nabumarduk/detection-lab

# detection-lab 一个经过实验室验证的 **Sigma 检测库**。这里的每一条规则的构建方式，都与检测工程师在生产环境中构建规则的方式完全相同：选择一种技术，进行模拟，观察其产生的遥测数据，编写检测，验证其是否触发，将其转换为目标查询语言，并编写文档——包括误报和盲区。 规则只需使用与厂商无关的 **Sigma** 编写一次，即可通过 `sigma-cli` 编译为 **Microsoft Defender XDR / Sentinel KQL**、**Splunk SPL**，以及（针对网络遥测规则）**Elastic Lucene**，因此同一套检测可以部署到多个平台。 ## 检测工程闭环 `detections/` 中的每一个检测都是由这个闭环产生的——整个规范只需六个步骤： 1. **选择**一个要覆盖的 ATT&CK 技术。 2. 使用 [Atomic Red Team](https://github.com/redcanaryco/atomic-red-team) 在 Windows 受害者虚拟机上安全地**模拟**它。 3. **观察**它生成的遥测数据（Sysmon / Windows 安全 / PowerShell 日志）。 4. 针对这些字段**编写** Sigma 规则。 5. **验证**它是否能针对捕获的日志触发——并检查它*遗漏*了什么，以及捕捉到了哪些正常行为。 6. **转换 + 记录**——编译为 KQL，映射到 ATT&CK，记录误报和调整。 重点不在于规则本身。而在于证明该行为是可检测的，并确切知道检测能看到什么、看不到什么。 ## 实验环境 | 层级 | 构建 | |---|---| | Hypervisor | Proxmox VE | | 网络 | OPNsense VLAN 间防火墙；隔离的 VLAN（攻击 / 受害者 / 监控） | | 受害者 | Windows + **Sysmon**（经过审查的配置）+ 高级审计策略 + PowerShell 日志记录 | | 攻击 | Atomic Red Team (`Invoke-AtomicTest`) | | SIEM / 验证 | Wazuh（自托管）—— 常驻验证引擎 | | 转换 | `sigma-cli` + `pysigma-backend-kusto` → Defender XDR / Sentinel KQL | 基于自建 SIEM 保持了实验室的免费性；以 Sigma 作为源意味着相同的规则仍然可以为 SC-200 / 生产环境编译为 Sentinel KQL。 ## 工具 - **Sigma** —— 厂商无关的检测语言（事实来源）。 - **sigma-cli** + **pysigma** 后端 —— `sigma convert -t kusto -p sysmon -p microsoft_xdr `（需要 Python 3.10+）。 - **Atomic Red Team** —— ATT&CK 映射的模拟。 ## 仓库结构 ``` detection-lab/ ├── detections/ # Sigma rules (source of truth) │ ├── host// # host-telemetry rules (Sysmon / Windows event logs) │ ├── network// # network-telemetry rules (Zeek conn/dns) │ └── _TEMPLATE.yml # clone this to start a new rule ├── docs/ │ ├── workflow.md # the loop + lab setup + how to add a detection │ └── detections/ # per-detection write-up (emulation → telemetry → KQL → FP) ├── emulation/ # Atomic Red Team commands per technique ├── converted/ # generated queries (committed so reviewers see output) │ ├── defender_xdr/ # KQL │ ├── splunk/ # SPL │ └── elastic/ # Lucene (network rules only) ├── wazuh/ # Wazuh local_rules XML — always-on lab validation ├── coverage/coverage.md # ATT&CK coverage index ├── scripts/ # consistency checker (rule ↔ doc ↔ README ↔ coverage) ├── .github/workflows/ # validate on PR + auto-convert on main ├── convert.sh # compile all rules └── requirements.txt ``` ## 使用方法 ``` python -m pip install -r requirements.txt # Python 3.10+ ./convert.sh # compile every rule to KQL + SPL (+ Lucene for network rules) # 或单个规则： sigma convert -t kusto -p sysmon -p microsoft_xdr detections/host/execution/t1059_001_powershell_download_cradle.yml ``` ## 检测规则 **43 条规则** —— `detections/host/` (39) + `detections/network/` (4)，下方按 ATT&CK 战术进行分组。 | 技术 | 战术 | 规则 | 文档 | 模拟 | 目标平台 | |---|---|---|---|---|---| | **T1027** 编码/混淆的 PowerShell | 执行 | [yml](detections/host/execution/t1027_encoded_powershell_command.yml) | [doc](docs/detections/t1027_encoded_powershell_command.md) | [emu](emulation/t1027_encoded_powershell_command.md) | Defender XDR · Splunk | | **T1059.001** PowerShell 下载诱饵 | 执行 | [yml](detections/host/execution/t1059_001_powershell_download_cradle.yml) | [doc](docs/detections/t1059_001_powershell_download_cradle.md) | [emu](emulation/t1059_001_powershell.md) | Defender XDR · Splunk | | **T1053.005** 通过 schtasks.exe 创建计划任务 | 持久化 | [yml](detections/host/persistence/t1053_005_scheduled_task_create.yml) | [doc](docs/detections/t1053_005_scheduled_task_create.md) | [emu](emulation/t1053_005_scheduled_task.md) | Defender XDR · Splunk | | **T1543.003** 暂存路径中的新服务 | 持久化 | [yml](detections/host/persistence/t1543_003_service_persistence_staging_path.yml) | [doc](docs/detections/t1543_003_service_persistence_staging_path.md) | [emu](emulation/t1543_003_service_persistence_staging_path.md) | Defender XDR · Splunk | | **T1546.003** WMI 永久事件订阅 | 持久化 | [yml](detections/host/persistence/t1546_003_wmi_event_subscription.yml) | [doc](docs/detections/t1546_003_wmi_event_subscription.md) | [emu](emulation/t1546_003_wmi_event_subscription.md) | Defender XDR · Splunk | | **T1546.008** 辅助功能二进制文件 IFEO 调试器 | 持久化 | [yml](detections/host/persistence/t1546_008_accessibility_feature_backdoor.yml) | [doc](docs/detections/t1546_008_accessibility_feature_backdoor.md) | [emu](emulation/t1546_008_accessibility_feature_backdoor.md) | Defender XDR · Splunk | | **T1547.001** 注册表 Run/RunOnce 自启动 | 持久化 | [yml](detections/host/persistence/t1547_001_registry_run_key.yml) | [doc](docs/detections/t1547_001_registry_run_key.md) | [emu](emulation/t1547_001_run_key.md) | Defender XDR · Splunk | | **T1547.004** Winlogon Shell/Userinit 修改 | 持久化 | [yml](detections/host/persistence/t1547_004_winlogon_helper.yml) | [doc](docs/detections/t1547_004_winlogon_helper.md) | [emu](emulation/t1547_004_winlogon_helper.md) | Defender XDR · Splunk | | **T1547.005** 安全支持提供程序安装 | 持久化 | [yml](detections/host/persistence/t1547_005_security_support_provider.yml) | [doc](docs/detections/t1547_005_security_support_provider.md) | [emu](emulation/t1547_005_security_support_provider.md) | Defender XDR · Splunk | | **T1547.009** 启动文件夹 .lnk 创建 | 持久化 | [yml](detections/host/persistence/t1547_009_startup_folder_shortcut.yml) | [doc](docs/detections/t1547_009_startup_folder_shortcut.md) | [emu](emulation/t1547_009_startup_folder_shortcut.md) | Defender XDR · Splunk | | **T1548.002** 通过 HKCU 类劫持绕过 UAC | 权限提升 | [yml](detections/host/privilege-escalation/t1548_002_uac_bypass_registry_hijack.yml) | [doc](docs/detections/t1548_002_uac_bypass_registry_hijack.md) | [emu](emulation/t1548_002_uac_bypass_registry_hijack.md) | Defender XDR · Splunk | | **T1036.005** 系统进程伪装 | 防御规避 | [yml](detections/host/defense-evasion/t1036_005_masquerading_system_process.yml) | [doc](docs/detections/t1036_005_masquerading_system_process.md) | [emu](emulation/t1036_005_masquerading_system_process.md) | Defender XDR · Splunk | | **T1055** 远程线程注入 LSASS | 防御规避 | [yml](detections/host/defense-evasion/t1055_createremotethread_lsass.yml) | [doc](docs/detections/t1055_createremotethread_lsass.md) | [emu](emulation/t1055_createremotethread_lsass.md) | Defender XDR · Splunk | | **T1070.001** 安全事件日志被清除 | 防御规避 | [yml](detections/host/defense-evasion/t1070_001_clear_windows_event_log.yml) | [doc](docs/detections/t1070_001_clear_windows_event_log.md) | [emu](emulation/t1070_001_clear_windows_event_log.md) | Defender XDR · Splunk | | **T1112** 通过注册表禁用 UAC | 防御规避 | [yml](detections/host/defense-evasion/t1112_disable_uac_registry.yml) | [doc](docs/detections/t1112_disable_uac_registry.md) | [emu](emulation/t1112_disable_uac_registry.md) | Defender XDR · Splunk | | **T1140** Certutil base64 解码 | 防御规避 | [yml](detections/host/defense-evasion/t1140_certutil_decode.yml) | [doc](docs/detections/t1140_certutil_decode.md) | [emu](emulation/t1140_certutil_decode.md) | Defender XDR · Splunk | | **T1218.005** Mshta 远程/脚本执行 | 防御规避 | [yml](detections/host/defense-evasion/t1218_005_mshta_proxy_execution.yml) | [doc](docs/detections/t1218_005_mshta_proxy_execution.md) | [emu](emulation/t1218_005_mshta_proxy_execution.md) | Defender XDR · Splunk | | **T1218.010** Regsvr32 远程 scriptlet (Squiblydoo) | 防御规避 | [yml](detections/host/defense-evasion/t1218_010_regsvr32_squiblydoo.yml) | [doc](docs/detections/t1218_010_regsvr32_squiblydoo.md) | [emu](emulation/t1218_010_regsvr32_squiblydoo.md) | Defender XDR · Splunk | | **T1220** WMIC 远程 XSL 脚本处理 | 防御规避 | [yml](detections/host/defense-evasion/t1220_xsl_script_processing_wmic.yml) | [doc](docs/detections/t1220_xsl_script_processing_wmic.md) | [emu](emulation/t1220_xsl_script_processing_wmic.md) | Defender XDR · Splunk | | **T1562.001** Defender 实时保护被禁用 | 防御规避 | [yml](detections/host/defense-evasion/t1562_001_disable_windows_defender.yml) | [doc](docs/detections/t1562_001_disable_windows_defender.md) | [emu](emulation/t1562_001_disable_windows_defender.md) | Defender XDR · Splunk | | **T1562.004** Windows 防火墙被禁用 | 防御规避 | [yml](detections/host/defense-evasion/t1562_004_disable_windows_firewall.yml) | [doc](docs/detections/t1562_004_disable_windows_firewall.md) | [emu](emulation/t1562_004_disable_windows_firewall.md) | Defender XDR · Splunk | | **T1564.001** 通过 attrib.exe 隐藏文件/目录 | 防御规避 | [yml](detections/host/defense-evasion/t1564_001_hidden_files_attrib.yml) | [doc](docs/detections/t1564_001_hidden_files_attrib.md) | [emu](emulation/t1564_001_hidden_files_attrib.md) | Defender XDR · Splunk | | **T1003.001** LSASS 内存访问 | 凭证访问 | [yml](detections/host/credential-access/t1003_001_lsass_access.yml) | [doc](docs/detections/t1003_001_lsass_access.md) | [emu](emulation/t1003_001_lsass_access.md) | Defender XDR · Splunk | | **T1003.002** SAM/SYSTEM 配置单元转储 (reg.exe save) | 凭证访问 | [yml](detections/host/credential-access/t1003_002_sam_registry_hive_dump.yml) | [doc](docs/detections/t1003_002_sam_registry_hive_dump.md) | [emu](emulation/t1003_002_sam_registry_hive_dump.md) | Defender XDR · Splunk | | **T1003.006** DCSync (非域控复制请求) | 凭证访问 | [yml](detections/host/credential-access/t1003_006_dcsync.yml) | [doc](docs/detections/t1003_006_dcsync.md) | [emu](emulation/t1003_006_dcsync.md) | Defender XDR · Splunk | | **T1110.001** 登录失败 (基础事件) | 凭证访问 | [yml](detections/host/credential-access/t1110_001_brute_force_base.yml) | [doc](docs/detections/t1110_001_brute_force_base.md) | [emu](emulation/t1110_001_brute_force.md) | Defender XDR · Splunk | | **T1110.001** 暴力破解 (源 IP 关联) | 凭证访问 | [yml](detections/host/credential-access/t1110_001_brute_force_correlation.yml) | [doc](docs/detections/t1110_001_brute_force_correlation.md) | [emu](emulation/t1110_001_brute_force.md) | Defender XDR · Splunk | | **T1552.001** 凭据关键字文件搜索 | 凭证访问 | [yml](detections/host/credential-access/t1552_001_credentials_in_files_search.yml) | [doc](docs/detections/t1552_001_credentials_in_files_search.md) | [emu](emulation/t1552_001_credentials_in_files_search.md) | Defender XDR · Splunk | | **T1552.004** 私钥文件搜索 | 凭证访问 | [yml](detections/host/credential-access/t1552_004_private_key_search.yml) | [doc](docs/detections/t1552_004_private_key_search.md) | [emu](emulation/t1552_004_private_key_search.md) | Defender XDR · Splunk | | **T1018** 远程系统发现 (内置工具) | 发现 | [yml](detections/host/discovery/t1018_remote_system_discovery.yml) | [doc](docs/detections/t1018_remote_system_discovery.md) | [emu](emulation/t1018_remote_system_discovery.md) | Defender XDR · Splunk | | **T1087** 账户/组发现 (内置工具) | 发现 | [yml](detections/host/discovery/t1087_account_discovery.yml) | [doc](docs/detections/t1087_account_discovery.md) | [emu](emulation/t1087_account_discovery.md) | Defender XDR · Splunk | | **T1021.001** 来自外部源的 RDP 登录 | 横向移动 | [yml](detections/host/lateral-movement/t1021_001_rdp_external_logon.yml) | [doc](docs/detections/t1021_001_rdp_external_logon.md) | [emu](emulation/t1021_001_rdp_external_logon.md) | Defender XDR · Splunk | | **T1021.002** 管理共享 (ADMIN$/C$) 访问 | 横向移动 | [yml](detections/host/lateral-movement/t1021_002_admin_share_access.yml) | [doc](docs/detections/t1021_002_admin_share_access.md) | [emu](emulation/t1021_002_admin_share_psexec.md) | Defender XDR · Splunk | | **T1021.002** PsExec 风格的服务安装 | 横向移动 | [yml](detections/host/lateral-movement/t1021_002_psexec_service_install.yml) | [doc](docs/detections/t1021_002_psexec_service_install.md) | [emu](emulation/t1021_002_admin_share_psexec.md) | Defender XDR · Splunk | | **T1550.002** Pass the Hash (空工作站) | 横向移动 | [yml](detections/host/lateral-movement/t1550_002_pass_the_hash_heuristic.yml) | [doc](docs/detections/t1550_002_pass_the_hash_heuristic.md) | [emu](emulation/t1550_002_pass_the_hash_heuristic.md) | Defender XDR · Splunk | | **T1560.001** 命令行归档暂存 | 收集 | [yml](detections/host/collection/t1560_001_archive_data_staging.yml) | [doc](docs/detections/t1560_001_archive_data_staging.md) | [emu](emulation/t1560_001_archive_data_staging.md) | Defender XDR · Splunk | | **T1071.001** 出站外部连接 (基础) | 命令与控制 | [yml](detections/network/command-and-control/t1071_001_c2_beaconing_base.yml) | [doc](docs/detections/t1071_001_c2_beaconing_base.md) | [emu](emulation/t1071_001_c2_beaconing.md) | Defender XDR · Splunk · Elastic | | **T1071.001** C 信标 (计数关联) | 命令与控制 | [yml](detections/network/command-and-control/t1071_001_c2_beaconing_correlation.yml) | [doc](docs/detections/t1071_001_c2_beaconing_correlation.md) | [emu](emulation/t1071_001_c2_beaconing.md) | Defender XDR · Splunk · Elastic | | **T1071.004** DNS 隧道 (长查询) | 命令与控制 | [yml](detections/network/command-and-control/t1071_004_dns_tunneling.yml) | [doc](docs/detections/t1071_004_dns_tunneling.md) | [emu](emulation/t1071_004_dns_tunneling.md) | Defender XDR · Splunk · Elastic | | **T1105** 入站工具传输 (certutil/bitsadmin) | 命令与控制 | [yml](detections/host/command-and-control/t1105_ingress_tool_transfer_lolbin.yml) | [doc](docs/detections/t1105_ingress_tool_transfer_lolbin.md) | [emu](emulation/t1105_ingress_tool_transfer_lolbin.md) | Defender XDR · Splunk | | **T1041** 大量出站传输 | 数据外发 | [yml](detections/network/exfiltration/t1041_large_outbound_transfer.yml) | [doc](docs/detections/t1041_large_outbound_transfer.md) | [emu](emulation/t1041_large_outbound_transfer.md) | Defender XDR · Splunk · Elastic | | **T1489** 安全/备份服务停止 | 影响 | [yml](detections/host/impact/t1489_service_stop.yml) | [doc](docs/detections/t1489_service_stop.md) | [emu](emulation/t1489_service_stop.md) | Defender XDR · Splunk | | **T1490** 卷影副本 / 备份删除 | 影响 | [yml](detections/host/impact/t1490_inhibit_system_recovery.yml) | [doc](docs/detections/t1490_inhibit_system_recovery.md) | [emu](emulation/t1490_inhibit_system_recovery.md) | Defender XDR · Splunk | 有关 ATT&CK 覆盖视图、单条规则遥测及已知遗漏，以及后续计划，请参阅 [`coverage/coverage.md`](coverage/coverage.md)。 ## 路线图（后续检测） T1053.005 通过 Security 4698（API 创建的任务——schtasks 规则中已知的漏洞）· PowerShell 4104 脚本块内容（捕捉命令行规则遗漏的混淆）· T1558.003 Kerberoasting · T1047 WMI 执行 ## 添加检测规则 克隆 `detections/_TEMPLATE.yml` 和 `docs/detections/_TEMPLATE.md`，遵循 [`docs/workflow.md`](docs/workflow.md) 中的六步闭环，运行 `./convert.sh`，并在上方的表格以及 `coverage/coverage.md` 中添加一行。

标签：AMSI绕过, KQL, Reconnaissance, Sigma规则, SPL, URL发现, 威胁检测, 安全检测, 目标导入, 逆向工具