Spark_Parquet_ProcessCreate.ipynb

{
 "cells": [
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "19fff070-ed35-4a62-adb0-e31172933474",
   "metadata": {},
   "outputs": [],
   "source": [
    "from pyspark.sql import SparkSession\n",
    "from pyspark.sql.types import *\n",
    "\n",
    "from datetime import datetime, timedelta\n",
    "import warnings\n",
    "\n",
    "from minio_extractor import fetch_logs, RequestConfig\n",
    "\n",
    "# Disable warnings\n",
    "warnings.filterwarnings('ignore')\n",
    "warnings.simplefilter('ignore')\n",
    "\n",
    "#For widescreen view\n",
    "from IPython.core.display import display, HTML\n",
    "display(HTML(\"<style>.container { width:80% !important; }</style>\")) \n",
    "\n",
    "spark = SparkSession \\\n",
    "    .builder \\\n",
    "    .appName(\"Spark_EID1\") \\\n",
    "    .config(\"spark.sql.caseSensitive\",\"True\") \\\n",
    "    .config('spark.sql.execution.arrow.pyspark.enabled', True) \\\n",
    "    .config('spark.sql.session.timeZone', 'EST') \\\n",
    "    .config('spark.driver.memory','16G') \\\n",
    "    .config('spark.ui.showConsoleProgress', True) \\\n",
    "    .config('spark.sql.repl.eagerEval.enabled', True) \\\n",
    "    .getOrCreate()\n",
    "sc = spark.sparkContext\n",
    "sc.setLogLevel(\"ERROR\")\n",
    "\n",
    "### reading from a parquet object\n",
    "park = spark.read.parquet(\"edr_all_raw.parquet\")"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "a0c92c95-3f10-4cf6-9a34-e4d996aff9ba",
   "metadata": {},
   "outputs": [],
   "source": [
    "park.printSchema()\n",
    "park.show(n = 1, vertical = True)\n",
    "park.createOrReplaceTempView('sparktable')"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "f345b737-be4f-4447-a735-57cf1935b509",
   "metadata": {},
   "outputs": [],
   "source": [
    "sparkDF_EID1 = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, ParentProcessGuid, ProcessGuid, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1)\n",
    "'''\n",
    ")\n",
    "sparkDF_EID1.show(10,30)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "c30e3e22-0647-4370-a701-ffa70107f65f",
   "metadata": {},
   "source": [
    "### proc_creation_win_7zip_cve_2022_29072\n",
    "##### description : 7-Zip through 21.07 on Windows allows privilege escalation (CVE-2022-29072) and command execution when a file with the .7z extension is dragged to the Help>Contents area. This is caused by misconfiguration of 7z.dll and a heap overflow. The command runs in a child process under the 7zFM.exe process."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "914839a5-e7f9-44f8-8ec6-8c67464af38c",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT  computer_name, ParentImage, ParentCommandLine, Image, CommandLine, ParentProcessGuid, ProcessGuid, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "    AND Image LIKE '%\\\\cmd.exe'\n",
    "    AND ParentImage LIKE '%\\\\7zFM.exe'\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10,40)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "40bac20c-ad0c-4a8c-ae02-381e1be2ab5a",
   "metadata": {},
   "source": [
    "### Abused Debug Privilege by Arbitrary Parent Processes\n",
    "##### description : Detection of unusual child processes by different system processes"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "905f9d41-7e01-4f9f-9722-7907a77a612d",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, ParentProcessGuid, ProcessGuid, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "    AND ( lower(Image) LIKE '%\\\\powershell.exe'\n",
    "        OR lower(Image) LIKE '%\\\\pwsh.exe'\n",
    "        OR lower(Image) LIKE '%\\\\cmd.exe'\n",
    "    )\n",
    "    AND (lower(ParentImage) LIKE '%\\\\winlogon.exe' \n",
    "        OR lower(ParentImage) LIKE '%\\\\services.exe' \n",
    "        OR lower(ParentImage) LIKE '%\\\\lsass.exe' \n",
    "        OR lower(ParentImage) LIKE '%\\\\csrss.exe' \n",
    "        OR lower(ParentImage) LIKE '%\\\\smss.exe' \n",
    "        OR lower(ParentImage) LIKE '%\\\\wininit.exe' \n",
    "        OR lower(ParentImage) LIKE '%\\\\spoolsv.exe' \n",
    "        OR lower(ParentImage) LIKE '%\\\\searchindexer.exe')\n",
    "    )\n",
    "    AND (lower(User) LIKE '%authori%'\n",
    "        OR lower(User) LIKE '%autori%'\n",
    "    )\n",
    "    \n",
    "'''\n",
    ")\n",
    "huntCase.show(10,50)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "93a526ce-b4bd-4816-a1e8-4ad201b86b16",
   "metadata": {},
   "source": [
    "### Abusing Windows Telemetry For Persistence\n",
    "##### description : Windows telemetry makes use of the binary CompatTelRunner.exe to run a variety of commands and perform the actual telemetry collections. This binary was created to be easily extensible, and to that end, it relies on the registry to instruct on which commands to run. The problem is, it will run any arbitrary command without restriction of location or type."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "15e7fec4-dfe4-4913-9977-949157ac2dd7",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "    AND \n",
    "        (\n",
    "        lower(CommandLine) LIKE '%schtasks%'\n",
    "        OR lower(CommandLine) LIKE '%\\\\Application Experience\\\\Microsoft Compatibility Appraiser%'\n",
    "        )\n",
    "    )\n",
    "    AND NOT \n",
    "        (\n",
    "        lower(User) LIKE '%authori%'\n",
    "        OR lower(User) LIKE '%autori%'\n",
    "        )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10,80)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "91fdaa1c-5807-4eaa-a38f-9370ccdf4e6a",
   "metadata": {},
   "source": [
    "### Accesschk Usage To Check Privileges\n",
    "##### description : Accesschk is an access and privilege audit tool developed by SysInternal and often being used by attacker to verify privileges"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "e454ebf6-f555-4ca9-a342-c1ceaf5a015d",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "    AND \n",
    "        (\n",
    "        lower(OriginalFileName) LIKE '%AccessChk%'\n",
    "        OR lower(CommandLine) LIKE '%\\\\accesschk.exe%'\n",
    "        )\n",
    "    AND \n",
    "        (\n",
    "        lower(CommandLine) LIKE '%uwcqv%'\n",
    "        OR lower(CommandLine) LIKE '%kwsu%'\n",
    "        OR lower(CommandLine) LIKE '%qwsu%'\n",
    "        OR lower(CommandLine) LIKE '%uwdqs%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10,80)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "6bd51a01-dbfe-4ae4-9090-eba338aaf08e",
   "metadata": {},
   "source": [
    "### AdFind Usage Detection\n",
    "##### description :  AdFind continues to be seen across majority of breaches. It is used to domain trust discovery to plan out subsequent steps in the attack chain."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "a2109c0e-0302-48f6-8645-322488739b03",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "    AND \n",
    "        (\n",
    "        lower(CommandLine) LIKE '%domainlist%'\n",
    "        OR lower(CommandLine) LIKE '%trustdmp%'\n",
    "        OR lower(CommandLine) LIKE '%dcmodes%'\n",
    "        OR lower(CommandLine) LIKE '%adinfo%'\n",
    "        OR lower(CommandLine) LIKE '% dclist %'\n",
    "        OR lower(CommandLine) LIKE '%computer_pwdnotreqd%'\n",
    "        OR lower(CommandLine) LIKE '%objectcategory=%'\n",
    "        OR lower(CommandLine) LIKE '%-subnets -f%'\n",
    "        OR lower(CommandLine) LIKE '%name=\\\"Domain Admins\\\"%'\n",
    "        OR lower(CommandLine) LIKE '%-sc u:%'\n",
    "        OR lower(CommandLine) LIKE '%domainncs%'\n",
    "        OR lower(CommandLine) LIKE '%dompol%'\n",
    "        OR lower(CommandLine) LIKE '% oudmp %'\n",
    "        OR lower(CommandLine) LIKE '%subnetdmp%'\n",
    "        OR lower(CommandLine) LIKE '%gpodmp%'\n",
    "        OR lower(CommandLine) LIKE '%fspdmp%'\n",
    "        OR lower(CommandLine) LIKE '%users_noexpire%'\n",
    "        OR lower(CommandLine) LIKE '%computers_active%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10,50)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "06cb5db5-d700-415d-b47c-83130d54dc4d",
   "metadata": {},
   "source": [
    "### Advanced IP Scanner\n",
    "##### description :  Detects the use of Advanced IP Scanner. Seems to be a popular tool for ransomware groups."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "32920d98-b02c-465d-91b6-73f06bc6bd4b",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "    AND \n",
    "        (\n",
    "            lower(Image) LIKE '%\\\\advanced_ip_scanner%'\n",
    "            OR lower(Image) LIKE '%\\\\advanced_port_scanner%'\n",
    "        )\n",
    "    AND \n",
    "        (\n",
    "            lower(CommandLine) LIKE '%portable%'\n",
    "            OR lower(CommandLine) LIKE '%lng%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10,70)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "8da73d9f-f04c-44b3-9386-3ffdeb4645f3",
   "metadata": {},
   "source": [
    "### Execute From Alternate Data Streams\n",
    "##### description :  Adversaries may use NTFS file attributes to hide their malicious data in order to evade detection"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "924a5556-0784-4b7c-be88-2111576554c9",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "    AND\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%txt:%'\n",
    "        )\n",
    "    AND\n",
    "        (\n",
    "            (\n",
    "                lower(CommandLine) LIKE '%type %'\n",
    "                AND  lower(CommandLine) LIKE '% > %'\n",
    "            )\n",
    "        OR\n",
    "            (\n",
    "                lower(CommandLine) LIKE '%makecab %'\n",
    "                AND  lower(CommandLine) LIKE '%.cab%'\n",
    "            )\n",
    "        OR\n",
    "            (\n",
    "                lower(CommandLine) LIKE '%reg %'\n",
    "                AND  lower(CommandLine) LIKE '% export %'\n",
    "            )\n",
    "        OR\n",
    "            (\n",
    "                lower(CommandLine) LIKE '%regedit %'\n",
    "                AND  lower(CommandLine) LIKE '% /E %'\n",
    "            )\n",
    "        OR\n",
    "            (\n",
    "                lower(CommandLine) LIKE '%esentutl %'\n",
    "                AND  lower(CommandLine) LIKE '% /y %'\n",
    "                AND  lower(CommandLine) LIKE '% /d %'\n",
    "                AND  lower(CommandLine) LIKE '% /o %'\n",
    "            )\n",
    "        )\n",
    "\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10,70)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "707cf96b-68a0-4078-b589-ea9e6fc63b0a",
   "metadata": {},
   "source": [
    "### Always Install Elevated MSI Spawned Cmd And Powershell\n",
    "##### description :  This rule looks for Windows Installer service (msiexec.exe) spawned command line and/or powershell"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "c9fce6f5-4634-4b49-9483-18df9bf7501e",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, ParentProcessGuid, ProcessGuid, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "    AND \n",
    "        ( \n",
    "            lower(Image) LIKE '%\\\\powershell.exe'\n",
    "            OR lower(Image) LIKE '%\\\\pwsh.exe'\n",
    "            OR lower(Image) LIKE '%\\\\cmd.exe'\n",
    "        )\n",
    "    AND\n",
    "        (\n",
    "            (\n",
    "                lower(ParentImage) LIKE '%\\\\Windows\\\\Installer\\\\%'\n",
    "                AND  lower(ParentImage) LIKE '%msi%'\n",
    "            )\n",
    "        AND\n",
    "            (\n",
    "                lower(ParentImage) LIKE '%tmp'\n",
    "            )\n",
    "        )\n",
    "\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10,70)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "2e2d16c5-a1bb-4fae-ba37-37a8033bc36e",
   "metadata": {},
   "source": [
    "### Always Install Elevated Windows Installer\n",
    "##### description :  This rule looks for Windows Installer service (msiexec.exe) trying to install MSI packages with SYSTEM privilege"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "1a5edffa-142b-450c-b793-c6d5ed681313",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, ParentProcessGuid, ProcessGuid, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "    AND\n",
    "        (\n",
    "            lower(User) LIKE '%authori%'\n",
    "            OR lower(User) LIKE '%autori%'\n",
    "        )\n",
    "    AND (\n",
    "            (\n",
    "                (\n",
    "                    lower(Image) LIKE '%\\\\Windows\\\\Installer\\\\%'\n",
    "                    AND  lower(Image) LIKE '%msi%'\n",
    "                )\n",
    "            AND\n",
    "                (\n",
    "                    lower(ParentImage) LIKE '%tmp'\n",
    "                )\n",
    "            AND NOT\n",
    "                    (\n",
    "                        lower(ParentImage) LIKE  '%c:%windows%services.exe%'\n",
    "                    )\n",
    "            )\n",
    "        OR\n",
    "            (\n",
    "                    lower(Image) LIKE '%\\\\msiexec.exe%'\n",
    "                    AND NOT lower(ParentImage) LIKE '%msi%'\n",
    "\n",
    "            AND\n",
    "                    (\n",
    "                        lower(User) LIKE '%authori%'\n",
    "                        OR lower(User) LIKE '%autori%'\n",
    "                    )\n",
    "            AND NOT\n",
    "                    (\n",
    "                        lower(ParentImage) LIKE  '%c:%windows%services.exe%'\n",
    "                    )\n",
    "            )\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10,70)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "97e83234-d9cc-4921-850c-e94b116fc479",
   "metadata": {},
   "source": [
    "### Scheduled Task WScript VBScript\n",
    "##### description :  Detects specific process parameters as used by ACTINIUM scheduled task persistence creation."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "f7902112-230a-4fa3-98fc-13525d19b6cb",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, ParentProcessGuid, ProcessGuid, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "    AND\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%\\\\schtasks%'\n",
    "            AND lower(CommandLine) LIKE '%e:vbscript%'\n",
    "            AND lower(CommandLine) LIKE '%wscript%'\n",
    "            AND lower(CommandLine) LIKE '%create%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10,70)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "68570b0a-16e4-4abc-aa24-19e3945e5359",
   "metadata": {},
   "source": [
    "### APT29\n",
    "##### description :  This method detects a suspicious PowerShell command line combination as used by APT29 in a campaign against U.S. think tanks."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "8e6beb61-02a7-4719-9e4a-8a04287297ae",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, ParentProcessGuid, ProcessGuid, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "    AND\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%-noni%'\n",
    "            AND lower(CommandLine) LIKE '%-ep%'\n",
    "            AND lower(CommandLine) LIKE '%bypass%'\n",
    "            AND lower(CommandLine) LIKE '%$%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10,70)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "f87bf583-d579-44d8-8924-812d90dc1259",
   "metadata": {},
   "source": [
    "### Baby Shark Activity\n",
    "##### description :  Detects activity that could be related to Baby Shark malware"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "fbed020a-2379-43bc-b901-9901f42dff30",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, ParentProcessGuid, ProcessGuid, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(Image) LIKE '%reg%Software%Terminal%Server%Client%Default%'\n",
    "            OR lower(CommandLine) LIKE 'powershell.exe%mshta.exe%http%'\n",
    "            OR lower(CommandLine) LIKE 'psh%mshta.exe%http%'\n",
    "            OR lower(CommandLine) LIKE '%cmd.exe%taskkill%/im%cmd.exe%'\n",
    "        )\n",
    "\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10,70)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "866fd779-f427-4f5b-9b77-f32d51ce2f60",
   "metadata": {},
   "source": [
    "### Judgement Panda Credential Access Activity\n",
    "##### description : Detects Russian group activity as described in Global Threat Report 2019 by Crowdstrike"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "94f023eb-1c2c-4b6b-b141-2117aee52099",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, ParentProcessGuid, ProcessGuid, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(Image) LIKE '%\\\\xcopy.exe'\n",
    "            AND lower(CommandLine) LIKE '%/S%'\n",
    "            AND lower(CommandLine) LIKE '%/E%'\n",
    "            AND lower(CommandLine) LIKE '%/C%'\n",
    "            AND lower(CommandLine) LIKE '%/Q%'\n",
    "            AND lower(CommandLine) LIKE '%/H%'\n",
    "            AND lower(CommandLine) LIKE '%\\\\\\\\%'\n",
    "        )\n",
    "        OR\n",
    "        (\n",
    "            lower(Image) LIKE '%\\\\adexplorer.exe'\n",
    "            AND lower(CommandLine) LIKE '%-snapshot%'\n",
    "            AND lower(CommandLine) LIKE '%\"\"%'\n",
    "            AND lower(CommandLine) LIKE '%c:\\\\users\\\\%'\n",
    "        )\n",
    "\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10,70)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "e56b06e6-0a0f-41b3-a3a8-cfe281087d94",
   "metadata": {},
   "source": [
    "### Arbitrary Shell Command Execution Via Settingcontent-Ms\n",
    "##### description :  The .SettingContent-ms file type was introduced in Windows 10 and allows a user to create \"shortcuts\" to various Windows 10 setting pages. These files are simply XML and contain paths to various Windows 10 settings binaries."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "bfd1c02c-425a-461e-bc25-ed76e96c0e91",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, ParentProcessGuid, ProcessGuid, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(ParentImage) LIKE '%\\\\Winrar.exe%'\n",
    "            OR lower(ParentImage) LIKE '%\\\\7zFM.exe%'\n",
    "            OR lower(ParentImage) LIKE '%\\\\peazip.exe%'\n",
    "        )\n",
    "        AND\n",
    "        (\n",
    "            lower(Image) LIKE '%\\\\isoburn.exe%'\n",
    "            OR lower(Image) LIKE '%\\\\PowerISO.exe%'\n",
    "            OR lower(Image) LIKE '%\\\\ImgBurn.exe%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10,70)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "c4c8030d-dfd3-425d-8635-61293bc9b87c",
   "metadata": {},
   "source": [
    "### Using AppVLP To Circumvent ASR File Path Rule\n",
    "##### description : Application Virtualization Utility is included with Microsoft Office. We are able to abuse \"AppVLP\" to execute shell commands.\n",
    "######    Normally, this binary is used for Application Virtualization, but we can use it as an abuse binary to circumvent the ASR file path rule folder or to mark a file as a system file."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "dde93ed7-e3fb-43fa-a15f-6804853328ef",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND lower(CommandLine) LIKE '%appvlp.exe%'\n",
    "        AND\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%cmd.exe%'\n",
    "            OR lower(CommandLine) LIKE '%powershell.exe%'\n",
    "            OR lower(CommandLine) LIKE '%pwsh.exe%'\n",
    "        )\n",
    "        AND\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%.sh%'\n",
    "            OR lower(CommandLine) LIKE '%.exe%'\n",
    "            OR lower(CommandLine) LIKE '%.dll%'\n",
    "            OR lower(CommandLine) LIKE '%.bin%'\n",
    "            OR lower(CommandLine) LIKE '%.bat%'\n",
    "            OR lower(CommandLine) LIKE '%.cmd%'\n",
    "            OR lower(CommandLine) LIKE '%.js%'\n",
    "            OR lower(CommandLine) LIKE '%.msh%'\n",
    "            OR lower(CommandLine) LIKE '%.reg%'\n",
    "            OR lower(CommandLine) LIKE '%.scr%'\n",
    "            OR lower(CommandLine) LIKE '%.ps%'\n",
    "            OR lower(CommandLine) LIKE '%.vb%'\n",
    "            OR lower(CommandLine) LIKE '%.jar%'\n",
    "            OR lower(CommandLine) LIKE '%.pl%'\n",
    "            OR lower(CommandLine) LIKE '%.inf%'\n",
    "            OR lower(CommandLine) LIKE '%.cpl%'\n",
    "            OR lower(CommandLine) LIKE '%.xml%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 50)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "111315d1-9a7c-4876-b4b1-39348cbce000",
   "metadata": {},
   "source": [
    "### Atlassian Confluence CVE-2021-26084\n",
    "##### description : Detects spawning of suspicious child processes by Atlassian Confluence server which may indicate successful exploitation of CVE-2021-26084"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "ec672c65-2e7f-4ab8-8fa7-06d0907f6d8d",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "            lower(ParentImage) LIKE '%\\\\Atlassian%\\\\java.exe%'\n",
    "        AND\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%.sh%'\n",
    "            OR lower(CommandLine) LIKE '%cmd /c%'\n",
    "            OR lower(CommandLine) LIKE '%cmd /k%'\n",
    "            OR lower(CommandLine) LIKE '%psh%'\n",
    "            OR lower(CommandLine) LIKE '%powershell%'\n",
    "            OR lower(CommandLine) LIKE '%certutil%'\n",
    "            OR lower(CommandLine) LIKE '%rundll32%'\n",
    "            OR lower(CommandLine) LIKE '%curl%'\n",
    "            OR lower(CommandLine) LIKE '%ipconfig%'\n",
    "            OR lower(CommandLine) LIKE '%ping%'\n",
    "            OR lower(CommandLine) LIKE '%whoami%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 50)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "02470430-60e8-48e5-a4f0-f8eff61a3b92",
   "metadata": {},
   "source": [
    "### Hiding Files with Attrib.exe\n",
    "##### description : Detects usage of attrib.exe to hide files from users."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "d4ed67e1-fe9a-4861-89da-731119e3057e",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "            lower(Image) LIKE '%\\attrib.exe%'\n",
    "        AND\n",
    "            lower(CommandLine) LIKE '% +h %' \n",
    "            AND NOT (\n",
    "                        lower(CommandLine) LIKE '%\\\\desktop.ini %'\n",
    "                        OR lower(ParentImage) LIKE '%cmd.exe%'\n",
    "                        OR lower(CommandLine) LIKE '%+R%+H%+S%+A%.cui%'\n",
    "                        OR lower(ParentCommandLine) LIKE '%C%WINDOWS%system32%.bat%'\n",
    "                     )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 50)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "00b7d401-7eaf-4c61-a54f-d64d4d0e9c73",
   "metadata": {},
   "source": [
    "### Automated Collection Command Prompt\n",
    "##### description : Once established within a system or network, an adversary may use automated techniques for collecting internal data."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "c1b25443-fe63-4a61-93b9-344c4a16f863",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%doc%'\n",
    "            OR lower(CommandLine) LIKE '%docx%'\n",
    "            OR lower(CommandLine) LIKE '%xls%'\n",
    "            OR lower(CommandLine) LIKE '%xlsx%'\n",
    "            OR lower(CommandLine) LIKE '%ppt%'\n",
    "            OR lower(CommandLine) LIKE '%pptx%'\n",
    "            OR lower(CommandLine) LIKE '%rtf%'\n",
    "            OR lower(CommandLine) LIKE '%pdf%'\n",
    "            OR lower(CommandLine) LIKE '%txt%'\n",
    "        )\n",
    "        AND\n",
    "        (\n",
    "            (\n",
    "                lower(CommandLine) LIKE '%dir%'\n",
    "                AND lower(CommandLine) LIKE '%/b%'\n",
    "                AND lower(CommandLine) LIKE '%/s%'\n",
    "            )\n",
    "            OR \n",
    "                lower(OriginalFileName) LIKE '%FINDSTR%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 75)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "ef385ccc-fcad-4c85-8860-a94ef0cff8f4",
   "metadata": {},
   "source": [
    "### Malicious Base64 Encoded Powershell Invoke Cmdlets\n",
    "##### description : A. Detects base64 encoded powershell cmdlet invocation of known suspicious cmdlets\n",
    "##### B. Detects base64 encoded listing Win32_Shadowcopy"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "43c37967-c6b7-4b95-91d1-678eac9179a4",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%SQBuAHYAbwBrAGUALQBCAGwAbwBvAGQASABvAHUAbgBkA%'\n",
    "            OR lower(CommandLine) LIKE '%kAbgB2AG8AawBlAC0AQgBsAG8AbwBkAEgAbwB1AG4AZA%'\n",
    "            OR lower(CommandLine) LIKE '%JAG4AdgBvAGsAZQAtAEIAbABvAG8AZABIAG8AdQBuAGQA%'\n",
    "            OR lower(CommandLine) LIKE '%SQBuAHYAbwBrAGUALQBNAGkAbQBpAGsAYQB0AHoA%'\n",
    "            OR lower(CommandLine) LIKE '%kAbgB2AG8AawBlAC0ATQBpAG0AaQBrAGEAdAB6A%'\n",
    "            OR lower(CommandLine) LIKE '%JAG4AdgBvAGsAZQAtAE0AaQBtAGkAawBhAHQAeg%'\n",
    "            OR lower(CommandLine) LIKE '%SQBuAHYAbwBrAGUALQBXAE0ASQBFAHgAZQBjA%'\n",
    "            OR lower(CommandLine) LIKE '%kAbgB2AG8AawBlAC0AVwBNAEkARQB4AGUAYw%'\n",
    "            OR lower(CommandLine) LIKE '%JAG4AdgBvAGsAZQAtAFcATQBJAEUAeABlAGMA%'\n",
    "            OR lower(CommandLine) LIKE '%VwBpAG4AMwAyAF8AUwBoAGEAZABvAHcAYwBvAHAAeQAgAHwAIABGAG8AcgBFAGEAYwBoAC0ATwBiAGoAZQBjAHQA%'\n",
    "            OR lower(CommandLine) LIKE '%cAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0A%'\n",
    "            OR lower(CommandLine) LIKE '%XAGkAbgAzADIAXwBTAGgAYQBkAG8AdwBjAG8AcAB5ACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdA%'\n",
    "            OR lower(CommandLine) LIKE '%WwBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKA%'\n",
    "            OR lower(CommandLine) LIKE '%sAUgBlAGYAbABlAGMAdABpAG8AbgAuAEEAcwBzAGUAbQBiAGwAeQBdADoAOgBMAG8AYQBkACgA%'\n",
    "            OR lower(CommandLine) LIKE '%bAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBBAHMAcwBlAG0AYgBsAHkAXQA6ADoATABvAGEAZAAoA%'\n",
    "            OR lower(CommandLine) LIKE '%AFsAcgBlAGYAbABlAGMAdABpAG8AbgAuAGEAcwBzAGUAbQBiAGwAeQBdADoAOgAoACIATABvAGEAZAAiAC%'\n",
    "            OR lower(CommandLine) LIKE '%BbAHIAZQBmAGwAZQBjAHQAaQBvAG4ALgBhAHMAcwBlAG0AYgBsAHkAXQA6ADoAKAAiAEwAbwBhAGQAIgAp%'\n",
    "            OR lower(CommandLine) LIKE '%AWwByAGUAZgBsAGUAYwB0AGkAbwBuAC4AYQBzAHMAZQBtAGIAbAB5AF0AOgA6ACgAIgBMAG8AYQBkACIAK%'\n",
    "            OR lower(CommandLine) LIKE '%sAUgBlAGYAbABlAGMAdABpAG8AbgAuAEEAcwBzAGUAbQBiAGwAeQBdADoAOgAoACIATABvAGEAZAAiACkA%'\n",
    "            OR lower(CommandLine) LIKE '%bAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBBAHMAcwBlAG0AYgBsAHkAXQA6ADoAKAAiAEwAbwBhAGQAIgApA%'\n",
    "            OR lower(CommandLine) LIKE '%WwBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6ACgAIgBMAG8AYQBkACIAKQ%'\n",
    "            OR lower(CommandLine) LIKE '%WwByAGUAZgBsAGUAYwB0AGkAbwBuAC4AYQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKA%'\n",
    "            OR lower(CommandLine) LIKE '%sAcgBlAGYAbABlAGMAdABpAG8AbgAuAGEAcwBzAGUAbQBiAGwAeQBdADoAOgBMAG8AYQBkACgA%'\n",
    "            OR lower(CommandLine) LIKE '%bAHIAZQBmAGwAZQBjAHQAaQBvAG4ALgBhAHMAcwBlAG0AYgBsAHkAXQA6ADoATABvAGEAZAAoA%'\n",
    "        )\n",
    "\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 75)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "c34aed57-55e2-4a36-b94a-8123ff96d4c1",
   "metadata": {},
   "outputs": [],
   "source": []
  },
  {
   "cell_type": "markdown",
   "id": "ef71e716-57fd-43cd-b112-9f703a3a3147",
   "metadata": {},
   "source": [
    "### Bitsadmin Suspicious Usgae\n",
    "##### description : Detects suspicious usage of bitsadmin"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "c8b5c393-2dfc-4107-8fae-df0f8480b63d",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(Image) LIKE '%bitsadmin.exe%'\n",
    "            AND\n",
    "            (\n",
    "                lower(CommandLine) LIKE '%http%'\n",
    "                AND\n",
    "                (\n",
    "                    lower(CommandLine) LIKE '%/create %'\n",
    "                    OR lower(CommandLine) LIKE '%/addfile %'\n",
    "                )\n",
    "                OR\n",
    "                (\n",
    "                    lower(CommandLine) LIKE '%transfer %'\n",
    "                )\n",
    "            )\n",
    "        )\n",
    "        OR\n",
    "            (\n",
    "                lower(CommandLine) LIKE '%bitsadmin.exe%'\n",
    "                AND\n",
    "                    (\n",
    "                        lower(CommandLine) LIKE '%copy%'\n",
    "                        OR lower(CommandLine) LIKE '%transfer%'\n",
    "                        OR lower(CommandLine) LIKE '%create%'\n",
    "                        OR lower(CommandLine) LIKE '%/addfile %'\n",
    "                        AND\n",
    "                            (\n",
    "                                lower(CommandLine) LIKE '%.asax%'\n",
    "                                OR lower(CommandLine) LIKE '%.ashx%'\n",
    "                                OR lower(CommandLine) LIKE '%.asmx%'\n",
    "                                OR lower(CommandLine) LIKE '%.asp%'\n",
    "                                OR lower(CommandLine) LIKE '%.aspx%'\n",
    "                                OR lower(CommandLine) LIKE '%.bat%'\n",
    "                                OR lower(CommandLine) LIKE '%.cfm%'\n",
    "                                OR lower(CommandLine) LIKE '%.cgi%'\n",
    "                                OR lower(CommandLine) LIKE '%.chm%'\n",
    "                                OR lower(CommandLine) LIKE '%.cmd%'\n",
    "                                OR lower(CommandLine) LIKE '%.cpl%'\n",
    "                                OR lower(CommandLine) LIKE '%.gif%'\n",
    "                                OR lower(CommandLine) LIKE '%.jpeg%'\n",
    "                                OR lower(CommandLine) LIKE '%.jpg%'\n",
    "                                OR lower(CommandLine) LIKE '%.jsp%'\n",
    "                                OR lower(CommandLine) LIKE '%.jspx%'\n",
    "                                OR lower(CommandLine) LIKE '%.png%'\n",
    "                                OR lower(CommandLine) LIKE '%.ps1%'\n",
    "                                OR lower(CommandLine) LIKE '%.psm1%'\n",
    "                                OR lower(CommandLine) LIKE '%.scf%'\n",
    "                                OR lower(CommandLine) LIKE '%.sct%'\n",
    "                                OR lower(CommandLine) LIKE '%.txt%'\n",
    "                                OR lower(CommandLine) LIKE '%.vbe%'\n",
    "                                OR lower(CommandLine) LIKE '%.vbs%'\n",
    "                                OR lower(CommandLine) LIKE '%.war%'\n",
    "                                OR lower(CommandLine) LIKE '%.wsf%'\n",
    "                                OR lower(CommandLine) LIKE '%.wsh%'\n",
    "                                OR lower(CommandLine) LIKE '%.zip%'\n",
    "                                OR lower(CommandLine) LIKE '%.rar%'\n",
    "                                OR lower(CommandLine) LIKE '%.dll%'\n",
    "                            )\n",
    "                    )\n",
    "            )\n",
    "\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 80)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "0e850cc3-0057-40a9-9804-f9208ef5e58a",
   "metadata": {},
   "source": [
    "### Modification of Boot Configuration\n",
    "##### description : Identifies use of the bcdedit command to delete boot configuration data. This tactic is sometimes used as by malware or an attacker as a destructive technique."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "db03f70b-7191-4f38-9a39-602a36f58a5b",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(Image) LIKE '%\\\\bcdedit.exe%'\n",
    "            AND lower(CommandLine) LIKE '%set%'\n",
    "        )\n",
    "        AND\n",
    "        (\n",
    "            (\n",
    "                lower(CommandLine) LIKE '%bootstatuspolicy%'\n",
    "                AND lower(CommandLine) LIKE '%ignoreallfailures%'\n",
    "            )\n",
    "            OR\n",
    "            (\n",
    "                lower(CommandLine) LIKE '%recoveryenabled%'\n",
    "                AND lower(CommandLine) LIKE '%no%'\n",
    "            )\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 75)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "e741ef0a-01a0-43fd-8151-c65cb72326f3",
   "metadata": {},
   "source": [
    "### Suspicious Load DLL via CertOC.exe\n",
    "##### description : Detects when a user installs certificates by using CertOC.exe to loads the target DLL file."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "385b622a-dd2a-430f-bdce-02973e2c7055",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(Image) LIKE '%\\\\certoc.exe%'\n",
    "            OR lower(OriginalFileName) LIKE '%CertOC.exe%'\n",
    "        )\n",
    "        AND\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%LoadDLL%'\n",
    "            AND lower(CommandLine) LIKE '%.dll%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 75)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "a5defee6-7425-4e17-a3ee-d2618a7600af",
   "metadata": {},
   "source": [
    "### Change Default File Association To Executable\n",
    "##### description : Detects when a program changes the default file association of any extension to an executable. When a file is opened, the default program used to open the file (also called the file association or handler) is checked. File association selections are stored in the Windows Registry and can be edited by users, administrators, or programs that have Registry access or by administrators using the built-in assoc utility. Applications can modify the file association for a given file extension to call an arbitrary program when a file with the given extension is opened.\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "752338f0-05d5-4144-b9a7-00f611fab52a",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%cmd%'\n",
    "            AND lower(CommandLine) LIKE '%/c%'\n",
    "            AND lower(CommandLine) LIKE '%assoc%'\n",
    "\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 75)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "6ebf0794-ff56-4b1e-8f0b-f027240bd89c",
   "metadata": {},
   "source": [
    "### Suspicious Firewall Change \n",
    "##### description : Detects when a firewall rule is modified or changed "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "47d5f438-49b1-4585-adde-b4098b75bb5d",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%cmd%'\n",
    "            AND lower(CommandLine) LIKE '% /c %'\n",
    "            AND lower(CommandLine) LIKE '%advfirewall%'\n",
    "        )\n",
    "\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 100)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "2bf347c6-1de2-4b07-beb2-0071a6f82071",
   "metadata": {},
   "source": [
    "### Windows Cmd Delete File\n",
    "##### description :     Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "43c04cc0-4896-49ad-a1c8-397d8a47fcbf",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%del %'\n",
    "            AND lower(CommandLine) LIKE '%/f%'\n",
    "        )\n",
    "        OR\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%rmdir%'\n",
    "            AND lower(CommandLine) LIKE '%/s%'\n",
    "            AND lower(CommandLine) LIKE '%/q%'\n",
    "        )\n",
    "\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 180)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "e6cff16c-30b2-4b24-b002-3cc1e18c652f",
   "metadata": {},
   "source": [
    "### Suspicious Dosfuscation Character in Commandline\n",
    "##### description :   Posssible Payload Obfuscation"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "345058b3-0db8-4ae9-82ce-8c0c56559335",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%^^%'\n",
    "            OR lower(CommandLine) LIKE '%\"\"%'\n",
    "            OR lower(CommandLine) LIKE '%,;,%'\n",
    "            OR lower(CommandLine) LIKE '%\\%COMSPEC:~%'\n",
    "            OR lower(CommandLine) LIKE '%s^et%'\n",
    "            OR lower(CommandLine) LIKE '%s^e^t%'\n",
    "            OR lower(CommandLine) LIKE '%se^t%'\n",
    "            OR lower(CommandLine) LIKE '%se^t%'\n",
    "            OR lower(CommandLine) LIKE '%\\%\\%%'\n",
    "            OR lower(CommandLine) LIKE '%&&%'\n",
    "        )\n",
    "\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(20, 80)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "a440c232-06d1-4968-a0e7-5d6f67281e57",
   "metadata": {},
   "source": [
    "### Suspicious CMD Shell Redirect\n",
    "##### description :   Detects inline windows shell commands redirecting output via the \">\" symbol to a suspicous location"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "461fc6db-9468-4e04-8da0-06b60072b05f",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(Image) LIKE '%\\\\cmd.exe'\n",
    "            AND \n",
    "            (\n",
    "                lower(CommandLine) LIKE '%>%\\%USERPROFILE%'\n",
    "                OR lower(CommandLine) LIKE '%>%\\%APPDATA%%'\n",
    "                OR lower(CommandLine) LIKE '%\\%TEMP:~%'\n",
    "                OR lower(CommandLine) LIKE '%>\\\\Users\\\\Public\\\\%'\n",
    "                OR lower(CommandLine) LIKE '%>%pipe%'\n",
    "                OR lower(CommandLine) LIKE '%s^e^t%'\n",
    "                OR lower(CommandLine) LIKE '%se^t%'\n",
    "                OR lower(CommandLine) LIKE '%se^t%'\n",
    "                OR lower(CommandLine) LIKE '%\\%\\%%'\n",
    "                OR lower(CommandLine) LIKE '%&&%'\n",
    "            )\n",
    "        )\n",
    "\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 70)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "1ee8508b-0382-4e99-bfb3-02f0ccd9c218",
   "metadata": {},
   "source": [
    "### CMSTP Execution Process Creation\n",
    "##### description :   Detects various indicators of Microsoft Connection Manager Profile Installer execution"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "aac220c9-3337-4bec-a6e0-b9e9d6e49edc",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(ParentImage) LIKE '%\\\\cmstp.exe'\n",
    "        )\n",
    "\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 90)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "cfbc88df-9167-4f63-a238-c54502a22603",
   "metadata": {},
   "source": [
    "### Operator Bloopers Cobalt Strike Commands\n",
    "##### description :  Detects use of Cobalt Strike commands accidentally entered in the CMD shell"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "e91d0cb7-6377-4992-8f5a-32c6366cc16d",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            (\n",
    "                lower(Image) LIKE '%\\\\cmd.exe'\n",
    "                OR lower(ParentImage) LIKE '%\\\\cmd.exe'\n",
    "            )\n",
    "            AND\n",
    "            (\n",
    "                lower(CommandLine) LIKE '%psinject%'\n",
    "                OR lower(CommandLine) LIKE '%spawnas%'\n",
    "                OR lower(CommandLine) LIKE '%make_token%'\n",
    "                OR lower(CommandLine) LIKE '%remote-exec%'\n",
    "                OR lower(CommandLine) LIKE '%rev2self%'\n",
    "                OR lower(CommandLine) LIKE '%getsystem%'\n",
    "                OR lower(CommandLine) LIKE '%logonpasswords%'\n",
    "                OR lower(CommandLine) LIKE '%dcsync%'\n",
    "                OR lower(CommandLine) LIKE '%psh%'\n",
    "                OR lower(CommandLine) LIKE '%remote-exec%'\n",
    "                OR lower(CommandLine) LIKE '%Invoke-UserHunter%'\n",
    "                OR lower(CommandLine) LIKE '%Invoke-ShareFinder%'\n",
    "                OR lower(CommandLine) LIKE '%Invoke-Kerberoast%'\n",
    "                OR lower(CommandLine) LIKE '%Invoke-SMBAutoBrute%'\n",
    "                OR lower(CommandLine) LIKE '%Invoke-Nightmare%'\n",
    "                OR lower(CommandLine) LIKE '%zerologon%'\n",
    "                OR lower(CommandLine) LIKE '%av_query%'\n",
    "            )\n",
    "\n",
    "        )\n",
    "\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 75)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "e89e543a-1349-4e4d-90f4-3da3cdded807",
   "metadata": {},
   "source": [
    "### Suspicious Load by Rundll32\n",
    "##### description :  Rundll32 can be use by Cobalt Strike with StartW function to load DLLs from the command line."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "dbe260b2-99f3-41a4-a402-2a8dee7c2520",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            (\n",
    "                lower(OriginalFileName) LIKE '%rundll32.exe%'\n",
    "                AND\n",
    "                (\n",
    "                    lower(CommandLine) LIKE '%.dll%'\n",
    "                    OR lower(CommandLine) LIKE '%.cpl%'\n",
    "                    OR lower(CommandLine) LIKE '%runhtmlapplication'\n",
    "                    OR lower(CommandLine) LIKE '%sta'\n",
    "                    OR lower(CommandLine) LIKE '%/sta'\n",
    "                    OR lower(CommandLine) LIKE '%activexobject'\n",
    "                    OR lower(CommandLine) LIKE '%wscript.shell'\n",
    "                    OR lower(CommandLine) LIKE '%dllregisterserver'\n",
    "                    OR lower(CommandLine) LIKE '%startw'\n",
    "                    OR lower(CommandLine) LIKE '%launchapplication'\n",
    "                    OR lower(CommandLine) LIKE '%.dll,a*/p:'\n",
    "                    OR lower(CommandLine) LIKE '%installhinfsection'\n",
    "                    OR lower(CommandLine) LIKE '%launchinfsection'\n",
    "                    OR lower(CommandLine) LIKE '%runhtmlapplication'\n",
    "                    OR lower(CommandLine) LIKE '%setupinfobjectinstallaction'\n",
    "                )\n",
    "                OR\n",
    "                (\n",
    "                   lower(CommandLine) LIKE '%url.dll%'\n",
    "                   AND lower(CommandLine) LIKE '%openurl%'\n",
    "                )\n",
    "                OR\n",
    "                (\n",
    "                   lower(CommandLine) LIKE '%url.dll%'\n",
    "                   AND lower(CommandLine) LIKE '%fileprotocolhandler%'\n",
    "                )\n",
    "            )\n",
    "            AND NOT\n",
    "            (\n",
    "                lower(ParentCommandLine) LIKE '%svchost.exe -k%'\n",
    "                OR lower(ParentCommandLine) LIKE '%ie4uinit.exe -cleariconcache%'\n",
    "            )\n",
    "\n",
    "        )\n",
    "\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(100, 70)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "09d8f951-f6f4-4614-b8d7-dbdd7d683193",
   "metadata": {},
   "source": [
    "### CobaltStrike Process Patterns\n",
    "##### description :  Detects process patterns found in Cobalt Strike beacon activity (see reference for more details) and also cases in which a China Chopper like webshell is used to run whoami"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "6f08b656-c189-4734-8164-555d9c03ac33",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            (\n",
    "                lower(ParentCommandLine) LIKE '%>%.%pipe%'\n",
    "                OR lower(ParentCommandLine) LIKE '%cmd.exe /c echo%'\n",
    "            )\n",
    "            OR\n",
    "            (\n",
    "                lower(CommandLine) LIKE '%>%.%pipe%'\n",
    "                OR lower(CommandLine) LIKE '%cmd.exe /c echo%'\n",
    "            )\n",
    "            OR\n",
    "                lower(ParentImage) LIKE '%\\\\runonce.exe%'\n",
    "                AND lower(Image) LIKE '%cmd.exe%'\n",
    "\n",
    "        )\n",
    "\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 70)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "2dc04a4c-7c5f-4852-b906-854793723e91",
   "metadata": {},
   "source": [
    "### Conti Ransomware Execution\n",
    "##### description : Conti ransomware CommandLine TTP"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "076513e1-6040-4305-b549-8c6742c13f6e",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%-m %'\n",
    "            AND  lower(CommandLine) LIKE '%-net %'\n",
    "            AND lower(CommandLine) LIKE '%-size %'\n",
    "            AND lower(CommandLine) LIKE '%-nomutex %'\n",
    "            AND lower(CommandLine) LIKE '%-p %'\n",
    "            AND lower(CommandLine) LIKE '%$%'\n",
    "        )\n",
    "\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 70)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "4f882764-aacc-4d1d-8408-bffb375bc2e3",
   "metadata": {},
   "source": [
    "### Copying Sensitive Files with Credential Data\n",
    "##### description : Files with well-known filenames (sensitive files with credential data) copying"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "5ceac3ad-42b1-4896-ad6a-3de967c456e2",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(Image) LIKE '%\\\\esentutl.exe%'\n",
    "        )\n",
    "        AND\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%vss%'\n",
    "            OR lower(CommandLine) LIKE '% /m %'\n",
    "            OR lower(CommandLine) LIKE '% /y %'\n",
    "            OR lower(CommandLine) LIKE '%windows%ntds%ntds.dit%'\n",
    "            OR lower(CommandLine) LIKE '%config%sam%'\n",
    "            OR lower(CommandLine) LIKE '%config%security%'\n",
    "            OR lower(CommandLine) LIKE '%config%system %'\n",
    "            OR lower(CommandLine) LIKE '%repair%sam%'\n",
    "            OR lower(CommandLine) LIKE '%repair%system%'\n",
    "            OR lower(CommandLine) LIKE '%repair%security%'\n",
    "            OR lower(CommandLine) LIKE '%config%regback%sam%'\n",
    "            OR lower(CommandLine) LIKE '%config%regback%system%'\n",
    "            OR lower(CommandLine) LIKE '%config%regback%security%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 80)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "42ccf4f4-1d25-4a49-a939-0112fe247e88",
   "metadata": {},
   "source": [
    "### CrackMapExec Process Patterns\n",
    "##### description : Detects suspicious process patterns found in logs when CrackMapExec is used"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "b36e76c5-e7ca-429d-b65e-53d5196704a4",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%cmd.exe /c%'\n",
    "            AND lower(CommandLine) LIKE '%tasklist /fi%'\n",
    "            AND lower(CommandLine) LIKE '%Imagename%lsass.exe%'\n",
    "        )\n",
    "        OR\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%do%rundll32.exe%.dll,%'\n",
    "            AND lower(CommandLine) LIKE '%\\\\temp\\\\%'\n",
    "            AND lower(CommandLine) LIKE '%full%'\n",
    "            AND lower(CommandLine) LIKE '%B%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 70)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "847e4b01-5441-401e-a35d-a104594d203d",
   "metadata": {},
   "source": [
    "### Mavinject Inject DLL Into Running Process\n",
    "##### description :  Injects arbitrary DLL into running process specified by process ID. Requires Windows 10."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "56214500-48ac-47ce-ab05-62988a5de46b",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            (\n",
    "                lower(Image) LIKE '%\\\\mavinject32.exe%'\n",
    "                OR lower(Image) LIKE '%\\\\mavinject64.exe%'\n",
    "            )\n",
    "            AND\n",
    "            (\n",
    "                lower(CommandLine) LIKE '%injectrunning%'\n",
    "                AND lower(CommandLine) LIKE '%.dll%'\n",
    "            )\n",
    "        )\n",
    "        OR\n",
    "        (\n",
    "            (\n",
    "                lower(OriginalFileName) LIKE '%mavinject32%'\n",
    "                OR lower(OriginalFileName) LIKE '%mavinject64%'\n",
    "            )\n",
    "            AND\n",
    "            (\n",
    "                lower(CommandLine) LIKE '%injectrunning%'\n",
    "                AND lower(CommandLine) LIKE '%.dll%'\n",
    "            )\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 50)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "69a5990b-3cb7-4574-86ea-b4b0eef42315",
   "metadata": {},
   "source": [
    "### Dropping Of Password Filter DLL\n",
    "##### description :  Detects dropping of dll files in system32 that may be used to retrieve user credentials from LSASS"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "a7a36ec1-08fe-4f61-bfb7-b3b873787b83",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "           lower(CommandLine) LIKE '%hklm%system%currentcontrolset%control%'\n",
    "           AND lower(CommandLine) LIKE '%scecli\\0%'\n",
    "           AND lower(CommandLine) LIKE '%reg%add%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 70)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "f8c886a9-a65a-4b7a-8499-e4bcb6857db2",
   "metadata": {},
   "source": [
    "### Curl Usage on Windows\n",
    "##### description :  Detects a curl process start on Windows, which indicates a file download from a remote location or a simple web request to a remote server"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "47da00ce-00f7-4434-b2dd-46a087bb0fcd",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%\\\\curl.exe%'\n",
    "            OR lower(OriginalFileName) LIKE '%curl.exe%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 70)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "a6d497b4-13c6-459d-b2c4-24c43b6d0eee",
   "metadata": {},
   "source": [
    "### CVE-2021-26857 Exchange Exploitation\n",
    "##### description :  Detects possible successful exploitation for vulnerability described in CVE-2021-26857 by looking for abnormal subprocesses spawning by Exchange Server's Unified Messaging service"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "27623ccf-24a7-44a7-83e2-36f34a6a601a",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(ParentImage) LIKE '%umworkerprocess.exe%'\n",
    "        )\n",
    "        AND NOT\n",
    "        (\n",
    "            lower(Image) LIKE '%wermgr.exe%'\n",
    "            OR lower(Image) LIKE '%werfault.exe%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 70)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "0ca475e8-d640-4951-adf5-d70ab6fc7c1b",
   "metadata": {},
   "source": [
    "### Data Compressed - rar.exe\n",
    "##### description :  An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "b4bb3914-ebef-4ed1-aeb3-9013804b9f1b",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(Image) LIKE '%\\\\rar.exe%'\n",
    "            AND lower(CommandLine) LIKE '% a %'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 70)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "dfd153ac-d0bc-4070-b774-ab8f8d750376",
   "metadata": {},
   "source": [
    "### Wbadmin Delete Systemstatebackup\n",
    "##### description :    Deletes the Windows systemstatebackup using wbadmin.exe. This technique is used by numerous ransomware families. This may only be successful on server platforms that have Windows Backup enabled."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "86c6c1e8-aac6-4ded-b3a3-08b25cc2d715",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            (\n",
    "                lower(Image) LIKE '%\\\\wbadmin.exe%'\n",
    "                OR  lower(CommandLine) LIKE '%wbadmin%'\n",
    "            )\n",
    "            AND\n",
    "            (\n",
    "                lower(CommandLine) LIKE '%delete %'\n",
    "                AND lower(CommandLine) LIKE '%systemstatebackup %'\n",
    "                AND lower(CommandLine) LIKE '%-keepversions:0%'\n",
    "            )\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 80)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "444e5e32-22df-41ca-8435-4f6d821a7a5f",
   "metadata": {},
   "source": [
    "### Detecting Fake Instances Of Hxtsr.exe\n",
    "##### description : HxTsr.exe is a Microsoft compressed executable file called Microsoft Outlook Communications.HxTsr.exe is part of Outlook apps, because it resides in a hidden \"WindowsApps\" subfolder of \"C:\\Program Files\". Its path includes a version number, e.g., \"C:\\Program Files\\WindowsApps\\microsoft.windowscommunicationsapps_17.7466.41167.0_x64__8wekyb3d8bbwe\\HxTsr.exe\". Any instances of hxtsr.exe not in this folder may be malware camouflaging itself as HxTsr.exe"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "8d5b92f1-d258-4d20-ae42-d603ad102e43",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(Image) LIKE '%hxtsr.exe%'\n",
    "            AND NOT\n",
    "                (\n",
    "                    lower(CurrentDirectory) LIKE '%program files\\\\windowsapps\\\\microsoft.windowscommunicationsapps_%'\n",
    "                    OR lower(CurrentDirectory) LIKE '%\\\\hxtsr.exe%'\n",
    "                )\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 80)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "3bd59353-e202-4d61-b58f-bdd160487215",
   "metadata": {},
   "source": [
    "### DInject PowerShell Cradle CommandLine Flags\n",
    "##### description : Detects the use of the Dinject PowerShell cradle based on the specific flags"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "4d17cc5f-a6ad-4e6a-a36e-c129a3e2e4b7",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(CommandLine) LIKE '% /am51%'\n",
    "            OR lower(CommandLine) LIKE '% /password%'\n",
    "        )\n",
    "        AND NOT\n",
    "                (\n",
    "                    lower(CommandLine) LIKE '% /passwordchg%'\n",
    "                )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 80)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "546cb746-24af-46a8-9e1e-136cdba0515c",
   "metadata": {},
   "source": [
    "###  DNS ServerLevelPluginDll Install\n",
    "##### description : Detects the installation of a plugin DLL via ServerLevelPluginDll parameter in Registry, which can be used to execute code in context of the DNS server (restart required)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "2526cd9a-fd78-46d2-8c51-9a09dbb31cff",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(Image) LIKE '%\\\\dnscmd.exe%'\n",
    "        )\n",
    "        AND\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%/config%'\n",
    "            OR lower(CommandLine) LIKE '%/serverlevelplugindll%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 80)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "cad927e3-6d96-4057-804a-6b137c2373bd",
   "metadata": {},
   "source": [
    "###  DNSCat2 Powershell Implementation Detection Via Process Creation\n",
    "##### description : The PowerShell implementation of DNSCat2 calls nslookup to craft queries. Counting nslookup processes spawned by PowerShell will show hundreds or thousands of instances if PS DNSCat2 is active locally."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "f4e8385d-6fd2-4f02-9de4-6a6e76d71fce",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(ParentImage) LIKE '%\\\\powershell.exe%'\n",
    "            OR lower(ParentImage) LIKE '%\\\\pwsh.exe%'\n",
    "        )\n",
    "        AND\n",
    "        (\n",
    "            lower(Image) LIKE '%\\\\nslookup.exe%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 80)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "7e99a8b4-1b68-4704-85a4-0a06530d39cd",
   "metadata": {},
   "source": [
    "###   Dotnet.exe Exec Dll and Execute Unsigned Code LOLBIN\n",
    "##### description : dotnet.exe will execute any DLL and execute unsigned code"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "dc93ba20-2c64-4e21-85dc-cb037937277b",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(Image) LIKE '%\\\\dotnet.exe%'\n",
    "        )\n",
    "        AND\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%.dll%'\n",
    "            AND lower(CommandLine) LIKE '%.csproj%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 80)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "b26ad234-9909-4909-879d-bf5d037ded82",
   "metadata": {},
   "source": [
    "###   Abusing Permissions Using Dsacls\n",
    "##### description : Detects usage of Dsacls to grant over permissive permissions"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "ef611a51-8662-45ed-8df5-bef9b1435112",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(Image) LIKE '%\\\\dsacls.exe%'\n",
    "            AND lower(CommandLine) LIKE '% /G %'\n",
    "        )\n",
    "        AND\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%gr%'\n",
    "            OR lower(CommandLine) LIKE '%ge%'\n",
    "            OR lower(CommandLine) LIKE '%gw%'\n",
    "            OR lower(CommandLine) LIKE '%ga%'\n",
    "            OR lower(CommandLine) LIKE '%wp%'\n",
    "            OR lower(CommandLine) LIKE '%wd%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 80)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "eba01e67-ef1d-44db-a8fa-13c19440609e",
   "metadata": {},
   "source": [
    "###   Password Spraying Attempts Using Dsacls\n",
    "##### description : Detects possible password spraying attempts using Dsacls"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "44a9a68f-3c38-4e62-aa88-ff46e040c487",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(Image) LIKE '%\\\\dsacls.exe%'\n",
    "        )\n",
    "        AND\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%/user:%'\n",
    "            AND lower(CommandLine) LIKE '%/passwd%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 80)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "a5de412c-8014-4882-b559-9b911fb65b18",
   "metadata": {},
   "source": [
    "###   DumpStack.log Defender Evasion\n",
    "##### description : Detects the use of the filename DumpStack.log to evade Microsoft Defender"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "ac31a638-d6d4-45d5-b98a-b84c02331c78",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(Image) LIKE '%\\\\dumpstack.log%'\n",
    "        )\n",
    "        AND\n",
    "        (\n",
    "            lower(CommandLine) LIKE '% -o dumpstack.log%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 80)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "8bf2595b-824f-4aba-98dc-562f512e5d1e",
   "metadata": {},
   "source": [
    "###  Hidden Powershell in Link File Pattern\n",
    "##### description : Detects events that appear when a user click on a link file with a powershell command in it"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "0b1a2a77-3e3a-422e-8029-9a0025d52fb3",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(ParentImage) LIKE '%windows\\\\explorer.exe%'\n",
    "            OR lower(Image) LIKE '%cmd.exe%'\n",
    "        )\n",
    "        AND\n",
    "        (\n",
    "             lower(CommandLine) LIKE '%powershell%'\n",
    "             AND lower(CommandLine) LIKE '%.lnk%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 110)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "168a2b42-7cb4-4203-b7a3-50750830a068",
   "metadata": {},
   "source": [
    "###  Encoded FromBase64String\n",
    "##### description :  Detects a base64 encoded FromBase64String keyword in a process command line"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "a3323c3a-27c5-4dcc-9810-6319f6bb9133",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%frombase64string%'\n",
    "            OR lower(CommandLine) LIKE '%decode%'\n",
    "            OR lower(CommandLine) LIKE '%gzip%'\n",
    "        )\n",
    "        OR\n",
    "        (\n",
    "            lower(ParentCommandLine) LIKE '%frombase64string%'\n",
    "            OR lower(ParentCommandLine) LIKE '%decode%'\n",
    "            OR lower(ParentCommandLine) LIKE '%gzip%'\n",
    "        )\n",
    "        OR\n",
    "        (\n",
    "            CommandLine LIKE '%OgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcA%'\n",
    "            OR CommandLine LIKE '%oAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnA%'\n",
    "            OR CommandLine LIKE '%6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZw%'\n",
    "            OR CommandLine LIKE '%^%^%^%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 50)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "8610b689-87f8-48d6-9d01-a4e47e86849b",
   "metadata": {},
   "source": [
    "###  Encoded IEX\n",
    "##### description :  Detects a base64 encoded IEX command string in a process command line"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "6572bea3-accb-44c1-babd-bd617f4d9792",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%iex ([%'\n",
    "            OR lower(CommandLine) LIKE '%iex (new%'\n",
    "        )\n",
    "        OR\n",
    "        (\n",
    "            CommandLine LIKE '%SQBFAFgAIAAoAFsA%'\n",
    "            OR CommandLine LIKE '%kARQBYACAAKABbA%'\n",
    "            OR CommandLine LIKE '%JAEUAWAAgACgAWw%'\n",
    "            OR CommandLine LIKE '%aQBlAHgAIAAoAFsA%'\n",
    "            OR CommandLine LIKE '%kAZQB4ACAAKABbA%'\n",
    "            OR CommandLine LIKE '%pAGUAeAAgACgAWw%'\n",
    "            OR CommandLine LIKE '%aQBlAHgAIAAoAE4AZQB3A%'\n",
    "            OR CommandLine LIKE '%kAZQB4ACAAKABOAGUAdw%'\n",
    "            OR CommandLine LIKE '%pAGUAeAAgACgATgBlAHcA%'\n",
    "            OR CommandLine LIKE '%SQBFAFgAIAAoAE4AZQB3A%'\n",
    "            OR CommandLine LIKE '%kARQBYACAAKABOAGUAdw%'\n",
    "            OR CommandLine LIKE '%JAEUAWAAgACgATgBlAHcA%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 50)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "9fd02133-bd5d-409b-884e-5f1a9d4eb164",
   "metadata": {},
   "source": [
    "###  Enumeration for Credentials in RegistryEnumeration for Credentials in Registry\n",
    "##### description :  Detects processes that query known 3rd party registry keys that holds credentials via commandline.  Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "1f6d2920-30d4-488b-8a4e-e57421dabff8",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%software%simontatham%putty%sessions%'\n",
    "            OR lower(CommandLine) LIKE '%software%simontatham%putty%sshhostkeys%'\n",
    "            OR lower(CommandLine) LIKE '%software\\\\mobatek\\\\mobaxterm\\\\%'\n",
    "            OR lower(CommandLine) LIKE '%software\\\\wow6432node\\\\radmin\\\\v3.0\\\\server\\\\parameters\\\\radmin%'\n",
    "            OR lower(CommandLine) LIKE '%software\\\\aerofox\\\\foxmailpreview%'\n",
    "            OR lower(CommandLine) LIKE '%software\\\\aerofox\\\\foxmail\\\\v3.1%'\n",
    "            OR lower(CommandLine) LIKE '%software\\\\incredimail\\\\identities%'\n",
    "            OR lower(CommandLine) LIKE '%software\\\\qualcomm\\\\eudora\\\\commandline%'\n",
    "            OR lower(CommandLine) LIKE '%software\\\\rimarts\\\\b2\\\\settings%'\n",
    "            OR lower(CommandLine) LIKE '%software\\\\openvpn-gui\\\\configs%'\n",
    "            OR lower(CommandLine) LIKE '%software\\\\martin prikryl\\\\winscp 2\\\\sessions%'\n",
    "            OR lower(CommandLine) LIKE '%software\\\\ftpware\\\\coreftp\\\\sites%'\n",
    "            OR lower(CommandLine) LIKE '%software\\\\downloadmanager\\\\passwords%'\n",
    "            OR lower(CommandLine) LIKE '%software\\\\openssh\\\\agent\\\\keys%'\n",
    "            OR lower(CommandLine) LIKE '%software\\\\tightvnc\\\\server%'\n",
    "            OR lower(CommandLine) LIKE '%software\\\\orl\\\\winvnc3\\\\password%'\n",
    "            OR lower(CommandLine) LIKE '%software\\\\realvnc\\\\winvnc4%'\n",
    "        )\n",
    "        OR\n",
    "        (\n",
    "            (\n",
    "                lower(CommandLine) LIKE '% query %'\n",
    "                AND lower(CommandLine) LIKE '%/t %'\n",
    "                AND lower(CommandLine) LIKE '%reg_sz%'\n",
    "                AND lower(CommandLine) LIKE '%/s %'\n",
    "            )\n",
    "            AND\n",
    "            (\n",
    "                (\n",
    "                    lower(CommandLine) LIKE '%hkcu%' \n",
    "                    AND lower(CommandLine) LIKE '% /f %'\n",
    "                )\n",
    "                OR\n",
    "                (\n",
    "                    lower(CommandLine) LIKE '%hklm%' \n",
    "                    AND lower(CommandLine) LIKE '% /f %'\n",
    "                )\n",
    "            )\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 70)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "f2ef01f0-2779-4d34-b1b8-fc19568684e7",
   "metadata": {},
   "source": [
    "###  COMPlus_ETWEnabled Command Line Arguments\n",
    "##### description :  Potential adversaries stopping ETW providers recording loaded .NET assemblies."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "60ca8f5b-9c90-49cd-bb26-e33f4cca5e44",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%complus_etwenabled=0%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 70)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "d45f21cc-8c31-477a-a002-65b993ab4cbe",
   "metadata": {},
   "source": [
    "###  Disable of ETW Trace\n",
    "##### description :  Detects a command that clears or disables any ETW trace log which could indicate a logging evasion."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "f26d4c34-3aee-4f6b-87e8-0c2e2c06c222",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%cl%'\n",
    "            AND lower(CommandLine) LIKE '%trace%'\n",
    "        )\n",
    "        OR\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%clear-log%'\n",
    "            AND lower(CommandLine) LIKE '%trace%'\n",
    "        )\n",
    "        OR\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%sl%'\n",
    "            AND lower(CommandLine) LIKE '%/e:false%'\n",
    "        )\n",
    "        OR\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%set-log%'\n",
    "            AND lower(CommandLine) LIKE '%/e:false%'\n",
    "        )\n",
    "        OR\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%logman%'\n",
    "            AND lower(CommandLine) LIKE '%update%'\n",
    "            AND lower(CommandLine) LIKE '%trace%'\n",
    "            AND lower(CommandLine) LIKE '%--p%'\n",
    "            AND lower(CommandLine) LIKE '%-ets%'\n",
    "        )\n",
    "        OR\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%remove-etwtraceprovider%'\n",
    "        )\n",
    "        OR\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%set-etwtraceprovider%'\n",
    "            AND lower(CommandLine) LIKE '%0x11%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 70)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "207b8e72-438f-49a8-bc46-b700cd44dcac",
   "metadata": {},
   "source": [
    "###  WinRM Access with Evil-WinRM\n",
    "##### description :  Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "d27b825d-3519-4ef2-a5e3-33c7f4ba57c1",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(Image) LIKE '%\\\\ruby.exe%'\n",
    "        )\n",
    "        AND\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%-i %'\n",
    "            OR lower(CommandLine) LIKE '%-u %'\n",
    "            OR lower(CommandLine) LIKE '%-p %'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 70)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "f3f7cc36-2f26-481f-821c-aa3b2f2a4735",
   "metadata": {},
   "source": [
    "###  Exfiltration and Tunneling Tools Execution\n",
    "##### description : Execution of well known tools for data exfiltration and tunneling"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "64fcd57a-43bc-4a17-ad97-65ea115582b2",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(Image) LIKE '%\\\\plink.exe%'\n",
    "            OR lower(Image) LIKE '%\\\\socat.exe%'\n",
    "            OR lower(Image) LIKE '%\\\\stunnel.exe%'\n",
    "            OR lower(Image) LIKE '%\\\\httptunnel.exe%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 70)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "759945b4-292e-4afd-97cc-b738bc721010",
   "metadata": {},
   "source": [
    "###  Droppers Exploiting CVE-2017-11882\n",
    "##### description : Detects exploits that use CVE-2017-11882 to start EQNEDT32.EXE and other sub processes like mshta.exe"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "01433d23-6bc7-4ea6-87c0-06e50c6d66aa",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(ParentImage) LIKE '%\\\\eqnedt32.exe%'\n",
    "            OR lower(Image) LIKE '%\\\\eqnedt32.exe%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 70)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "05324751-3029-476f-9693-851dda089888",
   "metadata": {},
   "source": [
    "###  Exploit for CVE-2017-8759\n",
    "##### description : Detects Winword starting uncommon sub process csc.exe as used in exploits for CVE-2017-8759; has been modified to look for suspicious lolbins"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "d1ce10c8-3402-4c5b-adc6-3ac6a815fe7e",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(ParentImage) LIKE '%\\\\winword.exe%'\n",
    "            AND\n",
    "            (\n",
    "                lower(Image) LIKE '%\\\\csc.exe%'\n",
    "                OR lower(Image) LIKE '%\\\\werfault.exe%'\n",
    "                OR lower(Image) LIKE '%\\\\mshta.exe%'\n",
    "                OR lower(Image) LIKE '%\\\\rundll32.exe%'\n",
    "                OR lower(Image) LIKE '%\\\\cmd.exe%'\n",
    "                OR lower(Image) LIKE '%\\\\powershell.exe%'\n",
    "                OR lower(Image) LIKE '%\\\\winword.exe%'\n",
    "            )\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 70)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "c8e96894-22e9-4142-9236-73aa143827f0",
   "metadata": {},
   "source": [
    "###  Exploiting SetupComplete.cmd CVE-2019-1378\n",
    "##### description : Detects exploitation attempt of privilege escalation vulnerability via SetupComplete.cmd and PartnerSetupComplete.cmd described in CVE-2019-1378"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "801c1b28-9b7c-4056-a6ea-5717f69393a2",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(ParentCommandLine) LIKE '%\\\\cmd.exe%'\n",
    "            AND lower(ParentCommandLine) LIKE '%/c%'\n",
    "            AND lower(ParentCommandLine) LIKE '%windows%setup%scripts%'\n",
    "            AND lower(ParentCommandLine) LIKE '%setupcomplete.cmd%'\n",
    "            AND lower(ParentCommandLine) LIKE '%partnersetupcomplete.cmd%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 70)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "a3dae16a-f4bc-4587-b290-1856cfb1d932",
   "metadata": {},
   "source": [
    "###   Exploiting CVE-2019-1388\n",
    "##### description :  Detects an exploitation attempt in which the UAC consent dialogue is used to invoke an Internet Explorer process running as LOCAL_SYSTEM"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "f5e99e82-2d35-44c4-81ee-c2c264d80872",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(ParentImage) LIKE '%\\\\consent.exe%'\n",
    "            AND lower(Image) LIKE '%\\\\iexplore.exe%'\n",
    "            AND lower(CommandLine) LIKE '%http%'\n",
    "        )\n",
    "        AND\n",
    "        (\n",
    "            lower(User) LIKE '%authori%'\n",
    "            OR lower(User) LIKE '%autori%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 70)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "f21e7e02-447f-4ceb-ac7e-02fa672434b7",
   "metadata": {},
   "source": [
    "###  Exploited CVE-2020-10189 Zoho ManageEngine\n",
    "##### description : Detects the exploitation of Zoho ManageEngine Desktop Central Java Deserialization vulnerability reported as CVE-2020-10189"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "c582cb46-7c2d-402f-9150-6d88cc49bf25",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(ParentImage) LIKE '%desktopcentral_server\\\\jre\\\\bin\\\\java.exe%'\n",
    "        )\n",
    "        AND\n",
    "        (\n",
    "            lower(Image) LIKE '%\\\\cmd.exe%'\n",
    "            OR lower(Image) LIKE '%\\\\powershell.exe%'\n",
    "            OR lower(Image) LIKE '%\\\\pwsh.exe%'\n",
    "            OR lower(Image) LIKE '%\\\\bitsadmin.exe%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 70)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "d338b850-382f-4048-b976-7b5da14f3cd0",
   "metadata": {},
   "source": [
    "###  DNS RCE CVE-2020-1350\n",
    "##### description :  Detects exploitation of DNS RCE bug reported in CVE-2020-1350 by the detection of suspicious sub process"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "4d26a722-f1f5-4eae-9faa-cb74f5e39cc1",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(ParentImage) LIKE '%system32\\\\dns.exe%'\n",
    "        )\n",
    "        AND\n",
    "        (\n",
    "            lower(Image) LIKE '%system32\\\\werfault.exe%'\n",
    "            OR lower(Image) LIKE '%system32\\\\conhost.exe%'\n",
    "            OR lower(Image) LIKE '%system32\\\\dnscmd.exe%'\n",
    "            OR lower(Image) LIKE '%system32\\\\dns.exe%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 70)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "63b9b41a-8eb5-4386-9d4e-13b8aa5a2a60",
   "metadata": {},
   "source": [
    "###  SystemNightmare Exploitation Script Execution\n",
    "##### description : Detects the exploitation of PrinterNightmare to get a shell as LOCAL_SYSTEM"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "82a13cda-d63a-4af0-888e-e84a4ec1547c",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%printnightmare.gentilkiwi.com%'\n",
    "            OR lower(CommandLine) LIKE '%user:gentilguest%'\n",
    "            OR lower(CommandLine) LIKE '%kiwi kegit printer%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 70)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "850f3e34-f7d7-4d89-b95a-41bc73546a4a",
   "metadata": {},
   "source": [
    "###  File or Folder Permissions Modifications\n",
    "##### description :  Detects a file or folder's permissions being modified."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "2a517200-0f2c-45b6-827e-8e11f76cc2e8",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "            lower(CommandLine) LIKE '%/grant%'\n",
    "        AND\n",
    "        (\n",
    "            lower(Image) LIKE '%\\\\takeown.exe%'\n",
    "            OR lower(Image) LIKE '%\\\\cacls.exe%'\n",
    "            OR lower(Image) LIKE '%\\\\icacls.exe%'\n",
    "            OR lower(Image) LIKE '%\\\\net.exe%'\n",
    "            OR lower(Image) LIKE '%\\\\net1.exe%'\n",
    "        )\n",
    "        OR\n",
    "        (\n",
    "            lower(Image) LIKE '%\\\\attrib.exe%'\n",
    "            AND\n",
    "            (\n",
    "                lower(CommandLine) LIKE '%-r%'\n",
    "            )\n",
    "        )\n",
    "        AND NOT\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%icacls%config\\\\connectivity.history /reset%'\n",
    "            OR lower(CommandLine) LIKE '%appdata\\\\local\\\\programs\\\\microsoft vs code%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 100)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "e55f3e0b-298a-4b93-9693-908d4e010386",
   "metadata": {},
   "source": [
    "###  Findstr GPP Passwords\n",
    "##### description :   Look for the encrypted cpassword value within Group Policy Preference files on the Domain Controller. This value can be decrypted with gpp-decrypt."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "007945f2-fc61-4c43-8c4e-7dba2791c9ed",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "            lower(Image) LIKE '%\\\\findstr.exe%'\n",
    "        AND\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%cpassword%'\n",
    "            AND lower(CommandLine) LIKE '%\\\\sysvol\\\\%'\n",
    "            AND lower(CommandLine) LIKE '%.xml%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 100)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "74b05b0d-cc85-44d3-a31e-86955cf5998c",
   "metadata": {},
   "source": [
    "###  ADCSPwn Hack Tool\n",
    "##### description : Detects command line parameters used by ADCSPwn, a tool to escalate privileges in an active directory network by coercing authenticate from machine accounts and relaying to the certificate service"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "b5b0ff08-7c15-45e4-ae93-3f7c1940d2ed",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(CommandLine) LIKE '% --adcs %'\n",
    "            OR lower(CommandLine) LIKE '% --port %'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 100)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "9856be72-7e56-46f9-9e3a-d6bcbda59696",
   "metadata": {},
   "source": [
    "###  Bloodhound and Sharphound Hack Tool\n",
    "##### description : Detects command line parameters used by Bloodhound and Sharphound hack tools"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "960233fb-fefb-482b-8ef9-b90523685df8",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(Image) LIKE '%\\\\bloodhound.exe%'\n",
    "            OR lower(Image) LIKE '%\\\\sharphound.exe%'\n",
    "        )\n",
    "        OR\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%-collectionmethod all%'\n",
    "            OR lower(CommandLine) LIKE '%.exe -c all -d %'\n",
    "            OR lower(CommandLine) LIKE '%invoke-bloodhound%'\n",
    "            OR lower(CommandLine) LIKE '%invoke-sharphound%'\n",
    "            OR lower(CommandLine) LIKE '%get-bloodhounddata%'\n",
    "        )\n",
    "        OR\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%jsonfolder%'\n",
    "            OR lower(CommandLine) LIKE '%-zipfilename%'\n",
    "        )\n",
    "        OR\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%dconly%'\n",
    "            AND lower(CommandLine) LIKE '%--nosavecache%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 55)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "c896f65f-6e98-417d-818a-2c3f15674ea0",
   "metadata": {},
   "source": [
    "###  Koadic Execution\n",
    "##### description : Detects command line parameters used by Koadic hack tool"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "83362851-7af1-43f4-9dbb-d68b5e5de87a",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(Image) LIKE '%\\\\cmd.exe%'\n",
    "        )\n",
    "        AND\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%/q%'\n",
    "            AND lower(CommandLine) LIKE '%/c%'\n",
    "            AND lower(CommandLine) LIKE '%chcp%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 80)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "05af0bd6-174d-4185-9225-281f74a584d8",
   "metadata": {},
   "source": [
    "###  KrbRelay Hack Tool\n",
    "##### description : Detects the use of KrbRelay, a Kerberos relaying tool"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "f5c33bbf-eb50-4500-935f-1beff2d2ef44",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%asreproast%'\n",
    "            OR lower(CommandLine) LIKE '%dump%service:krbtgt%'\n",
    "            OR lower(CommandLine) LIKE '%kerberoast%'\n",
    "            OR lower(CommandLine) LIKE '%createnetonly%program:%'\n",
    "            OR lower(CommandLine) LIKE '%ptt%ticket:%'\n",
    "            OR lower(CommandLine) LIKE '%impersonateuser:%'\n",
    "            OR lower(CommandLine) LIKE '%renew%ticket:%'\n",
    "            OR lower(CommandLine) LIKE '%asktgt%user:%'\n",
    "            OR lower(CommandLine) LIKE '%harvest%interval:%'\n",
    "            OR lower(CommandLine) LIKE '%s4u%user:%'\n",
    "            OR lower(CommandLine) LIKE '%s4u%ticket:%'\n",
    "            OR lower(CommandLine) LIKE '%hash%password:%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 80)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "81fbf04c-66a4-4121-a8e4-17da936a06c9",
   "metadata": {},
   "source": [
    "###  Domain hash retrieval via NTDS.dit detection\n",
    "##### description : Detects the usage of vssadmin to access or copy NTDS.dit for domain hash retrieval"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "71a15415-aab9-4c83-9311-889f53397e27",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "            lower(CommandLine) LIKE '%vssadmin%'\n",
    "        AND\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%for%'\n",
    "            OR lower(CommandLine) LIKE '%ntds%'\n",
    "            OR lower(CommandLine) LIKE '%sam%'\n",
    "            OR lower(CommandLine) LIKE '%resize%'\n",
    "            OR lower(CommandLine) LIKE '%hklm%'\n",
    "        )\n",
    "        AND NOT\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%add%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 65)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "57235f6a-284b-4d26-9b3c-9a599fb7d6f7",
   "metadata": {},
   "source": [
    "###  LethalHTA detection\n",
    "##### description : Detects the remote execution of Mshta via DCOM - LethalHTA"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "6620594a-ed0a-4ef3-8ec1-14331bc62a1c",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT  computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(ParentImage) LIKE '%svchost%'\n",
    "            AND lower(CommandLine) LIKE '%mshta'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 60)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "399b1064-91c8-4cbc-869d-c170a2f06c7a",
   "metadata": {},
   "source": [
    "###  CMD or PowerShell spawned from MS Office Process\n",
    "##### description : Detects the execution of command prompt or powershell from Microsoft Office Process"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "f5909250-f6e3-4da4-b0d3-ecba81e6cde9",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(ParentImage) LIKE '%winword.exe'\n",
    "            OR lower(ParentImage) LIKE '%excel.exe'\n",
    "            OR lower(ParentImage) LIKE '%eqnedt32.exe'\n",
    "            OR lower(ParentImage) LIKE '%msaccess.exe'\n",
    "            OR lower(ParentImage) LIKE '%mspub.exe'\n",
    "            OR lower(ParentImage) LIKE '%powerpnt.exe'\n",
    "            OR lower(ParentImage) LIKE '%visio.exe'\n",
    "        )\n",
    "        AND\n",
    "        (\n",
    "            lower(Description) LIKE '%forfiles - executes a command on selected files%'\n",
    "            OR lower(Description) LIKE '%microsoft (r) html application host%'\n",
    "            OR lower(Description) LIKE '%microsoft ® console based script host%'\n",
    "            OR lower(Description) LIKE '%microsoft ® windows based script host%'\n",
    "            OR lower(Description) LIKE '%microsoft(c) register server%'\n",
    "            OR lower(Description) LIKE '%microsoft® html help executable%'\n",
    "            OR lower(Description) LIKE '%msbuild.exe%'\n",
    "            OR lower(Description) LIKE '%network command shell%'\n",
    "            OR lower(Description) LIKE '%task scheduler configuration tool%'\n",
    "            OR lower(Description) LIKE '%windows command processor%'\n",
    "            OR lower(Description) LIKE '%windows host process (rundll32)%'\n",
    "            OR lower(Description) LIKE '%windows powershell%'\n",
    "            OR lower(Description) LIKE '%windows® installer%'\n",
    "            OR lower(Description) LIKE '%wmi commandline utility%'\n",
    "            OR lower(Description) LIKE '%wmi standard event consumer - scripting%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 60)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "ba9efefd-d4c8-4d0b-8345-35dcd357731c",
   "metadata": {},
   "source": [
    "###  Commands Related to Credential Dumping Detected\n",
    "##### description : Detects the Commands Related to Credential Dumping"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "4a142183-5b46-4c2a-a647-ae7e3f8c4e41",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%mimikatz%'\n",
    "            OR lower(CommandLine) LIKE '%mimilib%'\n",
    "            OR lower(CommandLine) LIKE '%sekurlsa::logonpasswords%'\n",
    "            OR lower(CommandLine) LIKE '%lsadump::sam%'\n",
    "            OR lower(CommandLine) LIKE '%mimidrv.sys%'\n",
    "            OR lower(CommandLine) LIKE '%crypto::certificates%'\n",
    "            OR lower(CommandLine) LIKE '%kerberos::golden%'\n",
    "            OR lower(CommandLine) LIKE '%kerberos::list%'\n",
    "            OR lower(CommandLine) LIKE '%kerberos::ptt%'\n",
    "            OR lower(CommandLine) LIKE '%lsadump::dcsync%'\n",
    "            OR lower(CommandLine) LIKE '%lsadump::lsa%'\n",
    "            OR lower(CommandLine) LIKE '%lsadump::secrets%'\n",
    "            OR lower(CommandLine) LIKE '%token::elevate%'\n",
    "            OR lower(CommandLine) LIKE '%token::list%'\n",
    "        )\n",
    "        OR\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%procdump.exe%'\n",
    "            AND lower(CommandLine) LIKE '%-ma%'\n",
    "        )\n",
    "        OR\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%rdrleakdiag.exe%'\n",
    "            AND lower(CommandLine) LIKE '%fullmemdmp%'\n",
    "        )\n",
    "        OR\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%tttracer.exe%'\n",
    "            AND lower(CommandLine) LIKE '%-dumpFull%'\n",
    "        )\n",
    "        OR\n",
    "        (\n",
    "            lower(OriginalFileName) LIKE '%processdump.exe%'\n",
    "            OR lower(OriginalFileName) LIKE '%writeminidump.exe%'\n",
    "        )\n",
    "        OR\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%hacktool%'\n",
    "            OR lower(CommandLine) LIKE '%rubeus%'\n",
    "            OR lower(CommandLine) LIKE '%sharphound%'\n",
    "            OR lower(CommandLine) LIKE '%bloodhound%'\n",
    "            OR lower(CommandLine) LIKE '%impacket%'\n",
    "            OR lower(CommandLine) LIKE '%seatbelt%'\n",
    "            OR lower(ParentCommandLine) LIKE '%hacktool%'\n",
    "            OR lower(ParentCommandLine) LIKE '%rubeus%'\n",
    "            OR lower(ParentCommandLine) LIKE '%sharphound%'\n",
    "            OR lower(ParentCommandLine) LIKE '%bloodhound%'\n",
    "            OR lower(ParentCommandLine) LIKE '%impacket%'\n",
    "            OR lower(ParentCommandLine) LIKE '%seatbelt%'\n",
    "        )\n",
    "        OR\n",
    "        (\n",
    "            (\n",
    "                lower(CommandLine) LIKE '%reg%'\n",
    "                AND lower(CommandLine) LIKE '%save%'\n",
    "            )\n",
    "            AND\n",
    "            (\n",
    "                lower(CommandLine) LIKE '%hklm%security%'\n",
    "                OR lower(CommandLine) LIKE '%hklm%system%'\n",
    "                OR lower(CommandLine) LIKE '%hklm%sam%'\n",
    "            )\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(50, 70)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "f5c2f636-a421-420d-b40e-a2dd9889738b",
   "metadata": {},
   "source": [
    "###   Possible webshell detection\n",
    "##### description : Detects the execution of possible webshell"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "4740ccd4-54cc-4a1e-98c2-1430c66c87e7",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(ParentImage) LIKE '%apache'\n",
    "            OR lower(ParentImage) LIKE '%tomcat'\n",
    "            OR lower(ParentImage) LIKE '%w3wp.exe' \n",
    "            OR lower(ParentImage) LIKE '%php-cgi.exe'\n",
    "            OR lower(ParentImage) LIKE '%nginx.exe'\n",
    "            OR lower(ParentImage) LIKE '%httpd.exe'\n",
    "        )\n",
    "        AND\n",
    "        (\n",
    "            lower(Description) LIKE '%forfiles - executes a command on selected files%'\n",
    "            OR lower(Description) LIKE '%microsoft (r) html application host%'\n",
    "            OR lower(Description) LIKE '%microsoft ® console based script host%'\n",
    "            OR lower(Description) LIKE '%microsoft ® windows based script host%'\n",
    "            OR lower(Description) LIKE '%microsoft(c) register server%'\n",
    "            OR lower(Description) LIKE '%microsoft® html help executable%'\n",
    "            OR lower(Description) LIKE '%msbuild.exe%'\n",
    "            OR lower(Description) LIKE '%network command shell%'\n",
    "            OR lower(Description) LIKE '%task scheduler configuration tool%'\n",
    "            OR lower(Description) LIKE '%windows command processor%'\n",
    "            OR lower(Description) LIKE '%windows host process (rundll32)%'\n",
    "            OR lower(Description) LIKE '%windows powershell%'\n",
    "            OR lower(Description) LIKE '%windows® installer%'\n",
    "            OR lower(Description) LIKE '%wmi commandline utility%'\n",
    "            OR lower(Description) LIKE '%wmi standard event consumer - scripting%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 60)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "f6014529-d1f0-48ef-9483-065f36c13596",
   "metadata": {},
   "source": [
    "###   Suspicious certutil execution detected\n",
    "##### description : Detects the suspicious execution of certutil"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "ad0da1af-b8ee-4e68-be3e-2b4517971438",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "            lower(CommandLine) LIKE '%certutil.exe%'\n",
    "        AND\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%http%'\n",
    "            OR lower(CommandLine) LIKE '%decode%'\n",
    "            OR lower(CommandLine) LIKE '%url%'\n",
    "            OR lower(CommandLine) LIKE '%ftp%'\n",
    "            OR lower(CommandLine) LIKE '%ping%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 60)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "735e445a-4212-4273-8a20-f85edd60ea3f",
   "metadata": {},
   "source": [
    "###   Suspicious execution via wscript.exe\n",
    "##### description : Detects the suspicious usage of wscript"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "674f64fb-dc51-49df-91eb-4912e255b3b6",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%wscript.exe%'\n",
    "            OR lower(ParentCommandLine) LIKE '%wscript.exe%'\n",
    "        )\n",
    "        AND\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%.jse%'\n",
    "            OR lower(CommandLine) LIKE '%.vbe%'\n",
    "            OR lower(CommandLine) LIKE '%.js%'\n",
    "            OR lower(CommandLine) LIKE '%.vba%'\n",
    "            OR lower(CommandLine) LIKE '%.vbs%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 80)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "0d0c36e3-bf89-4e8c-8849-04e66eb2d73d",
   "metadata": {},
   "source": [
    "###   Suspicious Regsvr32 CMD Executed\n",
    "##### description : Detects the suspicious execution of Regsvr32 command"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "d746543b-f9d0-4534-bb89-ada726926195",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(OriginalFileName) LIKE '%regsvr32.exe%'\n",
    "        )\n",
    "        AND\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%i:%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 100)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "51197e25-19d6-4019-b75e-e2b836974340",
   "metadata": {},
   "source": [
    "###   Detects Suspicious svchost.exe CMD Execution\n",
    "##### description : Detects the suspicious execution of svchost.exe command"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "2c0a6dab-87f8-4e8a-bcfa-811e0c2c4d4f",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "            lower(Image) LIKE '%svchost.exe%'\n",
    "        AND NOT\n",
    "            (\n",
    "                lower(ParentImage) LIKE '%services.exe%'\n",
    "                OR lower(ParentImage) LIKE '%microsoft%windows defender%'\n",
    "                OR lower(CommandLine) LIKE '%localservice%p%s%cdpsvc%'\n",
    "            )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 110)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "3fd60850-34ba-4f59-89af-fcffbd768bbc",
   "metadata": {},
   "source": [
    "###   Detects suspicious TASKKILL execution\n",
    "##### description : Detects the suspicious usage of TASKKILL"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "25991ed8-fc51-4048-8c8f-95a060ce0d00",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "            lower(Image) LIKE '%taskkill.exe%'\n",
    "        AND\n",
    "        (\n",
    "            lower(ParentImage) LIKE '%cmd.exe%'\n",
    "            OR lower(ParentImage) LIKE '%powershell.exe%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 50)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "1340274c-12af-426e-8d82-b6318ac99c71",
   "metadata": {},
   "source": [
    "###   Detects the potential Gootkit activity\n",
    "##### description : Detects the potential Gootkit activity"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "de245520-b765-4109-8a86-4dcc4421a0c6",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "            lower(CommandLine) LIKE '%collective_agreemente%'\n",
    "        OR\n",
    "        (\n",
    "            lower(Description) LIKE '%windows powershell%'\n",
    "            AND lower(ParentImage) LIKE '%\\wscript.exe%'\n",
    "        )\n",
    "\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 80)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "cf8d8465-38a0-4f38-975c-80d2b9c50507",
   "metadata": {},
   "source": [
    "###   WMI unusual child processes\n",
    "##### description : Detects the unusual execution of child processes via WMI"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "bf82c0d4-7108-468e-949c-9f18783d8d89",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "            lower(ParentImage) LIKE '%\\wmiprvse.exe%'\n",
    "        AND\n",
    "        (\n",
    "            lower(Image) LIKE '%rundll32.exe%'\n",
    "            OR lower(Image) LIKE '%regsvr32.exe%'\n",
    "            OR lower(Image) LIKE '%mshta.exe%'\n",
    "        )\n",
    "\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 80)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "ca416313-b28e-4202-8501-04c99fff3450",
   "metadata": {},
   "source": [
    "###   WMI Spawned From Unusual Process\n",
    "##### description :  Detects the execution of WMI from unusual process"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "d634f1e3-d6bc-48eb-8904-3a83289ccfee",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "            lower(Image) LIKE '%\\\\wmiprvse.exe%'\n",
    "        AND NOT\n",
    "        (\n",
    "            lower(ParentCommandLine) LIKE '%microsoft pfe remediation for configuration manager%pferemediationscript%'\n",
    "            OR lower(ParentImage) LIKE '%svchost.exe%'\n",
    "            OR lower(ParentImage) LIKE '%?%'\n",
    "        )\n",
    "\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 80)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "67f6c0a7-571c-4c91-b0e3-cbba57f255c2",
   "metadata": {},
   "source": [
    "###   Potential WMI lateral movement detected\n",
    "##### description :  Detects the ussage of WMI to perform Lateral Movement"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "0d006145-5a4c-4ce8-86fd-1b7e3a73db24",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%wmic%'\n",
    "            AND lower(CommandLine) LIKE '%process%'\n",
    "            AND lower(CommandLine) LIKE '%create%'\n",
    "        )\n",
    "        OR\n",
    "        (\n",
    "            lower(Description) == 'wmi commandline utility'\n",
    "            AND lower(CommandLine) LIKE '%node%'\n",
    "            AND\n",
    "            (\n",
    "                lower(CommandLine) LIKE '%process%'\n",
    "                OR lower(CommandLine) LIKE '%service%'\n",
    "                OR lower(CommandLine) LIKE '%shadowcopy%'\n",
    "            )\n",
    "        )\n",
    "\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(50, 75)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "12e75163-fbc8-4fa8-a87d-7c37dff01023",
   "metadata": {},
   "source": [
    "###   HH.exe launched shell\n",
    "##### description :  Detects a shell being launched by HH.exe"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "aa5d799b-6860-4d2f-bd5d-5fae4a9830de",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(Description) LIKE '%microsoft® html help executable%'\n",
    "        )\n",
    "\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(100, 80)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "0103b8a3-992e-4de3-9706-10ec65e35710",
   "metadata": {},
   "source": [
    "###   Potential MSHTA.exe abuse\n",
    "##### description :  Detects the potential MSHTA abuse"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "e0fdb5d5-3eab-4f8c-9b00-290a107118c0",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(Description) LIKE '%microsoft (r) html application host%'\n",
    "        )\n",
    "\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(100, 85)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "b733561c-ac66-4929-acce-4288084ec729",
   "metadata": {},
   "source": [
    "###  Potential MEGA/Rclone Data Exfiltration\n",
    "##### description :  Detects Potential MEGA/Rclone Data Exfiltration"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "0dbee3fd-cca3-40b5-9d48-497d1fafbe0a",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(Image) LIKE '%rclone%'\n",
    "            OR lower(Image) LIKE '%rsync.exe%'\n",
    "            OR lower(Description) LIKE '%rclone%'\n",
    "            OR lower(Description) LIKE '%rsync%'\n",
    "        )\n",
    "        AND\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%config%'\n",
    "            OR lower(CommandLine) LIKE '%lsd%'\n",
    "            OR lower(CommandLine) LIKE '%remote%'\n",
    "            OR lower(CommandLine) LIKE '%ftp:%'\n",
    "            OR lower(CommandLine) LIKE '%--config%'\n",
    "            OR lower(CommandLine) LIKE '%--auto-confirm%'\n",
    "            OR lower(CommandLine) LIKE '%--milti-thread-streams%'\n",
    "            OR lower(CommandLine) LIKE '%--progress%'\n",
    "            OR lower(CommandLine) LIKE '%--no-check-certificate%'\n",
    "            OR lower(CommandLine) LIKE '%--ignore-existing%'\n",
    "            OR lower(CommandLine) LIKE '%--transfers%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(100, 80)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "fccf6a19-1bc5-40b3-bbd6-94f094b385cc",
   "metadata": {},
   "source": [
    "###  Lazarus Group Activity Detected\n",
    "##### description : Detects the Lazarus group activity"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "50dedbdd-da3e-4beb-a6c3-274600559d8d",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(Description) LIKE '%forfiles - executes a command on selected files%'\n",
    "            OR lower(Description) LIKE '%microsoft (r) html application host%'\n",
    "            OR lower(Description) LIKE '%microsoft ® console based script host%'\n",
    "            OR lower(Description) LIKE '%microsoft ® windows based script host%'\n",
    "            OR lower(Description) LIKE '%microsoft(c) register server%'\n",
    "            OR lower(Description) LIKE '%microsoft® html help executable%'\n",
    "            OR lower(Description) LIKE '%msbuild.exe%'\n",
    "            OR lower(Description) LIKE '%network command shell%'\n",
    "            OR lower(Description) LIKE '%task scheduler configuration tool%'\n",
    "            OR lower(Description) LIKE '%windows command processor%'\n",
    "            OR lower(Description) LIKE '%windows host process (rundll32)%'\n",
    "            OR lower(Description) LIKE '%windows powershell%'\n",
    "            OR lower(Description) LIKE '%windows® installer%'\n",
    "            OR lower(Description) LIKE '%wmi commandline utility%'\n",
    "            OR lower(Description) LIKE '%wmi standard event consumer - scripting%'\n",
    "        )\n",
    "        AND\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%?:%drivers%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 80)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "c8882417-ed6d-4db8-be68-ae7364a60ed1",
   "metadata": {},
   "source": [
    "###  Detects suspicious MSBuild execution\n",
    "##### description : Detects the suspicious execution of MSBuild"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "76363d16-90f2-4c83-af2d-b70a7b94afbb",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(Image) LIKE '%msbuild.exe%'\n",
    "        )\n",
    "        OR\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%msbuild %'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(100, 80)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "8f8966d9-c754-4c61-b884-95a45c6a9e4d",
   "metadata": {},
   "source": [
    "###  Masqueraded Windows/Sysinternal Binary Detected\n",
    "##### description : Detects Windows/Sysinternal Binary Masquerading attack"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "60f3b255-cd5b-4fe2-af59-fd37ae66ae63",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, Description, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(Description) LIKE '%execute processes remotely%'\n",
    "            OR lower(Description) LIKE '%windows command processor%'\n",
    "            OR lower(Description) LIKE '%whoami - displays logged on user information%' \n",
    "            OR lower(Description) LIKE '%registry editor%'\n",
    "            OR lower(Description) LIKE '%secure file delete%'\n",
    "            OR lower(Description) LIKE '%net command%'\n",
    "            OR lower(Description) LIKE '%microsoft® windows based script host%'\n",
    "            OR lower(Description) LIKE '%autostart program viewer%'\n",
    "            OR lower(Description) LIKE '%microsoft (r) html application host%'\n",
    "            OR lower(Description) LIKE '%microsoft® html help executable%'\n",
    "            OR lower(Description) LIKE '%remote desktop connection%'\n",
    "            OR lower(Description) LIKE '%network command shell%'\n",
    "            OR lower(Description) LIKE '%registry console tool%'\n",
    "            OR lower(Description) LIKE '%run as utility%'\n",
    "            OR lower(Description) LIKE '%task scheduler configuration tool%'\n",
    "            OR lower(Description) LIKE '%services and controller app%'\n",
    "            OR lower(Description) LIKE '%service control manager configuration tool%'\n",
    "            OR lower(Description) LIKE '%command line interface for microsoft® volume shadow copy service%'\n",
    "            OR lower(Description) LIKE '%microsoft(c) register server%'\n",
    "            OR lower(Description) LIKE '%reports effective permissions for securable objects%'\n",
    "            OR lower(Description) LIKE '%accessenum%'\n",
    "            OR lower(Description) LIKE '%active directory editor%'\n",
    "            OR lower(Description) LIKE '%active directory ldap monitor%'\n",
    "            OR lower(Description) LIKE '%autologon configuration%'\n",
    "            OR lower(Description) LIKE '%handle viewer%'\n",
    "            OR lower(Description) LIKE '%creates pending movefile operations%'\n",
    "            OR lower(Description) LIKE '%driver bug test program%'\n",
    "            OR lower(Description) LIKE '%sysinternals process dump utility%'\n",
    "            OR lower(Description) LIKE '%lists files and directories opened remotely%'\n",
    "            OR lower(Description) LIKE '%local and remote system information viewer%'\n",
    "            OR lower(Description) LIKE '%terminates processes on local or remote systems%'\n",
    "            OR lower(Description) LIKE '%local and remote password changer%'\n",
    "            OR lower(Description) LIKE '%service information and configuration utility%'\n",
    "            OR lower(Description) LIKE '%process suspender%'\n",
    "            OR lower(Description) LIKE '%run as different user%'\n",
    "            OR lower(Description) LIKE '%search for ansi and unicode strings in binary images%'\n",
    "            OR lower(Description) LIKE '%sysinternals winobj or schedule service command line interface%'\n",
    "            OR lower(Description) LIKE '%bits administration utility%'\n",
    "            OR lower(Description) LIKE '%certutil.exe%'\n",
    "            OR lower(Description) LIKE '%microsoft ® console based script host%'\n",
    "            OR lower(Description) LIKE '%com surrogate%'\n",
    "            OR lower(Description) LIKE '%extensible storage engine utilities for microsoft(r) windows(r)%'\n",
    "            OR lower(Description) LIKE '%windows host process (rundll32)%'\n",
    "            OR lower(Description) LIKE '%visual basic command line compiler%'\n",
    "            OR lower(Description) LIKE '%terminates processes%'\n",
    "            OR lower(Description) LIKE '%ctf loader%'\n",
    "            OR lower(Description) LIKE '%file transfer program%'\n",
    "            OR lower(Description) LIKE '%system configuration utility%'\n",
    "            OR lower(Description) LIKE '%windows remote assistance%'\n",
    "            OR lower(Description) LIKE '%microsoft® logon server test utility%'\n",
    "            OR lower(Description) LIKE '%displays the current open files list%'\n",
    "            OR lower(Description) LIKE '%mimikatz for windows%'\n",
    "            OR lower(Description) LIKE '%microsoft application virtualization injector%'\n",
    "            OR lower(Description) LIKE '%mavinject32%'\n",
    "        )\n",
    "        AND NOT\n",
    "        (\n",
    "            lower(Image) LIKE '%psexec.exe'\n",
    "            OR lower(Image) LIKE '%psexec.exe'\n",
    "            OR lower(Image) LIKE '%psexec64.exe'\n",
    "            OR lower(Image) LIKE '%remoteexec.exe'\n",
    "            OR lower(Image) LIKE '%cmd.exe'\n",
    "            OR lower(Image) LIKE '%whoami.exe'\n",
    "            OR lower(Image) LIKE '%regedit.exe'\n",
    "            OR lower(Image) LIKE '%sdelete.exe'\n",
    "            OR lower(Image) LIKE '%sdelete64.exe'\n",
    "            OR lower(Image) LIKE '%net.exe'\n",
    "            OR lower(Image) LIKE '%net1.exe'\n",
    "            OR lower(Image) LIKE '%wscript.exe'\n",
    "            OR lower(Image) LIKE '%autoruns.exe'\n",
    "            OR lower(Image) LIKE '%autoruns64.exe'\n",
    "            OR lower(Image) LIKE '%autorunsc.exe'\n",
    "            OR lower(Image) LIKE '%autorunsc64.exe'\n",
    "            OR lower(Image) LIKE '%mshta.exe'\n",
    "            OR lower(Image) LIKE '%hh.exe'\n",
    "            OR lower(Image) LIKE '%adfind.exe'\n",
    "            OR lower(Image) LIKE '%mstsc.exe'\n",
    "            OR lower(Image) LIKE '%multidesk.exe'\n",
    "            OR lower(Image) LIKE '%netsh.exe'\n",
    "            OR lower(Image) LIKE '%reg.exe'\n",
    "            OR lower(Image) LIKE '%reg_mam.exe'\n",
    "            OR lower(Image) LIKE '%runas.exe'\n",
    "            OR lower(Image) LIKE '%schtasks.exe'\n",
    "            OR lower(Image) LIKE '%services.exe'\n",
    "            OR lower(Image) LIKE '%sc.exe'\n",
    "            OR lower(Image) LIKE '%vssadmin.exe'\n",
    "            OR lower(Image) LIKE '%regsvr32.exe'\n",
    "            OR lower(Image) LIKE '%accesschk.exe'\n",
    "            OR lower(Image) LIKE '%accesschk64.exe'\n",
    "            OR lower(Image) LIKE '%accessenum.exe'\n",
    "            OR lower(Image) LIKE '%adexplorer.exe'\n",
    "            OR lower(Image) LIKE '%adexplorer64.exe'\n",
    "            OR lower(Image) LIKE '%adinsight.exe'\n",
    "            OR lower(Image) LIKE '%adinsight64.exe'\n",
    "            OR lower(Image) LIKE '%adinsight64.exe'\n",
    "            OR lower(Image) LIKE '%autologon.exe'\n",
    "            OR lower(Image) LIKE '%autologon64.exe'\n",
    "            OR lower(Image) LIKE '%handle.exe'\n",
    "            OR lower(Image) LIKE '%handle64.exe'\n",
    "            OR lower(Image) LIKE '%movefile.exe'\n",
    "            OR lower(Image) LIKE '%movefile64.exe'\n",
    "            OR lower(Image) LIKE '%notmyfault.exe'\n",
    "            OR lower(Image) LIKE '%notmyfault64.exe'\n",
    "            OR lower(Image) LIKE '%notmyfaultc.exe'\n",
    "            OR lower(Image) LIKE '%notmyfaultc64.exe'\n",
    "            OR lower(Image) LIKE '%procdump.exe'\n",
    "            OR lower(Image) LIKE '%procdump64.exe'\n",
    "            OR lower(Image) LIKE '%psfile.exe'\n",
    "            OR lower(Image) LIKE '%psfile64.exe'\n",
    "            OR lower(Image) LIKE '%psinfo.exe'\n",
    "            OR lower(Image) LIKE '%psinfo64.exe'\n",
    "            OR lower(Image) LIKE '%pskill.exe'\n",
    "            OR lower(Image) LIKE '%pskill64.exe'\n",
    "            OR lower(Image) LIKE '%pskllsvc.exe'\n",
    "            OR lower(Image) LIKE '%pspasswd.exe'\n",
    "            OR lower(Image) LIKE '%pspasswd64.exe'\n",
    "            OR lower(Image) LIKE '%psservice.exe'\n",
    "            OR lower(Image) LIKE '%psservice64.exe'\n",
    "            OR lower(Image) LIKE '%pssuspend.exe'\n",
    "            OR lower(Image) LIKE '%pssuspend64.exe'\n",
    "            OR lower(Image) LIKE '%shellrunas.exe'\n",
    "            OR lower(Image) LIKE '%strings.exe'\n",
    "            OR lower(Image) LIKE '%strings64.exe'\n",
    "            OR lower(Image) LIKE '%winobj.exe'\n",
    "            OR lower(Image) LIKE '%at.exe'\n",
    "            OR lower(Image) LIKE '%bitsadmin.exe'\n",
    "            OR lower(Image) LIKE '%certutil.exe'\n",
    "            OR lower(Image) LIKE '%cscript.exe'\n",
    "            OR lower(Image) LIKE '%dllhost.exe'\n",
    "            OR lower(Image) LIKE '%esentutl.exe'\n",
    "            OR lower(Image) LIKE '%rundll32.exe'\n",
    "            OR lower(Image) LIKE '%rundll32-low.exe'\n",
    "            OR lower(Image) LIKE '%vbc.exe'\n",
    "            OR lower(Image) LIKE '%taskkill.exe'\n",
    "            OR lower(Image) LIKE '%ctfmon.exe'\n",
    "            OR lower(Image) LIKE '%ftp.exe'\n",
    "            OR lower(Image) LIKE '%msconfig.exe'\n",
    "            OR lower(Image) LIKE '%msra.exe'\n",
    "            OR lower(Image) LIKE '%nltest.exe'\n",
    "            OR lower(Image) LIKE '%openfiles.exe'\n",
    "            OR lower(Image) LIKE '%mimikatz.exe'\n",
    "            OR lower(Image) LIKE '%mavinject.exe'\n",
    "            OR lower(Image) LIKE '%mavinject64.exe'\n",
    "            OR lower(Image) LIKE '%mavinject32.exe'\n",
    "            OR lower(Image) LIKE '%mavinject32.exe'\n",
    "        )\n",
    "        AND NOT\n",
    "        (\n",
    "             lower(ParentCommandLine) LIKE '%system32%svchost.exe -k netsvcs -p -s%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 60)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "c950c8d5-64b3-4b72-88ac-aca16905d29c",
   "metadata": {},
   "source": [
    "### Suspicious usage of CScript detected\n",
    "##### description :  Detects the suspicious usage of CScript"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "e74f60b5-187b-4bbf-b0dc-247ca302d48e",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(OriginalFileName) LIKE '%cscript.exe%'\n",
    "        )\n",
    "        AND\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%.jse%'\n",
    "            OR lower(CommandLine) LIKE '%.vbe%'\n",
    "            OR lower(CommandLine) LIKE '%.js%'\n",
    "            OR lower(CommandLine) LIKE '%.vba%'\n",
    "            OR lower(CommandLine) LIKE '%.vbs%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(100, 80)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "47af8af2-7f6a-4fdc-846e-d55c7787b01f",
   "metadata": {},
   "source": [
    "### Volume Shadow copy deletion detected\n",
    "##### description :  Detects volume shadow copy deletion"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "d5fcaad9-67b5-4fa2-960c-70e37245fc38",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%vssadmin%'\n",
    "        )\n",
    "        AND\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%delete%' \n",
    "            AND lower(CommandLine) LIKE '%shadow%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 80)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "56afbcca-a101-4ddb-9fb1-4b081d27bacf",
   "metadata": {},
   "source": [
    "### Suspicious File Permission Modification - Granting Access to Network Shares via Net Share\n",
    "##### description :  Detects attempts by attackers to modify Windows Access Control Lists (ACLS) via the net share"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "56dc89ca-4059-4d2a-8610-01b3412b2e51",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(Description) LIKE '%net command%'\n",
    "        )\n",
    "        AND\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%share%' \n",
    "            AND lower(CommandLine) LIKE '%grant%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 80)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "9b92d168-c4cc-498b-8a14-f722a7031e75",
   "metadata": {},
   "source": [
    "### Potential Runexehelper Proxy Execution Detected\n",
    "##### description : Detects Potential Runexehelper Proxy Execution"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "068654eb-c25d-4ee5-a9a5-a833368301f0",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(Image) LIKE '%runexehelper.exe%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 80)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "86b33eca-dfa2-4d26-8d6c-b4faf179e799",
   "metadata": {},
   "source": [
    "### AppInstaller Installation Detected\n",
    "##### description : Detects the installation of AppInstaller"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "b2f1612e-9949-44b8-9ecc-4db1ec8f0124",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(Image) LIKE '%appinstaller.exe%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 80)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "43e76db3-c84d-4e52-9335-b73c843ac6f6",
   "metadata": {},
   "source": [
    "### Impacket Wmiexec Detected\n",
    "##### description: Detects Impacket Wmiexec"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "e5b0c3d4-6d1a-4105-a7fb-1e998113b97e",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%127.0.0.1%admin$%'\n",
    "            OR lower(ParentCommandLine) LIKE '%127.0.0.1%admin$%'\n",
    "        )\n",
    "        AND\n",
    "        (\n",
    "            (\n",
    "                lower(CommandLine) LIKE '%cmd.exe%'\n",
    "                AND lower(CommandLine) LIKE '%/q%'\n",
    "                AND lower(CommandLine) LIKE '%/c%'\n",
    "            )\n",
    "            OR\n",
    "            (\n",
    "                lower(ParentCommandLine) LIKE '%cmd.exe%'\n",
    "                AND lower(ParentCommandLine) LIKE '%/q%'\n",
    "                AND lower(ParentCommandLine) LIKE '%/c%'\n",
    "            )\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 80)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "e47d315e-f60d-4793-95b4-fe9578a3dba7",
   "metadata": {},
   "source": [
    "### CobaltStrike Werfault Detected\n",
    "##### description: Detects CobaltStrike injected into Werfault"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "65a08448-4878-4197-9eb6-d584de12655a",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%werfault.exe%'\n",
    "        )\n",
    "        AND\n",
    "        (\n",
    "            (\n",
    "                lower(CommandLine) LIKE '%-s%-t%'\n",
    "                AND lower(CommandLine) LIKE '%-o 0%'\n",
    "            )\n",
    "            OR\n",
    "            (\n",
    "                lower(ParentCommandLine) LIKE '%-s%-t%'\n",
    "                AND lower(ParentCommandLine) LIKE '%-o 0%'\n",
    "            )\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 60)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "d710f774-2036-4b39-ac1d-de940223645b",
   "metadata": {},
   "source": [
    "### Suspicious non EXE image Detected\n",
    "##### description: Detects suspicious non exe image execution"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "7dd97027-2fb2-4558-8291-9baeff5033b5",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND NOT\n",
    "        (\n",
    "            lower(Image) LIKE '%.scr%'\n",
    "            OR lower(Image) LIKE '%.dat%'\n",
    "            OR lower(Image) LIKE '%\\chcp.com%'\n",
    "            OR lower(Image) LIKE '%.p5x%'\n",
    "            OR lower(Image) LIKE '%.tmp%'\n",
    "            OR lower(Image) LIKE '%\\mode.com%'\n",
    "            OR lower(Image) LIKE '%\\sftmime.com%'\n",
    "            OR lower(Image) LIKE '%\\cgi%'\n",
    "            OR lower(Image) LIKE '%.bin%'\n",
    "            OR lower(Image) LIKE '%-\\winscp.com%'\n",
    "            OR lower(Image) LIKE '%\\more.com%'\n",
    "            OR lower(Image) LIKE '%.srv%'\n",
    "            OR lower(Image) LIKE '%.exe%'\n",
    "            OR lower(Image) LIKE '%basename%'\n",
    "            OR lower(Image) LIKE '%c%windows%temp%'\n",
    "            OR lower(Image) LIKE '%trend micro%'\n",
    "            OR lower(Image) LIKE '%hpimageassistant%'\n",
    "            OR lower(Image) LIKE '%wd desktop app%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 60)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "b8763d00-134b-42a6-8c04-8c42a9811055",
   "metadata": {},
   "source": [
    "### Detects MMC20.Application Lateral Movement\n",
    "##### description: Detects MMC20.Application Lateral Movement"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "3ffd00c9-da45-4349-a498-5cafd6448265",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%-embedding%'\n",
    "        )\n",
    "        AND\n",
    "        (\n",
    "            lower(ParentImage) LIKE '%svchost.exe%'\n",
    "        )\n",
    "        AND\n",
    "        (\n",
    "            lower(Image) LIKE '%mmc.exe%'\n",
    "        )\n",
    "        AND NOT\n",
    "        (\n",
    "            lower(ParentCommandLine) LIKE '%svchost.exe -k dcomlaunch%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 80)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "ebd14716-8a4e-4815-abc2-8a50039021e7",
   "metadata": {},
   "source": [
    "### Execution from Remote Shares Lateral Movement\n",
    "##### description: Detects the execution from remote shares for Lateral Movement"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "692cceb4-e920-4a73-bb19-25fd1408992c",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(Image) LIKE '%admin$%'\n",
    "            OR lower(Image) LIKE '%ipc$%'\n",
    "            OR lower(Image) LIKE '%c$%'\n",
    "            OR lower(Image) LIKE '%\\public%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 80)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "62aa1226-de95-4686-9ea6-2fc3016bd27b",
   "metadata": {},
   "source": [
    "### Detects execution via PSRemoting - Lateral Movement\n",
    "##### description: Detects the lateral movement via PSRemoting"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "418335fc-1475-47fd-80d8-4372a863641d",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(ParentCommandLine) LIKE '%-embedding%'\n",
    "            OR lower(ParentCommandLine) LIKE '%-enb%'\n",
    "        )\n",
    "        AND\n",
    "        (\n",
    "            lower(ParentImage) LIKE '%wsmprovhost.exe%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 80)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "d75e34fa-a7da-4ffb-9b4f-a713f3a0a3d8",
   "metadata": {},
   "source": [
    "### WMI Lateral Movement detected\n",
    "##### description: Detects the lateral movement via WMI execution"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "8171d972-cf33-446e-acf2-fa14c60d96a9",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(ParentCommandLine) LIKE '%-embedding%'\n",
    "        )\n",
    "        AND\n",
    "        (\n",
    "            lower(ParentImage) LIKE '%\\wmiprvse.exe%'\n",
    "        )\n",
    "        AND NOT\n",
    "        (\n",
    "            lower(Image) LIKE '%-%-%-%-%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 100)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "299804ff-7b89-4a01-b9c1-8cf169cb0363",
   "metadata": {},
   "source": [
    "### WFC Proxy Execution\n",
    "##### description:  Detects the execution of WFC to compile and execute C# code embedded in XOML file"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "71f02565-84a6-432f-af5c-7cde24149b56",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(Description) == 'microsoft windows workflow foundation compiler'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 80)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "cdca841a-02f0-49f5-9db6-add3d7b5176e",
   "metadata": {},
   "source": [
    "### Microsoft Workflow Compiler Execution detected\n",
    "##### description:  Detects the execution of Microsoft Workflow Compiler"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "6f48399e-5314-44ac-823e-7ef7fee4cc3f",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, Description, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(Image) LIKE '%compiler.exe%'\n",
    "        )\n",
    "        OR\n",
    "        (\n",
    "            lower(Description) == 'microsoft.workflow.compiler.exe'\n",
    "        )\n",
    "        AND NOT lower(CommandLine) == 'null'\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 60)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "a4247c17-3d05-4675-bf23-5e144822d872",
   "metadata": {},
   "source": [
    "### Suspicious JSC Execution detected\n",
    "##### description: Detects suspicious execution of JSC"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "cef54a1f-acea-495b-96a0-1583da594172",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(Image) LIKE '%jsc.exe%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 80)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "7cb95908-ef86-45ef-8a10-5f24d97c0271",
   "metadata": {},
   "source": [
    "### Visual Basics Commandline Compiler Proxy Execution\n",
    "##### description: Detects the execution of VBC to compile and execute the code"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "ed30284c-a1f8-4bf5-94d1-cdbe87561cc7",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(Description) == 'visual basic command line compiler'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 80)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "b93ca5fc-a227-4125-ad95-12c098f8917f",
   "metadata": {},
   "source": [
    "### System Service Modification Using SC/PowerShell\n",
    "##### description: Detects the System Service Modification Using SC/PowerShell"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "79e48b1b-3321-4d5c-8e15-46153c594515",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            (\n",
    "                lower(CommandLine) LIKE '%sc.exe%'\n",
    "                AND lower(CommandLine) LIKE '%config%'\n",
    "            )\n",
    "            AND\n",
    "            (\n",
    "                lower(CommandLine) LIKE '%disabled%'\n",
    "                OR lower(CommandLine) LIKE '%auto%'\n",
    "            )\n",
    "            OR\n",
    "            (\n",
    "                lower(CommandLine) LIKE '%set-service%'\n",
    "                OR lower(CommandLine) LIKE '%startuptype%'\n",
    "                OR lower(CommandLine) LIKE '%new-service%'\n",
    "            )\n",
    "            OR\n",
    "            (\n",
    "                lower(ParentCommandLine) LIKE '%set-service%'\n",
    "                OR lower(ParentCommandLine) LIKE '%startuptype%'\n",
    "                OR lower(ParentCommandLine) LIKE '%new-service%'\n",
    "            )\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 80)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "4ffebd05-e53d-46a1-a490-89aee0147f4b",
   "metadata": {},
   "source": [
    "### SSH Protocol Tunneling detected\n",
    "##### description: Detects the protocol tunneling"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "31cb081a-0250-4cce-80bc-b9b0f5618e11",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(Description) LIKE '%rlogin%'\n",
    "        )\n",
    "        AND\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%pw'\n",
    "            AND lower(CommandLine) LIKE '%-r'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 80)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "f00efb3a-8342-4832-98e8-5ca6af73c206",
   "metadata": {},
   "source": [
    "### File Download via IMEWDBLD.exe\n",
    "##### description: Detects attempts to conduct file downloads using the Microsoft IME Open Extended Dictionary Module (IMEWDBLD.exe) lolbin."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "14c76132-c3f4-4458-8a38-4e386c3d3d64",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(Description) == 'microsoft ime open extended dictionary module'\n",
    "            OR lower(Image) LIKE '%imewdbld.exe%'\n",
    "        )\n",
    "        AND\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%http%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 80)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "c8ce0e31-bab8-4ae7-8727-4c612e627be4",
   "metadata": {},
   "source": [
    "### File Download via Finger.exe\n",
    "##### description: Detects attempts to use the Finger.exe tool for potential ingress tool transfer"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "a3f1e518-ae47-4679-aea0-1e0ca26bb4cd",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(Description) == 'tcpip finger command'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 80)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "0320fcd3-d8bd-4704-997a-639ce8cd2e05",
   "metadata": {},
   "source": [
    "### Credential Dumping via comsvcs.dll\n",
    "##### description: Detects attempts to dump process memory using the built in Windows comsvcs.dll"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "f11c4058-c469-4050-8207-774d69e44155",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%minidump%'\n",
    "            AND lower(CommandLine) LIKE '%comsvcs.dll%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 50)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "9cbcbbd1-0b6b-4c17-ac65-4c7d20b2610c",
   "metadata": {},
   "source": [
    "### Esentutl.exe Abuse Detected\n",
    "##### description: Detects suspicious Esentutl.exe usage"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "5657ca7e-66d1-4e77-8b78-43169fc02927",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(Image) LIKE '%\\esentutl.exe%'\n",
    "            OR lower(Description) == 'extensible storage engine utilities for microsoft(r) windows(r)'\n",
    "        )\n",
    "        AND NOT\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%/k %'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 70)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "4e0770b2-a38f-4cf9-b8ac-cadf0b735212",
   "metadata": {},
   "source": [
    "### WMIC Shadow Copy Abuse Detected\n",
    "##### description: Detects the use of the WMI commandline utility to manipulate shadow copies, including remotely"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "ecfbbbce-27d6-434e-a219-2878377f1a21",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, Description, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%shadowcopy%'\n",
    "            OR lower(Description) == 'wmi commandline utility'\n",
    "        )\n",
    "        AND NOT\n",
    "            lower(ParentCommandLine) LIKE '%svchost.exe%-k%netsvcs%'\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(20, 40)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "718aeb13-c413-43c5-abaa-ed99fcbf9419",
   "metadata": {},
   "source": [
    "### NTDSUtil Active Directory Database Dumping Detected\n",
    "##### description:  Detects the use of the Active Directory management tool ntdsutil.exe to dump a copy of the Active Directory Database"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "ad697476-7889-4b5d-aa61-c1ed93468df9",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%ntdsutil%'\n",
    "            AND lower(CommandLine) LIKE '%ntds%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 70)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "c3c6d21b-6df9-4d58-a57c-8eca4e6110fd",
   "metadata": {},
   "source": [
    "### IFEO Debugger Abuse Detected\n",
    "##### description: Detects attempts to escalate privilege/establish persistence by executing malicious content triggered by Image File Execution Options (IFEO) debuggers"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "671eccf9-50a9-46d3-bb85-4473deadee49",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(Description) == 'microsoft® nt global flags manipulator'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 70)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "46bb23e3-cce7-4d96-b682-ab0bb78a0fa8",
   "metadata": {},
   "source": [
    "### Netsh Helper DLL Registration Detected\n",
    "##### description: Detects attempts to establish persistence or escalate privilege by triggering Netshell helper DLLs"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "609e79c4-f871-4496-92bd-898d4b02211c",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%netsh%'\n",
    "            AND lower(CommandLine) LIKE '%add%'\n",
    "            AND lower(CommandLine) LIKE '%helper%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 70)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "718dd4b1-7ec5-4a9a-90a7-ca84192d0aac",
   "metadata": {},
   "source": [
    "### Csc.exe Compilation After Delivery Detected\n",
    "##### description: Detects attempts to use the csc.exe .NET C# compiler to compile payloads from downloaded C# code"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "55ce811b-5f00-4201-a49c-43e05914f376",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(Description) == 'visual c# command line compiler'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 70)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "16607724-1433-4520-91af-2a5c242c2abf",
   "metadata": {},
   "source": [
    "### Signed Binary Proxy Execution via Odbcconf Detected\n",
    "##### description: Detects abuse of the Microsoft signed odbcconf.exe (Open Database Connectivity Configuration) binary to proxy the execution of malicious payloads"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "5cc276d8-1004-4d1b-bf53-380d07a7fcbd",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(Description) == 'odbc driver configuration program'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 70)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "107bb82b-1072-4b33-b75b-9955fd60ea0f",
   "metadata": {},
   "source": [
    "### Signed Binary Proxy Execution via Mavinject Detected\n",
    "##### description: Detects abuse of the Microsoft Application Virtualization Injector (Mavinject.exe) to inject malicious DLLs into running processes"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "c0bcad18-7ff8-4bbf-ad7c-74697311805f",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(Description) == 'microsoft application virtualization injector'\n",
    "            AND lower(CommandLine) LIKE '%.dll%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 50)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "d5ec744f-7a08-4a0d-b137-dd52e4390286",
   "metadata": {},
   "source": [
    "### MSXSL Script Bypass Detected\n",
    "##### description: Detects attempts to execute scripts embedded in Extensible Stylesheet Language (XSL) files via the Microsoft Common Line Transformation Utility (msxsl.exe)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "85ba9a39-0887-4b03-a8f0-8efaaaca532a",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(Description) == 'msxsl'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 70)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "05e66db8-ea42-419b-8df4-4193ac20e6d5",
   "metadata": {},
   "source": [
    "### WMIC XSL Script Bypass Detected\n",
    "##### description: Detects attempts to execute scripts embedded in Extensible Stylesheet Language (XSL) files via the Windows Management Instrumentation Command-Line utility (wmic.exe)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "3894ba02-26a6-48b3-9b31-285f8099d444",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, OriginalFileName, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%format%'\n",
    "            AND lower(CommandLine) LIKE '%xsl%'\n",
    "        )\n",
    "        AND NOT\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%list%'\n",
    "            OR lower(CommandLine) LIKE '%csv%'\n",
    "            OR lower(CommandLine) LIKE '%namespace%'\n",
    "            OR lower(CommandLine) LIKE '%value%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 70)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "6d117c3c-ea52-44a8-be18-d270b3bffd0f",
   "metadata": {},
   "source": [
    "### Suspicious File Permission Modification - Granting Access to Files/Folders\n",
    "##### description: Detects attempts by attackers to modify Windows Access Control Lists (ACLS) via the Windows icacls.exe tool in order to grant access to files and folders"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "5a8314d0-1d41-4f68-81cd-538a525ee3b1",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(OriginalFileName) LIKE '%icacls.exe%'\n",
    "        )\n",
    "        AND\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%grant%'\n",
    "            OR\n",
    "            (\n",
    "                lower(CommandLine) LIKE '%administrators%'\n",
    "                AND lower(CommandLine) LIKE '%everyone%'\n",
    "            )\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 70)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "4d9aa12b-a818-40ae-a3d3-a18596145bea",
   "metadata": {},
   "source": [
    "### CMSTP Proxy Execution Detected\n",
    "##### description: Detects attempts to abuse the Microsoft Connection Manager Profile Installer (CMSTP.exe) to proxy execution of malicious code"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "dbb8cb44-e64f-4606-8b93-fe572e797bae",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, CurrentDirectory, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(Description) LIKE 'microsoft connection manager profile installer'\n",
    "        )\n",
    "        AND\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%/au%'\n",
    "            OR lower(CommandLine) LIKE '%/s%'\n",
    "            OR lower(CommandLine) LIKE '%/su$'\n",
    "\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 70)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "51cc6d98-037b-4e87-bf63-8e4f38f01b3a",
   "metadata": {},
   "source": [
    "###  Msiexec Proxy Execution Detected\n",
    "##### description: Detects attempts to abuse the Windows Installer (msiexec.exe) command-line utility to proxy the execution of malicious DLL payloads"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "709296b5-2500-413a-ae3b-053902fdd011",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(Description) == 'windows® installer'\n",
    "        )\n",
    "        AND\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%/quiet%'\n",
    "            OR lower(CommandLine) LIKE '%/q%'\n",
    "            OR lower(CommandLine) LIKE '%/y$'\n",
    "\n",
    "        )\n",
    "        AND\n",
    "        (\n",
    "            lower(ParentImage) LIKE '%\\powershell.exe%'\n",
    "            OR lower(ParentImage) LIKE '%\\pwsh.exe%'\n",
    "            OR lower(ParentImage) LIKE '%\\cmd.exe%'\n",
    "            OR lower(ParentImage) LIKE '%\\wt.exe%'\n",
    "            OR lower(ParentImage) LIKE '%\\winword.exe%'\n",
    "            OR lower(ParentImage) LIKE '%\\excel.exe%'\n",
    "            OR lower(ParentImage) LIKE '%\\powerpnt.exe%'\n",
    "            OR lower(ParentImage) LIKE '%\\mspub.exe%'\n",
    "            OR lower(ParentImage) LIKE '%\\visio.exe%'\n",
    "            OR lower(ParentImage) LIKE '%\\msaccess.exe%'\n",
    "            OR lower(ParentImage) LIKE '%\\eqnedt32.exe%'\n",
    "            OR lower(ParentImage) LIKE '%\\explorer.exe%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 100)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "37ccfd57-31e7-4d1f-9c4a-5bd7f53ea62a",
   "metadata": {},
   "source": [
    "###  Regasm Unregister Proxy Execution Detected\n",
    "##### description: Detects attempts to abuse the Microsoft Regasm .NET COM registration command-line utility to proxy execute malicious code using the binary's UnRegisterClass function"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "bf893ba8-6a89-48c1-9df2-a67ed1c4dc7f",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(Image) LIKE '%regasm.exe%'\n",
    "        )\n",
    "        AND\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%/u%'\n",
    "\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 70)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "a6736111-7765-4021-82aa-ad3b4b0b824d",
   "metadata": {},
   "source": [
    "###  Regsvcs Unregister Proxy Execution Detected\n",
    "##### description: Detects attempts to abuse the Microsoft Regsvr .NET COM registration command-line utility to proxy execute malicious code using the binary's UnRegisterClass function"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "fd98fd19-433c-4c1b-9fa6-33d658d489cb",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(Description) == 'microsoft .net services installation utility'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 70)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "33d1fa46-dfa7-4bcb-89ef-93bab5a4b97a",
   "metadata": {},
   "source": [
    "###  Regsvr32 Non-DLL Proxy Execution Detected\n",
    "##### description: Detects attempts to abuse the Microsoft control and DLL Registration Server command-line application (Regsvr32) to proxy execute a malicious DLL embedded within another filetype"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "2ce75421-96b0-46f7-b5c6-035e551d748f",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, User, Description\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(Description) == 'microsoft(c) register server'\n",
    "        )\n",
    "        AND\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%/s%'\n",
    "            OR lower(CommandLine) LIKE '%-s%'\n",
    "        )\n",
    "        AND NOT\n",
    "        (\n",
    "            lower(ParentImage) LIKE '%system32%spoolsv.exe%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 100)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "bb98515f-2837-4f0c-ac27-fa28694ffb30",
   "metadata": {},
   "source": [
    "###  AppVLP Proxy Execution Detected\n",
    "##### description:  Detects the Proxy Execution via AppVLP"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "461f42ed-b4bc-40b1-9d68-36dc61496610",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(ParentImage) LIKE'%ppvlp.exe%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 70)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "172176a5-298c-48b9-a667-db67be9d30f8",
   "metadata": {},
   "source": [
    "###  Backup File Deletion Detected\n",
    "##### description:  Detects attempts to delete backup files, which may be used by adversaries to inhibit system recovery in the event of data destruction or ransomware encryption"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "b9de533d-5b08-433c-8e8e-be3ecc36b1d4",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(CommandLine) LIKE'%.vhd%'\n",
    "            OR lower(CommandLine) LIKE'%.bac%' \n",
    "            OR lower(CommandLine) LIKE'%.bak%'\n",
    "            OR lower(CommandLine) LIKE'%.wbcat%'\n",
    "            OR lower(CommandLine) LIKE'%.bkf%'\n",
    "            OR lower(CommandLine) LIKE'%backup%.%'\n",
    "            OR lower(CommandLine) LIKE'%.set%'\n",
    "            OR lower(CommandLine) LIKE'%.win%'\n",
    "            OR lower(CommandLine) LIKE'%.dsk%'\n",
    "        )\n",
    "        AND\n",
    "            lower(CommandLine) LIKE'%.del %'\n",
    "        AND\n",
    "        (\n",
    "            lower(CommandLine) LIKE'% /s%'\n",
    "            OR lower(CommandLine) LIKE'% /f%'\n",
    "            OR lower(CommandLine) LIKE'% -s%'\n",
    "            OR lower(CommandLine) LIKE'% -f%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 70)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "647a7246-290a-43e7-9b21-59e7a82db053",
   "metadata": {},
   "source": [
    "###  Potential Protocol Tunneling via Chisel\n",
    "##### description:  Detects Potential Protocol Tunneling via Chisel"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "108dd6e3-e224-4763-999a-dd7c8fffd18a",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(CommandLine) LIKE'%client%'\n",
    "        )\n",
    "        AND\n",
    "        (\n",
    "            lower(CommandLine) LIKE'%socks%'\n",
    "            OR lower(CommandLine) LIKE'%fingerprint%'\n",
    "            OR lower(CommandLine) LIKE'%authfile%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 70)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "11a0a748-ee38-4b34-8880-114da26b7199",
   "metadata": {},
   "source": [
    "###  Credential Dumping via Keymgr.dll\n",
    "##### description:   Detects Credential Dumping via Keymgr.dll"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "03fd13ca-3bac-4f61-ad3d-83887bd1794a",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(CommandLine) LIKE'%keymgr.dll%'\n",
    "            AND lower(CommandLine) LIKE'%krshowkeymgr%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 70)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "07c03d46-1fa3-418f-a9e2-5a39b863eec0",
   "metadata": {},
   "source": [
    "###  Msiexec HTTP Proxy Execution\n",
    "##### description: Detects Msiexec HTTP Proxy Execution"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "14f895c4-8395-4803-ac62-3e0c1ebee692",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(CommandLine) LIKE'%msiexec%'\n",
    "            AND lower(CommandLine) LIKE'%http%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 70)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "a20a3e4a-2261-42b7-9255-faf0df5a4ca5",
   "metadata": {},
   "source": [
    "###  PowerShell Execution via SQLPS.exe Detected\n",
    "##### description: Detects PowerShell Execution via SQLPS.exe"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "bd7059d8-e1e4-4eb8-b239-aaa270dcf18a",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(Description) == 'sql server powershell'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 70)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "74fc419f-e84d-4580-b993-17156e414295",
   "metadata": {},
   "source": [
    "###  UAC Bypass via Fodhelper Detected\n",
    "##### description: Detects UAC Bypass via Fodhelper"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "50e6a1a4-febc-4723-863a-5812bdd2082a",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(ParentImage) LIKE '%fodhelper.exe%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 70)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "08c2a5ff-e30f-49f6-842a-c03503485bcb",
   "metadata": {},
   "source": [
    "###  Proxy Execution via Verclsid Detected\n",
    "##### description:  Detects Proxy Execution via Verclsid"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "6dd8b186-c318-45af-8d4d-a08b5f7830a5",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(ParentImage) LIKE '%verclsid.exe%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 70)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "a95bf788-56ba-456f-974c-abb6fcb4aba8",
   "metadata": {},
   "source": [
    "###  Proxy Execution via InstallUtil.exe Detected\n",
    "##### description:  Detects Proxy Execution via InstallUtil.exe"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "67507979-1d00-4a5a-89ac-77abb7beecba",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(ParentImage) LIKE '%installutil.exe%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 70)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "1d9c8904-7c0e-4c85-893a-e930762027d5",
   "metadata": {},
   "source": [
    "###  MSDT Proxy Execution from Office Detected\n",
    "##### description:  Detects MSDT Proxy Execution from Office"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "78f0157f-d03b-46d3-ac89-13d049234775",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(Description) == 'diagnostics troubleshooting wizard'\n",
    "        )\n",
    "        AND\n",
    "        (\n",
    "            lower(CommandLine) LIKE'%-path%'\n",
    "            AND\n",
    "            (\n",
    "                lower(CommandLine) LIKE'%true%'\n",
    "                OR lower(CommandLine) LIKE'%/skip%'\n",
    "            )\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 70)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "4187134d-f924-48d2-8982-7d6ef0a39a59",
   "metadata": {},
   "source": [
    "### Sdiagnhost Proxy Execution Detected\n",
    "##### description:  Detects Proxy Execution via Sdiagnhost"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "98ba654d-029a-42bc-83d6-0715aec35c37",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(ParentImage) LIKE '%sdiagnhost.exe%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 70)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "5e08f74e-0e61-45ee-8bfc-19006f277b94",
   "metadata": {},
   "source": [
    "### Suspicious RunDll32 & Control.exe invokation\n",
    "##### description:  Detects suspicious invokations of RunDll32 & Control.exe .This TTP is used in ISO Embedded DLL Proxy Execution from Explorer as well."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "3d04c834-0975-41e0-aff6-504217607544",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(ParentImage) LIKE '%explorer.exe%'\n",
    "            OR lower(ParentImage) LIKE '%cmd.exe%'\n",
    "            OR lower(ParentImage) LIKE '%control.exe%'\n",
    "            OR lower(ParentImage) LIKE '%powershell.exe%'\n",
    "            OR lower(ParentImage) LIKE '%svchost.exe%'\n",
    "        )\n",
    "        AND\n",
    "        (\n",
    "            lower(Description) == 'windows host process (rundll32)'\n",
    "            OR lower(Description) == 'windows control panel'\n",
    "        )\n",
    "        AND NOT\n",
    "        (\n",
    "            lower(ParentCommandLine) LIKE '%svchost.exe%'\n",
    "            AND\n",
    "            (\n",
    "                lower(ParentCommandLine) LIKE '%localservice%'\n",
    "                OR lower(ParentCommandLine) LIKE '%netsvcs%'\n",
    "                OR lower(ParentCommandLine) LIKE '%-p%'\n",
    "                OR lower(ParentCommandLine) LIKE '%-s%'\n",
    "            )\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(100, 100)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "be2e29dd-8a12-4db1-a09c-0eab774a50e0",
   "metadata": {},
   "source": [
    "### PCWRun Proxy Execution Detected\n",
    "##### description:  Detects Proxy Execution via PCWRun"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "f7a70df8-0a4e-4019-a911-11d773ba1a29",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(ParentCommandLine) LIKE '%pcwutl.dll%'\n",
    "            OR lower(ParentCommandLine) LIKE '%pcwutl.exe%'\n",
    "            OR lower(CommandLine) LIKE '%pcwutl.dll%'\n",
    "            OR lower(CommandLine) LIKE '%pcwutl.exe%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 70)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "99360741-56ef-4b01-a299-2a73fb52522d",
   "metadata": {},
   "source": [
    "### Safeboot Manipulation via Bcdedit/Bootcfg Detected\n",
    "##### description: Safeboot Manipulation via Bcdedit/Bootcfg Detected"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "21f9df87-7771-4ed6-ab6c-9cfe5090bb5b",
   "metadata": {},
   "outputs": [],
   "source": [
    "huntCase = spark.sql(\n",
    "'''\n",
    "SELECT computer_name, ParentImage, ParentCommandLine, Image, CommandLine, User\n",
    "FROM sparktable\n",
    "WHERE (source_name = \"Microsoft-Windows-Sysmon\" AND event_id = 1\n",
    "        AND\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%bcdedit%'\n",
    "            OR lower(CommandLine) LIKE '%bootcfg%'\n",
    "        )\n",
    "        AND\n",
    "        (\n",
    "            lower(CommandLine) LIKE '%safeboot%'\n",
    "        )\n",
    "    )\n",
    "'''\n",
    ")\n",
    "huntCase.show(10, 70)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "6fa942f0-2dbe-4f90-9739-6e3a0a6898f2",
   "metadata": {},
   "outputs": [],
   "source": []
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3 (ipykernel)",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.10.5"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 5
}