[CB20] LogonTracer v1.5 + Elasticsearch = Real-time AD Log Analysis System by Shusei Tomonaga and Kota Kino

Copyright ©2020 JPCERT/CC All rights reserved.0
＋
= Real-time AD Log Analysis Syste
CODE BLUE 2020

We released LogonTracer in 2018
CODE BLUE 2018

Completed Works
Finished!

Copyright ©2020 JPCERT/CC All rights reserved.
LogonTracer Basic
3
Concept
LogonTracer is a tool to investigate
malicious logon by
visualizing and analyzing
Windows Active Directory event logs.

Visualizing
Event Log
Malicious
Account
Ranking
Malicious
Activity
Search
4
Key Features

Visualizing
Event Log
Malicious
Account
Ranking
Malicious
Activity
Search

Visualizing Event Log

It is easy to check which account name was used to logon
to a host.
7
Details of Visualization
User1 Host User2
Event ID
4624
Event ID
4625
Connect an account name and a host
from the logon event IDs.

Check How Admin Account is Accessed from an Infected Host
Search for a specific account which
has a transaction path to Domain
Administrator

Search the possible path to domain administrator
from the infected host.
Host User Host Domain
Admin
Malware infected
host
Possible to reach DomainAdmin

Possible to reach Domain Admin

Visualizing
Event Log
Malicious
Account
Ranking
Malicious
Activity
Search

Malicious Account and Host Ranking
Account Ranking
Host Ranking

Important websites are cited in many websites, so the
number of links will be large.
Websites linked from websites with a large number of
links have high importance.
13
Rank using PageRank
PageRank is an algorithm used by Google Search
to rank websites in their search engine results.
𝑃𝑃𝑃𝑃 𝐴𝐴 = 1 − 𝑑𝑑 + 𝑑𝑑 �
𝑖𝑖=1
𝑛𝑛
𝑃𝑃𝑃𝑃 𝑇𝑇𝑖𝑖
𝐶𝐶 𝑇𝑇𝑖𝑖
Idea

Important User
!

The HMM is one of the most important machine learning models in
speech and language processing.
This model is the state transition of the past in hidden state, and the
event is modeled from the output result of that state.
15
PageRank with Hidden Markov Model
Improve PageRank accuracy by using Hidden
Markov Model (HMM) in combination.
𝑃𝑃𝑃𝑃 𝐴𝐴 = 1 − 𝑑𝑑(𝐴𝐴) + 𝑑𝑑(𝐴𝐴) �
𝑖𝑖=1
𝑛𝑛
𝑃𝑃𝑃𝑃 𝑇𝑇𝑖𝑖
𝐶𝐶 𝑇𝑇𝑖𝑖
What’s HMM

Anomaly Detection of State Transition Using HMM
Logon state transitions HMM
4624 47764625 4768 4769
Predict the state from the event ID timeline.
Detects not transitioning to Stage 1 or 2.
Not
logged on
Logon
Attempt
Logged
on
Stage0 Stage1 Stage2

ID 4768 4769 4769 4624 4769 4624 4624 4776 4624 4769 4769 4624
Stage 0 2 2 0 2 0 0 2 0 2 2 0
17
Anomaly Detection of State Transition Using HMM
Predict using HMM
Normal Logon
Pass-the-Ticket
ID 4624 4624 4624 4624 4769 4624 4624 4769 4624 4624 4624 4624
Stage 0 0 0 1 2 0 0 2 0 0 0 0
In the case of PtT, it has not shifted to Stage 1.
Not
logged on
Logon
Attempt
Logged
on
Stage0 Stage1 Stage2

Visualizing
Event Log
Malicious
Account
Ranking
Malicious
Activity
Search

Malicious Activity Search

All users Visualize all users and hosts.
SYSTEM privileges Visualize users with system privileges.
NTLM Remote Logon Visualize remote logon users and hosts using NTLM authentication. If not using NTLM authentication, it may be
pass-the-hash.
RDP Logon Visualize RDP logon users and hosts (Logon type: 10).
Network Logon Visualize logon users and hosts from remote network (Logon type: 3).
Batch Logon Visualize batch server logon (Logon type: 4).
Service Logon Visualize Services Control Manager logon (Logon type: 5).
ms14-068 exploit failure Visualize the error log that the ms14-068 exploit failed.
Logon failure Visualize failed logon.
Detect DCSync/DCShadow Visualize the detection of DCSync and DCShadow log.
Add/Delete Users Visualize deleted or added user(s).
Domain Check Visualize all domain names. If an attacker has intruded into a network, there may be a malicious domain name.
Audit Policy Change Visualize changed audit policy.
Diff Graph Compare two days and view unique events.
20
Additional Event Log Search

All users Visualize all users and hosts.
SYSTEM privileges Visualize users with system privileges.
NTLM Remote Logon Visualize remote logon users and hosts using NTLM authentication. If not using NTLM authentication, it may be
pass-the-hash.
RDP Logon Visualize RDP logon users and hosts (Logon type: 10).
Network Logon Visualize logon users and hosts from remote network (Logon type: 3).
Batch Logon Visualize batch server logon (Logon type: 4).
Service Logon Visualize Services Control Manager logon (Logon type: 5).
ms14-068 exploit failure Visualize the error log that the ms14-068 exploit failed.
Logon failure Visualize failed logon.
Detect DCSync/DCShadowVisualize the detection of DCSync and DCShadow log.
Add/Delete Users Visualize deleted or added user(s).
Domain Check Visualize all domain names. If an attacker has intruded into a network, there may be a malicious domain name.
Audit Policy Change Visualize changed audit policy.
Diff Graph Compare two days and view unique events.
21
Additional Event Log Search

Diff Graph

Timeline

Timeline
Anomaly detection score using
Change Finder.

DEMONSTRATION
26

LogonTracer Released Timeline

Frequently Asked Feedback
Can I useLogonTracerfor real-
timeAD log analysis?
LogonTraceris only used with
#DFIR.

New Feature!

We are released LogonTracer 1.5
Main Feature
LogonTracer updated to support

LogonTracer + Elasticsearch
＋
LogonTracer provides real-time AD log analysis
function using Elasticsearch.

LogonTracer + Elasticsearch
LogonTracer
ElasticsearchWinlogbeat Kibana
AD
Event log
Event log Analysis results
Monitoring
Visualization
AD Log Monitoring System
Neo4j
Analysis results
Event log

There is a limit to the size of visualization.
It is not realistic to visualize all the event logs of
a month or year with LogonTracer.
Use LogonTracer visualization at intervals such
as a day or hours.
33
Weak Point of LogonTracer

Monitoring Operation using LogonTracer
LogonTracer
ElasticsearchWinlogbeat Kibana
AD
Event log
(Real-time)
Event log
(/day /hour)
Analysis results
(/day /hour)
E-mail etc.
(/day /hour)
Visualization
(as necessary)
AD Log Monitoring System
Neo4j
Analysis results
(/day /hour)
Event log
Analyze logs daily or
hourly.
Reporting daily or
hourly.
Check log based on
report.

Monitoring Operation using LogonTracer
Kibana GUI

How to Use
Load from ES

DEMONSTRATION
37
v1.5

Elasticsearch Query Samples
curl -H "Content-Type: application/json" -XPOST 'localhost:9200/logontracer-
user-index/_search?pretty' -d '{ "query": { "match_all": {} }, "size": 10, "sort":
{ "rank": { "order": "desc" } }}'
user-index/_search?pretty' -d '{ "query": { "match": { "status": “2020" }}}'
user-index/_search?pretty' -d '{ "query": { "match": { "rights": "system" }}}'
Search for admin user
Search for policy changes and user add/del
Search for top 10 user ranks

LogonTracer Wiki
https://github.com/JPCERTCC/LogonTracer/wiki
How to Use
39

Future Works
Add analysis function for Sysmon and
PowerShell.
Add detection function of new attack
method.
We welcome your feedback and pull request.

T h a n k y o u !
@jpcert_en ir-info@jpcert.or.jp
PGP https://www.jpcert.or.jp/english/pgp/
Contact
https://github.com/JPCERTCC/LogonTracer
41

[CB20] LogonTracer v1.5 + Elasticsearch = Real-time AD Log Analysis System by Shusei Tomonaga and Kota Kino

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to [CB20] LogonTracer v1.5 + Elasticsearch = Real-time AD Log Analysis System by Shusei Tomonaga and Kota Kino

Similar to [CB20] LogonTracer v1.5 + Elasticsearch = Real-time AD Log Analysis System by Shusei Tomonaga and Kota Kino (20)

More from CODE BLUE

More from CODE BLUE (20)

Recently uploaded

Recently uploaded (20)

[CB20] LogonTracer v1.5 + Elasticsearch = Real-time AD Log Analysis System by Shusei Tomonaga and Kota Kino