浅谈某产品在Windows环境下自定义策略

日志的基本走向

某产品策略示例

策略名称	策略细节	策略来源	注释
T1003.005.RULE OS Credential Dumping: Cached Domain Credentials	This is rule based on Sysmon configuration. Following options should be enable: In section add following lines: HKLM\SECURITY\CACHE Get more Windows MITRE rules: https://www.scnsoft.com/services/security/siem/windows-mitre-attack-rule	https://attack.mitre.org/tactics/TA0006/	策略是通过定义Sysmon的配置文件自定义策略匹配收集日志
WIN.T1052.001.RULE Exfiltration Over Physical Medium: Exfiltration over USB	No action required. Get more Windows MITRE rules: https://www.scnsoft.com/services/security/siem/windows-mitre-attack-rules	https://attack.mitre.org/techniques/T1052/001/	此处和下面列举的策略都是No action required，表示没有动作只有事件产生，所以可以根据Windows生成的事件进行检测
WIN.T1053.002.RULE Scheduled Task/Job: At (Windows)	No action required. Get more Windows MITRE rules: https://www.scnsoft.com/services/security/siem/windows-mitre-attack-rules	https://attack.mitre.org/techniques/T1053/002/	基于事件ID检测
WIN.T1053.005.RULE Scheduled Task/Job: Scheduled Task	No action required. Get more Windows MITRE rules: https://www.scnsoft.com/services/security/siem/windows-mitre-attack-rules	https://attack.mitre.org/techniques/T1053/005/	基于事件ID检测
WIN.T1070.001.RULE Indicator Removal on Host: Clear Windows Event Logs	No action required. Get more Windows MITRE rules: https://www.scnsoft.com/services/security/siem/windows-mitre-attack-rules	https://attack.mitre.org/techniques/T1070/001/	基于事件ID检测
WIN.T1200.RULE Hardware Additions	No action required. Get more Windows MITRE rules: https://www.scnsoft.com/services/security/siem/windows-mitre-attack-rules	https://attack.mitre.org/techniques/T1200/	基于事件ID检测
WIN.T1222.001.RULE File and Directory Permissions Modification: Windows File and Directory Permissions Modification	No action required. Get more Windows MITRE rules: https://www.scnsoft.com/services/security/siem/windows-mitre-attack-rules	https://attack.mitre.org/techniques/T1222/001/	基于事件ID检测
WIN.T1489.RULE Service Stop	No action required. Get more Windows MITRE rules: https://www.scnsoft.com/services/security/siem/windows-mitre-attack-rules	https://attack.mitre.org/techniques/T1489/	没有事件ID，但是Mitre官方给出的检测方式都是监控命令参数，文件，进程，服务和注册表
WIN.T1490.RULE Inhibit System Recovery	No action required. Get more Windows MITRE rules: https://www.scnsoft.com/services/security/siem/windows-mitre-attack-rules	https://attack.mitre.org/techniques/T1490/	基于事件ID检测
WIN.T1529.RULE System Shutdown/Reboot	No action required. Get more Windows MITRE rules: https://www.scnsoft.com/services/security/siem/windows-mitre-attack-rules	https://attack.mitre.org/techniques/T1529/	基于事件ID检测
WIN.T1558.001.RULE Steal or Forge Kerberos Tickets: Golden Ticket	No action required. Get more Windows MITRE rules: https://www.scnsoft.com/services/security/siem/windows-mitre-attack-rules	https://attack.mitre.org/techniques/T1558/001/	基于事件ID检测
WIN.T1558.002.RULE Steal or Forge Kerberos Tickets: Silver Ticket	No action required. Get more Windows MITRE rules: https://www.scnsoft.com/services/security/siem/windows-mitre-attack-rules	https://attack.mitre.org/techniques/T1558/002/	基于事件ID检测
WIN.T1558.003.RULE Steal or Forge Kerberos Tickets: Kerberoasting	No action required. Get more Windows MITRE rules: https://www.scnsoft.com/services/security/siem/windows-mitre-attack-rules	https://attack.mitre.org/techniques/T1558/003/	基于事件ID检测

基于关键字匹配策略来源细节诠释

In section <ProcessCreate onmatch="include"> add following lines: <CommandLine name="T1003.005" condition="contains">HKLM\SECURITY\CACHE</CommandLine>

根据上述策略细节显示，可知是通过Sysmon的配置准确定义检测注册表HKLM\SECURITY\CACHE的变化进行研判是否触发策略，从而生成对应的日志事件，将其转发至Agent，再解析日志格式推送至SIEM

事件ID匹配策略诠释

表格中列举出来的基于事件ID匹配策略，某产品文档中给出的就是No action required，大概意思就是不用基于某些关键字操作行为的关键字进行监控，而是直接使用Windows生成的事件ID号进行策略匹配；

不过发现个别策略Mitre官方并未给出检测的策略事件ID，但是某产品给出了，目前我尚未查询到对应事件ID

总结

此产品流量走向和策略匹配是基于Windows环境下Sysmon工具为基础进行收集生成，然后某产品通过Agent解析日志格式并推送至SIEM中，最终在SIEM中配置定义触发的条件，进行关联分析；其中在策略部分简单点理解就是使用Mitre里面告知的检测方式进行定义Sysmon配置文件，通过Sysmon生成的日志，然后使用Agent将其解析最终推送至SIME的过程；

引用参考链接：

Sysmon官方下载地址：
https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon
 
Sysmon安装使用：
https://blog.csdn.net/qq237696047/article/details/108886184
https://www.cnblogs.com/SzSecNote/p/14203360.html
https://www.jianshu.com/p/43bf5aadfd28
https://blog.csdn.net/qq_34367997/article/details/94749805
 
配置模板及Windows环境下恶意行为日志：
https://github.com/SwiftOnSecurity/sysmon-config
https://www.malwarearchaeology.com/cheat-sheets
https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/5eb3687f39d69d48c403a42a/1588816000014/Windows+Sysmon+Logging+Cheat+Sheet_Jan_2020.pdf
https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/5b8f091c0ebbe8644d3a886c/1536100639356/Windows+ATT%26CK_Logging+Cheat+Sheet_ver_Sept_2018.pdf
https://github.com/MalwareArchaeology/ATTACK
https://github.com/olafhartong/sysmon-modular
https://github.com/SwiftOnSecurity/sysmon-config/blob/master/sysmonconfig-export.xml
 
Mitre官方：
https://attack.mitre.org/techniques/T1003/005/