ridgelinecyberdefence/Enterprise-Detection-Engineering

# Ridgeline 检测库 经过生产环境验证的检测查询、调查脚本和狩猎 artifact，并附带您部署和调优所需上下文。每项检测都包含查询语句、触发条件、已知误报、调优指导，以及讲解底层概念的 Ridgeline 课程链接。 涵盖九大平台的 **179 个 artifact**：KQL (32)、Sigma (38)、Splunk (29)、Athena (21)、PowerShell (19)、Velociraptor (22)、YARA (5)、Suricata (6)、osquery (7)。 ## 本库的独特之处 其他代码库只提供查询。本库提供的是您可以真正部署的查询。 本库中的每项检测均包含： - **查询语句** — KQL、Sigma、PowerShell 或 VQL，随时可部署 - **触发条件** — 具体的攻击者行为，而非模糊的描述 - **误报情况** — 哪些合法活动会匹配以及如何区分 - **调优说明** — 阈值、排除项以及针对特定环境的调整 - **验证步骤** — 在依赖该检测前如何测试其有效性 - **了解更多** — 深入讲解相关概念的 Ridgeline 培训模块 ## KQL — Microsoft Sentinel & Defender XDR (32) | 检测项 | 战术 | 严重程度 | |---|---|---| | [匿名化基础设施登录](kql/initial-access/signin-from-anonymizer-infrastructure.md) | Initial Access | Medium | | [Office 生成可疑子进程](kql/execution/office-spawning-suspicious-child.md) | Execution | High | | [AiTM Token 重放 — User-Agent 相似性](kql/credential-access/aitm-token-replay-useragent-similarity.md) | Credential Access | Critical | | [DCSync — 目录复制滥用](kql/credential-access/dcsync-directory-replication-abuse.md) | Credential Access | Critical | | [LSASS 访问掩码监控](kql/credential-access/lsass-access-mask-monitoring.md) | Credential Access | High | | [密码喷射 — 分布式检测](kql/credential-access/password-spray-distributed-detection.md) | Credential Access | High | | [Token 重放 — 地理位置不一致](kql/credential-access/token-replay-geo-inconsistency.md) | Credential Access | Critical | | [Kerberoasting — RC4 TGS 请求](kql/credential-access/kerberoasting-rc4-tgs-requests.md) | Credential Access | High | | [OAuth 非法同意授权](kql/persistence/oauth-illicit-consent-grant.md) | Persistence | High | | [收件箱规则 — BEC 持久化](kql/persistence/inbox-rule-bec-persistence.md) | Persistence, Collection | High | | [联合信任修改](kql/persistence/federation-trust-modification.md) | Persistence | Critical | | [添加工作负载身份联合](kql/persistence/workload-identity-federation-added.md) | Persistence | Critical | | [应用权限提升](kql/privilege-escalation/app-permission-escalation.md) | Privilege Escalation | High | | [审计日志缺失检测](kql/defense-evasion/audit-log-gap-detection.md) | Defense Evasion | High | | [批量 Graph API 枚举](kql/discovery/bulk-graph-api-enumeration.md) | Discovery | Medium | | [服务主体凭据 + API 活动](kql/lateral-movement/service-principal-credential-then-authenticate.md) | Lateral Movement | Critical | | [跨租户访客提权活动](kql/lateral-movement/cross-tenant-guest-elevated-activity.md) | Lateral Movement | High | | [BEC 对外邮件 — 支付关键词](kql/collection/bec-payment-keyword-outbound.md) | Impact | Critical | | [批量 SharePoint/OneDrive 下载](kql/collection/bulk-sharepoint-onedrive-download.md) | Collection | High | | [MailItemsAccessed 量激增](kql/collection/mailitemsaccessed-volume-spike.md) | Collection | Critical | | [勒索软件加密前指标](kql/impact/ransomware-pre-encryption-indicators.md) | Impact | Critical | | [挖矿 — 资源劫持](kql/impact/cryptomining-resource-hijacking.md) | Impact | High | | [MFA 疲劳 — 狂推通知](kql/initial-access/mfa-fatigue-push-bombing.md) | Initial Access | High | | [OAuth 设备代码钓鱼](kql/initial-access/device-code-phishing.md) | Initial Access | Critical | | [C2 Beaconing — 周期性回连](kql/command-and-control/c2-beaconing-periodic-callbacks.md) | Command and Control | High | | [域前端 — CDN 滥用](kql/command-and-control/domain-fronting-cdn-abuse.md) | Command and Control | High | | [SharePoint 外部共享激增](kql/exfiltration/sharepoint-external-sharing-spike.md) | Exfiltration | High | | [邮件自动转发到外部域](kql/exfiltration/email-autoforward-external.md) | Exfiltration | Critical | | [不可能的旅行 — 短时间内同一用户在距离遥远的国家登录](kql/initial-access/impossible-travel-signin.md) | Initial Access, Defense Evasion | High | | [允许高风险登录 — 未执行风险裁定](kql/initial-access/high-risk-signin-allowed.md) | Initial Access, Defense Evasion | High | | [单因素登录成功 — 未满足 MFA](kql/credential-access/signin-single-factor-success.md) | Credential Access, Defense Evasion | High | | [未应用 Conditional Access — 策略覆盖漏洞](kql/defense-evasion/conditional-access-not-applied.md) | Defense Evasion | Medium | ## Sigma — 厂商无关 (38) | 检测项 | 战术 | 严重程度 | |---|---|---| | [启用宏的文档生成可疑进程](sigma/execution/macro-child-process.md) | Execution | High | | [MSBuild 内联任务代码执行](sigma/execution/msbuild-inline-task.md) | Defense Evasion, Execution | High | | [具有多种规避指标的 PowerShell](sigma/execution/powershell-evasion-indicators.md) | Execution, Defense Evasion | High | | [WMIC 远程执行和侦察](sigma/execution/wmic-remote-execution-recon.md) | Execution, Lateral Movement | Medium | | [SAM 数据库转储](sigma/credential-access/sam-database-dump.md) | Credential Access | High | | [PIM 之外的特权角色分配](sigma/privilege-escalation/privileged-role-outside-pim.md) | Privilege Escalation | High | | [命名管道模拟 — Potato 家族](sigma/privilege-escalation/named-pipe-impersonation.md) | Privilege Escalation | Critical | | [AMSI 绕过 — 基于反射的内存补丁](sigma/defense-evasion/amsi-bypass-memory-patch.md) | Defense Evasion | High | | [Conditional Access 策略被削弱](sigma/defense-evasion/conditional-access-policy-weakened.md) | Defense Evasion | High | | [DLL 搜索顺序劫持](sigma/defense-evasion/dll-search-order-hijacking.md) | Defense Evasion, Persistence | High | | [ETW Provider 篡改](sigma/defense-evasion/etw-provider-tampering.md) | Defense Evasion | Critical | | [收件箱规则删除或隐藏邮件](sigma/defense-evasion/inbox-rule-hiding-email.md) | Defense Evasion | High | | [LOLBin 下载或解码](sigma/defense-evasion/lolbin-download-decode.md) | Defense Evasion, Execution | Medium | | [Timestomping — 文件时间篡改](sigma/defense-evasion/timestomping-setfiletime.md) | Defense Evasion | Medium | | [BloodHound/SharpHound AD 侦察](sigma/discovery/bloodhound-sharphound-recon.md) | Discovery | High | | [RDP 隧道 — SSH/netsh 端口转发](sigma/lateral-movement/rdp-tunneling.md) | Lateral Movement | High | | [通过计划任务、Run Key 或服务实现持久化](sigma/persistence/scheduled-task-run-key-service.md) | Persistence | Medium | | [传输规则操纵](sigma/persistence/transport-rule-manipulation.md) | Persistence, Collection | Critical | | [WMI 事件订阅持久化](sigma/persistence/wmi-event-subscription.md) | Persistence | High | | [DNS 外泄 — 高熵子域](sigma/exfiltration/dns-exfiltration-high-entropy.md) | Exfiltration | Medium | | [OneDrive 同步到非托管设备](sigma/exfiltration/onedrive-sync-unmanaged-device.md) | Exfiltration | High | | [DNS C2 — 编码子域查询](sigma/command-and-control/dns-c2-encoded-subdomains.md) | Command and Control | High | | [非标准端口 C2](sigma/command-and-control/non-standard-port-c2.md) | Command and Control | Medium | | [HTML 走私 — 浏览器释放的归档文件](sigma/initial-access/html-smuggling-browser-drop.md) | Initial Access | High | | [批量账户禁用或删除](sigma/impact/mass-account-disablement-deletion.md) | Impact | Critical | | [云权限和角色枚举](sigma/discovery/cloud-permission-enumeration.md) | Discovery | Medium | | [Linux 反弹 Shell 检测](sigma/linux/reverse-shell-detection.md) | Execution | Critical | | [Linux 提权 — SUID/Sudo/Capabilities](sigma/linux/privilege-escalation-suid-sudo.md) | Privilege Escalation | High | | [Linux 持久化 — Cron/Systemd/SSH 密钥](sigma/linux/persistence-cron-systemd-ssh.md) | Persistence | High | | [Linux 日志篡改和防御规避](sigma/linux/log-tampering-defense-evasion.md) | Defense Evasion | High | | [容器逃逸和 Docker 滥用](sigma/linux/container-escape-docker-abuse.md) | Privilege Escalation | Critical | | [Linux 内核模块和 Rootkit 指标](sigma/linux/kernel-module-rootkit-indicators.md) | Persistence, Defense Evasion | Critical | | [SSH 滥用 — 暴力破解、密钥窃取、隧道](sigma/linux/ssh-abuse-bruteforce-tunneling.md) | Lateral Movement, Credential Access | High | | [AWS 日志或检测被禁用 — CloudTrail、Config、GuardDuty](sigma/cloud/cloudtrail-logging-detection-disabled.md) | Defense Evasion | High | | [AWS IAM 身份伪造 — Create 操作爆发](sigma/cloud/iam-identity-manufacture.md) | Persistence, Privilege Escalation | High | | [无 MFA 的 AWS 控制台登录 — 单因素访问](sigma/cloud/console-login-without-mfa.md) | Initial Access, Defense Evasion | High | | [AWS RunInstances 资源劫持 — 异常计算实例启动](sigma/cloud/runinstances-resource-hijacking.md) | Impact, Defense Evasion | High | | [AWS KMS 密钥被禁用或计划删除 — 阻碍恢复](sigma/cloud/kms-key-disabled-or-deleted.md) | Impact | Critical | ## Splunk — SPL (29) | 检测项 | 战术 | 严重程度 | |---|---|---| | [允许高风险登录 — 未执行风险裁定](splunk/initial-access/high-risk-signin-allowed.md) | Initial Access, Defense Evasion | High | | [不可能的旅行 — 短时间内同一用户在距离遥远的国家登录](splunk/initial-access/impossible-travel-signin.md) | Initial Access, Defense Evasion | High | | [来自罕见源国家的登录 — 基于租户的地理异常](splunk/initial-access/signin-from-rare-source-country.md) | Initial Access, Defense Evasion | High | | [来自威胁源的入站扫描 — 边界探测](splunk/reconnaissance/inbound-scan-from-threat-source.md) | Reconnaissance | Low | | [分布式密码喷射 — 源 IP 的低速慢速攻击](splunk/credential-access/password-spray-distributed.md) | Credential Access | High | | [LSASS 凭据转储 — comsvcs MiniDump 和转储文件](splunk/credential-access/lsass-credential-dump.md) | Credential Access | Critical | | [恶意服务主体身份验证 — 来自不良来源的应用身份](splunk/credential-access/malicious-service-principal-auth.md) | Credential Access, Defense Evasion | High | | [OAuth 同意授权滥用 — 非法应用授权](splunk/credential-access/oauth-consent-grant-abuse.md) | Credential Access | High | | [无 MFA 登录成功 — 单因素云访问](splunk/credential-access/signin-success-without-mfa.md) | Credential Access, Defense Evasion | High | | [Office 应用 — 生成 Shell 或脚本宿主](splunk/execution/office-spawning-shell-child.md) | Execution | High | | [PowerShell — 编码或隐藏窗口执行](splunk/execution/encoded-or-hidden-powershell.md) | Execution, Defense Evasion | High | | [罕见进程谱系 — 全网唯一的父子进程对](splunk/execution/rare-process-lineage.md) | Execution | Medium | | [计划任务创建 — 命令行持久化](splunk/persistence/scheduled-task-creation.md) | Persistence, Privilege Escalation, Execution | Medium | | [AiTM Token 重放 — 来自外部源的声明支持登录](splunk/credential-access/aitm-token-replay.md) | Defense Evasion, Lateral Movement | Critical | | [未应用 Conditional Access — 策略覆盖漏洞](splunk/defense-evasion/conditional-access-not-applied.md) | Defense Evasion | Medium | | [LOLBin 集群 — 来自 cmd.exe 的多个已签名二进制文件](splunk/defense-evasion/lolbin-cluster-from-cmd.md) | Defense Evasion, Execution | High | | [非交互式 Token 滥用 — 从外部使用 Refresh-Token](splunk/credential-access/non-interactive-token-misuse.md) | Defense Evasion, Lateral Movement | High | | [WMIC 远程执行 — /node 进程创建](splunk/lateral-movement/wmic-remote-node-execution.md) | Lateral Movement, Execution | High | | [恶意邮箱规则 — 转发、隐藏或删除邮件](splunk/collection/mailbox-rule-creation.md) | Collection, Defense Evasion | High | | [DNS 隧道 — 每个父域的高子域量](splunk/command-and-control/dns-tunneling-subdomain-volume.md) | Command and Control | High | | [ ingress 工具传输 — 通过脚本或 LOLBin 的下载 Cradle](splunk/command-and-control/ingress-tool-download-cradle.md) | Command and Control | High | | [网络 Beaconing — 固定间隔回连](splunk/command-and-control/regular-interval-beaconing.md) | Command and Control | High | | [代理 Beaconing — 每个目标命中数的统计异常值](splunk/command-and-control/proxy-beaconing-statistical.md) | Command and Control | High | | [威胁情报匹配 — 到已知指标的外部连接](splunk/command-and-control/connection-to-threat-intel-ioc.md) | Command and Control | High | | [威胁情报匹配 — 代理和 DNS 目标](splunk/command-and-control/threatintel-proxy-dns-match.md) | Command and Control | High | | [Web 上传外泄 — 到单一目标的大量出站 POST](splunk/exfiltration/web-upload-exfiltration.md) | Exfiltration | High | | [阻碍恢复 — 卷影副本删除](splunk/impact/shadow-copy-deletion-recovery-inhibition.md) | Impact | Critical | | [身份到端点的关联 — 账户失陷并登录主机](splunk/hunting/identity-to-endpoint-correlation.md) | Multiple | High | | [多阶段攻击 — 单一主机上的 Kill-Chain 关联](splunk/hunting/multi-stage-attack-correlation.md) | | Critical | ## Athena — AWS CloudTrail SQL (21) 针对 AWS 的检测，以标准 CloudTrail、VPC Flow Log 和 S3 访问日志表上的 Athena SQL 形式编写。通过映射字段名，它们可以移植到 CloudTrail Lake 和 Security Lake。 | 检测项 | 战术 | 严重程度 | |---|---|---| | [无 MFA 控制台登录 — 单因素访问](athena/initial-access/console-login-without-mfa.md) | Initial Access, Defense Evasion | High | | [IAM 访问密钥 — 内部和外部同时使用](athena/credential-access/access-key-concurrent-internal-external.md) | Initial Access, Persistence, Privilege Escalation, Defense Evasion | High | | [控制台登录暴力破解 — 失败后成功](athena/credential-access/console-login-brute-force.md) | Credential Access | High | | [EC2 实例配置文件凭据在实例外使用 — IMDS 窃取](athena/credential-access/ec2-instance-profile-credential-exposure.md) | Credential Access | High | | [STS AssumeRole 激增 — 来自单一源的角色枚举](athena/credential-access/sts-assumerole-spike.md) | Credential Access, Privilege Escalation | High | | [Secrets Manager — 批量密钥检索](athena/credential-access/secrets-manager-bulk-access.md) | Credential Access | High | | [IAM 后门凭据 — 向主体添加密钥或登录信息](athena/persistence/iam-backdoor-credential-added.md) | Persistence | High | | [IAM 身份伪造 — Create 操作爆发](athena/persistence/iam-identity-manufacture-burst.md) | Persistence, Privilege Escalation | High | | [IAM 权限扩展 — 策略附加与版本转移](athena/privilege-escalation/iam-permission-self-expansion.md) | Privilege Escalation, Persistence | High | | [未使用区域中的活动 — 超出常规足迹的操作](athena/defense-evasion/activity-in-unused-region.md) | Defense Evasion | Medium | | [云日志和检测被禁用 — CloudTrail、Config、GuardDuty](athena/defense-evasion/cloud-logging-detection-disabled.md) | Defense Evasion | High | | [外部只读侦察 — Describe 和 List 操作爆发](athena/discovery/external-readonly-reconnaissance.md) | Discovery | Medium | | [S3 存储桶枚举 — 全账户级列表](athena/discovery/s3-bucket-enumeration.md) | Discovery | Medium | | [担任角色 — 凭据来自外部源](athena/lateral-movement/assumed-role-from-external-source.md) | Lateral Movement, Defense Evasion, Persistence | High | | [S3 批量对象读取 — 单一主体批量收集](athena/collection/s3-mass-object-read.md) | Collection | High | | [大量数据流出 — 持续出站到外部目标](athena/exfiltration/large-egress-to-external-destination.md) | Exfiltration | High | | [快照或 AMI 对外共享 — 数据转移到另一账户](athena/exfiltration/snapshot-or-ami-shared-externally.md) | Exfiltration | High | | [KMS 密钥被禁用或计划删除 — 阻碍恢复](athena/impact/kms-key-disabled-or-deleted.md) | Impact | Critical | | [RunInstances 资源劫持 — 异常计算实例启动](athena/impact/runinstances-resource-hijacking.md) | Impact, Defense Evasion | High | | [S3 批量对象删除 — 破坏性影响](athena/impact/s3-mass-object-deletion.md) | Impact | Critical | | [GuardDuty 高严重性发现 — 展示与关联](athena/hunting/guardduty-high-severity-findings.md) | Multiple | High | ## PowerShell — 调查、分诊与自动化 (19) ### 收集 (5) | 脚本 | 用例 | |---|---| | [易失性证据收集](powershell/collection/volatile-evidence-collection.md) | 首要响应人员采集：网络状态、进程、持久化、DNS 缓存 | | [浏览器 Artifact 收集](powershell/collection/browser-artifact-collection.md) | Chrome/Edge/Firefox 历史、下载、Cookie、登录元数据 | | [事件日志导出](powershell/collection/event-log-export.md) | 针对性导出安全、Sysmon、PowerShell 和 Defender 日志 | | [USB 设备历史记录](powershell/collection/usb-device-history.md) | USBSTOR 注册表、SetupAPI 日志、设备序列号 | | [KAPE 远程启动器](powershell/collection/kape-remote-launcher.md) | 通过 WinRM 或 PsExec 进行远程 KAPE 分诊收集 | ### 调查 (7) | 脚本 | 用例 | |---|---| | [Entra ID 失陷评估](powershell/investigation/entra-id-compromise-assessment.md) | 事后审计：OAuth、收件箱规则、CA 策略、凭据、角色 | | [登录日志分析](powershell/investigation/signin-log-analysis.md) | Entra ID 登录分析：不可能的旅行、MFA 绕过、风险评分 | | [同意授权审计](powershell/investigation/consent-grant-audit.md) | OAuth 同意授权清单及风险评分 | | [CA 策略评估审计](powershell/investigation/ca-policy-evaluation-audit.md) | Conditional Access 策略覆盖范围和差距分析 | | [转发和委派审计](powershell/investigation/forwarding-delegation-audit.md) | 邮箱转发、代理人、传输规则、收件箱规则 | | [服务主体凭据审计](powershell/investigation/sp-credential-audit.md) | 应用注册凭据清单、生命周期、多重凭据标记 | | [角色分配时间线](powershell/investigation/role-assignment-timeline.md) | 活动与 PIM 资格角色映射、多重角色检测 | ### 分诊 (2) | 脚本 | 用例 | |---|---| | [M365 邮箱分诊](powershell/triage/m365-mailbox-triage.md) | 快速邮箱评估：转发、规则、代理人、近期活动 | | [远程 WinRM 分诊](powershell/triage/remote-winrm-triage.md) | 远程端点分诊：进程、连接、持久化、服务 | ### 自动化 (4) | 脚本 | 用例 | |---|---| | [IR 遏制](powershell/automation/ir-containment.md) | 5 步遏制：禁用、撤销、重置、阻止、IP 封锁 | | [OAuth 同意撤销](powershell/automation/oauth-revocation.md) | 批量移除 OAuth 授权并支持试运行 | | [紧急 CA 部署](powershell/automation/emergency-ca-deployment.md) | 针对活跃事件的预置 CA 策略（旧版阻止、MFA、合规性） | | [Sentinel 富化 Playbook](powershell/automation/sentinel-enrichment-playbook.md) | 多源 IOC 富化：VirusTotal、AbuseIPDB | ### 报告 (1) | 脚本 | 用例 | |---|---| | [每周威胁狩猎报告](powershell/reporting/weekly-hunt-report.md) | Sentinel 驱动的每周报告：事件、ATT&CK 映射、热门规则、指标 | ## Velociraptor — 端点调查与狩猎 (22) ### 收集 (9) | Artifact | 用例 | |---|---| | [快速端点分诊](velociraptor/collection/rapid-endpoint-triage.md) | 60 秒分诊：进程、连接、持久化、最近文件 | | [持久化深入分析](velociraptor/collection/persistence-deep-dive.md) | Run Key、Tasks、Services、WMI、Startup、AppInit DLL、IFEO | | [浏览器凭据](velociraptor/collection/browser-credentials.md) | Chrome/Edge/Firefox 登录元数据、会话 Cookie、认证 URL | | [Prefetch 分析](velociraptor/collection/prefetch-analysis.md) | 程序执行历史及可疑模式匹配 | | [Amcache 分析](velociraptor/collection/amcache-analysis.md) | 已执行二进制文件的 SHA1 哈希（删除后仍保留） | | [USB 设备历史记录](velociraptor/collection/usb-device-history.md) | USBSTOR 注册表、挂载点、SetupAPI 日志 | | [ShellBags 分析](velociraptor/collection/shellbags-analysis.md) | 文件夹访问历史：网络共享、可移动媒体、暂存路径 | | [SRUM 分析](velociraptor/collection/srum-analysis.md) | 每个进程的网络使用情况、大容量传输检测 | | [事件日志导出](velociraptor/collection/event-log-export.md) | 根据事件 ID 和时间窗口进行针对性事件收集 | ### 狩猎 (10) | Artifact | 用例 | |---|---| | [横向移动全网狩猎](velociraptor/hunting/lateral-movement-fleet-hunt.md) | 整个网络中的远程登录、PsExec、WMI、WinRM、RDP | | [未授权软件堆叠](velociraptor/hunting/unauthorized-software-stacking.md) | 不在已批准白名单中的已安装软件和进程 | | [持久化堆叠](velociraptor/hunting/persistence-stacking.md) | 每个端点的持久化密度 — 标记统计异常值 | | [进程注入检测](velociraptor/hunting/process-injection-detection.md) | 无后备可执行内存、可疑父子进程、DLL 异常 | | [DNS 异常检测](velociraptor/hunting/dns-anomaly-detection.md) | 高熵子域、DGA 检测、TXT 隧道 | | [未签名驱动检测](velociraptor/hunting/unsigned-driver-detection.md) | 签名验证、BYOVD 哈希匹配、异常路径 | | [WMI 持久化检测](velociraptor/hunting/wmi-persistence-detection.md) | 事件消费者、过滤器、绑定及其风险分类 | | [证书异常检测](velociraptor/hunting/certificate-anomaly-detection.md) | 自签名根 CA、弱密钥、最近添加的证书 | | [凭据工具检测](velociraptor/hunting/credential-tool-detection.md) | 跨 Prefetch、Amcache、文件系统、内存检测 Mimikatz/Rubeus/LaZagne | | [数据暂存检测](velociraptor/investigation/data-staging-detection.md) | 异常位置的归档文件、压缩工具使用 | ### 调查 (4) | Artifact | 用例 | |---|---| | [时间线构建](velociraptor/investigation/timeline-construction.md) | 来自 EventLog、Prefetch、Amcache 和 Sysmon 的统一时间线 | | [用户活动重建](velociraptor/investigation/user-activity-reconstruction.md) | 最近文件、UserAssist、PS 历史记录、浏览器、键入路径 | | [勒索软件影响评估](velociraptor/investigation/ransomware-impact-assessment.md) | 加密文件扫描、勒索信、卷影副本、恢复状态 | | [数据暂存检测](velociraptor/investigation/data-staging-detection.md) | 暂存位置的归档文件、近期大文件、压缩 | ## YARA — 恶意软件与 Artifact 分类 (5) | 规则 | 目标 | 严重程度 | |---|---|---| | [Cobalt Strike Beacon](yara/malware/cobalt-strike-beacon.md) | Beacon 配置、命名管道、睡眠掩码、反射加载器 | Critical | | [开源 C2 Implant](yara/malware/open-source-c2-implants.md) | Sliver、Mythic (Apollo/Poseidon)、Havoc Demon 代理 | Critical | | [凭据收集工具](yara/malware/credential-harvesting-tools.md) | Mimikatz、Rubeus、SharpHound、LaZagne、LSASS 转储器 | Critical | | [Webshell 检测](yara/webshells/webshell-php-aspx-jsp.md) | PHP、ASPX 和 JSP webshell — eval、exec、已知 shell | Critical | | [可疑 PE 特征](yara/suspicious-pe/suspicious-pe-characteristics.md) | 高熵、加壳区段、缺失导入、时间戳异常 | Medium | ## Suricata — 网络 IDS (6) | 规则集 | 目标 | 严重程度 | |---|---|---| | [C2 HTTP Beaconing](suricata/command-and-control/c2-http-beaconing.md) | Cobalt Strike/Sliver 默认配置文件、周期性回调、Base64 POST | High | | [DNS 隧道](suricata/command-and-control/dns-tunneling-detection.md) | 长子域、高频 TXT 查询、编码标签 | High | | [反弹 Shell 网络检测](suricata/command-and-control/reverse-shell-detection.md) | 交互式 Shell 提示符、/dev/tcp 模式、Python shell、常见端口 | Critical | | [SMB 横向移动](suricata/lateral-movement/smb-lateral-movement.md) | PsExec、admin share 写入、Impacket 管道、可执行文件传输 | High | | [网络凭据窃取](suricata/credential-access/network-credential-theft.md) | NTLM 中继、LDAP 明文、Responder/LLMNR、Kerberoasting、DCSync | Critical | | [数据外泄](suricata/exfiltration/network-data-exfiltration.md) | 大量 POST 上传、文件共享服务、FTP、ICMP 隧道 | Medium | ## osquery — 跨平台端点 (7) | 查询包 | 平台 | 用例 | |---|---|---| | [Linux 持久化检测](osquery/persistence/linux-persistence-detection.md) | Linux | Cron、systemd、SSH 密钥、Shell 配置文件、LD_PRELOAD、init 脚本 | | [跨平台进程与网络狩猎](osquery/hunting/cross-platform-process-network.md) | All | 外部连接、临时目录进程、可疑父子进程、挖矿 | | [Linux 易失性证据收集](osquery/collection/linux-volatile-evidence.md) | Linux | 进程、连接、用户、打开的文件、内核模块、DNS 配置 | | [跨平台资产盘点](osquery/discovery/cross-platform-asset-inventory.md) | All | 软件包、用户、组、监听器、系统信息、启动项 | | [SUID 二进制文件和 Capability 狩猎](osquery/linux-hunting/suid-capability-hunting.md) | Linux | SUID 审计、GTFOBins 候选、capabilities、全局可写文件 | | [容器和 Docker 安全审计](osquery/linux-hunting/container-docker-security.md) | Linux | 特权容器、Socket 挂载、主机 namespace、镜像清单 | | [文件完整性和 Rootkit 检测](osquery/linux-hunting/file-integrity-rootkit-detection.md) | Linux | 二进制哈希、隐藏文件、LD_PRELOAD、PAM审计、/etc 监控 | ## 格式 每项检测都遵循[标准格式](DETECTION-FORMAT.md)。贡献内容必须包含所有必填字段。 ## 培训 每项检测都映射到 [Ridgeline Cyber 培训平台](https://ridgelinecyber.com/training) 中的一个模块。检测为您提供查询语句。而培训则赋予您在整个环境中编写、调优和操作检测的能力。 - [检测工程](https://ridgelinecyber.com/training/courses/detection-engineering/) — 规则架构、威胁建模、检测生命周期 - [SOC 运营](https://ridgelinecyber.com/training/courses/m365-security-operations/) — 调查 Playbook、警报分诊、响应措施 - [威胁狩猎](https://ridgelinecyber.com/training/courses/threat-hunting-m365/) — 使用 KQL 和 VQL 进行假设驱动狩猎 - [事件响应](https://ridgelinecyber.com/training/courses/practical-ir/) — 遏制、调查和恢复 - [面向防守者的进攻安全](https://ridgelinecyber.com/training/courses/offensive-security-for-defenders/) — 攻击技术及其检测方法 - [紫队运营](https://ridgelinecyber.com/training/courses/purple-teaming-for-blue-teams/) — 技术验证和检测覆盖率 - [Windows 取证](https://ridgelinecyber.com/training/courses/windows-endpoint-investigation/) — Artifact 分析和时间线构建 - [Linux IR](https://ridgelinecyber.com/training/courses/linux-endpoint-investigation/) — Linux 持久化、易失性证据和进程取证 - [网络检测与取证](https://ridgelinecyber.com/training/courses/network-detection-forensics/) — 网络协议分析和 IDS 规则 - [Entra ID 安全](https://ridgelinecyber.com/training/courses/entra-id-security/) — 身份检测、Conditional Access、PIM 治理 - [AWS 事件检测与响应](https://ridgelinecyber.com/training/courses/aws-detection-and-response/): 基于 CloudTrail 的检测、IAM 攻击路径和云事件响应 - [Splunk 检测与事件响应](https://ridgelinecyber.com/training/courses/splunk-detection-and-response/): SPL 检测工程、CIM 数据模型和调查 - [YARA](https://ridgelinecyber.com/training/courses/yara-rule-writing/) — 用于恶意软件分类的规则开发 - [恶意软件分诊](https://ridgelinecyber.com/training/courses/malware-triage/) — 静态和动态分析基础 每门课程均提供免费模块。无需注册账号即可开始学习。 ## 许可证 [Apache 2.0](LICENSE) — 在您的环境中部署这些检测，进行修改并自由分享。 由 [Ridgeline Cyber](https://ridgelinecyber.com/training) 构建 — 我们是在生产环境中构建检测，并教导他人也这样做的从业者。

标签：AI合规, AMSI绕过, KQL, Metaprompt, 威胁检测, 安全运营, 扫描框架, 搜索语句（dork）