Jonathan-Sproule/Corvid

# Corvid Corvid 是一个检测工程作品集，旨在展示在担任生产角色之前的生产级思维。其方法论是经过深思熟虑的：以 Sigma 为优先编写，使用 Splunk 作为 SIEM，并结合 Atomic Red Team 及手动对手模拟进行验证——因为目标不仅仅是编写检测规则，而是要理解它们是如何失败的、攻击者如何适应，以及如何构建在现实条件下依然有效的覆盖率。杀伤链方法遵循在多个阶段跟踪同一攻击家族，而不是编写孤立的、不相关的规则。 这些工作的构建方式与实际中的检测构建方式相同——基于一手来源的研究、复制实际攻击者行为的模拟、在规则发布前进行规避测试，以及基于真实遥测数据的误报审查。阶段日志记录了在每个阶段构建了什么、什么失败了，以及学到了什么。 ## 实验室概述 | 组件 | 角色 | |---|---| | Splunk Enterprise (Ubuntu VM) | SIEM - 检测编写、调优和测试 | | Windows 11 VM | 检测目标 + Atomic Red Team 运行环境 | | Kali Linux VM | 红队模拟 - 手动对手模拟以获取真实遥测数据 | | Sysmon (Olaf Hartong config) | 端点遥测源 | | Universal Forwarder | 将 Sysmon、PowerShell 和安全日志发送至 Splunk | | Atomic Red Team | 用于检测验证的对手模拟 | | Domain Controller VM | 已构建并提升 - 待命用于身份阶段 | | Raspberry Pi 5 | 计划中的网络传感器 (Suricata/Zeek) | ## 仓库结构 ``` /Detections per-attack detection folders; each contains Sigma rule, Splunk SPL, research notes, references, and variant subdirs /Templates reusable Sigma scaffold for new detections /Infrastructure /Phase-Log narrative log per phase (phase0.md, phase1.md, ...) /Atomic-Red-VM-Config Build-Notes.md VM-specific troubleshooting log /PowerShell-Profile atomicred-vm-profile.ps1 (lab helpers) /SplunkForwarder-Config-Files /Splunk-Server-VM-Config Build-Notes.md Splunk VM build and config notes /Notes SPL query scratchpad, reference material /Tools run-atomic.ps1 toggles Defender, detonates Atomic tests /hooks post-commit.py structured commit hook - auto-updates detection log and state install-hooks.sh run once after cloning to wire up git hooks ``` ## 设置说明 克隆后，安装 git hooks： ``` bash Tools/hooks/install-hooks.sh ``` 这将配置 post-commit hook，用于解析结构化的提交信息，并自动维护本地检测日志和项目状态文件。 ## 提交规范 ``` (): ``` **检测周期类型** - `scope` 为 ATT&CK 技术 ID： | 类型 | 步骤 | 示例 | |---|---|---| | `research` | 1 - 研究 | `research(T1053.005): scheduled task persistence source analysis` | | `detonate` | 2 - 红方 | `detonate(T1053.005): confirmed EID 4698 from manual detonation` | | `author` | 3 - 编写 | `author(T1053.005): draft Sigma rule - TaskName and image conditions` | | `validate` | 4 - 验证 | `validate(T1053.005): rule fires against detonation events in Splunk` | | `evade` | 5 - 规避 | `evade(T1053.005): task name mutation bypass identified` | | `tune` | 6 - 调优 | `tune(T1053.005): tightened ParentImage condition after evasion test` | | `backtest` | 7 - 回测 | `backtest(T1053.005): zero false positives against 30 days historical` | | `ship` | 8 - 发布 | `ship(T1053.005): scheduled task persistence detection complete` | **结构化类型：** | 类型 | 范围 | 示例 | |---|---|---| | `phase` | 过渡 | `phase(2→3): identity arc begins - DC online` | | `infra` | 组件 | `infra(splunk): added winsec index` | | `docs` | 组件 | `docs(readme): update lab overview` | 非结构化提交不受限制地予以接受 - hook 会静默忽略它们。 ## 检测方法论 每个检测都遵循一个八步周期，从研究到引爆、验证、规避测试和回测。有关完整的生命周期和检测理念，请参阅 [Detections/README.md](Detections/README.md)。 ## 阶段路线图 ``` Phase 0 - Pipeline build ........................... COMPLETE Splunk lab: Sysmon + PowerShell telemetry, Universal Forwarder, end-to-end ingestion verified. Phase 1 - ClickFix detection authored and validated .. COMPLETE Sigma-first authoring, structured research, five-layer validation. CrashFix/KongTuke rule complete: OriginalFileName anchor, detonation confirmed across three iterations. Phase 2 - Detection-as-code + CI/CD ............... COMPLETE GitHub Actions pipeline: sigma-cli validation on every PR, gitleaks OPSEC secret scan, pySigma conversion to SPL artifact. Branch protection requires all three jobs to pass before merge to main. --- Identity detection arc --- Phase 3 - On-prem identity: AD detection Domain-join Windows VM, bring DC online. Kerberoasting, password spraying, privilege escalation, replication abuse. Phase 4 - Detection library + eval harness Golden TP/FP datasets; local LLM (Ollama) for payload analysis. Phase 5 - Cloud identity: Entra ID / Azure Sentinel + Azure. AiTM, session hijacking, illicit consent / OAuth abuse, CA tampering. --- Tooling and long tail --- Phase 6 - Python tooling Sigma→Splunk pusher, Atomic Red Team MCP server. Phase 7 - Network telemetry (Pi 5 + Suricata) Long-tail phase - added once identity arc is mature. ``` ## 核心文档 - [Phase 0 构建日志](Infrastructure/Phase-Log/phase0.md) - [Phase 1 构建日志](Infrastructure/Phase-Log/phase1.md) - [Atomic Red VM 构建笔记](Infrastructure/Atomic-Red-VM-Config/Build-Notes.md) - [Splunk server 构建笔记](Infrastructure/Splunk-Server-VM-Config/Build-Notes.md) - [实验室的 PowerShell profile](Infrastructure/Atomic-Red-VM-Config/PowerShell-Profile/README.md)

标签：AI合规, 逆向工具