Workshop: Kusto Graph Semantics Explained

// Save as something like ActiveDirectoryEdges
externaldata (SourceNodeId: string, DestinationNodeId: string, DeviceName: string, AccountName: string, AccountSid: string, EdgeDisplayName: string, EdgeType: string, DeviceId: string, LogonType: string, Timestamp: datetime, FirstSessionTimestamp: datetime, ActiveSession: bool) [ 
h@"https://gist.githubusercontent.com/f-bader/650c20d091f11ce0cf6fcfd21548df53/raw/a310d59fa43bc3855b274849ab101a3e8d4403ad/Edges.csv"
] with (format="csv", ignoreFirstRecord = true)

externaldata (NodeId: string, DeviceId: string, DeviceName: string, NodeDisplayName: string, ObjectType: string, AccountName: string, AccountSid: string, Timestamp: datetime, Tags: dynamic, DistinguishedName: string) [ 
h@"https://gist.githubusercontent.com/f-bader/650c20d091f11ce0cf6fcfd21548df53/raw/6df770343938898471aca01e4ad639b67f38cf3a/Nodes.csv"
] with (format="csv", ignoreFirstRecord = true)

let Entities = datatable(name: string, type: string) 
    [ 
    "Alice", "Person",  
    "Bob", "Person",  
    "Eve", "Person",  
    "Mallory", "Person",  
    "Apollo", "System" 
]; 
let Actions = datatable(source: string, destination: string, action_type: string) 
    [ 
    "Alice", "Bob", "communicatesWith",  
    "Alice", "Apollo", "trusts",  
    "Bob", "Apollo", "hasPermission",  
    "Eve", "Alice", "attacks",  
    "Mallory", "Alice", "attacks",  
    "Mallory", "Bob", "attacks"  
]; 
Actions 
| make-graph source --> destination with Entities on name 
| graph-match //ToDo
    where // ToDo
    project Attacker = attacker.name, Compromised = compromised.name, System = apollo.name

ActiveDirectoryEdges
| make-graph SourceNodeId --> DestinationNodeId with ActiveDirectoryNodes on NodeId
| graph-match

// Solution:
// Create a graph query that has a path from the attacker node to a compromised node to the appollo node
// Filter the node "apollo" by name
// Filter the edge from the compromised account to apollo to only include "hasPermission"
// Filter the edge from the attacker to the compromised account to only include "attacks"
// Source: https://learn.microsoft.com/en-us/kusto/query/graph-match-operator?view=azure-data-explorer&preserve-view=true#attack-path
// Remark: Modified example
let Entities = datatable(name: string, type: string) 
    [ 
    "Alice", "Person",  
    "Bob", "Person",  
    "Eve", "Person",  
    "Mallory", "Person",  
    "Apollo", "System" 
]; 
let Actions = datatable(source: string, destination: string, action_type: string) 
    [ 
    "Alice", "Bob", "communicatesWith",  
    "Alice", "Apollo", "trusts",  
    "Bob", "Apollo", "hasPermission",  
    "Eve", "Alice", "attacks",  
    "Mallory", "Alice", "attacks",  
    "Mallory", "Bob", "attacks"  
]; 
Actions 
| make-graph source --> destination with Entities on name 
| graph-match (attacker)-[attacks]->(compromised)-[hasPermission]->(apollo) 
    where apollo.name == "Apollo" and attacks.action_type == "attacks" and hasPermission.action_type == "hasPermission" 
    project Attacker = attacker.name, Compromised = compromised.name, System = apollo.name

let ProcessEdges = Sysmon
    // Process Create
    | where EventID == 1
    | summarize
        by
        Computer,
        ProcessId,
        ProcessGuid,
        ParentProcessId,
        ParentProcessGuid,
        CommandLine,
        Image,
        ParentImage
    | extend SourceNodeId = hash_many(tolower(Computer), ParentProcessGuid)
    | extend DestinationNodeId = hash_many(tolower(Computer), ProcessGuid)
;
let ProcessNodes = Sysmon
    // Process Create
    | where EventID == 1
    | summarize arg_max(TimeGenerated, *) by Computer, ProcessId, ProcessGuid, CommandLine, Image
    | extend NodeId = hash_many(tolower(Computer), ProcessGuid);
ProcessEdges
| make-graph SourceNodeId --> DestinationNodeId with ProcessNodes on NodeId
| graph-match
    (cmd) -[ProcessPath*1..10]-> (whoami)
    where cmd.Image has "cmd.exe" and whoami.Image has "whoami.exe"
    project
    InitialProcess = cmd.Image,
    Path = ProcessPath.Image,
    FinalProcess = whoami.CommandLine,
    InitialProcessParent = cmd.ParentImage

ActiveDirectoryEdges
| make-graph SourceNodeId --> DestinationNodeId with ActiveDirectoryNodes on NodeId
| graph-match
    (Account)-[HasPathTo*1 .. 10]->(Administrator)
    where HasPathTo.EdgeType in ("HadSession", "AdminTo")
    // task 4
    // For some reason == true does not work at this point and == 1 has to be used
    //where ( ( HasPathTo.EdgeType == "HadSession" and HasPathTo.ActiveSession == 1 )  or HasPathTo.EdgeType == "AdminTo" )
    and Administrator.Tags has "Sensitive"
    and Account.Tags has "Compromised" 
    project User = Account.AccountName, Path = todynamic(HasPathTo.EdgeDisplayName), PathEdges=HasPathTo.EdgeType, DomainAdmin = Administrator.AccountName, IsActive = HasPathTo.ActiveSession
    // This helps with task 2 + 3
| extend PathLength = array_length(Path)
| summarize by User, tostring(Path), tostring(PathEdges),tostring(IsActive), DomainAdmin, PathLength

# Sorry, but "Knecht Ruprecht" has lost the answer for this one.
# But here are more hints to steer you in the right direction:
# * What happens after you start the first PowerShell?
# * Look at Sysmon EventID 3
# * One node can have multiple edges of different kind, separate them by comma (it's in the video)