Pentest Detection

pentest-detection

Defansif detection rule yazimi. Pentest bulgularini detection rule'a cevirir — gelecekteki saldirilari yakalamak icin.

Triggers

• "Sigma rule yaz"
• "Splunk SPL query"
• "KQL hunting query"
• "Sentinel rule"
• "YARA imza"
• "Suricata kural"
• "detection coverage analizi"

Sigma (Vendor-Agnostic)

title: Suspicious PowerShell Encoded Command Execution
id: 12345678-1234-1234-1234-1234567890ab
status: experimental
description: Detects PowerShell with -EncodedCommand flag, common in payloads
references:
  - https://attack.mitre.org/techniques/T1059/001/
author: Security Team
date: 2026/05/15
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  product: windows
  service: powershell
  category: process_creation
detection:
  selection:
    EventID: 4104
    ScriptBlockText|contains:
      - '-EncodedCommand'
      - '-enc '
      - '-e '
  filter:
    User|startswith: 'NT AUTHORITY\SYSTEM'
  condition: selection and not filter
falsepositives:
  - Legitimate admin scripts
level: high

Splunk SPL

index=windows EventCode=4104
| where match(ScriptBlockText, "-EncodedCommand|-enc\s|-e\s")
| stats count by Computer, User, ScriptBlockText
| where count > 1
| sort -count

Elastic KQL

event.code:"4104"
AND powershell.file.script_block_text:(*-EncodedCommand* OR *-enc * OR *-e *)
AND NOT user.name:"SYSTEM"

Microsoft Sentinel KQL

SecurityEvent
| where EventID == 4104
| where EventData has_any ("-EncodedCommand", "-enc ", "-e ")
| where Account != "NT AUTHORITY\\SYSTEM"
| summarize count() by Computer, Account, EventData
| where count_ > 0

YARA (Malware/File Imza)

rule SuspiciousPowerShellLoader {
    meta:
        author = "Security Team"
        date = "2026-05-15"
        description = "Detects PowerShell with base64 + IEX pattern"
        tags = "attack.t1059.001"

    strings:
        $iex = "IEX" nocase
        $invoke = "Invoke-Expression" nocase
        $b64 = /[A-Za-z0-9+\/]{50,}={0,2}/   // base64 blob >= 50 char
        $download = "DownloadString" nocase
        $bypass = "ExecutionPolicy Bypass" nocase

    condition:
        ($iex or $invoke) and $b64 and ($download or $bypass)
}

Suricata (Network IDS)

alert http any any -> any any (msg:"Possible SQL Injection in URI"; \
  flow:established,to_server; \
  http.uri; content:"' OR '1"; nocase; \
  classtype:web-application-attack; sid:1000001; rev:1;)

alert dns any any -> any any (msg:"DNS Query to Suspicious DGA Domain"; \
  dns.query; content:"|"; depth:30; pcre:"/^[a-z0-9]{20,}\.(com|net)$/i"; \
  classtype:trojan-activity; sid:1000002; rev:1;)

Detection Coverage Mapping

Pentest sonrasi her bulguyu detection rule'a esle:

finding: BloodHound LDAP enumeration
mitre: T1087.002 (Account Discovery: Domain Account)
detection:
  - sigma:
      file: bloodhound_ldap_query.yml
      query: large_ldap_query_pattern
  - splunk: |
      index=windows EventCode=4662
      | where ObjectName="DC=*"
      | stats count by SubjectUserName
      | where count > 1000
  - sentinel: |
      SecurityEvent
      | where EventID == 4662
      | where ObjectName contains "DC="
      | summarize count() by Account
      | where count_ > 1000

Atomic Red Team Mapping

ART tests'i pentest bulgularina hizalama:

# Pentest bulgu: PsExec lateral
# ART test: T1021.002 - Test 1 (PsExec.exe)

# Detection test
Invoke-AtomicTest T1021.002-1

# SIEM'de query calistir, hit gelmesi gerekli
# Hit gelmiyorsa coverage gap

Detection Rule Test Strategy

1. Pozitif test: simulated attack -> rule fires
2. Negatif test: normal activity -> no false positive
3. Tuning: baseline 7-30 gun, false positive rate hesap
4. Aksiyon: low confidence -> alert only, high -> auto-isolate

Output Sablonu

## Detection Coverage — <engagement>

### Bulgu -> Detection Rule
| Bulgu | ATT&CK | Sigma | Splunk | Sentinel | Coverage |
|-------|--------|-------|--------|----------|----------|
| Kerberoast | T1558.003 | DC1234 | yes | yes | FULL |
| PsExec lateral | T1021.002 | DC1235 | yes | no | PARTIAL |
| BloodHound LDAP | T1087.002 | (new) | (new) | (new) | NEW |
| DCSync | T1003.006 | DC1236 | yes | yes | FULL |

### Gap Analiz
- BloodHound LDAP enum: hicbir SIEM'de coverage YOK
  -> Yeni Sigma rule oner (bu rapor ekinde)
- PsExec: Sentinel'de yok
  -> Sentinel detection rule template yaz

### Test
- Atomic Red Team T1021.002-1 -> Splunk: HIT, Sentinel: MISS
- Recommended action: Sentinel detection rule ship

Out-of-Scope

• Production SIEM degisikligi (sadece rule yazimi, deployment musteri)
• Real-time blue team operasyonu