=== PRIVILEGE AUDITABILITY REPORT - WEEK 37/2024 ===

ADMINISTRATOR ACCOUNTS DETECTED: 127 (+1)
- Service accounts: 45
- Permanent administrators: 23  
- Temporary administrators: 59 (+1)

CRITICAL ALERT: New admin account detected
- User ID: jdupont.stagiaire
- Privilege level: Domain Admin, Enterprise Admin, Schema Admin
- Creation date: 02/09/2024
- Last connection: 23/09/2024 - 23:47
- Accessible systems: ALL (178 servers)
- Databases: ALL (23 instances)
- Business applications: ALL (67 applications)

SUSPICIOUS NIGHT ACTIVITY DETECTED:
- 156 connections between 22:00 and 06:00 for 15 days
- 2.3 TB of data accessed
- 47 client databases consulted
- 12 backup servers accessed

# Privilege investigation script - Analysis of jdupont.stagiaire account
# INTERNAL SECURITY USE - Marcus Fontaine, CIO

# Checking group memberships
Get-ADUser jdupont.stagiaire -Properties MemberOf | 
    Select-Object -ExpandProperty MemberOf | 
    Get-ADGroup | Select-Object Name, Description

# Terrifying results:
# Domain Admins - Full domain access
# Enterprise Admins - Complete forest access  
# Schema Admins - AD schema modification
# Backup Operators - Backup access
# Server Operators - Server management
# Account Operators - Account creation/deletion

# Audit of recent connections
Get-EventLog -LogName Security -InstanceId 4624 | 
    Where-Object {$_.ReplacementStrings[5] -eq "jdupont.stagiaire"} |
    Select-Object TimeGenerated, MachineName, @{Name="LoginType";Expression={$_.ReplacementStrings[8]}}

# Analysis of sensitive data access
Get-EventLog -LogName Security -InstanceId 4663 |
    Where-Object {$_.ReplacementStrings[1] -eq "jdupont.stagiaire"} |
    Group-Object {$_.ReplacementStrings[6]} | 
    Sort-Object Count -Descending

# Forensic analysis script of jdupont.stagiaire activities
# Claudius Security Analytics - Marcus Fontaine

import pandas as pd
from datetime import datetime, timedelta
import matplotlib.pyplot as plt

class InsiderThreatAnalysis:
    def __init__(self, user_id):
        self.user_id = user_id
        self.suspicious_activities = []
        
    def analyze_data_access_patterns(self, access_logs):
        """Analysis of data access patterns"""
        
        # Grouping by access hour
        hourly_access = access_logs.groupby(
            access_logs['timestamp'].dt.hour
        ).size()
        
        # Abnormal activity detection (10 PM-6 AM)
        night_activity = hourly_access[22:24].sum() + hourly_access[0:6].sum()
        day_activity = hourly_access[6:22].sum()
        
        if night_activity > day_activity * 0.3:  # More than 30% night activity
            self.suspicious_activities.append({
                'type': 'unusual_hours',
                'severity': 'HIGH',
                'details': f'Night activity: {night_activity}, Day: {day_activity}'
            })
    
    def detect_bulk_data_extraction(self, data_transfer_logs):
        """Detection of massive data extraction"""
        
        daily_transfers = data_transfer_logs.groupby(
            data_transfer_logs['timestamp'].dt.date
        )['size_mb'].sum()
        
        # Critical threshold: more than 100GB per day
        critical_days = daily_transfers[daily_transfers > 100 * 1024]
        
        if len(critical_days) > 0:
            self.suspicious_activities.append({
                'type': 'bulk_extraction',
                'severity': 'CRITICAL',
                'details': f'Large transfers on {len(critical_days)} days'
            })
    
    def check_privilege_usage(self, privilege_logs):
        """Privilege usage verification"""
        
        admin_actions = privilege_logs[
            privilege_logs['action_type'].isin([
                'user_creation', 'policy_modification', 
                'backup_access', 'schema_change'
            ])
        ]
        
        if len(admin_actions) > 50:  # Arbitrary threshold
            self.suspicious_activities.append({
                'type': 'excessive_admin_usage',
                'severity': 'HIGH', 
                'details': f'{len(admin_actions)} admin actions detected'
            })

# Analysis for jdupont.stagiaire
analyzer = InsiderThreatAnalysis("jdupont.stagiaire")

# Automated analysis results:
# - 78% activity between 10 PM and 6 AM
# - 2.3 TB transferred in 15 days (average 157 GB/day)
# - 127 privileged administration actions
# - Access to 23 different client databases
# - Creation of 12 unauthorized accounts

/exports_julien/
├── clients_premium/
│   ├── fortunes_500_contacts.xlsx (234 MB)
│   ├── government_contracts.pdf (156 MB)
│   └── commercial_strategies_2024.docx (45 MB)
├── technical_data/
│   ├── complete_architecture_schemas.json (789 MB)
│   ├── service_passwords.txt (2 MB)
│   └── prod_server_configurations.zip (1.2 GB)
└── human_resources/
    ├── management_salaries.xlsx (12 MB)
    ├── confidential_evaluations.pdf (234 MB)
    └── restructuring_strategies.docx (67 MB)

# Emergency revocation script
# EXECUTE IMMEDIATELY - Marcus Fontaine

# 1. User account deactivation
Disable-ADAccount -Identity jdupont.stagiaire

# 2. Active sessions revocation  
Get-ADComputer -Filter * | ForEach-Object {
    Invoke-Command -ComputerName $_.Name -ScriptBlock {
        Get-Process -IncludeUserName | Where-Object {$_.UserName -eq "TECHNOSERV\jdupont.stagiaire"} | Stop-Process -Force
    } -ErrorAction SilentlyContinue
}

# 3. Network blocking by MAC address
$MacAddress = "00:1B:44:11:3A:B7"  # Julien's laptop MAC
netsh advfirewall firewall add rule name="Block Julien Device" dir=in action=block remoteip=any

# 4. Certificate and token invalidation
Revoke-AzAccessToken -TenantId "technoserv-tenant-id"

#!/bin/bash
# Forensic collection script - Julien Dupont Incident
# Claudius Incident Response Team

echo "=== INSIDER THREAT FORENSIC COLLECTION ==="

# Log preservation before rotation
mkdir -p /forensics/julien_dupont_incident/
cp -r /var/log/security/* /forensics/julien_dupont_incident/logs/
cp -r /var/log/audit/* /forensics/julien_dupont_incident/audit/

# Network activity extraction
tcpdump -r /var/log/network.pcap host 192.168.1.45 > /forensics/julien_dupont_incident/network_activity.txt

# Database access analysis  
mysql -e "SELECT user,host,command_type,db,time FROM mysql.general_log WHERE user LIKE '%jdupont%' AND time >= '2024-09-02';" > /forensics/julien_dupont_incident/db_access.sql

# Timeline reconstruction
python3 << EOF
import json
from datetime import datetime

# Complete chronological reconstruction
events = []

# Log fusion: AD, applications, network, databases
with open('/forensics/julien_dupont_incident/timeline.json', 'w') as f:
    json.dump(events, f, indent=2)
    
print("Forensic timeline generated")
EOF

# Access template by profile - TechnoServ SA v2.0
access_profiles:
  intern:
    duration: "temporary_max_6_months"  
    privileges:
      - read_access: ["dev_environment", "documentation", "training_resources"]
      - write_access: ["personal_workspace", "test_databases_limited"]
      - admin_access: []  # NEVER admin access
    prohibited:
      - production_systems
      - client_databases  
      - backup_systems
      - schema_modifications
    monitoring: "enhanced_24x7"
    
  junior_employee:
    duration: "permanent"
    privileges:
      - read_access: ["dev_environment", "staging_environment", "project_docs"]
      - write_access: ["assigned_projects", "dev_databases"] 
      - admin_access: ["dev_servers_assigned"]
    prohibited:
      - production_admin
      - client_data_full
      - backup_admin
    monitoring: "standard"
    
  senior_admin:
    duration: "permanent"
    privileges:
      - read_access: ["all_environments"]  
      - write_access: ["all_non_prod"]
      - admin_access: ["infrastructure", "user_management"]
    additional_controls:
      - mfa_required: true
      - approval_workflow: true
      - session_recording: true  
      - just_in_time_access: true
    monitoring: "maximum"

#!/bin/bash
# Secure onboarding script v3.0 - TechnoServ SA
# Author: Marcus Fontaine, CIO
# Validation: Sophie Chen, CISO

create_secure_user_account() {
    local username=$1
    local user_type=$2  # intern|employee|admin
    local duration=$3   # days
    
    echo "=== SECURE ONBOARDING - $username ==="
    
    # 1. Preliminary verification
    if [[ "$user_type" == "intern" && "$duration" -gt 180 ]]; then
        echo "ERROR: Max intern duration = 180 days"
        exit 1
    fi
    
    # 2. Account creation with appropriate profile
    case $user_type in
        "intern")
            create_account_with_profile "$username" "intern_template"
            setup_enhanced_monitoring "$username"
            setup_data_loss_prevention "$username"
            ;;
        "employee") 
            create_account_with_profile "$username" "employee_template"
            setup_standard_monitoring "$username"
            ;;
        "admin")
            echo "ADMIN CREATION REQUIRES MANUAL APPROVAL"
            create_approval_request "$username" "admin_creation"
            exit 0
            ;;
    esac
    
    # 3. Automatic expiration configuration
    setup_account_expiry "$username" "$duration"
    
    # 4. Security teams notification
    notify_security_team "$username" "$user_type" "$duration"
    
    # 5. Traceable documentation
    log_account_creation "$username" "$user_type" "$duration"
}

setup_enhanced_monitoring() {
    local username=$1
    
    # 24/7 surveillance for interns
    cat >> /etc/security/watched_accounts.conf << EOF
$username:
  monitor_level: MAXIMUM
  alert_thresholds:
    failed_logins: 3
    off_hours_access: ANY
    data_transfer_mb: 100
    admin_attempts: 1
  real_time_alerts: true
  session_recording: true
EOF
}

# Insider threat detection system - TechnoServ SA
# Machine learning behavioral analysis

import numpy as np
from sklearn.ensemble import IsolationForest
from sklearn.preprocessing import StandardScaler
import pandas as pd

class InsiderThreatDetection:
    def __init__(self):
        self.model = IsolationForest(contamination=0.1, random_state=42)
        self.scaler = StandardScaler()
        self.baseline_established = False
        
    def extract_behavioral_features(self, user_logs):
        """Behavioral characteristics extraction"""
        features = {
            # Temporal patterns
            'avg_login_hour': user_logs['login_time'].dt.hour.mean(),
            'night_activity_ratio': len(user_logs[(user_logs['login_time'].dt.hour >= 22) | 
                                                (user_logs['login_time'].dt.hour <= 6)]) / len(user_logs),
            'weekend_activity_ratio': len(user_logs[user_logs['login_time'].dt.weekday >= 5]) / len(user_logs),
            
            # Access patterns
            'unique_systems_accessed': user_logs['system'].nunique(),
            'avg_session_duration': user_logs['session_duration'].mean(),
            'failed_access_attempts': len(user_logs[user_logs['status'] == 'failed']),
            
            # Data patterns
            'total_data_transferred_mb': user_logs['data_transferred_mb'].sum(),
            'avg_daily_transfer': user_logs.groupby(user_logs['login_time'].dt.date)['data_transferred_mb'].sum().mean(),
            'max_single_transfer': user_logs['data_transferred_mb'].max(),
            
            # Privilege patterns
            'admin_actions_count': len(user_logs[user_logs['privilege_level'] == 'admin']),
            'privilege_escalation_attempts': len(user_logs[user_logs['action'].str.contains('elevate|sudo|runas', case=False, na=False)]),
        }
        
        return pd.DataFrame([features])
    
    def train_baseline(self, historical_data):
        """Behavioral baseline establishment"""
        features_matrix = []
        
        for user_id in historical_data['user_id'].unique():
            user_data = historical_data[historical_data['user_id'] == user_id]
            if len(user_data) >= 10:  # Minimum observations
                features = self.extract_behavioral_features(user_data)
                features_matrix.append(features.values[0])
        
        X = np.array(features_matrix)
        X_scaled = self.scaler.fit_transform(X)
        self.model.fit(X_scaled)
        self.baseline_established = True
        
    def detect_anomaly(self, user_logs, user_id):
        """Anomaly detection for a user"""
        if not self.baseline_established:
            return {'error': 'Baseline not established'}
            
        features = self.extract_behavioral_features(user_logs)
        X_scaled = self.scaler.transform(features.values)
        
        anomaly_score = self.model.decision_function(X_scaled)[0]
        is_anomaly = self.model.predict(X_scaled)[0] == -1
        
        # Risk score calculation (0-100)
        risk_score = max(0, min(100, (0.5 - anomaly_score) * 100))
        
        return {
            'user_id': user_id,
            'is_anomaly': is_anomaly,
            'risk_score': risk_score,
            'anomaly_score': anomaly_score,
            'behavioral_features': features.to_dict('records')[0]
        }

# Real-time monitoring integration
detector = InsiderThreatDetection()

# Automatic alert if risk_score > 75 for interns
def alert_if_high_risk(user_id, risk_score):
    if risk_score > 75:
        send_security_alert({
            'severity': 'HIGH',
            'user': user_id, 
            'risk_score': risk_score,
            'timestamp': datetime.now(),
            'action_required': 'IMMEDIATE_REVIEW'
        })

TIMELINE RECONSTRUCTION - OPERATION "HARVEST DATA"

D-180: First Julien/Christophe contact on HackTheBox forum
D-120: Start of financial negotiations via ProtonMail
D-60 : Initial payment 5000€ BTC to Christophe
D-30 : Julien's spontaneous application for cybersecurity internship
D-15 : Application validation, selection by... Christophe
D-7  : Complement payment 10000€ BTC to Christophe  
D+0  : Julien's arrival, privilege attribution "by error"
D+1  : First data transfer 156 GB
D+21 : Discovery by Marcus via PAM audit