391 lines
11 KiB
Python
391 lines
11 KiB
Python
rule = [
|
|
{
|
|
'rules': [
|
|
'originalfilename =~ ".*taskill.exe.*"',
|
|
'originalfilename =~ ".*net.exe.*" and commandline =~ ".*stop.*"',
|
|
'originalfilename =~ ".*sc.exe.*" and commandline =~ ".*config.*" and commandline =~ ".*disabled.*"',
|
|
],
|
|
'score': 40,
|
|
'name': '通过系统程序关闭进程'
|
|
},
|
|
{
|
|
'rules': [
|
|
'originalfilename =~ ".*curl.exe" or originalfilename =~ ".*wget.exe" or originalfilename =~ ".*dget.exe"'
|
|
],
|
|
'score': 40,
|
|
'name':'通过应用下载文件'
|
|
},
|
|
{
|
|
'rules': [
|
|
'image =~ ".*\.doc\.exe"',
|
|
'image =~ ".*\.docx\.exe"',
|
|
'image =~ ".*\.ppt\.exe"',
|
|
'image =~ ".*\.pdf\.exe"',
|
|
'image =~ ".*\.html\.exe"',
|
|
'image =~ ".*\.htm\.exe"',
|
|
'image =~ ".*\.zip\.exe"',
|
|
'image =~ ".*\.rar\.exe"'
|
|
],
|
|
'score': 30,
|
|
'name':'启动双扩展名文件'
|
|
},
|
|
{
|
|
'rules': [
|
|
'commandline =~ ".*-k dcomlaunch.*"'
|
|
],
|
|
'score': 30,
|
|
'name':'通过DCOM启动了进程'
|
|
},
|
|
{
|
|
'rules': [
|
|
'originalfilename =~ ".*wbadmin.exe.*" and commandline =~ ".*delete.*"',
|
|
],
|
|
'score': 70,
|
|
'name': '通过wbadmin删除备份'
|
|
},
|
|
{
|
|
'rules': [
|
|
'originalfilename =~ ".*net.exe.*" and commandline =~ ".*view.*"',
|
|
],
|
|
'score': 70,
|
|
'name': '通过net进行远程系统发现'
|
|
},
|
|
{
|
|
'rules': [
|
|
'originalfilename =~ ".*fsutil.exe.*" and commandline =~ ".*deletejournal.*"',
|
|
],
|
|
'score': 70,
|
|
'name': '通过系统工具删除USN'
|
|
},
|
|
{
|
|
'rules': [
|
|
'originalfilename =~ ".*net.exe.*" and commandline =~ ".*user.*"',
|
|
],
|
|
'score': 70,
|
|
'name': '通过net进行系统用户发现'
|
|
},
|
|
{
|
|
'rules': [
|
|
'originalfilename =~ ".*schtasks.exe.*" and commandline =~ ".*create.*"',
|
|
],
|
|
'score': 70,
|
|
'name': '通过系统应用创建计划任务'
|
|
},
|
|
{
|
|
'rules': [
|
|
'originalfilename =~ ".*schtasks.exe.*" and commandline =~ ".*delete.*"',
|
|
],
|
|
'score': 40,
|
|
'name': '通过系统应用删除计划任务'
|
|
},
|
|
{
|
|
'rules': [
|
|
'originalfilename =~ ".*vssadmin.exe.*" and commandline =~ ".*create.*"',
|
|
],
|
|
'score': 40,
|
|
'name': '通过系统程序创建卷影备份'
|
|
},
|
|
{
|
|
'rules': [
|
|
'originalfilename =~ ".*todesk_service.*" or originalfilename =~ ".*sunloginclient.*" or originalfilename =~ ".*teamviewer_service.exe.*" or originalfilename =~ ".*logmein.*" or originalfilename =~ ".*dwrcs.*" or originalfilename =~ ".*aa_v3.*" or originalfilename =~ ".*screenconnect.*" or originalfilename =~ ".*tvnserver.*" or originalfilename =~ ".*vncserver.*"',
|
|
],
|
|
'score': 20,
|
|
'name': '已知远程协助程序'
|
|
},
|
|
{
|
|
'rules': [
|
|
'originalfilename =~ ".*phoenixminer.*" or originalfilename =~ ".*ccminer.*" or originalfilename =~ ".*csminer.exe.*" or originalfilename =~ ".*xmrig.*" or originalfilename =~ ".*xmr-stak.*"',
|
|
],
|
|
'score': 300,
|
|
'name': '已知挖矿程序'
|
|
},
|
|
{
|
|
'rules': [
|
|
'image =~ ".*\\\\\\\\appdata\\\\\\\\local\\\\\\\\temp\\\\\\\\.*" or image =~ ".*\\\\\\\\windows\\\\\\\\temp\\\\\\\\.*"',
|
|
],
|
|
'score': 40,
|
|
'name': '从临时文件创建进程'
|
|
},
|
|
{
|
|
'rules': [
|
|
'originalfilename =~ ".*rubeus.*" and commandline =~ ".*domain.*"',
|
|
],
|
|
'score': 100,
|
|
'name': '通过系统工具获取域登陆令牌'
|
|
},
|
|
{
|
|
'rules': [
|
|
'originalfilename =~ ".*whoami.*"',
|
|
],
|
|
'score': 70,
|
|
'name': 'whoami被执行'
|
|
},
|
|
{
|
|
'rules': [
|
|
'originalfilename =~ ".*\u202e.*"',
|
|
],
|
|
'score': 100,
|
|
'name': '伪装名字程序被执行'
|
|
},
|
|
{
|
|
'rules': [
|
|
'parentimage =~ ".*mmc.exe" and commandline =~ ".*eventvwr\.msc.*"',
|
|
],
|
|
'score': 40,
|
|
'name': '高权限进程被创建'
|
|
},
|
|
{
|
|
'rules': [
|
|
'originalfilename =~ ".*bcdedit.exe" and commandline =~ ".*recoveryenabled.*no.*"',
|
|
'originalfilename =~ ".*bcdedit.exe" and commandline =~ ".*bootstatuspolicy.*ignoreallfailures.*"',
|
|
],
|
|
'score': 80,
|
|
'name': '通过系统工具关闭系统恢复'
|
|
},
|
|
{
|
|
'rules': [
|
|
'originalfilename =~ ".*wmic.exe" and commandline =~ ".*useraccount.*"',
|
|
],
|
|
'score': 70,
|
|
'name': '通过wmic进行系统用户发现'
|
|
},
|
|
{
|
|
'rules': [
|
|
'originalfilename =~ ".*wmic.exe" and commandline =~ ".*startup.*"',
|
|
],
|
|
'score': 70,
|
|
'name': '通过wmic查看系统启动项'
|
|
},
|
|
{
|
|
'rules': [
|
|
'originalfilename =~ ".*wmic.exe" and commandline =~ ".*share.*"',
|
|
],
|
|
'score': 70,
|
|
'name': '通过wmic查看系统共享'
|
|
},
|
|
{
|
|
'rules': [
|
|
'originalfilename =~ ".*wmic.exe" and commandline =~ ".*shadowcopy.*" and commandline =~ ".*delete.*"',
|
|
],
|
|
'score': 70,
|
|
'name': 'wmic删除卷影备份'
|
|
},
|
|
{
|
|
'rules': [
|
|
'originalfilename =~ ".*vssadmin.exe" and commandline =~ ".*shadows.*" and commandline =~ ".*delete.*"',
|
|
],
|
|
'score': 70,
|
|
'name': 'vssadmin删除卷影备份'
|
|
},
|
|
{
|
|
'rules': [
|
|
'originalfilename =~ ".*tasklist.exe"',
|
|
],
|
|
'score': 50,
|
|
'name': '通过tasklist查看系统信息'
|
|
},
|
|
{
|
|
'rules': [
|
|
'originalfilename =~ ".*systeminfo.exe"',
|
|
],
|
|
'score': 70,
|
|
'name': '通过systeminfo查看系统信息'
|
|
},
|
|
{
|
|
'rules': [
|
|
'originalfilename =~ ".*query.exe"',
|
|
],
|
|
'score': 70,
|
|
'name': '通过query进行系统用户发现'
|
|
},
|
|
{
|
|
'rules': [
|
|
'originalfilename =~ ".*net.exe" and commandline =~ ".*domain.*"',
|
|
'originalfilename =~ ".*net.exe" and commandline =~ ".*view.*"',
|
|
'originalfilename =~ ".*net.exe" and commandline =~ ".*workstation.*"'
|
|
],
|
|
'score': 70,
|
|
'name': '通过net进行本地系统用户发现'
|
|
},
|
|
{
|
|
'rules': [
|
|
'originalfilename =~ ".*setspn.exe"',
|
|
],
|
|
'score': 70,
|
|
'name': '通过setspn进行本地系统用户发现'
|
|
},
|
|
{
|
|
'rules': [
|
|
'originalfilename =~ ".*netsh.exe" and commandline =~ ".*firewall.*"',
|
|
],
|
|
'score': 70,
|
|
'name': '通过netsh关闭防火墙'
|
|
},
|
|
{
|
|
'rules': [
|
|
'originalfilename =~ ".*cmd.exe" and commandline =~ ".*ipconfig.*"',
|
|
],
|
|
'score': 80,
|
|
'name': 'cmd启动ipconfig'
|
|
},
|
|
{
|
|
'rules': [
|
|
'originalfilename =~ ".*cmd.exe" and commandline =~ ".*net.*"',
|
|
],
|
|
'score': 60,
|
|
'name': 'cmd启动net'
|
|
},
|
|
{
|
|
'rules': [
|
|
'originalfilename =~ ".*netstat.exe"',
|
|
],
|
|
'score': 40,
|
|
'name': 'netstat被运行'
|
|
},
|
|
{
|
|
'rules': [
|
|
'originalfilename =~ ".*ping.exe"',
|
|
],
|
|
'score': 40,
|
|
'name': 'ping被运行'
|
|
},
|
|
{
|
|
'rules': [
|
|
'originalfilename =~ ".*ipconfig.exe"',
|
|
],
|
|
'score': 40,
|
|
'name': 'ipconfig被运行'
|
|
},
|
|
{
|
|
'rules': [
|
|
'originalfilename =~ ".*attrib.exe"',
|
|
],
|
|
'score': 40,
|
|
'name': 'attrib被运行'
|
|
},
|
|
{
|
|
'rules': [
|
|
'originalfilename =~ ".*PSEXESVC.exe"',
|
|
],
|
|
'score': 100,
|
|
'name': 'PSEXESVC内网横向移动'
|
|
},
|
|
{
|
|
'rules': [
|
|
'originalfilename =~ "\\\\\\\\.*\\\\\\C\$.*"',
|
|
],
|
|
'score': 100,
|
|
'name': 'SMB共享启动进程'
|
|
},
|
|
{
|
|
'rules': [
|
|
'commandline =~ ".*__\d{10}\."',
|
|
'originalfilename =~ ".*wmi_share.exe"',
|
|
],
|
|
'score': 100,
|
|
'name': 'wmic内网横向移动被触发'
|
|
},
|
|
{
|
|
'rules': [
|
|
'originalfilename =~ ".*icacls.exe"',
|
|
],
|
|
'score': 40,
|
|
'name': 'icacls被运行'
|
|
},
|
|
{
|
|
'rules': [
|
|
'originalfilename =~ "\\\\\\.*" and parentimage =~ ".*services.exe"',
|
|
],
|
|
'score': 100,
|
|
'name': '远程服务被创建'
|
|
},
|
|
{
|
|
'rules': [
|
|
'parentimage =~ ".*services.exe"',
|
|
],
|
|
'score': 30,
|
|
'name': '从服务创建的进程'
|
|
},
|
|
{
|
|
'rules': [
|
|
'originalfilename =~ ".*wscript.exe"',
|
|
'originalfilename =~ ".*cscript.exe"',
|
|
],
|
|
'score': 40,
|
|
'name': '脚本程序被运行'
|
|
},
|
|
{
|
|
'rules': [
|
|
'originalfilename =~ ".*mofcomp.exe.*"'
|
|
],
|
|
'score': 80,
|
|
'name':'注册WMI订阅'
|
|
},
|
|
{
|
|
'rules': [
|
|
'originalfilename =~ ".*csc.exe.*"'
|
|
],
|
|
'score': 80,
|
|
'name':'.NET编译器被启动'
|
|
},
|
|
{
|
|
'rules': [
|
|
'originalfilename =~ ".*cmdkey.exe.*"'
|
|
],
|
|
'score': 100,
|
|
'name':'通过系统应用查询本机账户'
|
|
},
|
|
{
|
|
'rules': [
|
|
'originalfilename =~ ".*adfind.exe.*"'
|
|
],
|
|
'score': 80,
|
|
'name':'通过系统程序发现域信息'
|
|
},
|
|
# 这些是保底规则 必须放到最底下才匹配
|
|
{
|
|
'rules': [
|
|
'originalfilename =~ ".*cmd.exe"'
|
|
],
|
|
'score': 30,
|
|
'name':'执行CMD命令'
|
|
},
|
|
{
|
|
'rules': [
|
|
'originalfilename =~ ".*chcp.com"'
|
|
],
|
|
'score': 30,
|
|
'name':'执行chcp.com'
|
|
},
|
|
{
|
|
'rules': [
|
|
'originalfilename =~ ".*wmic.exe.*"'
|
|
],
|
|
'score': 80,
|
|
'name':'执行wmic'
|
|
},
|
|
{
|
|
'rules': [
|
|
'originalfilename =~ ".*rundll32.exe.*"'
|
|
],
|
|
'score': 20,
|
|
'name':'通过rundll32启动进程'
|
|
},
|
|
{
|
|
'rules': [
|
|
'originalfilename =~ ".*certutil.exe"',
|
|
'originalfilename =~ ".*curl.exe"',
|
|
'originalfilename =~ ".*powershell.exe" and commandline =~ ".*invoke-webrequest.*"'
|
|
],
|
|
'score': 80,
|
|
'name':'通过系统命令下载文件'
|
|
},
|
|
{
|
|
'rules': [
|
|
'originalfilename =~ ".*powershell.exe"'
|
|
],
|
|
'score': 80,
|
|
'name':'Powershell被执行'
|
|
},
|
|
]
|