admin/RmEye
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

优化一下

Browse Source 
优化一下
This commit is contained in:
huoji
2022-09-05 17:50:44 +08:00
parent c2f44adc2e
commit b33043f8b6
4 changed files with 51 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
Server/hash_white_list.py
View File

@@ -1,5 +1,27 @@
import sql
g_white_list = []
g_white_dll_load_list = [
'c:\\windows\\system32\\advapi32.dll',
'c:\\windows\\system32\\crypt32.dll',
'c:\\windows\\system32\\cryptdll.dll',
'c:\\windows\\system32\\gdi32.dll',
'c:\\windows\\system32\\imm32.dll',
'c:\\windows\\system32\\kernel32.dll',
'c:\\windows\\system32\\kernelbase.dll',
'c:\\windows\\system32\\msasn1.dll',
'c:\\windows\\system32\\msvcrt.dll',
'c:\\windows\\system32\\ntdll.dll',
'c:\\windows\\system32\\rpcrt4.dll',
'c:\\windows\\system32\\rsaenh.dll',
'c:\\windows\\system32\\samlib.dll',
'c:\\windows\\system32\\sechost.dll',
'c:\\windows\\system32\\secur32.dll',
'c:\\windows\\system32\\shell32.dll',
'c:\\windows\\system32\\shlwapi.dll',
'c:\\windows\\system32\\sspicli.dll',
'c:\\windows\\system32\\user32.dll',
'c:\\windows\\system32\\vaultcli.dll',
]
def add_white_list(path, hash, reason):

33
Server/log.py
View File

@@ -178,22 +178,23 @@ def process_log(host, json_log, raw_log):
target_image_path = target_process.path
target_hash = target_process.md5
self_hash = current_process.md5
sql.push_process_raw(
host,
raw_json_log,
rule_hit_name,
score,
chain_hash,
had_threat,
parent_pid,
target_pid,
self_hash,
target_image_path,
target_hash,
params,
user,
)
# 以后有其他排除需求再优化
if json_log['action'] == 'imageload' and json_log['data']['imageloaded'] not in hash_white_list.g_white_dll_load_list:
sql.push_process_raw(
host,
raw_json_log,
rule_hit_name,
score,
chain_hash,
had_threat,
parent_pid,
target_pid,
self_hash,
target_image_path,
target_hash,
params,
user,
)
"""
for iter in process.g_ProcessChainList:

17
Server/plugins/mimikazt_detect/mimikatz_detect.py
View File

@@ -45,14 +45,15 @@ def rule_new_process_action(current_process: process.Process, host, raw_log_data
if 'mimikatz_detected' in current_process.plugin_var and json_log_data['action'] == 'imageload' and current_process.plugin_var['mimikatz_detected'] == False:
# 把日志中的dll路径取出来
dll_path = json_log_data['data']['imageloaded']
# 如果dll的路径在mimikatz的路径里面,进程上下文+1
if dll_path in mimikatz_dll_list:
current_process.plugin_var['mimikatz_matched_num'] += 1
if current_process.plugin_var['mimikatz_matched_num'] >= len(mimikatz_dll_list):
current_process.set_score(300, "[mimikatz]检测到疑似mimikatz进程")
current_process.plugin_var['mimikatz_detected'] = True
return global_vars.THREAT_TYPE_PROCESS
# 排除误报
if current_process.parent_process.path != 'c:\\windows\\system32\\svchost.exe':
# 如果dll的路径在mimikatz的路径里面,进程上下文+1
if dll_path in mimikatz_dll_list:
current_process.plugin_var['mimikatz_matched_num'] += 1
if current_process.plugin_var['mimikatz_matched_num'] >= len(mimikatz_dll_list):
current_process.set_score(300, "[mimikatz]检测到疑似mimikatz进程")
current_process.plugin_var['mimikatz_detected'] = True
return global_vars.THREAT_TYPE_PROCESS
return global_vars.THREAT_TYPE_NONE