尧图网页设计 
使用 Splunk 与 SPL 分析 Windows 事件日志从暴力破解检测到取证时间线构建【免费下载链接】Anthropic-Cybersecurity-Skills817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATTCK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF MITRE F3 (Fight Fraud) · agentskills.io standard · Works with Claude Code, GitHub Copilot, Codex CLI, Cursor, Gemini CLI 20 platforms · 29 security domains · Apache 2.0项目地址: https://gitcode.com/GitHub_Trending/an/Anthropic-Cybersecurity-Skills导读本文是一份面向 SOC 分析师、检测工程师与事件响应人员的实战指南核心主题是基于 Splunk SPL 查询分析 Windows Security、System 与 Sysmon 事件日志覆盖认证攻击检测、权限提升、持久化机制、横向移动四大 ATTCK 战术域并最终沉淀为可复用的取证时间线与参考查表。该能力在 Anthropic-Cybersecurity-Skills 仓库中由 skills/analyzing-windows-event-logs-in-splunk/SKILL.md 完整承载配套提供 Python 自动化检测 Agent 与 API 参考文档。读完本文你将掌握 15 条可复制可运行的 SPL 检测查询、Windows/Sysmon 关键事件 ID 的语义以及将检测结果映射到 MITRE ATTCK 技术编号的完整方法。使用场景与适用边界该技能面向以下典型场景SOC 分析师调查告警与 Windows 认证、进程执行或 Active Directory 变更相关的告警需要深入取证时检测工程师编写检测规则基于 Windows 事件日志构建 SPL 检测查询落地威胁检测用例事件响应人员构建取证时间线还原 Windows 终端或域控制器上攻击者完整的活动路径周期性威胁狩猎针对 Windows 特有的 ATTCK 技术进行定向狩猎。明确不适用的边界本技能不适用于 Linux/macOS 终端分析也不适用于纯网络侧无主机事件的取证调查。前置条件与数据接入在运行任何检测查询之前需要确认以下数据链路已经打通前置条件说明Splunk 已接入 Windows 事件日志sourcetype 至少包含WinEventLog:Security、WinEventLog:SystemSysmon 日志使用XmlWinEventLog:Microsoft-Windows-Sysmon/OperationalSysmon 已部署到终端建议使用 SwiftOnSecurity 或 Olaf Hartong 的公开配置以获取进程、网络与文件活动的高保真日志Splunk CIM 数据模型加速建议启用 Endpoint 与 Authentication 两个数据模型的加速便于跨数据源归一化查询基础知识熟悉 Windows Security Event ID 与 Sysmon 事件类型的语义可参考下文关键概念表从部署架构看Windows 事件通常通过 Windows Event Forwarding (WEF) 集中到收集服务器后再进入 SplunkSysmon 提供比原生安全日志更细粒度的进程、网络与文件活动记录二者互补构成了安全日志 行为日志的双通道数据源这正是后续检测查询得以交叉验证的基础。六步检测工作流整个分析流程分为六个步骤认证攻击检测 → 权限提升检测 → 持久化检测 → 横向移动检测 → 取证时间线构建 → 参考查表建设。每一步都对应明确的 ATTCK 技术编号可直接落地为检测用例。Step 1认证攻击检测T1110暴力破解检测EventCode 4625 — 登录失败该查询以src_ip、Logon_Type、Status三个维度聚合失败登录事件通过Logon_Type判别攻击面网络、RDP 或本机交互并通过Status状态码解释失败原因indexwineventlog sourcetypeWinEventLog:Security EventCode4625 | stats count, dc(TargetUserName) AS unique_users, values(TargetUserName) AS targeted_users by src_ip, Logon_Type, Status | where count 20 | eval attack_type case( Logon_Type3, Network Brute Force, Logon_Type10, RDP Brute Force, Logon_Type2, Interactive Brute Force, 11, Other ) | eval status_meaning case( Status0xc000006d, Bad Username or Password, Status0xc000006a, Incorrect Password (valid user), Status0xc0000234, Account Locked Out, Status0xc0000072, Account Disabled, 11, Status ) | sort - count | table src_ip, attack_type, status_meaning, count, unique_users, targeted_users密码喷洒检测密码喷洒的典型特征是单源 IP 在短时间内对大量账户各尝试少量密码因此判断条件是唯一用户数多、但总尝试次数不显著高于用户数indexwineventlog sourcetypeWinEventLog:Security EventCode4625 Logon_Type3 | bin _time span10m | stats dc(TargetUserName) AS unique_users, count AS total_attempts, values(TargetUserName) AS users_targeted by src_ip, _time | where unique_users 10 AND total_attempts unique_users * 3 | eval spray_confidence if(unique_users 25, HIGH, MEDIUM)失败后成功的登录账户失陷指标攻击者暴力破解成功后必然伴随一次成功登录4624该查询以失败次数 10 且存在成功为判据并计算从首次失败到成功的时间差time_to_success时间越短说明口令猜测越高效、失陷风险越高indexwineventlog sourcetypeWinEventLog:Security (EventCode4625 OR EventCode4624) src_ip!127.0.0.1 | sort _time | stats earliest(_time) AS first_seen, latest(_time) AS last_seen, sum(eval(if(EventCode4625,1,0))) AS failures, sum(eval(if(EventCode4624,1,0))) AS successes by src_ip, TargetUserName, ComputerName | where failures 10 AND successes 0 | eval time_to_success round((last_seen - first_seen)/60, 1) | sort - failuresStep 2权限提升检测新建管理员账户T1136.001通过 4720账户创建左连接 4732加入 Administrators 组两个事件直接定位创建即提权的可疑账户indexwineventlog sourcetypeWinEventLog:Security EventCode4720 | join TargetUserName typeleft [ search indexwineventlog EventCode4732 TargetUserNameAdministrators | rename MemberName AS TargetUserName ] | table _time, SubjectUserName, TargetUserName, ComputerName | eval alert New account created and added to Administrators group特殊权限分配EventCode 4672先剔除 SYSTEM、LOCAL SERVICE、NETWORK SERVICE 等合法服务账户再聚焦SeDebugPrivilege、SeTcbPrivilege、SeBackupPrivilege、SeRestorePrivilege、SeAssignPrimaryTokenPrivilege这五类高风险特权——这些特权常被攻击者用于注入、令牌模拟或备份密钥窃取indexwineventlog sourcetypeWinEventLog:Security EventCode4672 SubjectUserName!SYSTEM SubjectUserName!LOCAL SERVICE SubjectUserName!NETWORK SERVICE | stats count, values(PrivilegeList) AS privileges by SubjectUserName, ComputerName | where count 0 | search privileges IN (SeDebugPrivilege, SeTcbPrivilege, SeBackupPrivilege, SeRestorePrivilege, SeAssignPrimaryTokenPrivilege)令牌操纵检测T1134借助 Sysmon EventCode 10进程访问监控对lsass.exe的可疑句柄请求。GrantedAccess中的0x1010读取、0x1038读取查询、0x1fffff完全控制、0x40进程查询均与 Mimikatz 等凭据窃取工具的典型请求模式相符同时排除系统合法进程以降低误报indexsysmon EventCode10 TargetImage*\\lsass.exe GrantedAccess IN (0x1010, 0x1038, 0x1fffff, 0x40) | stats count by SourceImage, SourceUser, Computer, GrantedAccess | where NOT match(SourceImage, (svchost|csrss|wininit|MsMpEng|CrowdStrike)) | sort - countStep 3持久化机制检测计划任务创建T1053.005同时覆盖两条数据链路——Security 日志的 4698计划任务创建与 Sysmon 的进程创建事件检测schtasks.exe执行并用coalesce合并字段后过滤包含 PowerShell、cmd、HTTP 或 Temp 目录特征的任务内容indexwineventlog (sourcetypeWinEventLog:Security EventCode4698) OR (sourcetypeXmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode1 Image*\\schtasks.exe) | eval task_info coalesce(TaskContent, CommandLine) | search task_info*powershell* OR task_info*cmd* OR task_info*http* OR task_info*\\Temp\\* | table _time, Computer, SubjectUserName, TaskName, task_info注册表 Run 键修改T1547.001监控 Sysmon EventCode 13注册表值设置覆盖Run、RunOnce、RunServices及Explorer\Shell Folders四类自启动位置并排除 explorer、msiexec、setup 等合法写入方indexsysmon EventCode13 TargetObject IN ( *\\CurrentVersion\\Run\\*, *\\CurrentVersion\\RunOnce\\*, *\\CurrentVersion\\RunServices\\*, *\\Explorer\\Shell Folders\\* ) | stats count by Computer, Image, TargetObject, Details | where NOT match(Image, (explorer\.exe|msiexec\.exe|setup\.exe)) | sort - countWMI 事件订阅T1546.003WMI 持久化是典型的无文件攻击手段Sysmon EventCode 20WMI 事件活动与 21WMI 过滤器绑定直接暴露攻击者注册的恶意消费者与命名空间indexsysmon EventCode20 OR EventCode21 | stats count by Computer, Operation, Consumer, EventNamespace | where count 0Step 4横向移动检测远程服务利用T1021.002 — SMB/Windows 管理共享以单一来源账户登录目标主机数超过 3 台为异常基线识别 SMB 共享驱动的批量横向移动indexwineventlog sourcetypeWinEventLog:Security EventCode4624 Logon_Type3 | stats dc(ComputerName) AS unique_destinations, values(ComputerName) AS targets by src_ip, TargetUserName | where unique_destinations 3 | sort - unique_destinations | table src_ip, TargetUserName, unique_destinations, targetsPsExec 检测T1021.002PsExec 家族的指纹特征集中在进程名psexec.exe、服务端psexesvc.exe与编译原始文件名psexec.c三处任一路径命中即可告警indexsysmon EventCode1 (Image*\\psexec.exe OR Image*\\psexesvc.exe OR ParentImage*\\psexesvc.exe OR OriginalFileNamepsexec.c) | table _time, Computer, User, ParentImage, Image, CommandLineRDP 横向移动T1021.001通过 Logon_Type10远程交互登录聚合 RDP 登录目标数单账户访问超过 2 台主机即触发indexwineventlog sourcetypeWinEventLog:Security EventCode4624 Logon_Type10 | stats count, dc(ComputerName) AS rdp_targets, values(ComputerName) AS destinations by src_ip, TargetUserName | where rdp_targets 2 | sort - rdp_targetsStep 5构建取证时间线针对被入侵主机示例为WORKSTATION-042跨 Security 与 Sysmon 两个索引构建统一事件视图将原始事件编号翻译为人类可读的描述登录、进程、网络、文件、注册表等按时间排序后即为完整的攻击活动时间线(indexwineventlog OR indexsysmon) ComputerWORKSTATION-042 earliest2024-03-14T00:00:00 latest2024-03-16T00:00:00 | eval event_description case( EventCode4624, Logon: .TargetUserName. (Type .Logon_Type.), EventCode4625, Failed Logon: .TargetUserName, EventCode4688 OR (sourcetypeXmlWinEventLog:*Sysmon* AND EventCode1), Process: .Image. CMD: .CommandLine, EventCode4698, Scheduled Task: .TaskName, EventCode3, Network: .DestinationIp.:.DestinationPort, EventCode11, File Created: .TargetFilename, EventCode13, Registry: .TargetObject, 11, Event .EventCode ) | sort _time | table _time, EventCode, event_description, User, src_ipStep 6创建参考查表用于富化为每个事件 ID 建立描述 ATTCK 技术 严重级别的上下文映射供检测结果即时富化| inputlookup windows_eventcode_lookup.csv | table EventCode, Description, ATT_CK_Technique, Severity若查表不存在可按以下格式创建windows_eventcode_lookup.csvEventCode,Description,ATT_CK_Technique,Severity 4624,Successful Logon,T1078,Informational 4625,Failed Logon,T1110,Low 4648,Explicit Credential Logon,T1078,Medium 4672,Special Privileges Assigned,T1134,Medium 4688,New Process Created,T1059,Informational 4698,Scheduled Task Created,T1053.005,Medium 4720,User Account Created,T1136.001,High 4732,Member Added to Security Group,T1098,High 4768,Kerberos TGT Requested,T1558,Informational 4769,Kerberos Service Ticket,T1558.003,Low 4771,Kerberos Pre-Auth Failed,T1110,Low关键概念速查术语定义EventCode 4624成功登录事件 —— Logon_Type 2交互、3网络、10RDP、7解锁EventCode 4625失败登录事件 —— Status 状态码指示失败原因密码错误、账户锁定、账户禁用Sysmon EventCode 1进程创建事件包含完整命令行、父进程与哈希信息Sysmon EventCode 3进程发起的网络连接事件 —— 源/目标 IP、端口与进程上下文Logon Type 3网络登录SMB、WMI、PowerShell Remoting—— 横向移动的关键指标Logon Type 10通过 RDP/终端服务的远程交互登录登录类型全景来自 API 参考文档Type描述上下文2Interactive本地控制台登录3NetworkSMB、WMI、PowerShell Remoting7Unlock工作站解锁9NewCredentialsrunas /netonly10RemoteInteractiveRDP 登录Sysmon 关键事件 ID1进程创建、3网络连接、7镜像加载/DLL、10进程访问——LSASS 凭据窃取、11文件创建、13注册表值设置、22DNS 查询。常见攻击场景的检测要点KerberoastingT1558.003检测 EventCode 4769 中加密类型为 0x17RC4且服务名非krbtgt的票据请求——这通常意味着攻击者在离线破解服务账户哈希DCSyncT1003.006检测 EventCode 4662 中对象类型为domainDNS且属性包含Replicating Directory Changes的非域控来源——这是目录复制权限被滥用的直接证据黄金票据T1558.001检测 EventCode 4769 中票据属性异常过长的票据寿命、非标准加密类型Pass-the-HashT1550.002检测 EventCode 4624 中来自异常来源、使用 NTLM 认证的 Logon_Type 3 网络登录DLL 侧加载T1574.002Sysmon EventCode 7 显示合法进程加载了未签名 DLL。从人工查询到自动化 Agent源码级实现仓库为上述手工 SPL 查询提供了完整的 Python 自动化实现见 scripts/agent.py。其设计结构为连接 → 检测函数 → 全量狩猎每个检测函数与本文的 SPL 查询一一对应连接与搜索基座基于splunklib.client建立连接支持环境变量SPLUNK_HOST、SPLUNK_PORT、SPLUNK_USERNAME、SPLUNK_PASSWORD注入并通过exec_modeblocking提交阻塞式搜索任务以 JSON 格式读取结果import splunklib.client as client import splunklib.results as results def connect(host, port, username, password): return client.connect( hosthost, portport, usernameusername, passwordpassword, autologinTrue ) def search(service, query, earliest-24h, latestnow): job service.jobs.create( fsearch {query}, **{earliest_time: earliest, latest_time: latest, exec_mode: blocking} ) reader results.JSONResultsReader(job.results(output_modejson)) rows [r for r in reader if isinstance(r, dict)] job.cancel() return rows检测函数与 SPL 的对应关系Agent 函数对应检测能力默认时间窗阈值参数detect_brute_force暴力破解4625 按登录类型分类-24hthreshold20detect_password_spray密码喷洒10 分钟桶-24hunique_users 10detect_new_admin_accounts新建管理员账户T1136.001-7d—detect_lsass_accessLSASS 凭据窃取T1003.001-24hGrantedAccess 白名单detect_lateral_movement_smbSMB 横向移动T1021.002-24h目标主机 3detect_psexecPsExec 执行T1021.002-24h—build_forensic_timeline主机取证时间线由--hostname指定—命令行用法通过--action参数选择单项检测或full_hunt全量狩猎--hostname指定取证时间线的目标主机# 全量狩猎默认动作 python3 scripts/agent.py --host splunk --port 8089 --username admin --password $SPLUNK_PASSWORD --action full_hunt # 仅检测暴力破解自定义阈值 python3 scripts/agent.py --action brute_force --earliest -48h # 构建指定主机的取证时间线 python3 scripts/agent.py --action timeline --hostname WORKSTATION-042 --earliest -7d执行结果以 JSON 输出包含generated_at时间戳与按检测类型分组的 findings 结构便于下游 SOAR 或工单系统消费。框架映射ATTCK、NIST CSF 与 D3FEND该技能在仓库中被系统化地映射到多个安全框架见 SKILL.md 的 YAML frontmatter这使其既可作为检测用例库也可作为合规覆盖证据MITRE ATTCKT1110暴力破解、T1053.005计划任务、T1547.001注册表 Run 键、T1021.002SMB/Windows 管理共享、T1558.003Kerberoasting、T1003.006DCSync等NIST CSF 2.0DE.CM-01持续监控、DE.AE-02异常事件分析、DE.AE-06关联信息形成分析结论、RS.MA-01指示器分析D3FENDRestore Access、Password Authentication、Strong Password Policy、Restore User Account Access 等防御计数。仓库级覆盖证据可在 ATTACK_COVERAGE.md 中交叉验证本技能在 T1078、T1110、T1136.001、T1546.003、T1547.001、T1558.003、T1021.002 等多个技术上被列为覆盖技能之一且与building-detection-rule-with-splunk-spl、detecting-lateral-movement-with-splunk、detecting-dcsync-attack-in-active-directory等相邻技能构成互补的检测能力簇详见 mappings/mitre-attack/README.md 的技术映射方法论与 mappings/attack-navigator-layer.json 的覆盖可视化层。输出格式与报告模板分析完成后建议按以下结构化模板输出结论将统计数字、可疑发现与 ATTCK 映射整合为可直接进入工单或复盘报告的结果WINDOWS EVENT LOG ANALYSIS — HOST: WORKSTATION-042 ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ Period: 2024-03-14 to 2024-03-15 Events: 12,847 total (Security: 9,231 | Sysmon: 3,616) Authentication Summary: Successful Logons (4624): 487 (Type 3: 312, Type 10: 45, Type 2: 130) Failed Logons (4625): 847 (from 192.168.1.105 — BRUTE FORCE) Explicit Creds (4648): 12 Suspicious Findings: [HIGH] 847 failed logons followed by success at 14:35 from 192.168.1.105 [HIGH] New user backdoor_admin created (4720) at 14:38 [HIGH] User added to Administrators group (4732) at 14:38 [MEDIUM] schtasks.exe creating persistence task at 14:42 [MEDIUM] PowerShell encoded command execution at 14:45 ATTCK Mapping: T1110.001 — Password Guessing (847 failed logons) T1136.001 — Local Account Creation (backdoor_admin) T1053.005 — Scheduled Task (persistence) T1059.001 — PowerShell (encoded execution)小结本文以 SKILL.md 为骨架完整覆盖了 Windows 事件日志分析的六步实战工作流从 4624/4625 认证事件识别暴力破解与密码喷洒经 4672/4720/4698/1547 等事件定位提权与持久化再以 Logon_Type 3/10 与 Sysmon 事件 1/10 追踪横向移动最后通过跨索引时间线与事件 ID 查表完成取证闭环。配合仓库中的 自动化 Agent 脚本SOC 团队可以将这些检测逻辑从手工查询升级为可定时执行的批量狩猎任务借助 ATTCK 覆盖 与 NIST CSF 对齐这些检测用例同时具备威胁知情的防御价值与合规审计价值。【免费下载链接】Anthropic-Cybersecurity-Skills817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATTCK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF MITRE F3 (Fight Fraud) · agentskills.io standard · Works with Claude Code, GitHub Copilot, Codex CLI, Cursor, Gemini CLI 20 platforms · 29 security domains · Apache 2.0项目地址: https://gitcode.com/GitHub_Trending/an/Anthropic-Cybersecurity-Skills创作声明：本文部分内容由AI辅助生成（AIGC），仅供参考 使用 Splunk 与 SPL 分析 Windows 事件日志：从暴力破解检测到取证时间线构建
使用 Splunk 与 SPL 分析 Windows 事件日志从暴力破解检测到取证时间线构建【免费下载链接】Anthropic-Cybersecurity-Skills817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATTCK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF MITRE F3 (Fight Fraud) · agentskills.io standard · Works with Claude Code, GitHub Copilot, Codex CLI, Cursor, Gemini CLI 20 platforms · 29 security domains · Apache 2.0项目地址: https://gitcode.com/GitHub_Trending/an/Anthropic-Cybersecurity-Skills导读本文是一份面向 SOC 分析师、检测工程师与事件响应人员的实战指南核心主题是基于 Splunk SPL 查询分析 Windows Security、System 与 Sysmon 事件日志覆盖认证攻击检测、权限提升、持久化机制、横向移动四大 ATTCK 战术域并最终沉淀为可复用的取证时间线与参考查表。该能力在 Anthropic-Cybersecurity-Skills 仓库中由 skills/analyzing-windows-event-logs-in-splunk/SKILL.md 完整承载配套提供 Python 自动化检测 Agent 与 API 参考文档。读完本文你将掌握 15 条可复制可运行的 SPL 检测查询、Windows/Sysmon 关键事件 ID 的语义以及将检测结果映射到 MITRE ATTCK 技术编号的完整方法。使用场景与适用边界该技能面向以下典型场景SOC 分析师调查告警与 Windows 认证、进程执行或 Active Directory 变更相关的告警需要深入取证时检测工程师编写检测规则基于 Windows 事件日志构建 SPL 检测查询落地威胁检测用例事件响应人员构建取证时间线还原 Windows 终端或域控制器上攻击者完整的活动路径周期性威胁狩猎针对 Windows 特有的 ATTCK 技术进行定向狩猎。明确不适用的边界本技能不适用于 Linux/macOS 终端分析也不适用于纯网络侧无主机事件的取证调查。前置条件与数据接入在运行任何检测查询之前需要确认以下数据链路已经打通前置条件说明Splunk 已接入 Windows 事件日志sourcetype 至少包含WinEventLog:Security、WinEventLog:SystemSysmon 日志使用XmlWinEventLog:Microsoft-Windows-Sysmon/OperationalSysmon 已部署到终端建议使用 SwiftOnSecurity 或 Olaf Hartong 的公开配置以获取进程、网络与文件活动的高保真日志Splunk CIM 数据模型加速建议启用 Endpoint 与 Authentication 两个数据模型的加速便于跨数据源归一化查询基础知识熟悉 Windows Security Event ID 与 Sysmon 事件类型的语义可参考下文关键概念表从部署架构看Windows 事件通常通过 Windows Event Forwarding (WEF) 集中到收集服务器后再进入 SplunkSysmon 提供比原生安全日志更细粒度的进程、网络与文件活动记录二者互补构成了安全日志 行为日志的双通道数据源这正是后续检测查询得以交叉验证的基础。六步检测工作流整个分析流程分为六个步骤认证攻击检测 → 权限提升检测 → 持久化检测 → 横向移动检测 → 取证时间线构建 → 参考查表建设。每一步都对应明确的 ATTCK 技术编号可直接落地为检测用例。Step 1认证攻击检测T1110暴力破解检测EventCode 4625 — 登录失败该查询以src_ip、Logon_Type、Status三个维度聚合失败登录事件通过Logon_Type判别攻击面网络、RDP 或本机交互并通过Status状态码解释失败原因indexwineventlog sourcetypeWinEventLog:Security EventCode4625 | stats count, dc(TargetUserName) AS unique_users, values(TargetUserName) AS targeted_users by src_ip, Logon_Type, Status | where count 20 | eval attack_type case( Logon_Type3, Network Brute Force, Logon_Type10, RDP Brute Force, Logon_Type2, Interactive Brute Force, 11, Other ) | eval status_meaning case( Status0xc000006d, Bad Username or Password, Status0xc000006a, Incorrect Password (valid user), Status0xc0000234, Account Locked Out, Status0xc0000072, Account Disabled, 11, Status ) | sort - count | table src_ip, attack_type, status_meaning, count, unique_users, targeted_users密码喷洒检测密码喷洒的典型特征是单源 IP 在短时间内对大量账户各尝试少量密码因此判断条件是唯一用户数多、但总尝试次数不显著高于用户数indexwineventlog sourcetypeWinEventLog:Security EventCode4625 Logon_Type3 | bin _time span10m | stats dc(TargetUserName) AS unique_users, count AS total_attempts, values(TargetUserName) AS users_targeted by src_ip, _time | where unique_users 10 AND total_attempts unique_users * 3 | eval spray_confidence if(unique_users 25, HIGH, MEDIUM)失败后成功的登录账户失陷指标攻击者暴力破解成功后必然伴随一次成功登录4624该查询以失败次数 10 且存在成功为判据并计算从首次失败到成功的时间差time_to_success时间越短说明口令猜测越高效、失陷风险越高indexwineventlog sourcetypeWinEventLog:Security (EventCode4625 OR EventCode4624) src_ip!127.0.0.1 | sort _time | stats earliest(_time) AS first_seen, latest(_time) AS last_seen, sum(eval(if(EventCode4625,1,0))) AS failures, sum(eval(if(EventCode4624,1,0))) AS successes by src_ip, TargetUserName, ComputerName | where failures 10 AND successes 0 | eval time_to_success round((last_seen - first_seen)/60, 1) | sort - failuresStep 2权限提升检测新建管理员账户T1136.001通过 4720账户创建左连接 4732加入 Administrators 组两个事件直接定位创建即提权的可疑账户indexwineventlog sourcetypeWinEventLog:Security EventCode4720 | join TargetUserName typeleft [ search indexwineventlog EventCode4732 TargetUserNameAdministrators | rename MemberName AS TargetUserName ] | table _time, SubjectUserName, TargetUserName, ComputerName | eval alert New account created and added to Administrators group特殊权限分配EventCode 4672先剔除 SYSTEM、LOCAL SERVICE、NETWORK SERVICE 等合法服务账户再聚焦SeDebugPrivilege、SeTcbPrivilege、SeBackupPrivilege、SeRestorePrivilege、SeAssignPrimaryTokenPrivilege这五类高风险特权——这些特权常被攻击者用于注入、令牌模拟或备份密钥窃取indexwineventlog sourcetypeWinEventLog:Security EventCode4672 SubjectUserName!SYSTEM SubjectUserName!LOCAL SERVICE SubjectUserName!NETWORK SERVICE | stats count, values(PrivilegeList) AS privileges by SubjectUserName, ComputerName | where count 0 | search privileges IN (SeDebugPrivilege, SeTcbPrivilege, SeBackupPrivilege, SeRestorePrivilege, SeAssignPrimaryTokenPrivilege)令牌操纵检测T1134借助 Sysmon EventCode 10进程访问监控对lsass.exe的可疑句柄请求。GrantedAccess中的0x1010读取、0x1038读取查询、0x1fffff完全控制、0x40进程查询均与 Mimikatz 等凭据窃取工具的典型请求模式相符同时排除系统合法进程以降低误报indexsysmon EventCode10 TargetImage*\\lsass.exe GrantedAccess IN (0x1010, 0x1038, 0x1fffff, 0x40) | stats count by SourceImage, SourceUser, Computer, GrantedAccess | where NOT match(SourceImage, (svchost|csrss|wininit|MsMpEng|CrowdStrike)) | sort - countStep 3持久化机制检测计划任务创建T1053.005同时覆盖两条数据链路——Security 日志的 4698计划任务创建与 Sysmon 的进程创建事件检测schtasks.exe执行并用coalesce合并字段后过滤包含 PowerShell、cmd、HTTP 或 Temp 目录特征的任务内容indexwineventlog (sourcetypeWinEventLog:Security EventCode4698) OR (sourcetypeXmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode1 Image*\\schtasks.exe) | eval task_info coalesce(TaskContent, CommandLine) | search task_info*powershell* OR task_info*cmd* OR task_info*http* OR task_info*\\Temp\\* | table _time, Computer, SubjectUserName, TaskName, task_info注册表 Run 键修改T1547.001监控 Sysmon EventCode 13注册表值设置覆盖Run、RunOnce、RunServices及Explorer\Shell Folders四类自启动位置并排除 explorer、msiexec、setup 等合法写入方indexsysmon EventCode13 TargetObject IN ( *\\CurrentVersion\\Run\\*, *\\CurrentVersion\\RunOnce\\*, *\\CurrentVersion\\RunServices\\*, *\\Explorer\\Shell Folders\\* ) | stats count by Computer, Image, TargetObject, Details | where NOT match(Image, (explorer\.exe|msiexec\.exe|setup\.exe)) | sort - countWMI 事件订阅T1546.003WMI 持久化是典型的无文件攻击手段Sysmon EventCode 20WMI 事件活动与 21WMI 过滤器绑定直接暴露攻击者注册的恶意消费者与命名空间indexsysmon EventCode20 OR EventCode21 | stats count by Computer, Operation, Consumer, EventNamespace | where count 0Step 4横向移动检测远程服务利用T1021.002 — SMB/Windows 管理共享以单一来源账户登录目标主机数超过 3 台为异常基线识别 SMB 共享驱动的批量横向移动indexwineventlog sourcetypeWinEventLog:Security EventCode4624 Logon_Type3 | stats dc(ComputerName) AS unique_destinations, values(ComputerName) AS targets by src_ip, TargetUserName | where unique_destinations 3 | sort - unique_destinations | table src_ip, TargetUserName, unique_destinations, targetsPsExec 检测T1021.002PsExec 家族的指纹特征集中在进程名psexec.exe、服务端psexesvc.exe与编译原始文件名psexec.c三处任一路径命中即可告警indexsysmon EventCode1 (Image*\\psexec.exe OR Image*\\psexesvc.exe OR ParentImage*\\psexesvc.exe OR OriginalFileNamepsexec.c) | table _time, Computer, User, ParentImage, Image, CommandLineRDP 横向移动T1021.001通过 Logon_Type10远程交互登录聚合 RDP 登录目标数单账户访问超过 2 台主机即触发indexwineventlog sourcetypeWinEventLog:Security EventCode4624 Logon_Type10 | stats count, dc(ComputerName) AS rdp_targets, values(ComputerName) AS destinations by src_ip, TargetUserName | where rdp_targets 2 | sort - rdp_targetsStep 5构建取证时间线针对被入侵主机示例为WORKSTATION-042跨 Security 与 Sysmon 两个索引构建统一事件视图将原始事件编号翻译为人类可读的描述登录、进程、网络、文件、注册表等按时间排序后即为完整的攻击活动时间线(indexwineventlog OR indexsysmon) ComputerWORKSTATION-042 earliest2024-03-14T00:00:00 latest2024-03-16T00:00:00 | eval event_description case( EventCode4624, Logon: .TargetUserName. (Type .Logon_Type.), EventCode4625, Failed Logon: .TargetUserName, EventCode4688 OR (sourcetypeXmlWinEventLog:*Sysmon* AND EventCode1), Process: .Image. CMD: .CommandLine, EventCode4698, Scheduled Task: .TaskName, EventCode3, Network: .DestinationIp.:.DestinationPort, EventCode11, File Created: .TargetFilename, EventCode13, Registry: .TargetObject, 11, Event .EventCode ) | sort _time | table _time, EventCode, event_description, User, src_ipStep 6创建参考查表用于富化为每个事件 ID 建立描述 ATTCK 技术 严重级别的上下文映射供检测结果即时富化| inputlookup windows_eventcode_lookup.csv | table EventCode, Description, ATT_CK_Technique, Severity若查表不存在可按以下格式创建windows_eventcode_lookup.csvEventCode,Description,ATT_CK_Technique,Severity 4624,Successful Logon,T1078,Informational 4625,Failed Logon,T1110,Low 4648,Explicit Credential Logon,T1078,Medium 4672,Special Privileges Assigned,T1134,Medium 4688,New Process Created,T1059,Informational 4698,Scheduled Task Created,T1053.005,Medium 4720,User Account Created,T1136.001,High 4732,Member Added to Security Group,T1098,High 4768,Kerberos TGT Requested,T1558,Informational 4769,Kerberos Service Ticket,T1558.003,Low 4771,Kerberos Pre-Auth Failed,T1110,Low关键概念速查术语定义EventCode 4624成功登录事件 —— Logon_Type 2交互、3网络、10RDP、7解锁EventCode 4625失败登录事件 —— Status 状态码指示失败原因密码错误、账户锁定、账户禁用Sysmon EventCode 1进程创建事件包含完整命令行、父进程与哈希信息Sysmon EventCode 3进程发起的网络连接事件 —— 源/目标 IP、端口与进程上下文Logon Type 3网络登录SMB、WMI、PowerShell Remoting—— 横向移动的关键指标Logon Type 10通过 RDP/终端服务的远程交互登录登录类型全景来自 API 参考文档Type描述上下文2Interactive本地控制台登录3NetworkSMB、WMI、PowerShell Remoting7Unlock工作站解锁9NewCredentialsrunas /netonly10RemoteInteractiveRDP 登录Sysmon 关键事件 ID1进程创建、3网络连接、7镜像加载/DLL、10进程访问——LSASS 凭据窃取、11文件创建、13注册表值设置、22DNS 查询。常见攻击场景的检测要点KerberoastingT1558.003检测 EventCode 4769 中加密类型为 0x17RC4且服务名非krbtgt的票据请求——这通常意味着攻击者在离线破解服务账户哈希DCSyncT1003.006检测 EventCode 4662 中对象类型为domainDNS且属性包含Replicating Directory Changes的非域控来源——这是目录复制权限被滥用的直接证据黄金票据T1558.001检测 EventCode 4769 中票据属性异常过长的票据寿命、非标准加密类型Pass-the-HashT1550.002检测 EventCode 4624 中来自异常来源、使用 NTLM 认证的 Logon_Type 3 网络登录DLL 侧加载T1574.002Sysmon EventCode 7 显示合法进程加载了未签名 DLL。从人工查询到自动化 Agent源码级实现仓库为上述手工 SPL 查询提供了完整的 Python 自动化实现见 scripts/agent.py。其设计结构为连接 → 检测函数 → 全量狩猎每个检测函数与本文的 SPL 查询一一对应连接与搜索基座基于splunklib.client建立连接支持环境变量SPLUNK_HOST、SPLUNK_PORT、SPLUNK_USERNAME、SPLUNK_PASSWORD注入并通过exec_modeblocking提交阻塞式搜索任务以 JSON 格式读取结果import splunklib.client as client import splunklib.results as results def connect(host, port, username, password): return client.connect( hosthost, portport, usernameusername, passwordpassword, autologinTrue ) def search(service, query, earliest-24h, latestnow): job service.jobs.create( fsearch {query}, **{earliest_time: earliest, latest_time: latest, exec_mode: blocking} ) reader results.JSONResultsReader(job.results(output_modejson)) rows [r for r in reader if isinstance(r, dict)] job.cancel() return rows检测函数与 SPL 的对应关系Agent 函数对应检测能力默认时间窗阈值参数detect_brute_force暴力破解4625 按登录类型分类-24hthreshold20detect_password_spray密码喷洒10 分钟桶-24hunique_users 10detect_new_admin_accounts新建管理员账户T1136.001-7d—detect_lsass_accessLSASS 凭据窃取T1003.001-24hGrantedAccess 白名单detect_lateral_movement_smbSMB 横向移动T1021.002-24h目标主机 3detect_psexecPsExec 执行T1021.002-24h—build_forensic_timeline主机取证时间线由--hostname指定—命令行用法通过--action参数选择单项检测或full_hunt全量狩猎--hostname指定取证时间线的目标主机# 全量狩猎默认动作 python3 scripts/agent.py --host splunk --port 8089 --username admin --password $SPLUNK_PASSWORD --action full_hunt # 仅检测暴力破解自定义阈值 python3 scripts/agent.py --action brute_force --earliest -48h # 构建指定主机的取证时间线 python3 scripts/agent.py --action timeline --hostname WORKSTATION-042 --earliest -7d执行结果以 JSON 输出包含generated_at时间戳与按检测类型分组的 findings 结构便于下游 SOAR 或工单系统消费。框架映射ATTCK、NIST CSF 与 D3FEND该技能在仓库中被系统化地映射到多个安全框架见 SKILL.md 的 YAML frontmatter这使其既可作为检测用例库也可作为合规覆盖证据MITRE ATTCKT1110暴力破解、T1053.005计划任务、T1547.001注册表 Run 键、T1021.002SMB/Windows 管理共享、T1558.003Kerberoasting、T1003.006DCSync等NIST CSF 2.0DE.CM-01持续监控、DE.AE-02异常事件分析、DE.AE-06关联信息形成分析结论、RS.MA-01指示器分析D3FENDRestore Access、Password Authentication、Strong Password Policy、Restore User Account Access 等防御计数。仓库级覆盖证据可在 ATTACK_COVERAGE.md 中交叉验证本技能在 T1078、T1110、T1136.001、T1546.003、T1547.001、T1558.003、T1021.002 等多个技术上被列为覆盖技能之一且与building-detection-rule-with-splunk-spl、detecting-lateral-movement-with-splunk、detecting-dcsync-attack-in-active-directory等相邻技能构成互补的检测能力簇详见 mappings/mitre-attack/README.md 的技术映射方法论与 mappings/attack-navigator-layer.json 的覆盖可视化层。输出格式与报告模板分析完成后建议按以下结构化模板输出结论将统计数字、可疑发现与 ATTCK 映射整合为可直接进入工单或复盘报告的结果WINDOWS EVENT LOG ANALYSIS — HOST: WORKSTATION-042 ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ Period: 2024-03-14 to 2024-03-15 Events: 12,847 total (Security: 9,231 | Sysmon: 3,616) Authentication Summary: Successful Logons (4624): 487 (Type 3: 312, Type 10: 45, Type 2: 130) Failed Logons (4625): 847 (from 192.168.1.105 — BRUTE FORCE) Explicit Creds (4648): 12 Suspicious Findings: [HIGH] 847 failed logons followed by success at 14:35 from 192.168.1.105 [HIGH] New user backdoor_admin created (4720) at 14:38 [HIGH] User added to Administrators group (4732) at 14:38 [MEDIUM] schtasks.exe creating persistence task at 14:42 [MEDIUM] PowerShell encoded command execution at 14:45 ATTCK Mapping: T1110.001 — Password Guessing (847 failed logons) T1136.001 — Local Account Creation (backdoor_admin) T1053.005 — Scheduled Task (persistence) T1059.001 — PowerShell (encoded execution)小结本文以 SKILL.md 为骨架完整覆盖了 Windows 事件日志分析的六步实战工作流从 4624/4625 认证事件识别暴力破解与密码喷洒经 4672/4720/4698/1547 等事件定位提权与持久化再以 Logon_Type 3/10 与 Sysmon 事件 1/10 追踪横向移动最后通过跨索引时间线与事件 ID 查表完成取证闭环。配合仓库中的 自动化 Agent 脚本SOC 团队可以将这些检测逻辑从手工查询升级为可定时执行的批量狩猎任务借助 ATTCK 覆盖 与 NIST CSF 对齐这些检测用例同时具备威胁知情的防御价值与合规审计价值。【免费下载链接】Anthropic-Cybersecurity-Skills817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATTCK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF MITRE F3 (Fight Fraud) · agentskills.io standard · Works with Claude Code, GitHub Copilot, Codex CLI, Cursor, Gemini CLI 20 platforms · 29 security domains · Apache 2.0项目地址: https://gitcode.com/GitHub_Trending/an/Anthropic-Cybersecurity-Skills创作声明：本文部分内容由AI辅助生成（AIGC），仅供参考