | head -1)
                        echo "$(date -Iseconds),$eid,,$user,,,,CRITICAL" >> "$LATERAL_IOC_FILE"
                        LATERAL_COUNT=$((LATERAL_COUNT + 1))
                    }
                    ;;
                4697|7045)
                    svc_name=$(grep -oP 'ServiceName>\K[^<]+' "$logfile" 2>/dev/null | head -1)
                    svc_path=$(grep -oP 'ImagePath>\K[^<]+' "$logfile" 2>/dev/null | head -1)
                    echo "$svc_name" | grep -qiE 'psexesvc|random' && {
                        echo "$(date -Iseconds),$svc_name,$svc_path,$logfile,HIGH" >> "$SUSPICIOUS_SVC_FILE"
                        SVC_COUNT=$((SVC_COUNT + 1))
                    }
                    ;;
            esac
        done
    fi
done
echo "[*] Extraction complete:"
echo "    Lateral movement IOCs: $LATERAL_COUNT"
echo "    Data exfiltration IOCs: $EXFIL_COUNT"
echo "    Suspicious services: $SVC_COUNT"
echo "[+] Reports saved to $REPORT_DIR"

import xml.etree.ElementTree as ET
import csv
import sys
import os
import json
import hashlib
from datetime import datetime
from collections import defaultdict

NS = {'e': 'http://schemas.microsoft.com/win/2004/08/events/event'}
KNOWN_DC_IPS = {'10.0.0.1', '10.0.0.2'}
KNOWN_MGMT_SUBNETS = ['10.0.100.']

class RansomwareForensicsEngine:
    def __init__(self):
        self.findings = []
        self.timeline = []
        self.iocs = {'hashes': set(), 'ips': set(), 'domains': set(), 'users': set()}
        self.stats = {
            'total_events': 0,
            'ptH_attempts': 0,
            'wmi_lateral': 0,
            'psexec_detections': 0,
            'dcsync_alerts': 0,
            'kerberos_anomalies': 0,
            'exfiltration_indicators': 0,
            'dns_tunnel_suspects': 0,
        }

    def parse_evtx_xml(self, xml_path):
        events = []
        try:
            tree = ET.parse(xml_path)
            root = tree.getroot()
            for event in root.findall('.//e:Event', NS):
                eid_elem = event.find('.//e:System/e:EventID', NS)
                if eid_elem is None:
                    continue
                eid = int(eid_elem.text)
                ts_elem = event.find('.//e:System/e:TimeCreated', NS)
                ts = ts_elem.get('SystemTime', '') if ts_elem is not None else ''
                data = {}
                for d in event.findall('.//e:EventData/e:Data', NS):
                    data[d.get('Name', '')] = d.text if d.text else ''
                events.append({'id': eid, 'ts': ts, 'data': data})
            self.stats['total_events'] += len(events)
        except Exception as e:
            print(f"[!] Error parsing {xml_path}: {e}")
        return events

    def detect_pass_the_hash(self, events):
        for evt in events:
            if evt['id'] != 4624:
                continue
            d = evt['data']
            lt = d.get('LogonType', '')
            auth = d.get('AuthenticationPackageName', '')
            ip = d.get('IpAddress', '')
            user = d.get('TargetUserName', '')
            if lt == '3' and auth == 'NTLM' and ip and ip != '-' and ip not in KNOWN_DC_IPS:
                if not user.endswith('$') and user != 'ANONYMOUS LOGON':
                    self.findings.append({
                        'timestamp': evt['ts'], 'type': 'Pass-the-Hash',
                        'source_ip': ip, 'target_user': user,
                        'severity': 'HIGH', 'mitre': 'T1550.002'
                    })
                    self.stats['ptH_attempts'] += 1
                    self.iocs['ips'].add(ip)
                    self.iocs['users'].add(user)

    def detect_wmi_lateral(self, events):
        for evt in events:
            if evt['id'] != 4688:
                continue
            d = evt['data']
            cmdline = d.get('NewProcessCommandLine', '')
            proc = d.get('NewProcessName', '').lower()
            if 'wmic.exe' in proc and '/node:' in cmdline.lower():
                self.findings.append({
                    'timestamp': evt['ts'], 'type': 'WMI_Lateral',
                    'command_line': cmdline[:300], 'severity': 'HIGH', 'mitre': 'T1047'
                })
                self.stats['wmi_lateral'] += 1
            elif 'powershell.exe' in proc:
                if any(kw in cmdline.lower() for kw in ['invoke-command', 'invoke-wmimethod', 'enter-pssession']):
                    self.findings.append({
                        'timestamp': evt['ts'], 'type': 'PSRemoting_Lateral',
                        'command_line': cmdline[:300], 'severity': 'HIGH', 'mitre': 'T1021.006'
                    })
                    self.stats['wmi_lateral'] += 1

    def detect_dcsync(self, events):
        for evt in events:
            if evt['id'] != 4662:
                continue
            d = evt['data']
            props = d.get('Properties', '')
            if '1131f6ad-9c07-11d1-f79f-00c04fc2dcd2' in props:
                user = d.get('SubjectUserName', '')
                obj_dn = d.get('ObjectDN', '')
                self.findings.append({
                    'timestamp': evt['ts'], 'type': 'DCSync',
                    'user': user, 'target': obj_dn,
                    'severity': 'CRITICAL', 'mitre': 'T1003.006'
                })
                self.stats['dcsync_alerts'] += 1
                self.iocs['users'].add(user)

    def detect_psexec(self, events):
        for evt in events:
            if evt['id'] not in (4697, 7045):
                continue
            d = evt['data']
            svc_name = d.get('ServiceName', d.get('NewServiceName', ''))
            svc_path = d.get('ImagePath', d.get('ServiceFileName', ''))
            if 'psexesvc' in svc_name.lower() or 'admin$' in svc_path.lower():
                self.findings.append({
                    'timestamp': evt['ts'], 'type': 'PsExec',
                    'service_name': svc_name, 'service_path': svc_path[:200],
                    'severity': 'HIGH', 'mitre': 'T1021.002'
                })
                self.stats['psexec_detections'] += 1

    def detect_kerberoasting(self, events):
        tgs_requests = defaultdict(list)
        for evt in events:
            if evt['id'] != 4769:
                continue
            d = evt['data']
            user = d.get('TargetUserName', '')
            enc_type = d.get('TicketEncryptionType', '')
            spn = d.get('ServiceName', '')
            if enc_type == '0x17' and not user.endswith('$'):
                tgs_requests[user].append({'ts': evt['ts'], 'spn': spn})
        for user, requests in tgs_requests.items():
            unique_spns = set(r['spn'] for r in requests)
            if len(unique_spns) > 5:
                self.findings.append({
                    'timestamp': requests[0]['ts'], 'type': 'Kerberoasting',
                    'user': user, 'spn_count': len(unique_spns),
                    'severity': 'HIGH', 'mitre': 'T1558.003'
                })
                self.stats['kerberos_anomalies'] += 1
                self.iocs['users'].add(user)

    def analyze_dns_log(self, dns_log_path):
        domain_stats = defaultdict(lambda: {'count': 0, 'total_len': 0, 'txt_count': 0})
        try:
            with open(dns_log_path, 'r') as f:
                for line in f:
                    parts = line.strip().split('\t')
                    if len(parts) < 5:
                        continue
                    qname = parts[3].rstrip('.')
                    qtype = parts[4] if len(parts) > 4 else ''
                    qparts = qname.split('.')
                    subdomain = '.'.join(qparts[:-2]) if len(qparts) > 2 else qname
                    parent = '.'.join(qparts[-2:]) if len(qparts) > 2 else qname
                    domain_stats[parent]['count'] += 1
                    domain_stats[parent]['total_len'] += len(subdomain)
                    if qtype == 'TXT':
                        domain_stats[parent]['txt_count'] += 1
        except FileNotFoundError:
            return
        for domain, stats in domain_stats.items():
            avg_len = stats['total_len'] / max(stats['count'], 1)
            txt_ratio = stats['txt_count'] / max(stats['count'], 1)
            if stats['count'] > 500 or avg_len > 60 or txt_ratio > 0.3:
                self.findings.append({
                    'timestamp': datetime.utcnow().isoformat(),
                    'type': 'DNS_Tunnel_Suspect',
                    'domain': domain, 'query_count': stats['count'],
                    'avg_subdomain_len': round(avg_len, 1),
                    'txt_ratio': round(txt_ratio, 3),
                    'severity': 'HIGH', 'mitre': 'T1048.003'
                })
                self.stats['dns_tunnel_suspects'] += 1
                self.iocs['domains'].add(domain)

    def generate_report(self, output_dir):
        os.makedirs(output_dir, exist_ok=True)
        findings_file = os.path.join(output_dir, 'findings.csv')
        if self.findings:
            keys = set()
            for f in self.findings:
                keys.update(f.keys())
            with open(findings_file, 'w', newline='', encoding='utf-8') as csvfile:
                writer = csv.DictWriter(csvfile, fieldnames=sorted(keys))
                writer.writeheader()
                writer.writerows(self.findings)
        ioc_file = os.path.join(output_dir, 'iocs.json')
        ioc_data = {k: sorted(list(v)) for k, v in self.iocs.items() if v}
        with open(ioc_file, 'w') as f:
            json.dump(ioc_data, f, indent=2)
        stats_file = os.path.join(output_dir, 'stats.json')
        with open(stats_file, 'w') as f:
            json.dump(self.stats, f, indent=2)
        severity_counts = defaultdict(int)
        for finding in self.findings:
            severity_counts[finding.get('severity', 'UNKNOWN')] += 1
        print(f"\n{'='*60}")
        print(f"  RANSOMWARE FORENSICS ANALYSIS REPORT")
        print(f"{'='*60}")
        print(f"  Total events analyzed: {self.stats['total_events']}")
        print(f"  Findings: {len(self.findings)}")
        print(f"{'─'*60}")
        for sev, count in sorted(severity_counts.items()):
            print(f"  {sev}: {count}")
        print(f"{'─'*60}")
        for key, val in self.stats.items():
            if val > 0:
                print(f"  {key}: {val}")
        print(f"{'─'*60}")
        print(f"  IOCs: {sum(len(v) for v in self.iocs.values())}")
        print(f"{'='*60}")
        print(f"  Reports saved to: {output_dir}")

def main():
    if len(sys.argv) < 3:
        print(f"Usage: {sys.argv[0]} <log_dir> <output_dir>")
        print(f"  log_dir: directory containing .xml or .evtx event logs")
        print(f"  output_dir: directory for analysis reports")
        sys.exit(1)
    log_dir = sys.argv[1]
    output_dir = sys.argv[2]
    engine = RansomwareForensicsEngine()
    xml_files = []
    dns_files = []
    for root_dir, dirs, files in os.walk(log_dir):
        for f in files:
            fpath = os.path.join(root_dir, f)
            if f.endswith('.xml'):
                xml_files.append(fpath)
            elif 'dns' in f.lower() and f.endswith(('.log', '.tsv', '.csv')):
                dns_files.append(fpath)
    print(f"[*] Found {len(xml_files)} XML log files and {len(dns_files)} DNS log files")
    for xml_file in xml_files:
        events = engine.parse_evtx_xml(xml_file)
        engine.detect_pass_the_hash(events)
        engine.detect_wmi_lateral(events)
        engine.detect_dcsync(events)
        engine.detect_psexec(events)
        engine.detect_kerberoasting(events)
    for dns_file in dns_files:
        engine.analyze_dns_log(dns_file)
    engine.generate_report(output_dir)

if __name__ == '__main__':
    main()