# Revisiting the Detection of Lateral Movement through Sysmon
## 7 Python_Evtx_Analyzer
### Evaluation  
As a proof of concept, _Pex_ was implemented with Python 3 on a VM Linux machine with 16 GB of RAM and a quad-core processor. As presented in Table 4, four different subsets of the pre-collected logs were extracted, namely, _Normal_ (or \(\approx\)80,000 Event IDs), _NormalVsMalicious01_ (or \(\approx\)290,000 Event IDs), _NormalVsMalicious02_ (or \(\approx\)415,000 Event IDs) and _FullSet_ (or \(\approx\)870,000 Event IDs). Table 5 summarizes the total number of tests that were conducted with _PeX_ per attack and subset, including the number of logs and TP/FP rates. All the experiments were performed using the extended rule-based filtering mode presented in Appendices A.1 and A.2. Indicatively, _Pex_ took an average analyzing time of \(\approx\)15 min and 14 s of CPU time regarding the first three subsets of Table 4. As it concerns the _FullSet_, the analyzer took an average of 16 min and 22 s. This is translated to an increase of \(\approx\)7.13% vis-a-vis the average processing and analysis time that was perceived for the first three subsets of Table 4.  
Regarding the conducted experiments, _PeX_ successfully achieved an average detection rate above 90%, as it concerns the summed percentage of TP and FN identified incidents per subset. On the other hand, during each _.evtx_ subset analysis, _PeX_ generated a mean rate of \(\approx\)10% _FP_ and \(\approx\)1.5% _FN_ misidentification incidents, respectively. _PeX_ evaluation started with the _Normal_ subset and was examined under the proposed rule-based policy of Appendices A.1 and A.2. First, the logs were tested against the proposed rule-based filtering features without the implementation of the identified Mimikatz's _\".4 ll\"_ rules given in Section 6.2.4. As depicted in Table 5, _PeX_ successfully identified 70,641 Event ID logs (or else 88% TP rate) related to normal network traffic, plus another \(\approx\)2000 logs revealing 2.5% of TN results. Overall, it achieved a score of 90.5% regarding the identification of _Normal_ network traffic, as the sum of TP and TN rates. On the other hand, the analyzer misidentified 7224 logs as malicious, revealing a tendency of 9% on FP events regarding the _\"Normal\"_ subset. The majority of FP events are related to the fictitious presence of Mimikatz's _ProcessCreate Event IDs_, specifically the logs with _TargetImages: \"C:/Windows/System32/Isss.exe, services.exe, reg.exe, scolost.exe\"_ and _GrandedAccess: \"0x1010, 0x1410\"_. On the positive side, despite the initial concerns that a FP rate of \(\approx\)10% may arise, this figure falls under 1.5% (1.35% precisely) when combined with the _\".4 ll\"_ related rules of Section 6.2.4. The aforesaid percentage, if examined in conjunction with the 1.5% of the fourth column's FN events, it is statistically acceptable for the operational nature of a parsing and analysis tool. The reader should keep in mind that the FN events presented in Table 5 are related to Symson's rules that were generated and implemented in _config.xml_ file for ignoring any unwanted noise within the event filtering procedure. Regarding the _NormalVsMalicious01_ subset, which comprises logs related to the experiments of Section 6.1, _PeX_ successfully identified 250,666 (or 85.4%) TP logs as potentially malicious or normal, together with 15,556 (or 5.3%) more TN Event IDs. The same promising rates regarding TP and FP logs were also identified during the evaluation of the _NormalVsMalicious02_ subset of password hashing Exploitation attacks of Section 6.2. Precisely, 83.5% (or 347,384 logs) of the collected logs was successfully identified, while another 3.3% (or 13,728 logs) was also flagged correctly as TN. With reference to the penultimate column of Table 5, FP presented an average of 9.75% on both the _NormaVsMalicious_ subsets. In more detail, _PeX_ recognized 23,481 (or 8%) and 47,843 (or 11.5%) logs incorrectly per _NormaVsMalicious_ subset, respectively. It is noteworthy that most of the misclassified logs of both subsets were related to Mimikatz extracted log files.