All Projects → JPCERTCC → Logontracer

JPCERTCC / Logontracer

Licence: other
Investigate malicious Windows logon by visualizing and analyzing Windows event log

Programming Languages

javascript
184084 projects - #8 most used programming language
python
139335 projects - #7 most used programming language
HTML
75241 projects
Dockerfile
14818 projects
CSS
56736 projects

Projects that are alternatives of or similar to Logontracer

ad-privileged-audit
Provides various Windows Server Active Directory (AD) security-focused reports.
Stars: ✭ 42 (-97.81%)
Mutual labels:  active-directory, dfir, blueteam
Adtimeline
Timeline of Active Directory changes with replication metadata
Stars: ✭ 252 (-86.83%)
Mutual labels:  dfir, active-directory
Malwless
Test Blue Team detections without running any attack.
Stars: ✭ 215 (-88.77%)
Mutual labels:  dfir, blueteam
adalanche
Active Directory ACL Visualizer and Explorer - who's really Domain Admin?
Stars: ✭ 862 (-54.96%)
Mutual labels:  active-directory, blueteam
Lolbas
Living Off The Land Binaries And Scripts - (LOLBins and LOLScripts)
Stars: ✭ 1,506 (-21.32%)
Mutual labels:  dfir, blueteam
Cypheroth
Automated, extensible toolset that runs cypher queries against Bloodhound's Neo4j backend and saves output to spreadsheets.
Stars: ✭ 179 (-90.65%)
Mutual labels:  active-directory, blueteam
Blue-Team-Notes
You didn't think I'd go and leave the blue team out, right?
Stars: ✭ 899 (-53.03%)
Mutual labels:  dfir, blueteam
Opensource-Endpoint-Monitoring
This repository contains all the config files and scripts used for our Open Source Endpoint monitoring project.
Stars: ✭ 30 (-98.43%)
Mutual labels:  dfir, blueteam
WatchAD
AD Security Intrusion Detection System
Stars: ✭ 967 (-49.48%)
Mutual labels:  active-directory, event-log
Crack-O-Matic
Find and notify users in your Active Directory with weak passwords
Stars: ✭ 89 (-95.35%)
Mutual labels:  active-directory, blueteam
BTPS-SecPack
This repository contains a collection of PowerShell tools that can be utilized to protect and defend an environment based on the recommendations of multiple cyber security researchers at Microsoft. These tools were created with a small to medium size enterprise environment in mind as smaller organizations do not always have the type of funding a…
Stars: ✭ 33 (-98.28%)
Mutual labels:  active-directory, blueteam
Plumhound
Bloodhound for Blue and Purple Teams
Stars: ✭ 452 (-76.38%)
Mutual labels:  active-directory, blueteam
Lolbas
Living Off The Land Binaries And Scripts - (LOLBins and LOLScripts)
Stars: ✭ 3,810 (+99.06%)
Mutual labels:  dfir, blueteam
Threathunt
ThreatHunt is a PowerShell repository that allows you to train your threat hunting skills.
Stars: ✭ 92 (-95.19%)
Mutual labels:  dfir, blueteam
Timesketch
Collaborative forensic timeline analysis
Stars: ✭ 1,795 (-6.22%)
Mutual labels:  dfir
Psadhealth
A toolkit of AD specific health checks that you can run in your environment to ensure your Active Directory is running optimally.
Stars: ✭ 114 (-94.04%)
Mutual labels:  active-directory
Deploy Deception
A PowerShell module to deploy active directory decoy objects.
Stars: ✭ 109 (-94.31%)
Mutual labels:  blueteam
Mthc
All-in-one bundle of MISP, TheHive and Cortex
Stars: ✭ 134 (-93%)
Mutual labels:  dfir
Defaultcreds Cheat Sheet
One place for all the default credentials to assist the Blue/Red teamers activities on finding devices with default password 🛡️
Stars: ✭ 1,949 (+1.83%)
Mutual labels:  blueteam
Information Security Tasks
This repository is created only for infosec professionals whom work day to day basis to equip ourself with uptodate skillset, We can daily contribute daily one hour for day to day tasks and work on problem statements daily, Please contribute by providing problem statements and solutions
Stars: ✭ 108 (-94.36%)
Mutual labels:  blueteam

Arsenal Version Docker pull test

Concept

LogonTracer is a tool to investigate malicious logon by visualizing and analyzing Windows Active Directory event logs. This tool associates a host name (or an IP address) and account name found in logon-related events and displays it as a graph. This way, it is possible to see in which account login attempt occurs and which host is used.
This tool can visualize the following event id related to Windows logon based on this research.

  • 4624: Successful logon
  • 4625: Logon failure
  • 4768: Kerberos Authentication (TGT Request)
  • 4769: Kerberos Service Ticket (ST Request)
  • 4776: NTLM Authentication
  • 4672: Assign special privileges

More details are described in the following documents:

LogonTracer sample

Additional Analysis

LogonTracer uses PageRank, Hidden Markov model and ChangeFinder to detect malicious hosts and accounts from event log.
PageRank List
With LogonTracer, it is also possible to display event logs in a chronological order.
Timeline

Use LogonTracer

To use LogonTracer, you can:

Documentation

If you want to know more details, please check the LogonTracer wiki.

Demonstration

Following YouTube's video shows how to use LogonTracer.

LogonTracer_Demonstration

Architecture

LogonTracer is written in Python and uses Neo4j for database. The following tools are used.

Note that the project description data, including the texts, logos, images, and/or trademarks, for each open source project belongs to its rightful owner. If you wish to add or remove any projects, please contact us at [email protected].