#!/usr/bin/env python3
"""Agent for detecting T1003 credential dumping via EDR telemetry analysis."""

import argparse
import json
import re
import subprocess
import sys
from datetime import datetime, timezone


LSASS_ACCESS_MASKS = {
    0x1010: "PROCESS_QUERY_LIMITED_INFORMATION | PROCESS_VM_READ",
    0x1FFFFF: "PROCESS_ALL_ACCESS",
    0x1410: "PROCESS_QUERY_INFORMATION | PROCESS_VM_READ",
    0x0040: "PROCESS_DUP_HANDLE",
}

CREDENTIAL_DUMP_TOOLS = [
    "mimikatz", "procdump", "sqldumper", "comsvcs.dll",
    "nanodump", "pypykatz", "lazagne", "secretsdump",
    "gsecdump", "wce.exe", "fgdump", "pwdump",
    "ntdsutil", "reg save hklm\\sam", "reg save hklm\\system",
]

SYSMON_EVENTS = {
    1: "Process Creation",
    10: "Process Access (LSASS read)",
    11: "File Create (credential dump file)",
    7: "Image Loaded (suspicious DLL)",
}


def check_lsass_access_sysmon():
    """Query Sysmon Event ID 10 for LSASS process access."""
    findings = []
    if sys.platform != "win32":
        return findings
    ps_cmd = (
        "Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Sysmon/Operational';"
        "Id=10} -MaxEvents 500 "
        "| Where-Object {$_.Properties[8].Value -match 'lsass'} "
        "| Select-Object TimeCreated,"
        "@{N='SourceProcess';E={$_.Properties[4].Value}},"
        "@{N='SourcePID';E={$_.Properties[3].Value}},"
        "@{N='TargetProcess';E={$_.Properties[8].Value}},"
        "@{N='GrantedAccess';E={$_.Properties[10].Value}} "
        "| ConvertTo-Json -Depth 3"
    )
    try:
        result = subprocess.check_output(
            ["powershell", "-NoProfile", "-Command", ps_cmd],
            text=True, errors="replace", timeout=30
        )
        data = json.loads(result) if result.strip() else []
        if not isinstance(data, list):
            data = [data]
        for evt in data:
            source = evt.get("SourceProcess", "")
            access = evt.get("GrantedAccess", "")
            if not any(safe in source.lower() for safe in ["svchost", "csrss", "lsass", "wmiprvse"]):
                findings.append({
                    "time": evt.get("TimeCreated", ""),
                    "source": source,
                    "target": evt.get("TargetProcess", ""),
                    "access_mask": access,
                    "suspicious": True,
                })
    except (subprocess.SubprocessError, json.JSONDecodeError):
        pass
    return findings


def check_credential_dump_processes():
    """Check for known credential dumping tool processes."""
    findings = []
    if sys.platform != "win32":
        return findings
    ps_cmd = (
        "Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Sysmon/Operational';"
        "Id=1} -MaxEvents 1000 "
        "| Select-Object TimeCreated,"
        "@{N='Image';E={$_.Properties[4].Value}},"
        "@{N='CommandLine';E={$_.Properties[10].Value}},"
        "@{N='ParentImage';E={$_.Properties[20].Value}} "
        "| ConvertTo-Json -Depth 3"
    )
    try:
        result = subprocess.check_output(
            ["powershell", "-NoProfile", "-Command", ps_cmd],
            text=True, errors="replace", timeout=30
        )
        data = json.loads(result) if result.strip() else []
        if not isinstance(data, list):
            data = [data]
        for evt in data:
            cmdline = (evt.get("CommandLine", "") or "").lower()
            image = (evt.get("Image", "") or "").lower()
            for tool in CREDENTIAL_DUMP_TOOLS:
                if tool.lower() in cmdline or tool.lower() in image:
                    findings.append({
                        "time": evt.get("TimeCreated", ""),
                        "image": evt.get("Image", ""),
                        "commandline": evt.get("CommandLine", "")[:200],
                        "tool_match": tool,
                    })
                    break
    except (subprocess.SubprocessError, json.JSONDecodeError):
        pass
    return findings


def check_sam_ntds_access():
    """Check for SAM/NTDS.dit/SYSTEM registry hive access."""
    findings = []
    patterns = [
        r"reg\s+save\s+hklm\\sam",
        r"reg\s+save\s+hklm\\system",
        r"reg\s+save\s+hklm\\security",
        r"ntdsutil.*\"ac\s+i\s+ntds\"",
        r"vssadmin.*create\s+shadow",
        r"copy.*ntds\.dit",
    ]
    if sys.platform != "win32":
        return findings
    ps_cmd = (
        "Get-WinEvent -FilterHashtable @{LogName='Security';Id=4688} -MaxEvents 500 "
        "| Select-Object TimeCreated,"
        "@{N='CommandLine';E={$_.Properties[8].Value}} "
        "| ConvertTo-Json"
    )
    try:
        result = subprocess.check_output(
            ["powershell", "-NoProfile", "-Command", ps_cmd],
            text=True, errors="replace", timeout=30
        )
        data = json.loads(result) if result.strip() else []
        if not isinstance(data, list):
            data = [data]
        for evt in data:
            cmdline = (evt.get("CommandLine", "") or "").lower()
            for pat in patterns:
                if re.search(pat, cmdline):
                    findings.append({
                        "time": evt.get("TimeCreated", ""),
                        "commandline": cmdline[:200],
                        "pattern": pat,
                    })
    except (subprocess.SubprocessError, json.JSONDecodeError):
        pass
    return findings


def main():
    parser = argparse.ArgumentParser(
        description="Detect T1003 credential dumping via EDR telemetry"
    )
    parser.add_argument("--output", "-o", help="Output JSON report")
    parser.add_argument("--verbose", "-v", action="store_true")
    args = parser.parse_args()

    print("[*] T1003 Credential Dumping Detection Agent")
    report = {"timestamp": datetime.now(timezone.utc).isoformat(), "findings": {}}

    lsass = check_lsass_access_sysmon()
    report["findings"]["lsass_access"] = lsass
    print(f"[*] Suspicious LSASS access events: {len(lsass)}")

    tools = check_credential_dump_processes()
    report["findings"]["dump_tools"] = tools
    print(f"[*] Credential dump tool detections: {len(tools)}")

    sam = check_sam_ntds_access()
    report["findings"]["sam_ntds_access"] = sam
    print(f"[*] SAM/NTDS access events: {len(sam)}")

    total = len(lsass) + len(tools) + len(sam)
    report["risk_level"] = "CRITICAL" if total >= 5 else "HIGH" if total >= 2 else "MEDIUM" if total > 0 else "LOW"

    if args.output:
        with open(args.output, "w") as f:
            json.dump(report, f, indent=2)
        print(f"[*] Report saved to {args.output}")
    else:
        print(json.dumps(report, indent=2))


if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""
T1003 Credential Dumping Detection Script
Analyzes EDR/Sysmon logs for LSASS access, credential tool execution,
and registry hive exports indicating credential theft.
"""

import json
import csv
import argparse
import datetime
import re
from pathlib import Path

LSASS_SUSPICIOUS_ACCESS = {"0x1fffff", "0x1f3fff", "0x143a", "0x1f0fff", "0x0040", "0x1010", "0x1410"}
LSASS_LEGITIMATE_SOURCES = {
    "csrss.exe", "lsass.exe", "svchost.exe", "msmpe ng.exe", "wmiprvse.exe",
    "securityhealthservice.exe", "smartscreen.exe", "taskmgr.exe",
}

CREDENTIAL_TOOL_PATTERNS = [
    (r"(?i)sekurlsa", "Mimikatz_sekurlsa", "T1003.001", "CRITICAL"),
    (r"(?i)lsadump", "Mimikatz_lsadump", "T1003.001", "CRITICAL"),
    (r"(?i)procdump.*lsass", "ProcDump_LSASS", "T1003.001", "CRITICAL"),
    (r"(?i)comsvcs.*MiniDump", "Comsvcs_MiniDump", "T1003.001", "CRITICAL"),
    (r"(?i)ntdsutil.*ifm", "NTDS_IFM_Creation", "T1003.003", "CRITICAL"),
    (r"(?i)vssadmin.*create\s+shadow", "VSS_Shadow_Copy", "T1003.003", "HIGH"),
    (r"(?i)reg\s+(save|export)\s+hklm\\\\sam", "SAM_Hive_Export", "T1003.002", "CRITICAL"),
    (r"(?i)reg\s+(save|export)\s+hklm\\\\security", "SECURITY_Hive_Export", "T1003.004", "CRITICAL"),
    (r"(?i)reg\s+(save|export)\s+hklm\\\\system", "SYSTEM_Hive_Export", "T1003.002", "HIGH"),
    (r"(?i)esentutl.*ntds", "NTDS_Esentutl", "T1003.003", "CRITICAL"),
    (r"(?i)lazagne", "LaZagne", "T1003", "HIGH"),
]


def parse_events(input_path: str) -> list[dict]:
    path = Path(input_path)
    events = []
    if path.suffix == ".json":
        with open(path, "r", encoding="utf-8") as f:
            data = json.load(f)
            events = data if isinstance(data, list) else data.get("events", [])
    elif path.suffix == ".csv":
        with open(path, "r", encoding="utf-8-sig") as f:
            events = [dict(row) for row in csv.DictReader(f)]
    return events


def detect_credential_dumping(events: list[dict]) -> list[dict]:
    findings = []
    for event in events:
        event_code = str(event.get("EventCode", event.get("EventID", "")))
        computer = event.get("Computer", event.get("host", ""))
        timestamp = event.get("UtcTime", event.get("_time", ""))
        user = event.get("User", event.get("user", ""))

        if event_code == "10":
            target = event.get("TargetImage", "")
            source = event.get("SourceImage", "")
            access = event.get("GrantedAccess", "").lower()
            if "lsass.exe" not in target.lower():
                continue
            source_name = source.split("\\")[-1].lower()
            if source_name in LSASS_LEGITIMATE_SOURCES:
                continue
            if access not in LSASS_SUSPICIOUS_ACCESS:
                continue
            findings.append({
                "timestamp": timestamp, "computer": computer, "user": user,
                "detection_type": "LSASS_Access",
                "source_process": source, "target": "lsass.exe",
                "access_mask": access,
                "technique": "T1003.001", "severity": "CRITICAL",
                "description": f"{source_name} accessed LSASS with {access}",
            })

        elif event_code == "1":
            cmdline = event.get("CommandLine", "")
            image = event.get("Image", "")
            for pattern, tool_name, technique, severity in CREDENTIAL_TOOL_PATTERNS:
                if re.search(pattern, cmdline):
                    findings.append({
                        "timestamp": timestamp, "computer": computer, "user": user,
                        "detection_type": "Credential_Tool",
                        "tool": tool_name, "image": image,
                        "command_line": cmdline,
                        "technique": technique, "severity": severity,
                        "description": f"Credential dumping tool detected: {tool_name}",
                    })
                    break

    return sorted(findings, key=lambda x: {"CRITICAL": 0, "HIGH": 1, "MEDIUM": 2}.get(x["severity"], 3))


def run_hunt(input_path: str, output_dir: str) -> None:
    print(f"[*] T1003 Credential Dumping Hunt - {datetime.datetime.now().isoformat()}")
    events = parse_events(input_path)
    print(f"[*] Loaded {len(events)} events")
    findings = detect_credential_dumping(events)
    print(f"[!] Credential dumping detections: {len(findings)}")

    output_path = Path(output_dir)
    output_path.mkdir(parents=True, exist_ok=True)
    with open(output_path / "credential_dumping_findings.json", "w", encoding="utf-8") as f:
        json.dump({"hunt_id": f"TH-CRED-{datetime.date.today().isoformat()}",
                    "findings_count": len(findings), "findings": findings}, f, indent=2)
    print(f"[+] Results written to {output_dir}")


def main():
    parser = argparse.ArgumentParser(description="T1003 Credential Dumping Detection")
    parser.add_argument("--input", "-i", required=True)
    parser.add_argument("--output", "-o", default="./cred_dump_hunt_output")
    args = parser.parse_args()
    run_hunt(args.input, args.output)


if __name__ == "__main__":
    main()