OtunbaAde001/soc-detection-rules
GitHub: OtunbaAde001/soc-detection-rules
一套整合 Microsoft Sentinel KQL 查询、Sigma 规则与 MITRE ATT&CK 映射的 SOC 威胁检测规则库，帮助安全团队快速落地常用攻击行为检测。
Stars: 0 | Forks: 0
# soc-detection-rules
这包括 Microsoft Sentinel KQL 查询、Sigma 检测规则和 MITRE ATT&CK 映射
```
SigninLogs
| where ResultType != "0" // Filter for failed sign-ins
| summarize Count = count() by UserPrincipalName, bin(TimeGenerated, 1h)
| order by Count desc
```
```
DeviceNetworkEvents
| summarize count() by RemoteIP
| order by count_ desc
```
```
let startTime = ago(30d);
let endTime = now();
let suspiciousExtensions = dynamic([".locked", ".encrypted", ".crypt"]);
let massFileModifications = DeviceNetworkEvents
| where Timestamp between (startTime .. endTime)
| where ActionType == "FileModified"
| summarize Count = count() by FileName, DeviceId
| where Count > 100; // Example threshold for mass modifications
let highVolumeRenames = DeviceNetworkEvents
| where Timestamp between (startTime .. endTime)
| where ActionType == "FileRenamed"
| summarize Count = count() by FileName, DeviceId
| where Count > 100; // Example threshold for high-volume renames
let knownRansomwareProcesses = DeviceNetworkEvents
| where Timestamp between (startTime .. endTime)
| where ProcessName in ("vssadmin.exe", "wbadmin.exe", "bcdedit.exe", "cipher.exe")
| summarize Count = count() by ProcessName, DeviceId;
let shadowCopyDeletions = DeviceNetworkEvents
| where Timestamp between (startTime .. endTime)
| where ActionType == "ShadowCopyDeleted"
| summarize Count = count() by DeviceId;
union massFileModifications, highVolumeRenames, knownRansomwareProcesses, shadowCopyDeletions
| summarize TotalCount = sum(Count) by DeviceId
| order by TotalCount desc
```
标签：ATT&CK映射, KQL, Microsoft Sentinel, Sigma规则, SOC检测规则, 勒索软件检测, 目标导入, 速率限制处理