Detection, Monitoring, and Incident Response Capabilities Questions

from datetime import datetime, timedelta
from typing import List, Dict

TRIGGERS = ("procdump.exe", "rundll32.exe")
SUSPICIOUS_MODULES = ("mimikatz", "sekurlsa", "dcsync")

def parse_ts(s): return datetime.fromisoformat(s.replace("Z","+00:00"))

def detect_credential_dumping(events: List[dict]) -> List[dict]:
    by_host = {}
    for e in events:
        host = e.get("host")
        by_host.setdefault(host, []).append({**e, "ts": parse_ts(e["timestamp"])})
    incidents = []
    window = timedelta(minutes=10)
    for host, evs in by_host.items():
        evs.sort(key=lambda x: x["ts"])
        # maintain index to scan triggers
        for i, e in enumerate(evs):
            proc = (e.get("process") or "").lower()
            cmd = (e.get("command_line") or "").lower()
            img = (e.get("image_loaded") or "").lower()
            is_trigger = any(t in proc for t in TRIGGERS) and ("lsass" in cmd or "procdump" in proc)
            is_rundll_susp = "rundll32.exe" in proc and any(m in cmd or m in img for m in SUSPICIOUS_MODULES)
            is_lsass_access = "lsass" in cmd and ("-ma" in cmd or "dump" in cmd)
            if not (is_trigger or is_rundll_susp or is_lsass_access):
                continue
            start = e["ts"]
            end = start + window
            evidence = {e["event_id"]}
            # collect correlated events in window
            j = i+1
            while j < len(evs) and evs[j]["ts"] <= end:
                ej = evs[j]
                if any(m in (ej.get("image_loaded") or "").lower() for m in SUSPICIOUS_MODULES) \
                   or "lsass" in (ej.get("command_line") or "").lower() \
                   or any(t in (ej.get("process") or "").lower() for t in TRIGGERS):
                    evidence.add(ej["event_id"])
                j += 1
            if len(evidence) > 1:
                incidents.append({"host": host, "window_start": start.isoformat(), "window_end": end.isoformat(), "evidence_ids": sorted(evidence)})
    return incidents

index=wineventlog OR index=sysmon
(
  sourcetype=WinEventLog:Microsoft-Windows-TaskScheduler/Operational
  (EventCode=106 OR EventCode=201 OR EventCode=102) 
  ("procdump" OR "mimikatz" OR "rundll32" AND ("--" OR "/c" OR ".dll"))
)
OR
(
  sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=1
)
| eval src="scheduled" 
| eval suspicious=if(match(CommandLine,"(?i)procdump|mimikatz|rundll32"),1,0)
| where (sourcetype= "XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" AND EventCode=1) OR (sourcetype="WinEventLog:Microsoft-Windows-TaskScheduler/Operational" AND suspicious=1)
| eval _time=strftime(_time,"%Y-%m-%dT%H:%M:%SZ")
| bin _time span=1h
| transaction host maxspan=24h startswith=sourcetype="WinEventLog:Microsoft-Windows-TaskScheduler/Operational" endswith=EventCode=1 keeporphans=true
| search eventcount>0
| stats values(_time) as timestamps values(CommandLine) as cmdlines values(Image) as images earliest(_time) as first_seen latest(_time) as last_seen by host
| table host first_seen last_seen timestamps images cmdlines
| sort - last_seen