在规则中使用经过丰富情境的数据
为了在调查期间支持安全分析师，Google Security Operations 会从不同来源提取情境数据，对提取的数据执行分析，并提供有关客户环境中工件的其他背景信息。本文档提供了一些示例，说明分析师如何在 Detection Engine 规则中使用经过上下文丰富的数据。
如需详细了解数据丰富功能，请参阅 Google Security Operations 如何丰富事件和实体数据。
在规则中使用普遍性扩充字段
以下示例演示了如何在 Detection Engine 中使用与普遍性相关的丰富字段。如需参考信息，请参阅与普及性相关的丰富字段列表。
识别低普遍性网域访问权限
找到匹配项时，此检测规则会生成检测事件，而不是检测提醒。它主要在调查资产时用作辅助指标。例如，还有其他严重程度更高的提醒触发了突发事件。
$enrichment.graph.metadata.entity_type = "FILE"
$enrichment.graph.metadata.product_name = "VirusTotal Relationships"
$enrichment.graph.metadata.vendor_name = "VirusTotal"
如需详细了解如何添加过滤条件以提高规则性能，请参阅添加事件类型过滤条件。
如需了解每种扩充项类型，请参阅 Google Security Operations 如何丰富事件和实体数据。
在规则中使用普遍性扩充字段
以下示例演示了如何在 Detection Engine 中使用与普遍性相关的丰富字段。如需参考信息，请参阅与普及性相关的丰富字段列表。
识别对普及率分数较低的网域的访问权限
此规则可用于检测对普及率分数较低的网域的访问。 为了保证有效性，必须存在工件的普遍性分数基准。以下示例使用引用列表来调整结果并应用阈值普遍性值。
rule network_prevalence_low_prevalence_domain_access {
meta:
author = "Google Security Operations"
description = "Detects access to a low prevalence domain. Requires baseline of prevalence be in place for effective deployment."
severity = "LOW"
events:
$e.metadata.event_type = "NETWORK_HTTP"
$e.principal.ip = $ip
// filter out URLs with RFC 1918 IP addresses, i.e., internal assets
not re.regex($e.target.hostname, `(127(?:\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)){3}$)|(10(?:\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)){3}$)|(192\.168(?:\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)){2}$)|(172\.(?:1[6-9]|2\d|3[0-1])(?:\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)){2})`)
// used an explicit exclusion reference list
not $e.target.hostname in %exclusion_network_prevalence_low_prevalence_domain_access
// only match valid FQDN, filter out background non-routable noise
re.regex($e.target.hostname, `(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9][a-z0-9-]{0,61}[a-z0-9]`)
$domainName = $e.target.hostname
//join event ($e) to entity graph ($d)
$e.target.hostname = $d.graph.entity.domain.name
$d.graph.metadata.entity_type = "DOMAIN_NAME"
// tune prevalence as fits your results
$d.graph.entity.domain.prevalence.rolling_max > 0
$d.graph.entity.domain.prevalence.rolling_max <= 10
match:
$ip over 1h
outcome:
$risk_score = max(
// increment risk score based upon rolling_max prevalence
if ( $d.graph.entity.domain.prevalence.rolling_max >= 10, 10) +
if ( $d.graph.entity.domain.prevalence.rolling_max >= 2 and $d.graph.entity.domain.prevalence.rolling_max <= 9 , 20) +
if ( $d.graph.entity.domain.prevalence.rolling_max = 1, 30)
)
$domain_list = array_distinct($domainName)
$domain_count = count_distinct($domainName)
condition:
$e and #d > 10
}
通过 IOC 匹配识别低发生率域
此检测规则会生成检测提醒，并通过比较低发生率域（也称为已知 IOC）提供高保真度匹配。
rule network_prevalence_uncommon_domain_ioc_match {
meta:
author = "Google Security Operations"
description = "Lookup Network DNS queries against Entity Graph for low prevalence domains with a matching IOC entry."
severity = "MEDIUM"
events:
$e.metadata.event_type = "NETWORK_DNS"
$e.network.dns.questions.name = $hostname
//only match FQDNs, e.g., exclude chrome dns access tests and other internal hosts
$e.network.dns.questions.name = /(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9][a-z0-9-]{0,61}[a-z0-9]/
//prevalence entity graph lookup
$p.graph.metadata.entity_type = "DOMAIN_NAME"
$p.graph.entity.domain.prevalence.rolling_max > 0
$p.graph.entity.domain.prevalence.rolling_max <= 3
$p.graph.entity.domain.name = $hostname
//ioc entity graph lookup
$i.graph.metadata.vendor_name = "ET_PRO_IOC"
$i.graph.metadata.entity_type = "DOMAIN_NAME"
$i.graph.entity.hostname = $hostname
match:
$hostname over 10m
outcome:
$risk_score = max(
//increment risk score based upon rolling_max prevalence
if ( $p.graph.entity.domain.prevalence.rolling_max = 3, 50) +
if ( $p.graph.entity.domain.prevalence.rolling_max = 2, 70) +
if ( $p.graph.entity.domain.prevalence.rolling_max = 1, 90)
)
condition:
$e and $p and $i
}
在规则中使用实体的首次出现时间
您可以编写包含实体记录中的 first_seen_time 或 last_seen_time 字段的规则。
first_seen_time 和 last_seen_time 字段使用描述网域、IP 地址和文件（哈希）的实体进行填充。对于描述用户或资产的实体，仅填充 first_seen_time 字段。系统不会针对描述其他类型（如群组或资源）的实体计算这些值。
如需查看已填充的 UDM 字段列表，请参阅计算实体的首次出现时间和上次出现时间。
以下示例展示了如何在规则中使用 first_seen_time：
rule first_seen_data_exfil {
meta:
author = "Google Security Operations"
description = "Example usage first_seen data"
severity = "LOW"
events:
$first_access.metadata.event_type = "NETWORK_HTTP"
$ip = $first_access.principal.ip
// Join first_access event with entity graph to use first/last seen data.
$ip = $first_last_seen.graph.entity.ip
$first_last_seen.graph.metadata.entity_type = "IP_ADDRESS"
// Check that the first_access UDM event is the first_seen occurrence in the enterprise.
$first_last_seen.graph.entity.artifact.first_seen_time.seconds = $first_access.metadata.event_timestamp.seconds
$first_last_seen.graph.entity.artifact.first_seen_time.nanos = $first_access.metadata.event_timestamp.nanos
// Check for another access event that appears shortly after the first_seen event,
// where lots of data is being sent.
$next_access_data_exfil.metadata.event_type = "NETWORK_CONNECTION"
// Next access event goes to the same IP as the first.
$next_access_data_exfil.principal.ip = $ip
// Next access occurs within 60 seconds after first access.
$next_access_data_exfil.metadata.event_timestamp.seconds > $first_access.metadata.event_timestamp.seconds
60 > $next_access_data_exfil.metadata.event_timestamp.seconds - $first_access.metadata.event_timestamp.seconds
// Lots of data is being sent over the next access event.
$next_access_data_exfil.network.sent_bytes > 10 * 1024 * 1024 * 1024 // 10GB
// Extract hostname of next access event, for match section.
$hostname = $next_access_data_exfil.principal.hostname
match:
$hostname over 1h
condition:
$first_access and $next_access_data_exfil and $first_last_seen
}
在规则中使用包含地理定位信息的字段
可以在检测引擎规则中使用存储丰富地理位置数据的 UDM 字段。如需查看已填充的 UDM 字段列表，请参阅使用地理位置数据丰富事件。
以下示例说明了如何检测用户实体是否从多个不同状态进行身份验证。
rule geoip_user_login_multiple_states_within_1d {
meta:
author = "Google Security Operations"
description = "Detect multiple authentication attempts from multiple distinct locations using geolocation-enriched UDM fields."
severity = "INFORMATIONAL"
events:
$geoip.metadata.event_type = "USER_LOGIN"
(
$geoip.metadata.vendor_name = "Google Workspace" or
$geoip.metadata.vendor_name = "Google Cloud Platform"
)
/* optionally, detect distinct locations at a country */
(
$geoip.principal.ip_geo_artifact.location.country_or_region != "" and
$geoip.principal.ip_geo_artifact.location.country_or_region = $country
)
(
$geoip.principal.ip_geo_artifact.location.state != "" and
$geoip.principal.ip_geo_artifact.location.state = $state
)
$geoip.target.user.email_addresses = $user
match:
$user over 1d
condition:
$geoip and #state > 1
}
在规则中使用安全浏览丰富字段
Google Security Operations 会从与文件哈希相关的威胁列表中注入数据。这些丰富信息以实体形式存储在 Google Security Operations 中。
如需查看已填充的 UDM 字段列表，请参阅使用安全浏览威胁列表中的信息丰富实体。
您可以创建检测引擎规则，以针对从安全浏览中提取的实体识别匹配项。以下是一个检测引擎规则示例，用于查询这些丰富信息以构建情境感知分析。
rule safe_browsing_file_execution {
meta:
author = "Google Security Operations"
description = "Example usage of Safe Browsing data, to detect execution of a file that's been deemed malicious"
severity = "LOW"
events:
// find a process launch event, match on hostname
$execution.metadata.event_type = "PROCESS_LAUNCH"
$execution.principal.hostname = $hostname
// join execution event with Safe Browsing graph
$sb.graph.entity.file.sha256 = $execution.target.process.file.sha256
// look for files deemed malicious
$sb.graph.metadata.entity_type = "FILE"
$sb.graph.metadata.threat.severity = "CRITICAL"
$sb.graph.metadata.product_name = "Google Safe Browsing"
$sb.graph.metadata.source_type = "GLOBAL_CONTEXT"
match:
$hostname over 1h
condition:
$execution and $sb
}
在规则中使用 WHOIS 扩充字段
您可以编写规则以在表示网域的实体中搜索 WHOIS 丰富字段。这些实体的 entity.metadata.entity_type 字段设置为 DOMAIN_NAME。如需查看已填充的 UDM 字段列表，请参阅使用 WHOIS 数据丰富实体。
以下是一个示例规则，展示了如何执行此操作。此规则在 events 部分中包含以下过滤字段，以帮助优化规则的性能。
$whois.graph.metadata.entity_type = "DOMAIN_NAME"
$whois.graph.metadata.product_name = "WHOISXMLAPI Simple Whois"
$whois.graph.metadata.vendor_name = "WHOIS"
rule whois_expired_domain_executable_download {
meta:
author = "Google Security Operations"
description = "Example usage of WHOIS data, detecting an executable file download from a domain that's recently expired"
severity = "LOW"
events:
$access.metadata.event_type = "NETWORK_HTTP"
$hostname = $access.principal.hostname
// join access event to entity graph to use WHOIS data
$whois.graph.entity.domain.name = $access.target.hostname
// use WHOIS data to look for expired domains
$whois.graph.metadata.entity_type = "DOMAIN_NAME"
$whois.graph.metadata.product_name = "WHOISXMLAPI Simple Whois"
$whois.graph.metadata.vendor_name = "WHOIS"
$whois.graph.entity.domain.expiration_time.seconds < $access.metadata.event_timestamp.seconds
// join access event with executable file creation event by principal hostname
$creation.principal.hostname = $access.principal.hostname
$creation.metadata.event_type = "FILE_CREATION"
$creation.target.file.full_path = /exe/ nocase
// file creation comes after expired domain access
$creation.metadata.event_timestamp.seconds >
$access.metadata.event_timestamp.seconds
match:
$hostname over 1h
condition:
$access and $whois and $creation
}
查询 Google Cloud 威胁情报数据
Google Security Operations 会从 Google Cloud 威胁情报 (GCTI) 数据源中提取数据，为您提供相关情境信息，供您在调查环境中的活动时使用。您可以查询以下数据源：
- GCTI Tor 退出节点
- GCTI 良性二进制
- GCTI 远程访问工具
如需了解这些威胁 Feed 以及填充的所有字段，请参阅提取和存储 Google Cloud 威胁情报数据。
在本文档中，占位符 <variable_name> 表示在规则中用于标识 UDM 记录的唯一变量名称。
查询 Tor 退出节点 IP 地址
当 NETWORK_CONNECTION 事件包含存储在 target.ip 字段中的 IP 地址（也可在 GCTI Tor Exit Nodes 数据源中找到）时，以下示例规则会返回检测结果。请务必在规则中添加 <variable_name>.graph.metadata.threat.threat_feed_name、<variable_name>.graph.metadata.vendor_name 和 <variable_name>.graph.metadata.product_name 字段。
这是一个定时数据源。事件将与数据源在该时间点的快照匹配。
rule gcti_tor_exit_nodes {
meta:
author = "Google Cloud Threat Intelligence"
description = "Alert on known Tor exit nodes."
severity = "High"
events:
// Event
$e.metadata.event_type = "NETWORK_CONNECTION"
$e.target.ip = $tor_ip
// Tor IP search in GCTI Feed
$tor.graph.entity.artifact.ip = $tor_ip
$tor.graph.metadata.entity_type = "IP_ADDRESS"
$tor.graph.metadata.threat.threat_feed_name = "Tor Exit Nodes"
$tor.graph.metadata.source_type = "GLOBAL_CONTEXT"
$tor.graph.metadata.vendor_name = "Google Cloud Threat Intelligence"
$tor.graph.metadata.product_name = "GCTI Feed"
match:
$tor_ip over 1h
outcome:
$tor_ips = array_distinct($tor_ip)
$tor_geoip_country = array_distinct($e.target.ip_geo_artifact.location.country_or_region)
$tor_geoip_state = array_distinct($e.target.ip_geo_artifact.location.state)
condition:
$e and $tor
}
查询良性操作系统文件
以下示例规则将 Benign Binaries 和 Tor Exit Nodes 数据源组合起来，以便在良性二进制与 Tor 退出节点接触时返回提醒。该规则使用 Google Security Operations 通过目标 IP 地址扩充的地理定位数据来计算风险得分。请务必在规则中同时为 Benign Binaries 和 Tor Exit Nodes 数据源添加 <variable_name>.graph.metadata.vendor_name、<variable_name>.graph.metadata.product_name 和 <variable_name>.graph.metadata.threat.threat_feed_name。
这是一个永不过时的数据源。事件始终与数据源的最新快照匹配，而不考虑时间。
rule gcti_benign_binaries_contacts_tor_exit_node {
meta:
author = "Google Cloud Threat Intelligence"
description = "Alert on Benign Binary contacting a Tor IP address."
severity = "High"
events:
// Event
$e.metadata.event_type = "NETWORK_CONNECTION"
$e.principal.process.file.sha256 = $benign_hash
$e.target.ip = $ip
$e.principal.hostname = $hostname
// Benign File search in GCTI Feed
$benign.graph.entity.file.sha256 = $benign_hash
$benign.graph.metadata.entity_type = "FILE"
$benign.graph.metadata.threat.threat_feed_name = "Benign Binaries"
$benign.graph.metadata.source_type = "GLOBAL_CONTEXT"
$benign.graph.metadata.vendor_name = "Google Cloud Threat Intelligence"
$benign.graph.metadata.product_name = "GCTI Feed"
// Tor IP search in GCTI Feed
$tor.graph.entity.artifact.ip = $ip
$tor.graph.metadata.entity_type = "IP_ADDRESS"
$tor.graph.metadata.threat.threat_feed_name = "Tor Exit Nodes"
$tor.graph.metadata.source_type = "GLOBAL_CONTEXT"
$tor.graph.metadata.vendor_name = "Google Cloud Threat Intelligence"
$tor.graph.metadata.product_name = "GCTI Feed"
match:
$hostname over 1h
outcome:
$risk_score = max(
if($tor.graph.metadata.threat.confidence = "HIGH_CONFIDENCE", 70) +
// Unauthorized target geographies
if($e.target.ip_geo_artifact.location.country_or_region = "Cuba", 20) +
if($e.target.ip_geo_artifact.location.country_or_region = "Iran", 20) +
if($e.target.ip_geo_artifact.location.country_or_region = "North Korea", 20) +
if($e.target.ip_geo_artifact.location.country_or_region = "Russia", 20) +
if($e.target.ip_geo_artifact.location.country_or_region = "Syria", 20)
)
$benign_hashes = array_distinct($benign_hash)
$benign_files = array_distinct($e.principal.process.file.full_path)
$tor_ips = array_distinct($ip)
$tor_geoip_country = array_distinct($e.target.ip_geo_artifact.location.country_or_region)
$tor_geoip_state = array_distinct($e.target.ip_geo_artifact.location.state)
condition:
$e and $benign and $tor
}
查询有关远程访问工具的数据
当 PROCESS_LAUNCH 事件类型包含的哈希值同样存在于 Google Cloud Threat Intelligence 远程访问工具数据源中时，以下示例规则会返回检测结果。
这是一个永不过时的数据源。事件始终与数据源的最新快照匹配，而不考虑时间。
rule gcti_remote_access_tools {
meta:
author = "Google Cloud Threat Intelligence"
description = "Alert on Remote Access Tools."
severity = "High"
events:
// find a process launch event
$e.metadata.event_type = "PROCESS_LAUNCH"
$e.target.process.file.sha256 != ""
$rat_hash = $e.target.process.file.sha256
// join graph and event hashes
$gcti.graph.entity.file.sha256 = $rat_hash
// look for files identified as likely remote access tools
$gcti.graph.metadata.entity_type = "FILE"
$gcti.graph.metadata.vendor_name = "Google Cloud Threat Intelligence"
$gcti.graph.metadata.product_name = "GCTI Feed"
$gcti.graph.metadata.threat.threat_feed_name = "Remote Access Tools"
match:
$rat_hash over 5m
outcome:
$remote_hash = array_distinct($e.target.process.file.sha256)
condition:
$e and $gcti
}
在规则中使用 VirusTotal 丰富元数据字段
以下规则可检测特定文件类型的文件创建或进程启动，这表明系统上存在一些被监控的哈希。使用 VirusTotal 文件元数据扩充功能将文件标记为 exploit 时，系统会设置风险得分。
如需查看已填充所有 UDM 字段的列表，请参阅使用 VirusTotal 文件元数据丰富事件。
rule vt_filemetadata_hash_match_ioc {
meta:
author = "Google Cloud Threat Intelligence"
description = "Detect file/process events that indicate watchlisted hashes are on a system"
severity = "High"
events:
// Process launch or file creation events
$process.metadata.event_type = "PROCESS_LAUNCH" or $process.metadata.event_type ="FILE_CREATION"
$process.principal.hostname = $hostname
$process.target.file.sha256 != ""
$process.target.file.sha256 = $sha256
$process.target.file.file_type = "FILE_TYPE_DOCX"
// IOC matching
$ioc.graph.metadata.product_name = "MISP"
$ioc.graph.metadata.entity_type = "FILE"
$ioc.graph.metadata.source_type = "ENTITY_CONTEXT"
$ioc.graph.entity.file.sha256 = $sha256
match:
$hostname over 15m
outcome:
$risk_score = max(
// Tag enrichment from VirusTotal file metadata
if($process.target.file.tags = "exploit", 90)
)
$file_sha256 = array($process.target.file.sha256)
$host = array($process.principal.hostname)
condition:
$process and $ioc
}
在规则中使用 VirusTotal 关系数据
Google Security Operations 会从 VirusTotal 相关连接中提取数据。这些数据提供有关文件哈希与文件、网域、IP 地址和网址之间的关系的信息。这些丰富信息以实体的形式存储在 Google Security Operations 中。
您可以创建检测引擎规则，以根据从 VirusTotal 提取的实体识别匹配项。以下规则会在从具有 VirusTotal 关系的已知 IP 地址下载已知文件哈希时发送提醒。风险得分取决于 VirusTotal 文件元数据中的文件类型和标记。
此数据仅适用于某些 VirusTotal 和 Google Security Operations 许可。请与客户经理确认您的使用权。如需查看已填充的所有 UDM 字段的列表，请参阅使用 VirusTotal 关系数据丰富实体。
rule virustotal_file_downloaded_from_url {
meta:
author = "Google Cloud Threat Intelligence"
description = "Alerts on downloading a known file hash from a known IP with VirusTotal relationships. The risk score is based on file type and tags from VirusTotal file metadata."
severity = "High"
events:
// Filter network HTTP events
$e1.metadata.event_type = "NETWORK_HTTP"
$e1.principal.user.userid = $userid
$e1.target.url = $url
// Filter file creation events
$e2.metadata.event_type = "FILE_CREATION"
$e2.target.user.userid = $userid
$e2.target.file.sha256 = $file_hash
// The file creation event timestamp should be equal or greater than the network http event timestamp
$e1.metadata.event_timestamp.seconds <= $e2.metadata.event_timestamp.seconds
// Join event file hash with VirusTotal relationships entity graph
$vt.graph.metadata.entity_type = "FILE"
$vt.graph.metadata.source_type = "GLOBAL_CONTEXT"
$vt.graph.metadata.vendor_name = "VirusTotal"
$vt.graph.metadata.product_name = "VirusTotal Relationships"
$vt.graph.entity.file.sha256 = $file_hash
// Join network HTTP target URL with VirusTotal relationships entity graph
$vt.graph.relations.entity_type = "URL"
$vt.graph.relations.relationship = "DOWNLOADED_FROM"
$vt.graph.relations.entity.url = $url
match:
$userid over 1m
outcome:
$risk_score = max(
// Tag enrichment from VirusTotal file metadata
if($e2.target.file.tags = "via-tor" or $e2.target.file.tags = "malware" or $e2.target.file.tags = "crypto", 50) +
// File types enrichment from VirusTotal file metadata
if($e2.target.file.file_type = "FILE_TYPE_HTML", 5) +
if($e2.target.file.file_type = "FILE_TYPE_ELF", 10) +
if($e2.target.file.file_type = "FILE_TYPE_PE_DLL",15) +
if($e2.target.file.file_type = "FILE_TYPE_PE_EXE", 20)
)
condition:
$e1 and $e2 and $vt and $risk_score >= 50
}
后续步骤
如需了解如何将丰富数据与其他 Google Security Operations 功能搭配使用，请参阅以下内容：