cybersagnik/detect-lab-ci
GitHub: cybersagnik/detect-lab-ci
一个基于 GitHub Actions 的检测即代码流水线，将 Sigma 规则通过 EVTX 遥测验证后自动转换为 Sentinel 和 Splunk 查询，并追踪 MITRE ATT&CK 覆盖率。
Stars: 0 | Forks: 0
# DetectLab-CI
**将 Sigma 规则转换为 SIEM 查询的“检测即代码”流水线，在 CI 中通过真实的 EVTX 遥测数据验证它们，并自动追踪 ATT&CK 覆盖率。**
[](https://github.com/cybersagnik/detect-lab-ci/actions)
## 概述
DetectLab-CI 是一个 GitHub 原生的检测工程工作流：
1. 使用 `sigma check` 对每个 Sigma 规则进行 **Lint 检查**。
2. 针对 [sbousseaden/EVTX-ATTACK-SAMPLES](https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES) 数据集 **验证** 每个规则 —— 如果检测率降至 **80 %** 以下，CI 将会失败。
3. 通过带有 Sysmon pipeline 的 `sigma-cli` 将每个规则 **转换** 为 KQL (Microsoft Sentinel) 和 SPL (Splunk)，然后自动将重新生成的查询提交回 `master` 分支。
4. **发布** [ATT&CK Navigator](https://mitre-attack.github.io/attack-navigator/) 图层和差距报告，以便在每个 PR 中都能看到覆盖率偏差。
实验室环境：运行 Sysmon (SwiftOnSecurity) + Wazuh Agent 的 Windows 10 虚拟机，以及在 WSL2 Ubuntu 上运行的 Wazuh 4.x Manager/Indexer/Dashboard。对手模拟使用通过 `Invoke-AtomicRedTeam` 运行的 Atomic Red Team。
## 仓库结构
```
detect-lab-ci/
├── sigma-rules/windows/ ← 14 hand-authored Sigma rules
│ ├── credential_access/ (1 rule)
│ ├── defence_evasion/ (3 rules — British spelling)
│ ├── discovery/ (3 rules)
│ ├── execution/ (3 rules)
│ ├── persistence/ (3 rules)
│ └── privilege_escalation/ (1 rule)
├── converted/ ← auto-generated by CI
│ ├── kql/windows//.txt
│ └── spl/windows//.txt
├── navigator/coverage_layer.json ← ATT&CK Navigator layer
├── docs/
│ ├── atomic-results.md ← ART validation log (14/14 fired)
│ ├── gap_report.md ← coverage gap report (auto-generated)
│ ├── images/ ← Wazuh alert + Navigator + CI screenshots
│ └── rules_rationale/ ← one .md per validated rule
├── scripts/
│ ├── test_runner.py ← EVTX test runner (93% gate)
│ ├── coverage_mapper.py ← ATT&CK Navigator layer generator
│ ├── gap_analysis.py ← gap report generator
│ └── requirements.txt
├── tests/test_coverage_mapper.py ← 31 regression tests
├── .github/workflows/detect-ci.yml ← single CI pipeline
└── EVTX-ATTACK-SAMPLES/ ← submodule (sbousseaden)
```
## 架构
```
flowchart LR
R["Sigma Rules
sigma-rules/windows"] --> CI["GitHub Actions CI"] CI --> L["Lint
sigma check"] CI --> T["EVTX Tests
93% gate (>= 80%)"] CI --> C["Convert"] C --> K["KQL
converted/kql/"] C --> S["SPL
converted/spl/"] K --> A["Auto-commit
back to master"] S --> A CI --> M["Coverage Layer
coverage_mapper.py"] CI --> G["Gap Analysis
gap_analysis.py"] M --> NAV["navigator/
coverage_layer.json"] G --> GAP["docs/
gap_report.md"] ART["Atomic Red Team
Invoke-AtomicRedTeam"] --> VM["Windows 10 VM
Sysmon + Wazuh Agent"] VM --> WSL["WSL2 Ubuntu
Wazuh 4.x Manager/Indexer"] K --> SIEM1["Microsoft Sentinel"] S --> SIEM2["Splunk"] WSL -. alerts .-> SIEM1 WSL -. alerts .-> SIEM2 ``` ## 指标概览 | 指标 | 数值 | |---|---| | Sigma 规则 | **14** | | 覆盖的 MITRE 子技术 | **13** | | 覆盖的 ATT&CK 父技术 | **12 / 176** 项 Windows 技术 (**6.82 %**) | | 覆盖的 MITRE 战术 | **6 / 14** | | EVTX 检测率 | **93 %** (13 / 14 通过，≥ 80 % 门槛) | | Atomic Red Team 验证 | **14 / 14** 条规则在 Wazuh 中触发 | | 生成的 KQL 查询 | 14 | | 生成的 SPL 查询 | 14 | | ATT&CK Navigator 格式 | 4.5 | | ATT&CK 版本 | 19 | ## 检测覆盖率 每个规则都位于 `sigma-rules/` 中，由 `scripts/test_runner.py` 针对 EVTX-ATTACK-SAMPLES 子模块执行测试，通过 CI 转换为 KQL 和 SPL，并在实验室中针对 Atomic Red Team 进行验证。 | # | 战术 | 规则 | 技术 | 主要 EID | ART | EVTX | |---|---|---|---|---|---|---| | 1 | execution | `powershell_encoded_command.yml` | T1059.001 — PowerShell | Sysmon 1 | ✓ | ✗ | | 2 | execution | `powershell_download_cradle.yml` | T1059.001 — PowerShell | PS 4104 | ✓ | ✓ | | 3 | execution | `wmic_process_creation.yml` | T1047 — WMI | Sysmon 1 | ✓ | ✓ | | 4 | persistence | `scheduled_task_creation.yml` | T1053.005 — Scheduled Task | Sysmon 1 / Sec 4698 | ✓ | ✓ | | 5 | persistence | `registry_run_key_persistence.yml` | T1547.001 — Registry Run Keys | Sysmon 13 (`registry_set`) | ✓ | ✓ | | 6 | persistence | `wmi_event_subscription.yml` | T1546.003 — WMI Event Subscription | Sysmon 19/20/21 | ✓ | ✓ | | 7 | credential_access | `lsass_process_access.yml` | T1003.001 — LSASS Memory | Sysmon 10 | ✓ | ✓ | | 8 | privilege_escalation | `uac_bypass_fodhelper.yml` | T1548.002 — UAC Bypass | Sysmon 1 | ✓ | ✓ | | 9 | discovery | `network_config_discovery.yml` | T1016 — Network Config Discovery | Sysmon 1 | ✓ | ✓ | | 10 | discovery | `process_discovery_tasklist.yml` | T1057 — Process Discovery | Sysmon 1 | ✓ | ✓ | | 11 | discovery | `systeminfo_execution.yml` | T1082 — System Info Discovery | Sysmon 1 | ✓ | ✓ | | 12 | defence_evasion | `certutil_decode.yml` | T1140 — Deobfuscate/Decode | Sysmon 1 | ✓ | ✓ | | 13 | defence_evasion | `mshta_proxy_execution.yml` | T1218.005 — Mshta | Sysmon 1 | ✓ | ✓ | | 14 | defence_evasion | `regsvr32_proxy_execution.yml` | T1218.010 — Regsvr32 | Sysmon 1 | ✓ | ✓ | 唯一一项失败的 EVTX 测试是 `powershell_encoded_command` —— 运行器将其映射到了一个不包含 `-EncodedCommand` 调用的单一样本。该规则是正确的（已由 ART 验证）；EVTX 映射是缺陷所在。 ## ATT&CK Navigator 图层 `navigator/coverage_layer.json` 会在每次推送时重新生成。在 [MITRE ATT&CK Navigator](https://mitre-attack.github.io/attack-navigator/) 中打开它（`domain = enterprise-attack`，`versions.attack = 19`，`versions.navigator = 4.9`）—— 每个被覆盖的子技术都会显示为绿色 (`#1d9e75`)，并且父级行可以展开以显示每个子项。  图层细分：共 **20** 个条目 —— **7** 个父级框架 (`T1003`, `T1053`, `T1059`, `T1218`, `T1546`, `T1547`, `T1548`) 以及 **13** 个带颜色的叶子条目。 ## 快速开始 ``` # 1. 作为 submodule 克隆包含 EVTX 测试数据集的仓库 git clone --recursive https://github.com/cybersagnik/detect-lab-ci.git cd detect-lab-ci # 2. 安装 Python deps (sigma-cli、backends、EVTX parser、pyyaml) pip install -r scripts/requirements.txt # 3. 针对 EVTX-ATTACK-SAMPLES 验证所有 14 条 rules python scripts/test_runner.py # 4. 将每条 Sigma rule 转换为 KQL (Sentinel) 和 SPL (Splunk) sigma convert -t kusto -p sysmon sigma-rules/windows -o converted/kql sigma convert -t splunk -p sysmon sigma-rules/windows -o converted/spl # 5. 重新生成 ATT&CK Navigator layer python scripts/coverage_mapper.py ``` `步骤 3` 会输出检测率 —— 与 CI 的逻辑相同。执行 `步骤 5` 后，在 Navigator 中打开 `navigator/coverage_layer.json` 即可渲染热力图。 ## 实验室验证结果 已针对实验室环境进行端到端验证 —— 完整的截图和字段观察记录在 [`docs/atomic-results.md`](docs/atomic-results.md) 中。 | # | 技术 | ART 测试 | Wazuh 告警 | 主要 EID | 原理 | |---|---|---|---|---|---| | 1 | T1059.001 — Encoded PowerShell | `T1059.001-17` | ✓ | Sysmon 1 | [链接](docs/rules_rationale/T1059.001.md) | | 2 | T1053.005 — Scheduled Task via schtasks | `T1053.005-1` | ✓ | Sysmon 1 | [链接](docs/rules_rationale/T1053.005.md) | | 3 | T1003.001 — LSASS Memory Access | `T1003.001-1` | ✓ | Sysmon 10 | [链接](docs/rules_rationale/T1003.001.md) | | 4 | T1547.001 — Registry Run Key Persistence | `T1547.001-1` | ✓ | Sysmon 13 | [链接](docs/rules_rationale/T1547.001.md) | | 5 | T1548.002 — UAC Bypass (fodhelper) | `T1548.002-3` | ✓ | Sysmon 1 | [链接](docs/rules_rationale/T1548.002.md) | | 6 | T1016 — Network Config Discovery | `T1016-1` | ✓ | Sysmon 1 | [链接](docs/rules_rationale/T1016.md) | | 7 | T1047 — WMIC Process Creation | `T1047-5` | ✓ | Sysmon 1 | [链接](docs/rules_rationale/T1047.md) | | 8 | T1057 — Process Discovery (tasklist) | `T1057-2` | ✓ | Sysmon 1 | [链接](docs/rules_rationale/T1057.md) | | 9 | T1059.001 — PowerShell Download Cradle | `T1059.001-1` | ✓ | PS 4104 | [链接](docs/rules_rationale/T1059.001-DL.md) | | 10 | T1082 — System Information Discovery | `T1082-1` | ✓ | Sysmon 1 | [链接](docs/rules_rationale/T1082.md) | | 11 | T1140 — Certutil Encode/Decode | `T1140-1` | ✓ | Sysmon 1 | [链接](docs/rules_rationale/T1140.md) | | 12 | T1218.005 — Mshta Proxy Execution | `T1218.005-1` | ✓ | Sysmon 1 | [链接](docs/rules_rationale/T1218.005.md) | | 13 | T1218.010 — Regsvr32 Proxy Execution | `T1218.010-1` | ✓ | Sysmon 1 | [链接](docs/rules_rationale/T1218.010.md) | | 14 | T1546.003 — WMI Event Subscription | `T1546.003-1` | ✓ | Sysmon 20 | [链接](docs/rules_rationale/T1546.003.md) | **总计通过 ART 验证的规则：14 / 14。** 每个规则对应的 Wazuh 仪表板截图位于 [`docs/images/`](docs/images/) 中。 ## Sigma → SIEM 查询示例 `sigma-rules/windows/persistence/registry_run_key_persistence.yml` (T1547.001) —— 检测被设置的 Run-key 值，过滤掉已知安全的软件，并可顺畅地转换为两种后端。 ### Sigma（事实来源） ``` title: Registry Run Key Persistence - Low FP logsource: category: registry_set product: windows detection: selection: TargetObject|contains: - '\Software\Microsoft\Windows\CurrentVersion\Run' - '\Software\Microsoft\Windows\CurrentVersion\RunOnce' EventType: 'SetValue' filter_known_good: Details|contains: - 'OneDrive' - 'SecurityHealth' - 'Windows Defender' - 'Teams' - 'AdobeGCInvoker' condition: selection and not filter_known_good tags: - attack.persistence - attack.t1547.001 ``` ### KQL (Microsoft Sentinel) — `converted/kql/windows/persistence/registry_run_key_persistence.txt` ``` EventID == 13 and (((TargetObject contains "\\Software\\Microsoft\\Windows\\CurrentVersion\\Run" or TargetObject contains "\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce") and EventType =~ "SetValue") and (not((Details contains "OneDrive" or Details contains "SecurityHealth" or Details contains "Windows Defender" or Details contains "Teams" or Details contains "AdobeGCInvoker")))) ``` ### SPL (Splunk) — `converted/spl/windows/persistence/registry_run_key_persistence.txt` ``` EventID=13 (TargetObject="*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run*" OR TargetObject="*\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce*") EventType="SetValue" NOT (Details="*OneDrive*" OR Details="*SecurityHealth*" OR Details="*Windows Defender*" OR Details="*Teams*" OR Details="*AdobeGCInvoker*") ``` 同一个规则，适用于两种 SIEM，并在每次推送时重新生成。 ## CI 流水线截图  流水线定义：[`.github/workflows/detect-ci.yml`](.github/workflows/detect-ci.yml)。 ## 添加新规则 1. 将 `.yml` 文件放入 `sigma-rules/windows//` 目录下。
2. 在 `scripts/test_runner.py` 中追加一个 `RULE_TO_EVTX` 条目，并至少包含一个 EVTX 路径。
3. 在本地运行 `python scripts/test_runner.py` —— 确认通过。
4. 在 `docs/rules_rationale/T####.md` 下添加一份原理说明文档。
5. 提交一个 PR —— CI 将会执行 Lint 检查、EVTX 测试、转换，并重新生成 Navigator 图层和差距报告。
## 致谢
- EVTX 测试数据集：[sbousseaden/EVTX-ATTACK-SAMPLES](https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES)。
- 对手模拟：[Atomic Red Team](https://github.com/redcanaryco/atomic-red-team)。
- Sigma 工具链：[SigmaHQ/pySigma](https://github.com/SigmaHQ/pySigma)。
- ATT&CK 可视化：[MITRE ATT&CK Navigator](https://github.com/mitre-attack/attack-navigator)。
- 实验室 SIEM：运行于 WSL2 Ubuntu 上的 [Wazuh](https://wazuh.com/) 4.x。
sigma-rules/windows"] --> CI["GitHub Actions CI"] CI --> L["Lint
sigma check"] CI --> T["EVTX Tests
93% gate (>= 80%)"] CI --> C["Convert"] C --> K["KQL
converted/kql/"] C --> S["SPL
converted/spl/"] K --> A["Auto-commit
back to master"] S --> A CI --> M["Coverage Layer
coverage_mapper.py"] CI --> G["Gap Analysis
gap_analysis.py"] M --> NAV["navigator/
coverage_layer.json"] G --> GAP["docs/
gap_report.md"] ART["Atomic Red Team
Invoke-AtomicRedTeam"] --> VM["Windows 10 VM
Sysmon + Wazuh Agent"] VM --> WSL["WSL2 Ubuntu
Wazuh 4.x Manager/Indexer"] K --> SIEM1["Microsoft Sentinel"] S --> SIEM2["Splunk"] WSL -. alerts .-> SIEM1 WSL -. alerts .-> SIEM2 ``` ## 指标概览 | 指标 | 数值 | |---|---| | Sigma 规则 | **14** | | 覆盖的 MITRE 子技术 | **13** | | 覆盖的 ATT&CK 父技术 | **12 / 176** 项 Windows 技术 (**6.82 %**) | | 覆盖的 MITRE 战术 | **6 / 14** | | EVTX 检测率 | **93 %** (13 / 14 通过，≥ 80 % 门槛) | | Atomic Red Team 验证 | **14 / 14** 条规则在 Wazuh 中触发 | | 生成的 KQL 查询 | 14 | | 生成的 SPL 查询 | 14 | | ATT&CK Navigator 格式 | 4.5 | | ATT&CK 版本 | 19 | ## 检测覆盖率 每个规则都位于 `sigma-rules/` 中，由 `scripts/test_runner.py` 针对 EVTX-ATTACK-SAMPLES 子模块执行测试，通过 CI 转换为 KQL 和 SPL，并在实验室中针对 Atomic Red Team 进行验证。 | # | 战术 | 规则 | 技术 | 主要 EID | ART | EVTX | |---|---|---|---|---|---|---| | 1 | execution | `powershell_encoded_command.yml` | T1059.001 — PowerShell | Sysmon 1 | ✓ | ✗ | | 2 | execution | `powershell_download_cradle.yml` | T1059.001 — PowerShell | PS 4104 | ✓ | ✓ | | 3 | execution | `wmic_process_creation.yml` | T1047 — WMI | Sysmon 1 | ✓ | ✓ | | 4 | persistence | `scheduled_task_creation.yml` | T1053.005 — Scheduled Task | Sysmon 1 / Sec 4698 | ✓ | ✓ | | 5 | persistence | `registry_run_key_persistence.yml` | T1547.001 — Registry Run Keys | Sysmon 13 (`registry_set`) | ✓ | ✓ | | 6 | persistence | `wmi_event_subscription.yml` | T1546.003 — WMI Event Subscription | Sysmon 19/20/21 | ✓ | ✓ | | 7 | credential_access | `lsass_process_access.yml` | T1003.001 — LSASS Memory | Sysmon 10 | ✓ | ✓ | | 8 | privilege_escalation | `uac_bypass_fodhelper.yml` | T1548.002 — UAC Bypass | Sysmon 1 | ✓ | ✓ | | 9 | discovery | `network_config_discovery.yml` | T1016 — Network Config Discovery | Sysmon 1 | ✓ | ✓ | | 10 | discovery | `process_discovery_tasklist.yml` | T1057 — Process Discovery | Sysmon 1 | ✓ | ✓ | | 11 | discovery | `systeminfo_execution.yml` | T1082 — System Info Discovery | Sysmon 1 | ✓ | ✓ | | 12 | defence_evasion | `certutil_decode.yml` | T1140 — Deobfuscate/Decode | Sysmon 1 | ✓ | ✓ | | 13 | defence_evasion | `mshta_proxy_execution.yml` | T1218.005 — Mshta | Sysmon 1 | ✓ | ✓ | | 14 | defence_evasion | `regsvr32_proxy_execution.yml` | T1218.010 — Regsvr32 | Sysmon 1 | ✓ | ✓ | 唯一一项失败的 EVTX 测试是 `powershell_encoded_command` —— 运行器将其映射到了一个不包含 `-EncodedCommand` 调用的单一样本。该规则是正确的（已由 ART 验证）；EVTX 映射是缺陷所在。 ## ATT&CK Navigator 图层 `navigator/coverage_layer.json` 会在每次推送时重新生成。在 [MITRE ATT&CK Navigator](https://mitre-attack.github.io/attack-navigator/) 中打开它（`domain = enterprise-attack`，`versions.attack = 19`，`versions.navigator = 4.9`）—— 每个被覆盖的子技术都会显示为绿色 (`#1d9e75`)，并且父级行可以展开以显示每个子项。  图层细分：共 **20** 个条目 —— **7** 个父级框架 (`T1003`, `T1053`, `T1059`, `T1218`, `T1546`, `T1547`, `T1548`) 以及 **13** 个带颜色的叶子条目。 ## 快速开始 ``` # 1. 作为 submodule 克隆包含 EVTX 测试数据集的仓库 git clone --recursive https://github.com/cybersagnik/detect-lab-ci.git cd detect-lab-ci # 2. 安装 Python deps (sigma-cli、backends、EVTX parser、pyyaml) pip install -r scripts/requirements.txt # 3. 针对 EVTX-ATTACK-SAMPLES 验证所有 14 条 rules python scripts/test_runner.py # 4. 将每条 Sigma rule 转换为 KQL (Sentinel) 和 SPL (Splunk) sigma convert -t kusto -p sysmon sigma-rules/windows -o converted/kql sigma convert -t splunk -p sysmon sigma-rules/windows -o converted/spl # 5. 重新生成 ATT&CK Navigator layer python scripts/coverage_mapper.py ``` `步骤 3` 会输出检测率 —— 与 CI 的逻辑相同。执行 `步骤 5` 后，在 Navigator 中打开 `navigator/coverage_layer.json` 即可渲染热力图。 ## 实验室验证结果 已针对实验室环境进行端到端验证 —— 完整的截图和字段观察记录在 [`docs/atomic-results.md`](docs/atomic-results.md) 中。 | # | 技术 | ART 测试 | Wazuh 告警 | 主要 EID | 原理 | |---|---|---|---|---|---| | 1 | T1059.001 — Encoded PowerShell | `T1059.001-17` | ✓ | Sysmon 1 | [链接](docs/rules_rationale/T1059.001.md) | | 2 | T1053.005 — Scheduled Task via schtasks | `T1053.005-1` | ✓ | Sysmon 1 | [链接](docs/rules_rationale/T1053.005.md) | | 3 | T1003.001 — LSASS Memory Access | `T1003.001-1` | ✓ | Sysmon 10 | [链接](docs/rules_rationale/T1003.001.md) | | 4 | T1547.001 — Registry Run Key Persistence | `T1547.001-1` | ✓ | Sysmon 13 | [链接](docs/rules_rationale/T1547.001.md) | | 5 | T1548.002 — UAC Bypass (fodhelper) | `T1548.002-3` | ✓ | Sysmon 1 | [链接](docs/rules_rationale/T1548.002.md) | | 6 | T1016 — Network Config Discovery | `T1016-1` | ✓ | Sysmon 1 | [链接](docs/rules_rationale/T1016.md) | | 7 | T1047 — WMIC Process Creation | `T1047-5` | ✓ | Sysmon 1 | [链接](docs/rules_rationale/T1047.md) | | 8 | T1057 — Process Discovery (tasklist) | `T1057-2` | ✓ | Sysmon 1 | [链接](docs/rules_rationale/T1057.md) | | 9 | T1059.001 — PowerShell Download Cradle | `T1059.001-1` | ✓ | PS 4104 | [链接](docs/rules_rationale/T1059.001-DL.md) | | 10 | T1082 — System Information Discovery | `T1082-1` | ✓ | Sysmon 1 | [链接](docs/rules_rationale/T1082.md) | | 11 | T1140 — Certutil Encode/Decode | `T1140-1` | ✓ | Sysmon 1 | [链接](docs/rules_rationale/T1140.md) | | 12 | T1218.005 — Mshta Proxy Execution | `T1218.005-1` | ✓ | Sysmon 1 | [链接](docs/rules_rationale/T1218.005.md) | | 13 | T1218.010 — Regsvr32 Proxy Execution | `T1218.010-1` | ✓ | Sysmon 1 | [链接](docs/rules_rationale/T1218.010.md) | | 14 | T1546.003 — WMI Event Subscription | `T1546.003-1` | ✓ | Sysmon 20 | [链接](docs/rules_rationale/T1546.003.md) | **总计通过 ART 验证的规则：14 / 14。** 每个规则对应的 Wazuh 仪表板截图位于 [`docs/images/`](docs/images/) 中。 ## Sigma → SIEM 查询示例 `sigma-rules/windows/persistence/registry_run_key_persistence.yml` (T1547.001) —— 检测被设置的 Run-key 值，过滤掉已知安全的软件，并可顺畅地转换为两种后端。 ### Sigma（事实来源） ``` title: Registry Run Key Persistence - Low FP logsource: category: registry_set product: windows detection: selection: TargetObject|contains: - '\Software\Microsoft\Windows\CurrentVersion\Run' - '\Software\Microsoft\Windows\CurrentVersion\RunOnce' EventType: 'SetValue' filter_known_good: Details|contains: - 'OneDrive' - 'SecurityHealth' - 'Windows Defender' - 'Teams' - 'AdobeGCInvoker' condition: selection and not filter_known_good tags: - attack.persistence - attack.t1547.001 ``` ### KQL (Microsoft Sentinel) — `converted/kql/windows/persistence/registry_run_key_persistence.txt` ``` EventID == 13 and (((TargetObject contains "\\Software\\Microsoft\\Windows\\CurrentVersion\\Run" or TargetObject contains "\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce") and EventType =~ "SetValue") and (not((Details contains "OneDrive" or Details contains "SecurityHealth" or Details contains "Windows Defender" or Details contains "Teams" or Details contains "AdobeGCInvoker")))) ``` ### SPL (Splunk) — `converted/spl/windows/persistence/registry_run_key_persistence.txt` ``` EventID=13 (TargetObject="*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run*" OR TargetObject="*\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce*") EventType="SetValue" NOT (Details="*OneDrive*" OR Details="*SecurityHealth*" OR Details="*Windows Defender*" OR Details="*Teams*" OR Details="*AdobeGCInvoker*") ``` 同一个规则，适用于两种 SIEM，并在每次推送时重新生成。 ## CI 流水线截图  流水线定义：[`.github/workflows/detect-ci.yml`](.github/workflows/detect-ci.yml)。 ## 添加新规则 1. 将 `.yml` 文件放入 `sigma-rules/windows/
标签：PB级数据处理, Reconnaissance, Wazuh, 安全检测工程, 安全运维, 开源框架, 持续集成, 逆向工具