SANS Holiday Hack 2019 Objective 5 - Determine Compromised System

find_port.py

#!/use/bin/env python3

# SANS Holiday Hack 2019 Objective 5 - Determine Compromised System

import dateutil.parser
from datetime import timedelta, datetime
from os import listdir
from os.path import isfile, join
import pprint

# target_time = dateutil.parser.parse('2019-11-19T12:21:35.327998')
# ten_mins_after = target_time + timedelta(minutes=10)
# ten_mins_prior = target_time + timedelta(minutes=-10)

tgt_dir = 'elfu-zeeklogs'
log_files = [
    f for f in listdir(tgt_dir)
    if isfile(join(tgt_dir, f))
    and f.startswith('conn')
    # and ten_mins_after > dateutil.parser.parse(f.split('_')[1][:-4]) > ten_mins_prior
]

parsed_logs = list()
for log in log_files:
    with open(join(tgt_dir, log)) as f:
        data = f.read().split('\n')
    data = [d for d in data if '\t' in d and '#' not in d]
    for row in data:
        field_names = [
            'ts', 'uid', 'id.orig_h', 'id.orig_p', 'id.resp_h', 'id.resp_p', 'proto', 'service', 'duration', 'orig_bytes','conn_state',
            'local_orig', 'local_resp', 'missed_bytes', 'history', 'orig_pkts', 'orig_ip_bytes', 'resp_pkts', 'resp_ip_bytes', 'tunnel_parents'
            ]
        #types:	time	string	addr	port	addr	port	enum	string	interval	count	count
        # string	bool	bool	count	string	count	count	count	count	set[string]
        parsed_logs.append(dict(zip(field_names, row.split('\t'))))

focus = [l for l in parsed_logs if int(l['id.orig_p']) == 4444 or int(l['id.resp_p']) == 4444]
output = list()
for i in focus:
    i['ts'] = datetime.utcfromtimestamp(int(i['ts'].split('.')[0])).isoformat()
    output.append({k: v for (k,v) in i.items() if k in ['duration', 'id.orig_h', 'id.orig_p', 'id.resp_h', 'id.resp_p', 'ts']})
output.sort(key=lambda x: x['duration'])
pprint.pprint(output)

Example output:

 {'duration': '7.858810',
  'id.orig_h': '192.168.134.131',
  'id.orig_p': '4444',
  'id.resp_h': '69.171.250.25',
  'id.resp_p': '443',
  'ts': '2019-08-24T01:40:58'},
 {'duration': '9.201697',
  'id.orig_h': '192.168.134.131',
  'id.orig_p': '4444',
  'id.resp_h': '104.19.148.8',
  'id.resp_p': '80',
  'ts': '2019-08-23T23:26:48'},
 {'duration': '9.953056',
  'id.orig_h': '192.168.134.129',
  'id.orig_p': '4444',
  'id.resp_h': '3.213.171.170',
  'id.resp_p': '443',
  'ts': '2019-08-24T01:57:38'}]

This was based on a hunch because I saw port 4444 earlier in Sysmon.
Unfortunately this didn't help me find the solution, but was fun nonetheless.