在规则中使用经过丰富上下文的数据

为了在调查期间为安全分析师提供支持,Chronicle 从不同来源提取上下文数据,对提取的数据执行分析,并提供有关客户环境中的工件的其他上下文。本文档举例说明了分析人员可以如何在 Detection Engine 规则中使用经过上下文丰富的数据。

如需详细了解数据丰富化,请参阅 Chronicle 如何丰富事件和实体数据

在规则中使用普及率扩充字段

以下示例演示了如何在 Detection Engine 中使用与发生率相关的丰富字段。如需参考信息,请参阅与普及率相关的丰富字段列表。

确定发生率较低的网域访问权限

找到匹配项时,此检测规则会生成检测事件,而不是检测提醒。在调查资产时,它主要用作次要指标。例如,还有其他严重程度更高的提醒触发了突发事件。

$enrichment.graph.metadata.entity_type = "FILE"
$enrichment.graph.metadata.product_name = "VirusTotal Relationships"
$enrichment.graph.metadata.vendor_name = "VirusTotal"

请参阅添加事件类型过滤条件,详细了解如何添加过滤条件以提升规则性能。

如需了解每种扩充方式,请参阅 Chronicle 如何扩充事件和实体数据

在规则中使用普及率扩充字段

以下示例演示了如何在 Detection Engine 中使用与发生率相关的丰富字段。如需参考信息,请参阅与普及率相关的丰富字段列表。

识别对普遍性得分较低的网域的访问权限

此规则可用于检测对普遍性得分较低的网域的访问。为使这种方法有效,必须存在工件的普遍性分数基准。以下示例使用参考列表来调整结果并应用阈值发生率值。

rule network_prevalence_low_prevalence_domain_access {
  meta:
    author = "Chronicle Security"
    description = "Detects access to a low prevalence domain. Requires baseline of prevalence be in place for effective deployment."
    severity = "LOW"

  events:
        $e.metadata.event_type = "NETWORK_HTTP"
        $e.principal.ip = $ip

        // filter out URLs with RFC 1918 IP addresses, i.e., internal assets
        not re.regex($e.target.hostname, `(127(?:\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)){3}$)|(10(?:\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)){3}$)|(192\.168(?:\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)){2}$)|(172\.(?:1[6-9]|2\d|3[0-1])(?:\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)){2})`)

        // used an explicit exclusion reference list
        not $e.target.hostname in %exclusion_network_prevalence_low_prevalence_domain_access

        // only match valid FQDN, filter out background non-routable noise
        re.regex($e.target.hostname, `(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9][a-z0-9-]{0,61}[a-z0-9]`)

        $domainName = $e.target.hostname

        //join event ($e) to entity graph ($d)
        $e.target.hostname = $d.graph.entity.domain.name

        $d.graph.metadata.entity_type = "DOMAIN_NAME"

        // tune prevalence as fits your results
        $d.graph.entity.domain.prevalence.rolling_max > 0
        $d.graph.entity.domain.prevalence.rolling_max <= 10

  match:
        $ip over 1h

  outcome:
    $risk_score = max(
        // increment risk score based upon rolling_max prevalence
        if ( $d.graph.entity.domain.prevalence.rolling_max >= 10, 10) +
        if ( $d.graph.entity.domain.prevalence.rolling_max >= 2 and $d.graph.entity.domain.prevalence.rolling_max <= 9 , 20) +
        if ( $d.graph.entity.domain.prevalence.rolling_max = 1, 30)
    )

    $domain_list = array_distinct($domainName)
    $domain_count = count_distinct($domainName)

  condition:
    $e and #d > 10
}

以下屏幕截图显示了此规则生成的检测示例。

低使用率网域访问权限 在新窗口中查看图片

通过 IOC 匹配识别低发生率的网域

此检测规则会生成检测提醒,并提供与低频域(也是已知 IOC)进行比较的高保真度匹配。

rule network_prevalence_uncommon_domain_ioc_match {

  meta:
    author = "Chronicle Security"
    description = "Lookup Network DNS queries against Entity Graph for low prevalence domains with a matching IOC entry."
    severity = "MEDIUM"

  events:
    $e.metadata.event_type = "NETWORK_DNS"
    $e.network.dns.questions.name = $hostname

    //only match FQDNs, e.g., exclude chrome dns access tests and other internal hosts
    $e.network.dns.questions.name = /(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9][a-z0-9-]{0,61}[a-z0-9]/

    //prevalence entity graph lookup
    $p.graph.metadata.entity_type = "DOMAIN_NAME"
    $p.graph.entity.domain.prevalence.rolling_max > 0
    $p.graph.entity.domain.prevalence.rolling_max <= 3
    $p.graph.entity.domain.name = $hostname

    //ioc entity graph lookup
    $i.graph.metadata.vendor_name = "ET_PRO_IOC"
    $i.graph.metadata.entity_type = "DOMAIN_NAME"
    $i.graph.entity.hostname = $hostname

  match:
    $hostname over 10m

  outcome:
    $risk_score = max(
        //increment risk score based upon rolling_max prevalence
        if ( $p.graph.entity.domain.prevalence.rolling_max = 3, 50) +
        if ( $p.graph.entity.domain.prevalence.rolling_max = 2, 70) +
        if ( $p.graph.entity.domain.prevalence.rolling_max = 1, 90)
    )

  condition:
    $e and $p and $i
}

以下示例展示了此规则生成的检测。

具有 IOC 匹配的低普及率网域

在规则中使用实体的首次出现时间

您可以编写包含实体记录中的 first_seen_timelast_seen_time 字段的规则。

first_seen_timelast_seen_time 字段填充有描述网域、IP 地址和文件(哈希)的实体。对于描述用户或资产的实体,仅填充 first_seen_time 字段。系统不会针对描述其他类型(例如群组或资源)的实体计算这些值。

如需查看已填充的 UDM 字段的列表,请参阅计算实体的首次出现时间和上次出现时间

以下示例展示了如何在规则中使用 first_seen_time

rule first_seen_data_exfil {
    meta:
        author = "Chronicle Security"
        description = "Example usage first_seen data"
        severity = "LOW"

    events:
        $first_access.metadata.event_type = "NETWORK_HTTP"
        $ip = $first_access.principal.ip

        // Join first_access event with entity graph to use first/last seen data.
        $ip = $first_last_seen.graph.entity.ip
        $first_last_seen.graph.metadata.entity_type = "IP_ADDRESS"

        // Check that the first_access UDM event is the first_seen occurrence in the enterprise.
        $first_last_seen.graph.entity.artifact.first_seen_time.seconds = $first_access.metadata.event_timestamp.seconds
        $first_last_seen.graph.entity.artifact.first_seen_time.nanos   = $first_access.metadata.event_timestamp.nanos

        // Check for another access event that appears shortly after the first_seen event,
        // where lots of data is being sent.
        $next_access_data_exfil.metadata.event_type = "NETWORK_CONNECTION"
        // Next access event goes to the same IP as the first.
        $next_access_data_exfil.principal.ip = $ip

        // Next access occurs within 60 seconds after first access.
        $next_access_data_exfil.metadata.event_timestamp.seconds > $first_access.metadata.event_timestamp.seconds
        60 > $next_access_data_exfil.metadata.event_timestamp.seconds  - $first_access.metadata.event_timestamp.seconds

        // Lots of data is being sent over the next access event.
        $next_access_data_exfil.network.sent_bytes > 10 * 1024 * 1024 * 1024 // 10GB

        // Extract hostname of next access event, for match section.
        $hostname = $next_access_data_exfil.principal.hostname

    match:
        $hostname over 1h

    condition:
        $first_access and $next_access_data_exfil and $first_last_seen
}

在规则中使用包含地理位置信息的字段

存储丰富地理位置数据的 UDM 字段可用于 Detection Engine 规则。如需查看已填充的 UDM 字段列表,请参阅使用地理定位数据丰富事件

以下示例说明了如何检测用户实体是否从多个不同状态进行身份验证。

rule geoip_user_login_multiple_states_within_1d {

  meta:
    author = "Chronicle Security"
    description = "Detect multiple authentication attempts from multiple distinct locations using geolocation-enriched UDM fields."
    severity = "INFORMATIONAL"

  events:
    $geoip.metadata.event_type = "USER_LOGIN"
    (
      $geoip.metadata.vendor_name = "Google Workspace" or
      $geoip.metadata.vendor_name = "Google Cloud Platform"
    )
    /* optionally, detect distinct locations at a country */
    (
      $geoip.principal.ip_geo_artifact.location.country_or_region != "" and
      $geoip.principal.ip_geo_artifact.location.country_or_region = $country
    )
    (
      $geoip.principal.ip_geo_artifact.location.state != "" and
      $geoip.principal.ip_geo_artifact.location.state = $state
    )

    $geoip.target.user.email_addresses = $user

  match:
    $user over 1d

  condition:
    $geoip and #state > 1
}

在规则中使用“安全浏览”中的丰富字段

Chronicle 会从与文件哈希相关的威胁列表中注入数据。这种丰富信息以实体形式存储在 Chronicle 中。

如需查看已填充的 UDM 字段列表,请参阅使用安全浏览威胁列表中的信息丰富实体

您可以创建 Detection Engine 规则,以识别与从安全浏览功能中提取的实体的匹配项。以下是一个针对这种丰富信息进行查询以构建情境感知分析的 Detection Engine 规则示例。

rule safe_browsing_file_execution {
    meta:
        author = "Chronicle Security"
        description = "Example usage of Safe Browsing data, to detect execution of a file that's been deemed malicious"
        severity = "LOW"

    events:
        // find a process launch event, match on hostname
        $execution.metadata.event_type = "PROCESS_LAUNCH"
        $execution.principal.hostname = $hostname

        // join execution event with Safe Browsing graph
        $sb.graph.entity.file.sha256 = $execution.target.process.file.sha256

        // look for files deemed malicious
        $sb.graph.metadata.entity_type = "FILE"
        $sb.graph.metadata.threat.severity = "CRITICAL"
        $sb.graph.metadata.product_name = "Google Safe Browsing"
        $sb.graph.metadata.source_type = "GLOBAL_CONTEXT"

    match:
        $hostname over 1h

    condition:
        $execution and $sb
}

在规则中使用 WHOIS 扩充字段

您可以编写规则,以在表示网域的实体中搜索 WHOIS 丰富字段。这些实体的 entity.metadata.entity_type 字段设置为 DOMAIN_NAME。如需查看已填充的 UDM 字段列表,请参阅使用 WHOIS 数据丰富实体

以下示例规则展示了如何执行此操作。此规则在 events 部分添加以下过滤字段,以帮助优化规则的性能。

$whois.graph.metadata.entity_type = "DOMAIN_NAME"
$whois.graph.metadata.product_name = "WHOISXMLAPI Simple Whois"
$whois.graph.metadata.vendor_name = "WHOIS"
rule whois_expired_domain_executable_download {
 meta:
   author = "Chronicle Security"
   description = "Example usage of WHOIS data, detecting an executable file download from a domain that's recently expired"
   severity = "LOW"

 events:
        $access.metadata.event_type = "NETWORK_HTTP"
        $hostname = $access.principal.hostname

        // join access event to entity graph to use WHOIS data
        $whois.graph.entity.domain.name = $access.target.hostname

        // use WHOIS data to look for expired domains
        $whois.graph.metadata.entity_type = "DOMAIN_NAME"
        $whois.graph.metadata.product_name = "WHOISXMLAPI Simple Whois"
        $whois.graph.metadata.vendor_name = "WHOIS"
        $whois.graph.entity.domain.expiration_time.seconds < $access.metadata.event_timestamp.seconds

        // join access event with executable file creation event by principal hostname
        $creation.principal.hostname = $access.principal.hostname
        $creation.metadata.event_type = "FILE_CREATION"
        $creation.target.file.full_path = /exe/ nocase

        // file creation comes after expired domain access
        $creation.metadata.event_timestamp.seconds >
           $access.metadata.event_timestamp.seconds

   match:
       $hostname over 1h

 condition:
        $access and $whois and $creation
}

查询 Google Cloud 威胁情报数据

Chronicle 从 Google Cloud 威胁情报 (GCTI) 数据源中提取数据,这些数据源会为您提供上下文信息,供您在调查环境中的活动时使用。您可以查询以下数据源:

  • GCTI Tor 退出节点
  • GCTI 良性二进制文件
  • GCTI 远程访问工具

如需了解这些威胁 Feed 以及填充的所有字段,请参阅提取和存储 Google Cloud 威胁情报数据

在本文档中,占位符 <variable_name> 表示在规则中用于标识 UDM 记录的唯一变量名称。

查询 Tor 退出节点 IP 地址

NETWORK_CONNECTION 事件包含存储在 target.ip 字段中的 IP 地址时,以下示例规则会返回检测结果,而该 IP 地址也可在 GCTI Tor Exit Nodes 数据源中找到。请务必在规则中添加 <variable_name>.graph.metadata.threat.threat_feed_name<variable_name>.graph.metadata.vendor_name<variable_name>.graph.metadata.product_name 字段。

这是一个计时数据源。事件将与该时间点的数据源快照相匹配。

rule gcti_tor_exit_nodes {
  meta:
    author = "Google Cloud Threat Intelligence"
    description = "Alert on known Tor exit nodes."
    severity = "High"

  events:
    // Event
    $e.metadata.event_type = "NETWORK_CONNECTION"
    $e.target.ip = $tor_ip

    // Tor IP search in GCTI Feed
    $tor.graph.entity.artifact.ip = $tor_ip
    $tor.graph.metadata.entity_type = "IP_ADDRESS"
    $tor.graph.metadata.threat.threat_feed_name = "Tor Exit Nodes"
    $tor.graph.metadata.source_type = "GLOBAL_CONTEXT"
    $tor.graph.metadata.vendor_name = "Google Cloud Threat Intelligence"
    $tor.graph.metadata.product_name = "GCTI Feed"

  match:
    $tor_ip over 1h

  outcome:
    $tor_ips = array_distinct($tor_ip)
    $tor_geoip_country = array_distinct($e.target.ip_geo_artifact.location.country_or_region)
    $tor_geoip_state = array_distinct($e.target.ip_geo_artifact.location.state)

  condition:
    $e and $tor
}

查询良性操作系统文件

以下示例规则将 Benign BinariesTor Exit Nodes 数据源组合在一起,以便在良性二进制文件接触 Tor 退出节点时返回提醒。该规则使用 Chronicle 使用目标 IP 地址扩充的地理定位数据来计算风险得分。请务必在规则中针对 Benign BinariesTor Exit Nodes 数据源添加 <variable_name>.graph.metadata.vendor_name<variable_name>.graph.metadata.product_name<variable_name>.graph.metadata.threat.threat_feed_name

这是一个经久不衰的数据源。无论时间如何,事件将始终与数据源的最新快照匹配。

rule gcti_benign_binaries_contacts_tor_exit_node {
 meta:
   author = "Google Cloud Threat Intelligence"
   description = "Alert on Benign Binary contacting a Tor IP address."
   severity = "High"

 events:
   // Event
   $e.metadata.event_type = "NETWORK_CONNECTION"
   $e.principal.process.file.sha256 = $benign_hash
   $e.target.ip = $ip
   $e.principal.hostname = $hostname

   // Benign File search in GCTI Feed
   $benign.graph.entity.file.sha256 = $benign_hash
   $benign.graph.metadata.entity_type = "FILE"
   $benign.graph.metadata.threat.threat_feed_name = "Benign Binaries"
   $benign.graph.metadata.source_type = "GLOBAL_CONTEXT"
   $benign.graph.metadata.vendor_name = "Google Cloud Threat Intelligence"
   $benign.graph.metadata.product_name = "GCTI Feed"

   // Tor IP search in GCTI Feed
   $tor.graph.entity.artifact.ip = $ip
   $tor.graph.metadata.entity_type = "IP_ADDRESS"
   $tor.graph.metadata.threat.threat_feed_name = "Tor Exit Nodes"
   $tor.graph.metadata.source_type = "GLOBAL_CONTEXT"
   $tor.graph.metadata.vendor_name = "Google Cloud Threat Intelligence"
   $tor.graph.metadata.product_name = "GCTI Feed"

 match:
   $hostname over 1h

 outcome:
   $risk_score = max(
       if($tor.graph.metadata.threat.confidence = "HIGH_CONFIDENCE", 70) +
       // Unauthorized target geographies
       if($e.target.ip_geo_artifact.location.country_or_region = "Cuba", 20) +
       if($e.target.ip_geo_artifact.location.country_or_region = "Iran", 20) +
       if($e.target.ip_geo_artifact.location.country_or_region = "North Korea", 20) +
       if($e.target.ip_geo_artifact.location.country_or_region = "Russia", 20) +
       if($e.target.ip_geo_artifact.location.country_or_region = "Syria", 20)
   )
   $benign_hashes = array_distinct($benign_hash)
   $benign_files = array_distinct($e.principal.process.file.full_path)
   $tor_ips = array_distinct($ip)
   $tor_geoip_country = array_distinct($e.target.ip_geo_artifact.location.country_or_region)
   $tor_geoip_state = array_distinct($e.target.ip_geo_artifact.location.state)

 condition:
   $e and $benign and $tor
}

查询远程访问工具的相关数据

PROCESS_LAUNCH 事件类型包含哈希(也可在 Google Cloud Threat Intelligence Remote Access Tools 数据源中找到)时,以下示例规则会返回检测结果。

这是一个经久不衰的数据源。无论时间如何,事件将始终与数据源的最新快照匹配。

rule gcti_remote_access_tools {
 meta:
   author = "Google Cloud Threat Intelligence"
   description = "Alert on Remote Access Tools."
   severity = "High"

 events:
    // find a process launch event
    $e.metadata.event_type = "PROCESS_LAUNCH"
    $e.target.process.file.sha256 != ""
    $rat_hash = $e.target.process.file.sha256

    // join graph and event hashes
    $gcti.graph.entity.file.sha256 = $rat_hash

    // look for files identified as likely remote access tools
    $gcti.graph.metadata.entity_type = "FILE"
    $gcti.graph.metadata.vendor_name = "Google Cloud Threat Intelligence"
    $gcti.graph.metadata.product_name = "GCTI Feed"
    $gcti.graph.metadata.threat.threat_feed_name = "Remote Access Tools"

  match:
    $rat_hash over 5m

 outcome:
   $remote_hash = array_distinct($e.target.process.file.sha256)

  condition:
    $e and $gcti

}

在规则中使用 VirusTotal 丰富元数据字段

以下规则会检测特定文件类型的文件创建或进程启动,表明系统中有某些加入监控的哈希。使用 VirusTotal 文件元数据扩充功能将文件标记为 exploit 时,系统会设置风险得分。

如需查看已填充的所有 UDM 字段的列表,请参阅使用 VirusTotal 文件元数据丰富事件

rule vt_filemetadata_hash_match_ioc {
 meta:
   author = "Google Cloud Threat Intelligence"
   description = "Detect file/process events that indicate watchlisted hashes are on a system"
   severity = "High"

 events:
   // Process launch or file creation events
   $process.metadata.event_type = "PROCESS_LAUNCH" or $process.metadata.event_type ="FILE_CREATION"
   $process.principal.hostname = $hostname
   $process.target.file.sha256 != ""
   $process.target.file.sha256 = $sha256
   $process.target.file.file_type = "FILE_TYPE_DOCX"

   // IOC matching
   $ioc.graph.metadata.product_name = "MISP"
   $ioc.graph.metadata.entity_type = "FILE"
   $ioc.graph.metadata.source_type = "ENTITY_CONTEXT"
   $ioc.graph.entity.file.sha256 = $sha256

 match:
   $hostname over 15m

 outcome:
   $risk_score = max(
       // Tag enrichment from VirusTotal file metadata
       if($process.target.file.tags = "exploit", 90)
   )
   $file_sha256 = array($process.target.file.sha256)
   $host = array($process.principal.hostname)

 condition:
   $process and $ioc
}

在规则中使用 VirusTotal 关系数据

Chronicle 会从 VirusTotal 相关连接中提取数据。此数据提供了有关文件哈希与文件、网域、IP 地址和网址之间的关系的信息。这种丰富的信息以实体的形式存储在 Chronicle 中。

您可以创建 Detection Engine 规则,以识别与从 VirusTotal 提取的实体的匹配项。以下规则会在从具有 VirusTotal 关系的已知 IP 地址下载已知文件哈希时发送提醒。风险得分基于 VirusTotal 文件元数据中的文件类型和标记。

这些数据仅适用于某些 VirusTotal 和 Chronicle 许可。 请与您的客户经理联系,确认您的使用权。如需查看已填充的所有 UDM 字段的列表,请参阅使用 VirusTotal 关系数据丰富实体

rule virustotal_file_downloaded_from_url {
  meta:
    author = "Google Cloud Threat Intelligence"
    description = "Alerts on downloading a known file hash from a known IP with VirusTotal relationships. The risk score is based on file type and tags from VirusTotal file metadata."
    severity = "High"

  events:
    // Filter network HTTP events
    $e1.metadata.event_type = "NETWORK_HTTP"
    $e1.principal.user.userid = $userid
    $e1.target.url = $url

    // Filter file creation events
    $e2.metadata.event_type = "FILE_CREATION"
    $e2.target.user.userid = $userid
    $e2.target.file.sha256 = $file_hash

    // The file creation event timestamp should be equal or greater than the network http event timestamp
    $e1.metadata.event_timestamp.seconds <= $e2.metadata.event_timestamp.seconds

    // Join event file hash with VirusTotal relationships entity graph
    $vt.graph.metadata.entity_type = "FILE"
    $vt.graph.metadata.source_type = "GLOBAL_CONTEXT"
    $vt.graph.metadata.vendor_name = "VirusTotal"
    $vt.graph.metadata.product_name = "VirusTotal Relationships"
    $vt.graph.entity.file.sha256 = $file_hash

    // Join network HTTP target URL with VirusTotal relationships entity graph
    $vt.graph.relations.entity_type = "URL"
    $vt.graph.relations.relationship = "DOWNLOADED_FROM"
    $vt.graph.relations.entity.url = $url

  match:
    $userid over 1m

  outcome:
      $risk_score = max(
        // Tag enrichment from VirusTotal file metadata
        if($e2.target.file.tags = "via-tor" or $e2.target.file.tags = "malware" or $e2.target.file.tags = "crypto", 50) +
        // File types enrichment from VirusTotal file metadata
        if($e2.target.file.file_type = "FILE_TYPE_HTML", 5) +
        if($e2.target.file.file_type = "FILE_TYPE_ELF", 10) +
        if($e2.target.file.file_type = "FILE_TYPE_PE_DLL",15) +
        if($e2.target.file.file_type = "FILE_TYPE_PE_EXE", 20)
    )

  condition:
    $e1 and $e2 and $vt and $risk_score >= 50
}

后续步骤

如需了解如何将丰富数据与其他 Chronicle 功能结合使用,请参阅以下内容: