Anthropic-Cybersecurity-Skills/skills/performing-active-directory-compromise-investigation/scripts/agent.py

#!/usr/bin/env python3
"""Active Directory Compromise Investigation agent - analyzes Windows Security
event logs for indicators of AD compromise including DCSync, Golden Ticket,
Kerberoasting, and lateral movement."""

import argparse
import json
from collections import Counter, defaultdict
from datetime import datetime
from pathlib import Path


COMPROMISE_INDICATORS = {
    4662: {"name": "DCSync Detection", "description": "Directory service object accessed with replication rights"},
    4769: {"name": "Kerberoasting", "description": "Kerberos service ticket requested with RC4 encryption"},
    4768: {"name": "Golden Ticket", "description": "Kerberos TGT requested"},
    4672: {"name": "Privileged Logon", "description": "Special privileges assigned to new logon"},
    4624: {"name": "Logon Event", "description": "Successful logon - check Type 3 for lateral movement"},
    4648: {"name": "Explicit Credential Logon", "description": "Logon using explicit credentials"},
    4720: {"name": "Account Created", "description": "New user account created"},
    4728: {"name": "Group Membership Change", "description": "Member added to global group"},
}


def parse_evtx_json(log_path: str) -> list[dict]:
    """Parse Windows event logs exported as JSON."""
    content = Path(log_path).read_text(encoding="utf-8")
    try:
        events = json.loads(content)
    except json.JSONDecodeError:
        events = [json.loads(line) for line in content.strip().splitlines() if line.strip()]
    return events


def detect_dcsync(events: list[dict]) -> list[dict]:
    """Detect DCSync attacks via Event ID 4662 with replication GUIDs."""
    replication_guids = {
        "1131f6aa-9c07-11d1-f79f-00c04fc2dcd2",
        "1131f6ad-9c07-11d1-f79f-00c04fc2dcd2",
        "89e95b76-444d-4c62-991a-0facbeda640c",
    }
    findings = []
    for evt in events:
        eid = evt.get("EventID") or evt.get("event_id")
        if eid != 4662:
            continue
        data = evt.get("EventData", evt.get("event_data", {}))
        obj_type = str(data.get("ObjectType", "")).lower().strip("{}")
        if obj_type in replication_guids:
            subject = data.get("SubjectUserName", "unknown")
            findings.append({
                "type": "dcsync_detected",
                "severity": "critical",
                "event_id": 4662,
                "subject": subject,
                "object_type": obj_type,
                "timestamp": evt.get("TimeCreated", evt.get("timestamp", "")),
                "detail": f"DCSync replication by {subject}",
            })
    return findings


def detect_kerberoasting(events: list[dict]) -> list[dict]:
    """Detect Kerberoasting via Event ID 4769 with RC4 encryption."""
    findings = []
    for evt in events:
        eid = evt.get("EventID") or evt.get("event_id")
        if eid != 4769:
            continue
        data = evt.get("EventData", evt.get("event_data", {}))
        ticket_encryption = str(data.get("TicketEncryptionType", ""))
        if ticket_encryption == "0x17":
            service = data.get("ServiceName", "unknown")
            client = data.get("TargetUserName", "unknown")
            findings.append({
                "type": "kerberoasting_detected",
                "severity": "high",
                "event_id": 4769,
                "service": service,
                "client": client,
                "encryption": "RC4 (0x17)",
                "timestamp": evt.get("TimeCreated", evt.get("timestamp", "")),
                "detail": f"RC4 TGS request for {service} by {client}",
            })
    return findings


def detect_golden_ticket(events: list[dict]) -> list[dict]:
    """Detect Golden Ticket indicators via Event ID 4768 anomalies."""
    findings = []
    for evt in events:
        eid = evt.get("EventID") or evt.get("event_id")
        if eid != 4768:
            continue
        data = evt.get("EventData", evt.get("event_data", {}))
        client = data.get("TargetUserName", "")
        ip_addr = data.get("IpAddress", "")
        if ip_addr and not ip_addr.startswith("::") and ip_addr != "127.0.0.1":
            findings.append({
                "type": "golden_ticket_indicator",
                "severity": "critical",
                "event_id": 4768,
                "client": client,
                "source_ip": ip_addr,
                "timestamp": evt.get("TimeCreated", evt.get("timestamp", "")),
                "detail": f"TGT request for {client} from {ip_addr}",
            })
    return findings


def detect_lateral_movement(events: list[dict]) -> list[dict]:
    """Detect lateral movement via Type 3 logons and explicit credential use."""
    findings = []
    lateral_events = defaultdict(list)
    for evt in events:
        eid = evt.get("EventID") or evt.get("event_id")
        data = evt.get("EventData", evt.get("event_data", {}))
        if eid == 4624:
            logon_type = str(data.get("LogonType", ""))
            if logon_type == "3":
                src_ip = data.get("IpAddress", "")
                user = data.get("TargetUserName", "")
                lateral_events[(user, src_ip)].append(
                    evt.get("TimeCreated", evt.get("timestamp", "")))
        elif eid == 4648:
            user = data.get("SubjectUserName", "")
            target = data.get("TargetServerName", "")
            findings.append({
                "type": "explicit_credential_use",
                "severity": "medium",
                "event_id": 4648,
                "user": user,
                "target_server": target,
                "timestamp": evt.get("TimeCreated", evt.get("timestamp", "")),
                "detail": f"Explicit credential logon by {user} to {target}",
            })

    for (user, src_ip), timestamps in lateral_events.items():
        if len(timestamps) > 5:
            findings.append({
                "type": "lateral_movement_pattern",
                "severity": "high",
                "user": user,
                "source_ip": src_ip,
                "logon_count": len(timestamps),
                "detail": f"{len(timestamps)} Type 3 logons by {user} from {src_ip}",
            })
    return findings


def detect_persistence(events: list[dict]) -> list[dict]:
    """Detect persistence mechanisms via account creation and group changes."""
    findings = []
    for evt in events:
        eid = evt.get("EventID") or evt.get("event_id")
        data = evt.get("EventData", evt.get("event_data", {}))
        if eid == 4720:
            creator = data.get("SubjectUserName", "unknown")
            new_account = data.get("TargetUserName", "unknown")
            findings.append({
                "type": "account_created",
                "severity": "medium",
                "event_id": 4720,
                "creator": creator,
                "new_account": new_account,
                "timestamp": evt.get("TimeCreated", evt.get("timestamp", "")),
                "detail": f"Account {new_account} created by {creator}",
            })
        elif eid in (4728, 4732):
            subject = data.get("SubjectUserName", "unknown")
            member = data.get("MemberName", "unknown")
            group = data.get("TargetUserName", "unknown")
            findings.append({
                "type": "group_membership_change",
                "severity": "high",
                "event_id": eid,
                "subject": subject,
                "member": member,
                "group": group,
                "timestamp": evt.get("TimeCreated", evt.get("timestamp", "")),
                "detail": f"{member} added to {group} by {subject}",
            })
    return findings


def generate_report(log_path: str) -> dict:
    """Run all detection checks and produce consolidated report."""
    events = parse_evtx_json(log_path)
    findings = []
    findings.extend(detect_dcsync(events))
    findings.extend(detect_kerberoasting(events))
    findings.extend(detect_golden_ticket(events))
    findings.extend(detect_lateral_movement(events))
    findings.extend(detect_persistence(events))

    severity_counts = Counter(f["severity"] for f in findings)
    return {
        "report": "ad_compromise_investigation",
        "generated_at": datetime.utcnow().isoformat() + "Z",
        "log_file": log_path,
        "total_events_analyzed": len(events),
        "total_findings": len(findings),
        "severity_summary": dict(severity_counts),
        "findings": findings,
    }


def main():
    parser = argparse.ArgumentParser(description="AD Compromise Investigation Agent")
    parser.add_argument("--log", required=True, help="Path to JSON-exported Windows Security event log")
    parser.add_argument("--output", help="Output JSON file path")
    args = parser.parse_args()

    report = generate_report(args.log)
    output = json.dumps(report, indent=2)
    if args.output:
        Path(args.output).write_text(output, encoding="utf-8")
        print(f"Report written to {args.output}")
    else:
        print(output)


if __name__ == "__main__":
    main()