bangsv/soc-detection-rules
GitHub: bangsv/soc-detection-rules
为 SOC 分析师提供基于 CVE 的检测规则、IoC 指标与事件分诊材料的实战知识库。
Stars: 0 | Forks: 0
# 🛡️ SOC 检测规则
[]()
[]()
[]()
本仓库包含为 SOC 分析师提供的知识和检测规则库。这里收集了 Sigma/XP/Suricata、Sysmon/Auditd 规则、PoC 脚本以及用于事件分诊的材料。
## 📊 检测矩阵 (CVE + IOC)
| CVE (名称) | 描述 / NVD | 🌐 IOC 网络流量 | 💻 IOC Windows / Linux 主机 |
| :--- | :--- | :--- | :--- |
| **CVE-2017-0143**
*(EternalBlue)* | [NVD](https://nvd.nist.gov/vuln/detail/CVE-2017-0143) \| [📁 文件夹](./CVE-2017-0143_EternalBlue) | `Trans2 Response: NT Status: STATUS_INVALID_PARAMETER (0xc000000d)` | `Sysmon ID: 3`
`Security ID: 4624` | **CVE-2021-36942**
*(PetitPotam)* | [NVD](https://nvd.nist.gov/vuln/detail/CVE-2021-36942) \| [📁 文件夹](./CVE-2021-36942_PetitPotam) | `EfsRpcOpenFileRaw` (RPC 调用)
`WERR_BAD_NETPATH` (RPC 响应，主要 IoC)
`NTLM Negotiate/Challenge/Authenticate`
`SMB port 445 (DC 作为客户端)`
`SMB2 Negotiate (Dialect 0x0202)` | `Sysmon ID: 3 (Initiated=false → DC:445)`
`Sysmon ID: 3 (Initiated=true → Attacker:445)`
`Sysmon ID: 18 (PipeConnected, \lsass)`
`SMBClient EID: 30805 (0xC00000C3)`
`SMBClient EID: 30816 (0xC00000CC)`
`SMBClient EID: 31012 (GUID {4141...})`
`SMBClient EID: 31013 (0xC000A000)`
`SMBServer EID: 551 (0xc000006d)`
`Security ID: 4624 (LogonType=3, NULL SID)` | | **CVE-2026-27944**
*(Nginx UI)* | [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-27944) \| [📁 文件夹](./CVE-2026-27944_Nginx%20UI) | `GET "/api/backup"` | `GET "/api/backup"` | | *
*(EternalBlue)* | [NVD](https://nvd.nist.gov/vuln/detail/CVE-2017-0143) \| [📁 文件夹](./CVE-2017-0143_EternalBlue) | `Trans2 Response: NT Status: STATUS_INVALID_PARAMETER (0xc000000d)` | `Sysmon ID: 3`
`Security ID: 4624` | **CVE-2021-36942**
*(PetitPotam)* | [NVD](https://nvd.nist.gov/vuln/detail/CVE-2021-36942) \| [📁 文件夹](./CVE-2021-36942_PetitPotam) | `EfsRpcOpenFileRaw` (RPC 调用)
`WERR_BAD_NETPATH` (RPC 响应，主要 IoC)
`NTLM Negotiate/Challenge/Authenticate`
`SMB port 445 (DC 作为客户端)`
`SMB2 Negotiate (Dialect 0x0202)` | `Sysmon ID: 3 (Initiated=false → DC:445)`
`Sysmon ID: 3 (Initiated=true → Attacker:445)`
`Sysmon ID: 18 (PipeConnected, \lsass)`
`SMBClient EID: 30805 (0xC00000C3)`
`SMBClient EID: 30816 (0xC00000CC)`
`SMBClient EID: 31012 (GUID {4141...})`
`SMBClient EID: 31013 (0xC000A000)`
`SMBServer EID: 551 (0xc000006d)`
`Security ID: 4624 (LogonType=3, NULL SID)` | | **CVE-2026-27944**
*(Nginx UI)* | [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-27944) \| [📁 文件夹](./CVE-2026-27944_Nginx%20UI) | `GET "/api/backup"` | `GET "/api/backup"` | | *
标签：Metaprompt, XXE攻击, 威胁情报, 安全运营, 开发者工具, 扫描框架, 自定义脚本