Threat Hunting

Threat Hunting Skill

Overview

Threat hunting с использованием Sigma rules, detection engineering, анализ безопасности.

When to Use

• Проактивный поиск угроз
• Написание detection rules
• Анализ логов безопасности
• Incident response
• Security monitoring

Sigma Rules

Basic Structure

title: Suspicious PowerShell Execution
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects suspicious PowerShell command execution
author: Your Name
date: 2024/01/15
references:
    - https://attack.mitre.org/techniques/T1059/001/
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\powershell.exe'
        CommandLine|contains:
            - '-enc'
            - '-EncodedCommand'
            - 'bypass'
            - 'hidden'
    condition: selection
falsepositives:
    - Legitimate admin scripts
level: medium
tags:
    - attack.execution
    - attack.t1059.001

Common Detection Patterns

# String matching
detection:
    selection:
        CommandLine|contains: 'mimikatz'

# Multiple conditions
detection:
    selection1:
        Image|endswith: '\cmd.exe'
    selection2:
        CommandLine|contains:
            - 'whoami'
            - 'net user'
    condition: selection1 and selection2

# Exclusions
detection:
    selection:
        EventType: 'ProcessCreate'
    filter:
        User: 'SYSTEM'
    condition: selection and not filter

# Regex
detection:
    selection:
        CommandLine|re: '.*\.(ps1|bat|cmd).*-[eE].*'

Sigma Modifiers

Threat Categories

Execution (T1059)

title: Suspicious Script Execution
logsource:
    category: process_creation
detection:
    selection:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\cmd.exe'
            - '\wscript.exe'
            - '\cscript.exe'
        CommandLine|contains:
            - 'downloadstring'
            - 'invoke-expression'
            - 'iex'
            - 'bypass'
    condition: selection

Persistence (T1053)

title: Scheduled Task Creation
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4698
    filter:
        TaskName|contains:
            - 'Microsoft'
            - 'Windows'
    condition: selection and not filter

Defense Evasion (T1562)

title: Windows Defender Disabled
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 5001
    condition: selection
level: high

Credential Access (T1003)

title: LSASS Memory Access
logsource:
    category: process_access
    product: windows
detection:
    selection:
        TargetImage|endswith: '\lsass.exe'
        GrantedAccess|contains:
            - '0x1010'
            - '0x1410'
    filter:
        SourceImage|endswith:
            - '\wmiprvse.exe'
            - '\taskmgr.exe'
    condition: selection and not filter
level: critical

Log Sources

Windows Event Logs

Linux Logs

logsource:
    product: linux
    service: auditd
detection:
    selection:
        type: 'EXECVE'
        a0|contains: '/bin/bash'
        a1|contains: '-c'

Hunting Queries

Splunk

# Suspicious PowerShell
index=windows sourcetype=WinEventLog:Security EventCode=4688
| where match(CommandLine, "(?i)(invoke-expression|iex|downloadstring)")
| stats count by User, CommandLine, Computer

# Failed logins
index=windows sourcetype=WinEventLog:Security EventCode=4625
| stats count by src_ip, user
| where count > 10

# Rare processes
index=windows sourcetype=WinEventLog:Security EventCode=4688
| rare NewProcessName limit=20

Elastic/KQL

// Suspicious command lines
process.command_line: (*mimikatz* OR *sekurlsa* OR *kerberos*)

// Encoded PowerShell
process.name: "powershell.exe" AND
process.command_line: (*-enc* OR *-EncodedCommand*)

// Network connections to rare ports
event.category: "network" AND
destination.port: (4444 OR 5555 OR 8888)

Detection Engineering

Rule Development Process

1. HYPOTHESIS
   - What attack are we detecting?
   - MITRE ATT&CK technique?

2. DATA REQUIREMENTS
   - What logs needed?
   - Are they being collected?

3. LOGIC DEVELOPMENT
   - Write Sigma rule
   - Test against known-bad

4. TESTING
   - Atomic Red Team simulation
   - Check false positives

5. TUNING
   - Add exclusions
   - Adjust thresholds

6. DEPLOYMENT
   - Convert to SIEM format
   - Set alerting

Sigma to SIEM Conversion

# Install sigmac
pip install sigma-cli

# Convert to Splunk
sigma convert -t splunk rule.yml

# Convert to Elastic
sigma convert -t elasticsearch rule.yml

# Convert to QRadar
sigma convert -t qradar rule.yml

Python Sigma Parser

from sigma.parser.rule import SigmaRule
from sigma.backends.splunk import SplunkBackend

def convert_sigma_to_splunk(rule_path: str) -> str:
    """Convert Sigma rule to Splunk query"""
    with open(rule_path, 'r') as f:
        rule = SigmaRule.from_yaml(f.read())

    backend = SplunkBackend()
    return backend.generate(rule)

def validate_sigma_rule(rule_path: str) -> dict:
    """Validate Sigma rule syntax"""
    try:
        with open(rule_path, 'r') as f:
            rule = SigmaRule.from_yaml(f.read())
        return {
            "valid": True,
            "title": rule.title,
            "level": rule.level,
            "tags": rule.tags
        }
    except Exception as e:
        return {
            "valid": False,
            "error": str(e)
        }

Atomic Red Team Testing

# Install Atomic Red Team
IEX (IWR 'https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/install-atomicredteam.ps1' -UseBasicParsing)

# Run specific test
Invoke-AtomicTest T1059.001 -TestNumbers 1

# Run and generate logs
Invoke-AtomicTest T1003.001 -GetPrereqs
Invoke-AtomicTest T1003.001 -TestNumbers 1,2,3

# Cleanup
Invoke-AtomicTest T1059.001 -Cleanup

Hunting Playbook Template

# Threat Hunt: [Name]

## Hypothesis
Based on [intelligence/observation], we believe [threat actor/technique]
may be present in our environment.

## MITRE ATT&CK
- Technique: [T1xxx]
- Tactic: [Tactic name]

## Data Sources Required
- [ ] Windows Security Events
- [ ] Sysmon
- [ ] Network logs
- [ ] EDR telemetry

## Detection Logic

### Query 1: [Description]
```query
[SIEM query here]

Query 2: [Description]

[Query here]

Investigation Steps

1. Run queries
2. Analyze results
3. Pivot on IOCs
4. Document findings

Findings

Recommendations

1. [Recommendation 1]
2. [Recommendation 2]

IOCs Discovered

• IP: [x.x.x.x]
• Hash: [SHA256]
• Domain: [domain.com]

## Tips

1. **Start with hypothesis** - что ищем?
2. **Know your baseline** - что "нормально"
3. **Use MITRE ATT&CK** - структурируй охоту
4. **Document everything** - для повторяемости
5. **Tune rules** - уменьшай false positives
6. **Automate testing** - Atomic Red Team
7. **Share intelligence** - community rules