Simon
313 lines
7.9 KiB
YAML
313 lines
7.9 KiB
YAML
# =============================================================================
|
|
# Sigma Detection Rules - IT智能服务台 (修订版)
|
|
# =============================================================================
|
|
# 适用于无密码登录系统（仅企微OAuth/扫码）
|
|
# 编译目标: PostgreSQL (审计日志查询)
|
|
# =============================================================================
|
|
|
|
---
|
|
# 规则1: Token异常使用 - 多IP使用
|
|
# 适用ATT&CK: T1078 (有效账户), T1552 (非安全凭据)
|
|
---
|
|
- id: itdesk-T1078-001
|
|
title: 凭证异常 - Token多IP使用
|
|
status: draft
|
|
level: high
|
|
description: |
|
|
检测同一Token在短时间内被多个不同IP地址使用，可能是Token泄露或中间人攻击。
|
|
当同一token_hash在1小时内出现3个及以上不同IP时触发告警。
|
|
references:
|
|
- https://attack.mitre.org/techniques/T1078/
|
|
- https://attack.mitre.org/techniques/T1552/
|
|
author: Threat Detection Engineer
|
|
date: 2026/07/14
|
|
tags:
|
|
- attack.initial_access
|
|
- attack.t1078
|
|
- attack.credential_access
|
|
- attack.t1552
|
|
logsource:
|
|
category: application
|
|
product: itdesk
|
|
service: token
|
|
detection:
|
|
selection:
|
|
event: 'token_used'
|
|
timeframe: 1h
|
|
condition: |
|
|
DISTINCT ip_address >= 3
|
|
GROUP BY token_hash
|
|
falsepositives:
|
|
- 用户使用VPN导致IP跳变
|
|
- 移动设备切换网络 (4G/WiFi)
|
|
fields:
|
|
- token_hash
|
|
- employee_id
|
|
- ip_address
|
|
- created_at
|
|
actions:
|
|
- invalidate_token: true
|
|
- notify_security: webhook
|
|
- suspend_user: pending_review
|
|
|
|
---
|
|
# 规则2: 越权访问检测
|
|
# 适用ATT&CK: T1068 (权限提升)
|
|
---
|
|
- id: itdesk-T1068-001
|
|
title: 权限提升 - 越权访问
|
|
status: draft
|
|
level: critical
|
|
description: |
|
|
检测用户尝试访问其角色无权访问的资源，可能是权限提升攻击。
|
|
当同一用户在10分钟内触发3次及以上RBAC拒绝时触发告警。
|
|
references:
|
|
- https://attack.mitre.org/techniques/T1068/
|
|
author: Threat Detection Engineer
|
|
date: 2026/07/14
|
|
tags:
|
|
- attack.privilege_escalation
|
|
- attack.t1068
|
|
logsource:
|
|
category: application
|
|
product: itdesk
|
|
service: rbac
|
|
detection:
|
|
selection:
|
|
event: 'access_denied'
|
|
reason: 'insufficient_permissions'
|
|
timeframe: 10m
|
|
condition: |
|
|
COUNT(*) >= 3
|
|
GROUP BY employee_id
|
|
falsepositives:
|
|
- 前端缓存导致的重复请求
|
|
- 正常的权限申请流程
|
|
fields:
|
|
- employee_id
|
|
- requested_resource
|
|
- user_role
|
|
- required_role
|
|
- created_at
|
|
actions:
|
|
- notify_security: webhook
|
|
- suspend_user: pending_review
|
|
|
|
---
|
|
# 规则3: 数据外传 - 批量导出检测
|
|
# 适用ATT&CK: T1041 (通过Web服务外传数据)
|
|
---
|
|
- id: itdesk-T1041-001
|
|
title: 数据泄露 - 批量导出
|
|
status: draft
|
|
level: high
|
|
description: |
|
|
检测用户执行大量数据导出操作，可能是数据外传的前兆。
|
|
当导出记录数超过1000条或导出文件大小超过100MB时触发告警。
|
|
references:
|
|
- https://attack.mitre.org/techniques/T1041/
|
|
author: Threat Detection Engineer
|
|
date: 2026/07/14
|
|
tags:
|
|
- attack.exfiltration
|
|
- attack.t1041
|
|
logsource:
|
|
category: application
|
|
product: itdesk
|
|
service: audit
|
|
detection:
|
|
selection:
|
|
action: 'data_export'
|
|
condition: |
|
|
record_count > 1000 OR export_size_mb > 100
|
|
falsepositives:
|
|
- 正常的报表导出任务
|
|
- 数据备份脚本
|
|
fields:
|
|
- employee_id
|
|
- export_type
|
|
- record_count
|
|
- export_size_mb
|
|
- ip_address
|
|
- created_at
|
|
actions:
|
|
- require_mfa_verification: true
|
|
- notify_security: webhook
|
|
|
|
---
|
|
# 规则4: 内部威胁 - 管理员非工作时间操作
|
|
# 适用ATT&CK: T1056 (权限滥用)
|
|
---
|
|
- id: itdesk-T1056-001
|
|
title: 内部威胁 - 管理员非工作时间操作
|
|
status: draft
|
|
level: high
|
|
description: |
|
|
检测管理员在非工作时间(22:00-06:00)执行敏感操作。
|
|
敏感操作包括: 角色变更、配置修改、账号禁用等。
|
|
这是内部威胁的重要指标。
|
|
references:
|
|
- https://attack.mitre.org/techniques/T1056/
|
|
author: Threat Detection Engineer
|
|
date: 2026/07/14
|
|
tags:
|
|
- attack.privilege_escalation
|
|
- attack.t1056
|
|
logsource:
|
|
category: application
|
|
product: itdesk
|
|
service: audit
|
|
detection:
|
|
selection:
|
|
action|IN:
|
|
- role_change
|
|
- config_change
|
|
- account_disable
|
|
- account_create_reset
|
|
- data_export
|
|
condition: |
|
|
EXTRACT(HOUR FROM created_at) NOT BETWEEN 8 AND 22
|
|
AND employee_id IN (
|
|
SELECT employee_id FROM user_roles WHERE role = 'admin'
|
|
)
|
|
falsepositives:
|
|
- 紧急故障处理
|
|
- 定时任务执行
|
|
fields:
|
|
- employee_id
|
|
- action
|
|
- ip_address
|
|
- created_at
|
|
actions:
|
|
- notify_security: webhook
|
|
- require_mfa_verification: true
|
|
|
|
---
|
|
# 规则5: 外部服务异常 - Dify API高错误率
|
|
# 适用ATT&CK: T1071 (应用层协议)
|
|
---
|
|
- id: itdesk-T1071-001
|
|
title: 外部服务异常 - Dify API高错误率
|
|
status: draft
|
|
level: medium
|
|
description: |
|
|
检测Dify AI服务的异常调用模式。
|
|
当API错误率超过30%或响应时间超过30秒时触发告警。
|
|
references:
|
|
- https://attack.mitre.org/techniques/T1071/
|
|
author: Threat Detection Engineer
|
|
date: 2026/07/14
|
|
tags:
|
|
- attack.command_and_control
|
|
- attack.t1071
|
|
logsource:
|
|
category: application
|
|
product: itdesk
|
|
service: dify
|
|
detection:
|
|
selection:
|
|
service: 'dify'
|
|
timeframe: 5m
|
|
condition: |
|
|
error_rate > 0.3 OR response_time_ms > 30000
|
|
falsepositives:
|
|
- Dify服务临时不可用
|
|
- 网络抖动导致超时
|
|
fields:
|
|
- endpoint
|
|
- error_count
|
|
- total_count
|
|
- avg_response_time
|
|
- created_at
|
|
actions:
|
|
- switch_backup_channel: true
|
|
- notify_security: webhook
|
|
|
|
---
|
|
# 规则6: 异常会话 - 异地登录
|
|
# 适用ATT&CK: T1078 (有效账户)
|
|
---
|
|
- id: itdesk-T1078-002
|
|
title: 异常会话 - 异地登录
|
|
status: draft
|
|
level: medium
|
|
description: |
|
|
检测同一用户在短时间内从距离超过500km的不同位置登录。
|
|
需要结合IP地理信息库进行判断。
|
|
references:
|
|
- https://attack.mitre.org/techniques/T1078/
|
|
author: Threat Detection Engineer
|
|
date: 2026/07/14
|
|
tags:
|
|
- attack.initial_access
|
|
- attack.t1078
|
|
logsource:
|
|
category: application
|
|
product: itdesk
|
|
service: login
|
|
detection:
|
|
selection:
|
|
result: 'success'
|
|
timeframe: 30m
|
|
condition: |
|
|
DISTINCT ip_address >= 2
|
|
AND ip_geolocation_distance > 500km
|
|
GROUP BY employee_id
|
|
falsepositives:
|
|
- 用户使用VPN导致IP跳变
|
|
- 移动设备切换网络
|
|
fields:
|
|
- employee_id
|
|
- ip_address
|
|
- login_source
|
|
- created_at
|
|
actions:
|
|
- mark_suspicious: true
|
|
- notify_security: webhook
|
|
|
|
---
|
|
# 规则7: API滥用 - 高频调用
|
|
# 适用ATT&CK: T1105 (入口工具传输)
|
|
---
|
|
- id: itdesk-T1105-001
|
|
title: API滥用 - 高频调用
|
|
status: draft
|
|
level: high
|
|
description: |
|
|
检测特定API端点在短时间内被高频调用，可能是滥用或DDoS攻击。
|
|
监控的端点包括管理后台敏感操作和数据查询接口。
|
|
references:
|
|
- https://attack.mitre.org/techniques/T1105/
|
|
author: Threat Detection Engineer
|
|
date: 2026/07/14
|
|
tags:
|
|
- attack.resource_development
|
|
- attack.t1105
|
|
logsource:
|
|
category: application
|
|
product: itdesk
|
|
service: api
|
|
detection:
|
|
selection:
|
|
path|IN:
|
|
- /api/admin/roles/*
|
|
- /api/admin/configs/*
|
|
- /api/admin/agents/*
|
|
- /api/admin/export/*
|
|
- /api/employees/*
|
|
timeframe: 1m
|
|
condition: |
|
|
COUNT(*) > 20
|
|
GROUP BY employee_id, path
|
|
falsepositives:
|
|
- 批量数据导入任务
|
|
- 正常的管理脚本
|
|
fields:
|
|
- employee_id
|
|
- path
|
|
- ip_address
|
|
- request_count
|
|
actions:
|
|
- rate_limit: reduce
|
|
- notify_security: webhook
|