=== RAPPORT AUDITABILITE PRIVILEGES - SEMAINE 37/2024 ===

COMPTES ADMINISTRATEUR DETECTES : 127 (+1)
- Comptes service : 45
- Administrateurs permanents : 23  
- Administrateurs temporaires : 59 (+1)

ALERTE CRITIQUE : Nouveau compte admin détecté
- ID Utilisateur : jdupont.stagiaire
- Niveau privilège : Domain Admin, Enterprise Admin, Schema Admin
- Date création : 02/09/2024
- Dernière connexion : 23/09/2024 - 23h47
- Systèmes accessibles : TOUS (178 serveurs)
- Bases données : TOUTES (23 instances)
- Applications métier : TOUTES (67 applications)

ACTIVITE NOCTURNE SUSPECTE DETECTEE :
- 156 connexions entre 22h et 06h depuis 15 jours
- 2.3 TB de données accédées
- 47 bases clients consultées
- 12 serveurs de sauvegarde accédés

# Script d'investigation privilèges - Analyse compte jdupont.stagiaire
# USAGE INTERNE SECURITE - Marcus Fontaine, DSI

# Vérification des groupes d'appartenance
Get-ADUser jdupont.stagiaire -Properties MemberOf | 
    Select-Object -ExpandProperty MemberOf | 
    Get-ADGroup | Select-Object Name, Description

# Résultats terrifiants :
# Domain Admins - Accès total domaine
# Enterprise Admins - Accès forêt complète  
# Schema Admins - Modification schéma AD
# Backup Operators - Accès sauvegardes
# Server Operators - Gestion serveurs
# Account Operators - Création/suppression comptes

# Audit des connexions récentes
Get-EventLog -LogName Security -InstanceId 4624 | 
    Where-Object {$_.ReplacementStrings[5] -eq "jdupont.stagiaire"} |
    Select-Object TimeGenerated, MachineName, @{Name="LoginType";Expression={$_.ReplacementStrings[8]}}

# Analyse des accès aux données sensibles
Get-EventLog -LogName Security -InstanceId 4663 |
    Where-Object {$_.ReplacementStrings[1] -eq "jdupont.stagiaire"} |
    Group-Object {$_.ReplacementStrings[6]} | 
    Sort-Object Count -Descending

# Script d'analyse forensique des activités de jdupont.stagiaire
# Claudius Security Analytics - Marcus Fontaine

import pandas as pd
from datetime import datetime, timedelta
import matplotlib.pyplot as plt

class InsiderThreatAnalysis:
    def __init__(self, user_id):
        self.user_id = user_id
        self.suspicious_activities = []
        
    def analyze_data_access_patterns(self, access_logs):
        """Analyse des patterns d'accès aux données"""
        
        # Regroupement par heure d'accès
        hourly_access = access_logs.groupby(
            access_logs['timestamp'].dt.hour
        ).size()
        
        # Détection d'activité anormale (22h-6h)
        night_activity = hourly_access[22:24].sum() + hourly_access[0:6].sum()
        day_activity = hourly_access[6:22].sum()
        
        if night_activity > day_activity * 0.3:  # Plus de 30% d'activité nocturne
            self.suspicious_activities.append({
                'type': 'unusual_hours',
                'severity': 'HIGH',
                'details': f'Night activity: {night_activity}, Day: {day_activity}'
            })
    
    def detect_bulk_data_extraction(self, data_transfer_logs):
        """Détection d'extraction massive de données"""
        
        daily_transfers = data_transfer_logs.groupby(
            data_transfer_logs['timestamp'].dt.date
        )['size_mb'].sum()
        
        # Seuil critique : plus de 100GB par jour
        critical_days = daily_transfers[daily_transfers > 100 * 1024]
        
        if len(critical_days) > 0:
            self.suspicious_activities.append({
                'type': 'bulk_extraction',
                'severity': 'CRITICAL',
                'details': f'Large transfers on {len(critical_days)} days'
            })
    
    def check_privilege_usage(self, privilege_logs):
        """Vérification de l'usage des privilèges"""
        
        admin_actions = privilege_logs[
            privilege_logs['action_type'].isin([
                'user_creation', 'policy_modification', 
                'backup_access', 'schema_change'
            ])
        ]
        
        if len(admin_actions) > 50:  # Seuil arbitraire
            self.suspicious_activities.append({
                'type': 'excessive_admin_usage',
                'severity': 'HIGH', 
                'details': f'{len(admin_actions)} admin actions detected'
            })

# Analyse pour jdupont.stagiaire
analyzer = InsiderThreatAnalysis("jdupont.stagiaire")

# Résultats de l'analyse automatisée :
# - 78% d'activité entre 22h et 6h du matin
# - 2.3 TB transférés en 15 jours (moyenne 157 GB/jour)
# - 127 actions d'administration privilégiée
# - Accès à 23 bases de données clients différentes
# - Création de 12 comptes non autorisés

/exports_julien/
├── clients_premium/
│   ├── fortunes_500_contacts.xlsx (234 MB)
│   ├── contrats_gouvernementaux.pdf (156 MB)
│   └── strategies_commerciales_2024.docx (45 MB)
├── donnees_techniques/
│   ├── schemas_architecture_complete.json (789 MB)
│   ├── mots_de_passe_services.txt (2 MB)
│   └── configurations_serveurs_prod.zip (1.2 GB)
└── ressources_humaines/
    ├── salaires_direction.xlsx (12 MB)
    ├── evaluations_confidentielles.pdf (234 MB)
    └── strategies_restructuration.docx (67 MB)

# Script de révocation d'urgence
# EXECUTE IMMEDIATEMENT - Marcus Fontaine

# 1. Désactivation compte utilisateur
Disable-ADAccount -Identity jdupont.stagiaire

# 2. Révocation sessions actives  
Get-ADComputer -Filter * | ForEach-Object {
    Invoke-Command -ComputerName $_.Name -ScriptBlock {
        Get-Process -IncludeUserName | Where-Object {$_.UserName -eq "TECHNOSERV\jdupont.stagiaire"} | Stop-Process -Force
    } -ErrorAction SilentlyContinue
}

# 3. Blocage réseau par MAC address
$MacAddress = "00:1B:44:11:3A:B7"  # MAC laptop Julien
netsh advfirewall firewall add rule name="Block Julien Device" dir=in action=block remoteip=any

# 4. Invalidation certificats et tokens
Revoke-AzAccessToken -TenantId "technoserv-tenant-id"

#!/bin/bash
# Script de collecte forensique - Incident Julien Dupont
# Claudius Incident Response Team

echo "=== COLLECTE FORENSIQUE INSIDER THREAT ==="

# Préservation logs avant rotation
mkdir -p /forensics/julien_dupont_incident/
cp -r /var/log/security/* /forensics/julien_dupont_incident/logs/
cp -r /var/log/audit/* /forensics/julien_dupont_incident/audit/

# Extraction activité réseau
tcpdump -r /var/log/network.pcap host 192.168.1.45 > /forensics/julien_dupont_incident/network_activity.txt

# Analyse des accès bases de données  
mysql -e "SELECT user,host,command_type,db,time FROM mysql.general_log WHERE user LIKE '%jdupont%' AND time >= '2024-09-02';" > /forensics/julien_dupont_incident/db_access.sql

# Timeline reconstruction
python3 << EOF
import json
from datetime import datetime

# Reconstruction chronologique complète
events = []

# Fusion des logs : AD, applications, réseau, bases données
with open('/forensics/julien_dupont_incident/timeline.json', 'w') as f:
    json.dump(events, f, indent=2)
    
print("Timeline forensique générée")
EOF

# Template d'accès par profil - TechnoServ SA v2.0
access_profiles:
  stagiaire:
    duration: "temporary_max_6_months"  
    privileges:
      - read_access: ["dev_environment", "documentation", "training_resources"]
      - write_access: ["personal_workspace", "test_databases_limited"]
      - admin_access: []  # JAMAIS d'accès admin
    prohibited:
      - production_systems
      - client_databases  
      - backup_systems
      - schema_modifications
    monitoring: "enhanced_24x7"
    
  employee_junior:
    duration: "permanent"
    privileges:
      - read_access: ["dev_environment", "staging_environment", "project_docs"]
      - write_access: ["assigned_projects", "dev_databases"] 
      - admin_access: ["dev_servers_assigned"]
    prohibited:
      - production_admin
      - client_data_full
      - backup_admin
    monitoring: "standard"
    
  admin_senior:
    duration: "permanent"
    privileges:
      - read_access: ["all_environments"]  
      - write_access: ["all_non_prod"]
      - admin_access: ["infrastructure", "user_management"]
    additional_controls:
      - mfa_required: true
      - approval_workflow: true
      - session_recording: true  
      - just_in_time_access: true
    monitoring: "maximum"

#!/bin/bash
# Script d'onboarding sécurisé v3.0 - TechnoServ SA
# Auteur : Marcus Fontaine, DSI
# Validation : Sophie Chen, RSSI

create_secure_user_account() {
    local username=$1
    local user_type=$2  # stagiaire|employee|admin
    local duration=$3   # jours
    
    echo "=== ONBOARDING SECURISE - $username ==="
    
    # 1. Vérification préalable
    if [[ "$user_type" == "stagiaire" && "$duration" -gt 180 ]]; then
        echo "ERREUR: Durée max stagiaire = 180 jours"
        exit 1
    fi
    
    # 2. Création compte avec profil approprié
    case $user_type in
        "stagiaire")
            create_account_with_profile "$username" "stagiaire_template"
            setup_enhanced_monitoring "$username"
            setup_data_loss_prevention "$username"
            ;;
        "employee") 
            create_account_with_profile "$username" "employee_template"
            setup_standard_monitoring "$username"
            ;;
        "admin")
            echo "ADMIN CREATION REQUIRES MANUAL APPROVAL"
            create_approval_request "$username" "admin_creation"
            exit 0
            ;;
    esac
    
    # 3. Configuration expiration automatique
    setup_account_expiry "$username" "$duration"
    
    # 4. Notification équipes sécurité
    notify_security_team "$username" "$user_type" "$duration"
    
    # 5. Documentation traçable
    log_account_creation "$username" "$user_type" "$duration"
}

setup_enhanced_monitoring() {
    local username=$1
    
    # Surveillance 24/7 pour stagiaires
    cat >> /etc/security/watched_accounts.conf << EOF
$username:
  monitor_level: MAXIMUM
  alert_thresholds:
    failed_logins: 3
    off_hours_access: ANY
    data_transfer_mb: 100
    admin_attempts: 1
  real_time_alerts: true
  session_recording: true
EOF
}

# Système de détection d'insider threats - TechnoServ SA
# Analyse comportementale machine learning

import numpy as np
from sklearn.ensemble import IsolationForest
from sklearn.preprocessing import StandardScaler
import pandas as pd

class InsiderThreatDetection:
    def __init__(self):
        self.model = IsolationForest(contamination=0.1, random_state=42)
        self.scaler = StandardScaler()
        self.baseline_established = False
        
    def extract_behavioral_features(self, user_logs):
        """Extraction des caractéristiques comportementales"""
        features = {
            # Patterns temporels
            'avg_login_hour': user_logs['login_time'].dt.hour.mean(),
            'night_activity_ratio': len(user_logs[(user_logs['login_time'].dt.hour >= 22) | 
                                                (user_logs['login_time'].dt.hour <= 6)]) / len(user_logs),
            'weekend_activity_ratio': len(user_logs[user_logs['login_time'].dt.weekday >= 5]) / len(user_logs),
            
            # Patterns d'accès
            'unique_systems_accessed': user_logs['system'].nunique(),
            'avg_session_duration': user_logs['session_duration'].mean(),
            'failed_access_attempts': len(user_logs[user_logs['status'] == 'failed']),
            
            # Patterns de données
            'total_data_transferred_mb': user_logs['data_transferred_mb'].sum(),
            'avg_daily_transfer': user_logs.groupby(user_logs['login_time'].dt.date)['data_transferred_mb'].sum().mean(),
            'max_single_transfer': user_logs['data_transferred_mb'].max(),
            
            # Patterns privilèges
            'admin_actions_count': len(user_logs[user_logs['privilege_level'] == 'admin']),
            'privilege_escalation_attempts': len(user_logs[user_logs['action'].str.contains('elevate|sudo|runas', case=False, na=False)]),
        }
        
        return pd.DataFrame([features])
    
    def train_baseline(self, historical_data):
        """Établissement baseline comportementale"""
        features_matrix = []
        
        for user_id in historical_data['user_id'].unique():
            user_data = historical_data[historical_data['user_id'] == user_id]
            if len(user_data) >= 10:  # Minimum d'observations
                features = self.extract_behavioral_features(user_data)
                features_matrix.append(features.values[0])
        
        X = np.array(features_matrix)
        X_scaled = self.scaler.fit_transform(X)
        self.model.fit(X_scaled)
        self.baseline_established = True
        
    def detect_anomaly(self, user_logs, user_id):
        """Détection d'anomalie pour un utilisateur"""
        if not self.baseline_established:
            return {'error': 'Baseline not established'}
            
        features = self.extract_behavioral_features(user_logs)
        X_scaled = self.scaler.transform(features.values)
        
        anomaly_score = self.model.decision_function(X_scaled)[0]
        is_anomaly = self.model.predict(X_scaled)[0] == -1
        
        # Calcul risk score (0-100)
        risk_score = max(0, min(100, (0.5 - anomaly_score) * 100))
        
        return {
            'user_id': user_id,
            'is_anomaly': is_anomaly,
            'risk_score': risk_score,
            'anomaly_score': anomaly_score,
            'behavioral_features': features.to_dict('records')[0]
        }

# Intégration avec monitoring temps réel
detector = InsiderThreatDetection()

# Alerte automatique si risk_score > 75 pour stagiaires
def alert_if_high_risk(user_id, risk_score):
    if risk_score > 75:
        send_security_alert({
            'severity': 'HIGH',
            'user': user_id, 
            'risk_score': risk_score,
            'timestamp': datetime.now(),
            'action_required': 'IMMEDIATE_REVIEW'
        })

TIMELINE RECONSTRUCTION - OPERATION "HARVEST DATA"

J-180 : Premier contact Julien/Christophe sur forum HackTheBox
J-120 : Début négociations financières via ProtonMail
J-60  : Versement initial 5000€ BTC à Christophe
J-30  : Candidature spontanée Julien pour stage cybersécurité
J-15  : Validation candidature, sélection par... Christophe
J-7   : Versement complément 10000€ BTC à Christophe  
J+0   : Arrivée Julien, attribution privilèges "par erreur"
J+1   : Premier transfert données 156 GB
J+21  : Découverte par Marcus via audit PAM