#!/usr/bin/env python3
"""Pass-the-Hash attack detection agent.

Detects NTLM hash reuse attacks by analyzing Windows Security Event ID 4624
for Type 3 NTLM logons with anomalous patterns across multiple targets.
"""

import argparse
import json
import re
from collections import defaultdict
from datetime import datetime

try:
    import Evtx.Evtx as evtx
except ImportError:
    evtx = None

LEGITIMATE_SOURCES = {"127.0.0.1", "::1", "-", ""}


def parse_logon_events(filepath):
    if evtx is None:
        return {"error": "python-evtx not installed: pip install python-evtx"}
    events = []
    with evtx.Evtx(filepath) as log:
        for record in log.records():
            xml = record.xml()
            if "<EventID>4624</EventID>" not in xml:
                continue
            logon_type = re.search(r'<Data Name="LogonType">(\d+)', xml)
            auth_pkg = re.search(r'<Data Name="AuthenticationPackageName">([^<]+)', xml)
            account = re.search(r'<Data Name="TargetUserName">([^<]+)', xml)
            domain = re.search(r'<Data Name="TargetDomainName">([^<]+)', xml)
            src_ip = re.search(r'<Data Name="IpAddress">([^<]+)', xml)
            computer = re.search(r'<Data Name="Computer">([^<]+)', xml)
            time_match = re.search(r'SystemTime="([^"]+)"', xml)
            lt = logon_type.group(1) if logon_type else ""
            ap = auth_pkg.group(1) if auth_pkg else ""
            if lt == "3" and "NTLM" in ap.upper():
                events.append({
                    "timestamp": time_match.group(1) if time_match else "",
                    "logon_type": int(lt), "auth_package": ap.strip(),
                    "account": account.group(1) if account else "",
                    "domain": domain.group(1) if domain else "",
                    "source_ip": src_ip.group(1) if src_ip else "",
                    "computer": computer.group(1) if computer else "",
                })
    return events


def detect_pth_patterns(events, target_threshold=3):
    if isinstance(events, dict) and "error" in events:
        return [events]
    findings = []
    src_targets = defaultdict(lambda: {"computers": set(), "count": 0,
                                        "source_ip": "", "account": ""})
    for evt in events:
        src = evt.get("source_ip", "")
        if src in LEGITIMATE_SOURCES:
            continue
        key = f"{src}|{evt.get('account', '')}"
        src_targets[key]["computers"].add(evt.get("computer", ""))
        src_targets[key]["count"] += 1
        src_targets[key]["source_ip"] = src
        src_targets[key]["account"] = evt.get("account", "")

    for key, data in src_targets.items():
        target_count = len(data["computers"])
        if target_count >= target_threshold:
            findings.append({
                "type": "ntlm_type3_multi_target",
                "source_ip": data["source_ip"],
                "account": data["account"],
                "target_count": target_count,
                "targets": list(data["computers"])[:20],
                "total_logons": data["count"],
                "severity": "CRITICAL" if target_count >= 10 else "HIGH",
                "mitre": "T1550.002",
            })

    admin_sources = defaultdict(int)
    for evt in events:
        if evt.get("account", "").lower() in ("administrator", "admin"):
            admin_sources[evt.get("source_ip", "")] += 1
    for src, count in admin_sources.items():
        if count >= 2 and src not in LEGITIMATE_SOURCES:
            findings.append({
                "type": "admin_ntlm", "source_ip": src,
                "logon_count": count, "severity": "HIGH", "mitre": "T1550.002",
            })
    return findings


def main():
    parser = argparse.ArgumentParser(description="Pass-the-Hash Detector")
    parser.add_argument("--security-log", required=True, help="Windows Security EVTX")
    parser.add_argument("--target-threshold", type=int, default=3)
    args = parser.parse_args()
    events = parse_logon_events(args.security_log)
    findings = detect_pth_patterns(events, args.target_threshold)
    ntlm_count = len(events) if isinstance(events, list) else 0
    results = {
        "timestamp": datetime.utcnow().isoformat() + "Z",
        "total_ntlm_type3_logons": ntlm_count,
        "findings": findings, "total_findings": len(findings),
    }
    print(json.dumps(results, indent=2))


if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""Pass-the-Hash Detection - Analyzes authentication logs for NTLM-based lateral movement patterns."""

import json, csv, argparse, datetime, re
from collections import defaultdict
from pathlib import Path

SYSTEM_ACCOUNTS = {"system", "anonymous logon", "anonymous", "local service", "network service"}

def parse_logs(path):
    p = Path(path)
    if p.suffix == ".json":
        with open(p, encoding="utf-8") as f:
            data = json.load(f)
            return data if isinstance(data, list) else data.get("events", [])
    elif p.suffix == ".csv":
        with open(p, encoding="utf-8-sig") as f:
            return [dict(r) for r in csv.DictReader(f)]
    return []

def detect_pth(event):
    eid = str(event.get("EventCode", event.get("EventID", "")))
    if eid != "4624": return None
    logon_type = str(event.get("Logon_Type", event.get("LogonType", "")))
    if logon_type != "3": return None
    auth_pkg = event.get("Authentication_Package", event.get("AuthenticationPackageName", "")).lower()
    if "ntlm" not in auth_pkg: return None
    account = event.get("Account_Name", event.get("TargetUserName", "")).lower()
    if account in SYSTEM_ACCOUNTS or account.endswith("$"): return None
    src_ip = event.get("Source_Network_Address", event.get("IpAddress", ""))
    if not src_ip or src_ip in ("-", "::1", "127.0.0.1"): return None
    return {
        "technique": "T1550.002",
        "account": event.get("Account_Name", event.get("TargetUserName", "")),
        "source_ip": src_ip,
        "dest_host": event.get("Computer", event.get("hostname", "")),
        "auth_package": auth_pkg,
        "logon_process": event.get("Logon_Process", event.get("LogonProcessName", "")),
        "timestamp": event.get("_time", event.get("timestamp", "")),
        "risk_score": 45,
        "risk_level": "MEDIUM",
        "indicators": ["Type 3 NTLM logon - potential Pass-the-Hash"],
    }

def analyze_velocity(findings, threshold=3):
    account_dests = defaultdict(set)
    for f in findings:
        account_dests[f["account"]].add(f["dest_host"])
    alerts = []
    for acct, dests in account_dests.items():
        if len(dests) >= threshold:
            alerts.append({
                "technique": "T1550.002", "account": acct,
                "unique_targets": len(dests), "targets": list(dests),
                "risk_score": 80, "risk_level": "CRITICAL",
                "indicators": [f"NTLM auth to {len(dests)} hosts - PtH spray pattern"],
            })
    return alerts

def run_hunt(input_path, output_dir):
    print(f"[*] Pass-the-Hash Hunt - {datetime.datetime.now().isoformat()}")
    events = parse_logs(input_path)
    findings = [f for f in (detect_pth(e) for e in events) if f]
    velocity = analyze_velocity(findings)
    all_findings = findings + velocity
    Path(output_dir).mkdir(parents=True, exist_ok=True)
    with open(Path(output_dir) / "pth_findings.json", "w", encoding="utf-8") as f:
        json.dump({"hunt_id": f"TH-PTH-{datetime.date.today()}", "findings": all_findings}, f, indent=2)
    print(f"[+] {len(all_findings)} findings ({len(velocity)} velocity alerts)")

def main():
    p = argparse.ArgumentParser(description="Pass-the-Hash Detection")
    sp = p.add_subparsers(dest="cmd")
    h = sp.add_parser("hunt"); h.add_argument("--input", "-i", required=True); h.add_argument("--output", "-o", default="./pth_output")
    sp.add_parser("queries")
    args = p.parse_args()
    if args.cmd == "hunt": run_hunt(args.input, args.output)
    elif args.cmd == "queries":
        print("=== Splunk PtH Query ===")
        print('''index=wineventlog EventCode=4624 Logon_Type=3 Authentication_Package=NTLM
| stats count dc(Computer) as targets by Account_Name Source_Network_Address
| where targets > 3 | sort -targets''')
    else: p.print_help()

if __name__ == "__main__": main()