检测工程实战：规则、查询与高级度量

title: 办公文档派生可疑进程 (T1566.001)
id: 3a1b2c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: 文档/脚本宿主进程(office, wscript, mshta)派生异常子进程
references:
  - https://attack.mitre.org/techniques/T1566/001/
tags:
  - attack.initial-access
  - attack.t1566.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\\winword.exe'
      - '\\excel.exe'
      - '\\powerpnt.exe'
      - '\\wscript.exe'
      - '\\mshta.exe'
  selection_child:
    Image|endswith:
      - '\\cmd.exe'
      - '\\powershell.exe'
      - '\\rundll32.exe'
  condition: selection_parent and selection_child
falsepositives:
  - 合法的宏驱动办公自动化
level: high

title: MFA 请求轰炸特征 (T1621)
id: 7f8e9a0b-1c2d-3e4f-5a6b-7c8d9e0f1a2b
status: experimental
description: 单一账号短时间内产生大量 MFA 推送/批准请求
references:
  - https://attack.mitre.org/techniques/T1621/
tags:
  - attack.credential-access
  - attack.t1621
logsource:
  category: authentication
  product: idp   # 如 Entra ID/Okta 审计日志
detection:
  selection:
    event_action: 'mfa_prompt'
  timeframe: 10m
  condition: selection | count(user) by user > 10
falsepositives:
  - 用户操作失误导致的重试
level: medium

title: 卷影副本删除 (T1490)
id: 9c0d1e2f-3a4b-5c6d-7e8f-9a0b1c2d3e4f
status: experimental
description: vssadmin/ wbadmin/ PowerShell 删除卷影副本或停用修复
references:
  - https://attack.mitre.org/techniques/T1490/
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - 'vssadmin delete shadows'
      - 'wmic shadowcopy delete'
      - 'wbadmin delete catalog'
  condition: selection
falsepositives:
  - 合法备份维护
level: critical

// DeviceProcessEvents: 非系统进程打开 lsass.exe 且请求读取内存
DeviceProcessEvents
| where TargetImage =~ "lsass.exe"
| where ActionType == "ProcessAccess"
| where InitiatingProcessFileName !in~ ("lsass.exe","wininit.exe","csrss.exe","services.exe")
| where AccessMask has_any ("0x1010","0x1410","0x143a","0x1438")
| project TimeGenerated, DeviceName, InitiatingProcessFileName,
          InitiatingProcessCommandLine, AccessMask

// SigninLogs (Entra ID): 同账号出现非常规地理或新设备登录
SigninLogs
| where ResultType == 0
| summarize cnt=dcount(Location) by UserPrincipalName, bin(TimeGenerated,1d)
| where cnt > 3   // 单日多异常地理登录
| project UserPrincipalName, cnt

// 关联 IdP MFA 日志与 SaaS 会话日志：存在新会话但无对应 MFA 批准
let mfa = SigninLogs | where AuthenticationRequirement == "multiFactor" | project UserPrincipalName, TimeGenerated;
let sess = SaaS_SessionLogs | project UserPrincipalName, SessionStart;
sess | join kind=leftanti mfa on UserPrincipalName
| where SessionStart between (ago(1d) .. now())
| project UserPrincipalName, SessionStart