# Revisiting the Detection of Lateral Movement through Sysmon
## 7 Python_Evtx_Analyzer  
The analysis of large log files is always a demanding procedure for incident response teams struggling with shortages of computational power to manipulate the millions of logs produced on a daily basis. Despite the variety in propriety and open-source Security Information and Event Management (SIEM) solutions for centralized logging and analyzing activities, most of them require multi-step procedures regarding log parsing, event analyzing, exception handling, and monitoring parameter initialization. That is, the literature lacks a lightweight and easily configurable tool that can be used to automate the parsing and threat analysis of extended _evtx_ log sets. To cover this need, this section presents and evaluates an analytical Python scripting tool dubbed _\"Python_Evtx_Analyzer\" (PeX)_, which caters to the analysis of voluminous Sysmon logs and, therefore, contributes to the identification of LM events in a timely manner.  
From a bird's eye view, _PeX_ was developed to serve as a proof of concept for the proposed rule-based policy's efficiency discussed in Section 6. Towards this goal, the optimization of Sysmon's logging activity is concentrated on filtering the least unwanted _noise_ possible and being as targeted as possible to LM. Simply put, the essence of _PeX's_ operation is to provide a portable and OS-independent command line (or IDE executable) tool that helps EDR teams analyze massive _.evtx_ logs and successfully identify LM. It should be noted that _PeX's_ events identification is based on LM-oriented features that were extracted from Sysmon's pre-configured rules in the enclosed config.xml file, as presented in Appendices A.1 and A.2. What makes _PeX_ special is its ability to be fully customizable by incident response researching teams to analyze and identify any kind of logging activity captured by Sysmon, either normal or malicious. As a result, _PeX_ can be used in the context of other researchers in this timely field as it is made publicly available as open source in [2].  
In brief, the analyzer has dependencies on six Python libraries, namely _mmap_, _argmax_, _minidom_, _evtx_._Evtx_, _evtx_._Views_ and _ElementTree_), which should either be imported during the building of the IDE project or installed to the OS prior to the code execution with the terminal. It allows the following functions:  
* Memory mapping of massive Sysmon log files as inputs in.evtx form.
* Provision of basic arguments supporting a user-friendly command-line execution of the Python script's source code.
* Parsing and transformation of the logs included in the _.evtx_ file into an easily manipulated and analyzed.xml_ format.
* Custom header filtering of the.xml created file. This is based on pre-selected Sysmon's Event ID tags, presented in tree-based form on the command line's screen or stored externally to a.txt file.
* Manipulation of the tree-based.xml structure and filtering based on pre-configured features as enclosed in Sysmon's _config_.xml_.
* Enumeration of the identified LM events, alert message generation per attack denoting the number of identified malicious events and making an assumption of the type of potentially executed attack.  
From an OS version's perspective, the analyzer can run on all mainstream platforms, including _Windows 10_, _MacOS Big Sur v11.6.5_ and _Ubuntu v22.04_.