In [1]:
import pandas as pd
from pandas.io.json import json_normalize
import json
import matplotlib.pyplot as plt
In [3]:
invoke_wmi_df = pd.read_json('datasets/empire_invoke_wmi_2019-05-18214442.json', lines=True)
In [4]:
invoke_wmi_df.head()
Out[4]:
In [5]:
type(invoke_wmi_df)
Out[5]:
In [6]:
invoke_wmi_df.shape
Out[6]:
In [7]:
invoke_wmi_df.iloc[0]
Out[7]:
In [8]:
json_struct = json.loads(invoke_wmi_df.to_json(orient="records"))
invoke_wmi_flat = json_normalize(json_struct)
In [9]:
invoke_wmi_flat.iloc[0]
Out[9]:
In [10]:
invoke_wmi_flat.groupby(['source_name']).size()
Out[10]:
In [11]:
sysmon_filter = invoke_wmi_flat['source_name'] == "Microsoft-Windows-Sysmon"
sysmon_df = invoke_wmi_flat[sysmon_filter]
In [12]:
sysmon_df.iloc[0]
Out[12]:
In [13]:
sysmon_filter2 = sysmon_df['event_id'] == 1
sysmon_proc_create = sysmon_df[sysmon_filter2]
In [14]:
sysmon_proc_create.iloc[0]
Out[14]:
In [15]:
sysmon_proc_create = sysmon_proc_create.dropna(axis = 1, how = 'all')
In [16]:
sysmon_proc_create.iloc[0]
Out[16]:
In [17]:
sysmon_proc_create.groupby(['event_data.ParentImage']).size()
Out[17]:
In [18]:
sysmon_proc_create['command_count'] = sysmon_proc_create['event_data.CommandLine'].str.len()
In [19]:
sysmon_proc_create.iloc[1]
Out[19]:
In [20]:
sysmon_proc_create.plot(kind='bar',x='event_data.ParentImage',y='command_count')
Out[20]:
In [21]:
sysmon_filter3 = sysmon_proc_create['event_data.ParentImage'] == "C:\Windows\System32\wbem\WmiPrvSE.exe"
sysmon_proc_create[sysmon_filter3]['event_data.ProcessGuid']
Out[21]:
In [22]:
sysmon_filter4 = sysmon_proc_create['event_data.ProcessGuid'] =="{aa6b4a20-7cde-5ce0-0000-00109ea71e00}"
In [23]:
with pd.option_context('display.max_colwidth', 2000):
print(sysmon_proc_create[sysmon_filter4]['event_data.CommandLine'])
In [ ]: