Kusto Detective Agency Season 2のメモ | Case 10

# Kusto Detective Agency Season 2 のメモ

https://qiita.com/georgeOsdDev@github/items/0c1e3f485d9e9941749d

の続き

# Case 10 It's a sEnd game

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/4914/84cf049b-f501-a2f8-1d4f-214ee78e416d.png)

Case 9 で侵入されたマシンにトロイの木馬が仕掛けられた。そのログから目的を解析せよとのこと

回答入力欄のラベルはこれだけ。。。

> If you have anything that can help, type it here

## KuandaLogsのテーブル構造

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/4914/9580442b-506d-7230-b08b-4f2aae431295.png)

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/4914/f4da1486-0630-a326-c018-e46397f638d5.png)

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/4914/3fedc25b-84ae-3473-61c3-5d9296b41ab5.png)

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/4914/bc4ddae2-4ab4-a82d-4d93-d5a5a53557fb.png)

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/4914/23dee90a-2fe1-974b-ecb0-55617f940602.png)


### とりあえずパース

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/4914/b20d1720-cd27-0ee7-d67f-6ec6e7f63aa7.png)

適当な `DetectiveId` でみてみると `Message` に何パターンかありそうなのでパースする。

ざっとみて定型メッセージっぽいものを出してみるが、1005454件に対して、1005262件なので何件か足りない。
```sql
let EnterLog =
KuandaLogs
| where Message == "User entered the system, start collecting user encryption tokens."
| extend EventName = "SessionStart";
let ResetLog =
KuandaLogs
| where Message == "User session reset: all user encryption tokens are disposed."
| extend EventName = "SessinReset";
let OperationLog =
KuandaLogs
| where Message startswith "Operation"
| parse Message with "Operation id=" operationId " " op;
let StartOperationLog =
OperationLog
| where op startswith "started"
| parse op with "started ('" operationDetail "'). Captured user encryption token: '" token "'."
| extend EventName = "OperationStarted";
let CompleteOperationLog = 
OperationLog
| where op startswith "completed"
| extend EventName = "OperationCompleted";
let parsedLogs =
union EnterLog,ResetLog,StartOperationLog,CompleteOperationLog;
parsedLogs
| count

=> 1005262

```

parsedLogsのうち、KuandaLogsから漏れたものをチェック

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/4914/54afe045-a9f1-dc75-2093-50a56c0bb768.png)

`Sending an encrypted message,` なパターンもあるのでこちらもパース

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/4914/fdff0270-5bbc-433f-551e-dc4bb914202a.png)

件数一致したのでとりあえずパースはここまで
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/4914/45b1122d-6c74-8ba6-e05c-7cf3b06906a2.png)


### メッセージを受信した Detective に絞る

何かしら暗号化メッセージを解読するのが問題解決につながりそうなので絞り込み

```sql
let EnterLog =
KuandaLogs
| where Message == "User entered the system, start collecting user encryption tokens."
| extend EventName = "SessionStart";
let ResetLog =
KuandaLogs
| where Message == "User session reset: all user encryption tokens are disposed."
| extend EventName = "SessinReset";
let OperationLog =
KuandaLogs
| where Message startswith "Operation"
| parse Message with "Operation id=" operationId " " op;
let StartOperationLog =
OperationLog
| where op startswith "started"
| parse op with "started ('" operationDetail "'). Captured user encryption token: '" token "'."
| extend EventName = "OperationStarted";
let CompleteOperationLog = 
OperationLog
| where op startswith "completed"
| extend EventName = "OperationCompleted";
let sendEncryptedMsgLog =
KuandaLogs
| where Message startswith "Sending an encrypted message,"
| parse Message with "Sending an encrypted message, will use " func " for decoding."
| parse func with "Dekrypt(" encryptedMsg "," secondArg ")"
| extend EventName = "SendMessage";
let parsedLogs =
union EnterLog,ResetLog,StartOperationLog,CompleteOperationLog,sendEncryptedMsgLog;
let msgReceivedDetectives = sendEncryptedMsgLog
| distinct DetectiveId;
parsedLogs
| where DetectiveId in (msgReceivedDetectives)
```

適当な `DetectiveId` で見てみる

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/4914/dbd51ec6-ba15-9da3-96a8-529da7c56af2.png)

メッセージの直前のキーで複合してみる
うーん、Dekrypt関数がそのまま使えるわけではなさそう。

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/4914/ac583472-eccf-e4d6-338f-ccb036c789f3.png)

`Dekrypt` 関数の定義を見ると引数は `T:(Message:string,Key:string)` らしい。

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/4914/047710b8-8d4a-8c38-407a-7f4743b7bfed.png)

ところでいつこの関数が定義されたのか調べてみたら、Case 8でつかっていた。

https://qiita.com/georgeOsdDev@github/items/e59ef92581c4fbf44c22

同じように `Dekrypt` を呼び出せば復号できた。

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/4914/bfa53125-3716-3b1c-ada2-87bcf629ebdf.png)

とりあえず準備が整ったので今回はここまで。


## 回答

<details><summary>セットアップ</summary>

```sql
.execute database script <|
.create table KuandaLogs (Timestamp:datetime, DetectiveId:string, Message:string)
.ingest async into table KuandaLogs (@'https://kustodetectiveagency.blob.core.windows.net/kda2c10adminlogs/log_00000.csv.gz')
.ingest async into table KuandaLogs (@'https://kustodetectiveagency.blob.core.windows.net/kda2c10adminlogs/log_00001.csv.gz')
.ingest into table KuandaLogs (@'https://kustodetectiveagency.blob.core.windows.net/kda2c10adminlogs/log_00002.csv.gz')
```

</details>

<details><summary>回答</summary>

> If you have anything that can help, type it here

```sql
```

</details>