# =============================================================================
# Sigma Detection Rules - IT智能服务台 (修订版)
# =============================================================================
# 适用于无密码登录系统（仅企微OAuth/扫码）
# 编译目标: PostgreSQL (审计日志查询)
# =============================================================================

---
# 规则1: Token异常使用 - 多IP使用
# 适用ATT&CK: T1078 (有效账户), T1552 (非安全凭据)
---
- id: itdesk-T1078-001
  title: 凭证异常 - Token多IP使用
  status: draft
  level: high
  description: |
    检测同一Token在短时间内被多个不同IP地址使用，可能是Token泄露或中间人攻击。
    当同一token_hash在1小时内出现3个及以上不同IP时触发告警。
  references:
    - https://attack.mitre.org/techniques/T1078/
    - https://attack.mitre.org/techniques/T1552/
  author: Threat Detection Engineer
  date: 2026/07/14
  tags:
    - attack.initial_access
    - attack.t1078
    - attack.credential_access
    - attack.t1552
  logsource:
    category: application
    product: itdesk
    service: token
  detection:
    selection:
      event: 'token_used'
    timeframe: 1h
    condition: |
      DISTINCT ip_address >= 3
      GROUP BY token_hash
  falsepositives:
    - 用户使用VPN导致IP跳变
    - 移动设备切换网络 (4G/WiFi)
  fields:
    - token_hash
    - employee_id
    - ip_address
    - created_at
  actions:
    - invalidate_token: true
    - notify_security: webhook
    - suspend_user: pending_review

---
# 规则2: 越权访问检测
# 适用ATT&CK: T1068 (权限提升)
---
- id: itdesk-T1068-001
  title: 权限提升 - 越权访问
  status: draft
  level: critical
  description: |
    检测用户尝试访问其角色无权访问的资源，可能是权限提升攻击。
    当同一用户在10分钟内触发3次及以上RBAC拒绝时触发告警。
  references:
    - https://attack.mitre.org/techniques/T1068/
  author: Threat Detection Engineer
  date: 2026/07/14
  tags:
    - attack.privilege_escalation
    - attack.t1068
  logsource:
    category: application
    product: itdesk
    service: rbac
  detection:
    selection:
      event: 'access_denied'
      reason: 'insufficient_permissions'
    timeframe: 10m
    condition: |
      COUNT(*) >= 3
      GROUP BY employee_id
  falsepositives:
    - 前端缓存导致的重复请求
    - 正常的权限申请流程
  fields:
    - employee_id
    - requested_resource
    - user_role
    - required_role
    - created_at
  actions:
    - notify_security: webhook
    - suspend_user: pending_review

---
# 规则3: 数据外传 - 批量导出检测
# 适用ATT&CK: T1041 (通过Web服务外传数据)
---
- id: itdesk-T1041-001
  title: 数据泄露 - 批量导出
  status: draft
  level: high
  description: |
    检测用户执行大量数据导出操作，可能是数据外传的前兆。
    当导出记录数超过1000条或导出文件大小超过100MB时触发告警。
  references:
    - https://attack.mitre.org/techniques/T1041/
  author: Threat Detection Engineer
  date: 2026/07/14
  tags:
    - attack.exfiltration
    - attack.t1041
  logsource:
    category: application
    product: itdesk
    service: audit
  detection:
    selection:
      action: 'data_export'
    condition: |
      record_count > 1000 OR export_size_mb > 100
  falsepositives:
    - 正常的报表导出任务
    - 数据备份脚本
  fields:
    - employee_id
    - export_type
    - record_count
    - export_size_mb
    - ip_address
    - created_at
  actions:
    - require_mfa_verification: true
    - notify_security: webhook

---
# 规则4: 内部威胁 - 管理员非工作时间操作
# 适用ATT&CK: T1056 (权限滥用)
---
- id: itdesk-T1056-001
  title: 内部威胁 - 管理员非工作时间操作
  status: draft
  level: high
  description: |
    检测管理员在非工作时间(22:00-06:00)执行敏感操作。
    敏感操作包括: 角色变更、配置修改、账号禁用等。
    这是内部威胁的重要指标。
  references:
    - https://attack.mitre.org/techniques/T1056/
  author: Threat Detection Engineer
  date: 2026/07/14
  tags:
    - attack.privilege_escalation
    - attack.t1056
  logsource:
    category: application
    product: itdesk
    service: audit
  detection:
    selection:
      action|IN:
        - role_change
        - config_change
        - account_disable
        - account_create_reset
        - data_export
    condition: |
      EXTRACT(HOUR FROM created_at) NOT BETWEEN 8 AND 22
      AND employee_id IN (
        SELECT employee_id FROM user_roles WHERE role = 'admin'
      )
  falsepositives:
    - 紧急故障处理
    - 定时任务执行
  fields:
    - employee_id
    - action
    - ip_address
    - created_at
  actions:
    - notify_security: webhook
    - require_mfa_verification: true

---
# 规则5: 外部服务异常 - Dify API高错误率
# 适用ATT&CK: T1071 (应用层协议)
---
- id: itdesk-T1071-001
  title: 外部服务异常 - Dify API高错误率
  status: draft
  level: medium
  description: |
    检测Dify AI服务的异常调用模式。
    当API错误率超过30%或响应时间超过30秒时触发告警。
  references:
    - https://attack.mitre.org/techniques/T1071/
  author: Threat Detection Engineer
  date: 2026/07/14
  tags:
    - attack.command_and_control
    - attack.t1071
  logsource:
    category: application
    product: itdesk
    service: dify
  detection:
    selection:
      service: 'dify'
    timeframe: 5m
    condition: |
      error_rate > 0.3 OR response_time_ms > 30000
  falsepositives:
    - Dify服务临时不可用
    - 网络抖动导致超时
  fields:
    - endpoint
    - error_count
    - total_count
    - avg_response_time
    - created_at
  actions:
    - switch_backup_channel: true
    - notify_security: webhook

---
# 规则6: 异常会话 - 异地登录
# 适用ATT&CK: T1078 (有效账户)
---
- id: itdesk-T1078-002
  title: 异常会话 - 异地登录
  status: draft
  level: medium
  description: |
    检测同一用户在短时间内从距离超过500km的不同位置登录。
    需要结合IP地理信息库进行判断。
  references:
    - https://attack.mitre.org/techniques/T1078/
  author: Threat Detection Engineer
  date: 2026/07/14
  tags:
    - attack.initial_access
    - attack.t1078
  logsource:
    category: application
    product: itdesk
    service: login
  detection:
    selection:
      result: 'success'
    timeframe: 30m
    condition: |
      DISTINCT ip_address >= 2
      AND ip_geolocation_distance > 500km
      GROUP BY employee_id
  falsepositives:
    - 用户使用VPN导致IP跳变
    - 移动设备切换网络
  fields:
    - employee_id
    - ip_address
    - login_source
    - created_at
  actions:
    - mark_suspicious: true
    - notify_security: webhook

---
# 规则7: API滥用 - 高频调用
# 适用ATT&CK: T1105 (入口工具传输)
---
- id: itdesk-T1105-001
  title: API滥用 - 高频调用
  status: draft
  level: high
  description: |
    检测特定API端点在短时间内被高频调用，可能是滥用或DDoS攻击。
    监控的端点包括管理后台敏感操作和数据查询接口。
  references:
    - https://attack.mitre.org/techniques/T1105/
  author: Threat Detection Engineer
  date: 2026/07/14
  tags:
    - attack.resource_development
    - attack.t1105
  logsource:
    category: application
    product: itdesk
    service: api
  detection:
    selection:
      path|IN:
        - /api/admin/roles/*
        - /api/admin/configs/*
        - /api/admin/agents/*
        - /api/admin/export/*
        - /api/employees/*
    timeframe: 1m
    condition: |
      COUNT(*) > 20
      GROUP BY employee_id, path
  falsepositives:
    - 批量数据导入任务
    - 正常的管理脚本
  fields:
    - employee_id
    - path
    - ip_address
    - request_count
  actions:
    - rate_limit: reduce
    - notify_security: webhook