シナリオでは、検知対象となる項目があり、それらに対する検知の有無で評価しています。
項目は、「（大項目番号）.（中項目アルファベット）.（小項目番号）」というルールで付与されています。
また、今回は私の独自の着眼点として、項目毎に4つの分類を追加してみました。
その項目が、どのような振る舞いであるか、またどのような系統の検知機能で検知されるべきか、という指標になりそう、という理由です。
項目によっては複数関連しそうなものもありましたが、今回はとりあえずいずれかの一つに分類することとしました。
分類は以下の観点です。
Malware Inside Behavior
マルウェアの内部の動きが主となる項目。
検知する場合、マルウェアそのものの動作をモニタリングするか、マルウェアが動いたことによって発生した結果を検知する必要がある。
Command Level Behavior
攻撃者の操作によるコマンド実行や、マルウェア等が他のプロセスをコマンドライン等で起動したような振る舞い。DFIRをはじめとしたサイバー攻撃に対するフォレンジック観点などの方法で検知する必要がある。
Network
ネットワークの通信をモニタリングするか、ネットワーク通信に関連するログ等を元に検知する必要がある。リモートログオンもこの項目に含めている。
File or data attribute
ファイルまたはデータそのものを参照するなどして検知する必要がある。
この分類の結果、マルウェアそのものの動きに関する項目が2割弱、コマンド等の振る舞いに関する項目が5割弱、ネットワークに関する項目が3割強、これらに属さないファイルやデータそのもの情報が2項目となりました。
この項目分けと結果を比べることで、それぞれのソリューションが何に強く、何に弱いかを知る指標になるかと考え、今回の分析で採用しました。
シナリオ１ Wizard Spiderによるランサムウェア攻撃
| Step | Criteria | Malware Inside Behavior | Command Level Behavior | Network | File or data attribute |
| 1.A.1 | explorer.exe executes winword.exe | 〇 | |||
| 1.A.2 | winword.exe loads VBEUI.DLL, executes code via AutoOpen() | 〇 | |||
| 1.A.3 | winword.exe downloads C:\Users\Public\adb.txt | 〇 | |||
| 1.A.4 | winword.exe executes cmd.exe to execute adb.vbs | 〇 | |||
| 1.A.5 | adb.vbs is obfuscated | 〇 | |||
| 1.A.6 | adb.vbs executes powershell.exe via Win32_Process | 〇 | |||
| 1.A.7 | WmiPrvSE.exe spawns powershell.exe | 〇 | |||
| 1.A.8 | powershell.exe downloads adb.dll | 〇 | |||
| 1.A.9 | rundll32.exe executes adb.dll | 〇 | |||
| 1.A.10 | rundll32.exe connects to 192.168.0.4 over protocol HTTP | 〇 | |||
| 1.A.11 | rundll32.exe connects to 192.168.0.4 over AES-encrypted protocol HTTP | 〇 | |||
| 2.A.1 | rundll32.exe adds the blbdigital Registry Run key using RegSetValueExA() | 〇 | |||
| 3.A.1 | rundll32.exe executes RtlGetVersion(), GetNativeSystemInfo(), and RtlGetNtProductType() | 〇 | |||
| 3.A.2 | rundll32.exe executes CreateToolhelp32Snapshot() | 〇 | |||
| 3.A.3 | rundll32.exe downloads Outlook.dll | 〇 | |||
| 3.A.4 | rundll32.exe spawns cmd.exe then powershell.exe to search Outlook for password strings | 〇 | |||
| 3.A.5 | rundll32.exe spawns cmd.exe then powershell.exe to read SenderEmailAddress values from Outlook | 〇 | |||
| 4.A.1 | Adversary connects to 10.0.0.8 using protocol RDP (port 3389) | 〇 | |||
| 4.A.2 | User bill successfully authenticates into 10.0.0.8 | 〇 | |||
| 4.A.3 | cmd.exe downloads the file uxtheme.exe | 〇 | |||
| 4.A.4 | uxtheme.exe connects to 192.168.0.4 over protocol HTTP | 〇 | |||
| 4.A.5 | uxtheme.exe connects to 192.168.0.4 over protocol HTTP on port 447 | 〇 | |||
| 5.A.1 | cmd.exe executes systeminfo | 〇 | |||
| 5.A.2 | cmd.exe executes sc query | 〇 | |||
| 5.A.3 | cmd.exe executes net user | 〇 | |||
| 5.A.4 | cmd.exe executes net user /domain | 〇 | |||
| 5.A.5 | cmd.exe executes ipconfig | 〇 | |||
| 5.A.6 | cmd.exe executes netstat | 〇 | |||
| 5.A.7 | cmd.exe executes net /config | 〇 | |||
| 5.A.8 | cmd.exe executes nltest /domain_trusts /all_trusts | 〇 | |||
| 5.A.9 | cmd.exe executes whoami | 〇 | |||
| 6.A.1 | uxtheme.exe downloads the file rubeus.exe | 〇 | |||
| 6.A.2 | cmd.exe executes rubeus.exe kerberoast /domain:oz.local | 〇 | |||
| 7.A.1 | Adversary connects to 10.0.0.4 using protocol RDP (port 3389) | 〇 | |||
| 7.A.2 | User vfleming successfully authenticates into 10.0.0.4 | 〇 | |||
| 7.A.3 | powershell.exe downloads the file uxtheme.exe | 〇 | |||
| 7.A.4 | powershell.exe adds the Userinit Registry key using Set-ItemProperty | 〇 | |||
| 7.A.5 | powershell.exe executes adfind.exe | 〇 | |||
| 8.A.1 | cmd.exe executes vssadmin.exe to create a copy of C: | 〇 | |||
| 8.A.2 | cmd.exe executes reg.exe to save HKLM\SYSTEM | 〇 | |||
| 9.A.1 | cmd.exe downloads kill.bat | 〇 | |||
| 9.A.2 | cmd.exe stops various services via net stop, sc config, and taskkill | 〇 | |||
| 9.A.3 | cmd.Exe executes icacls.exe to modify permissions on C: and Z: | 〇 | |||
| 9.A.4 | cmd.exe downloads window.bat | 〇 | |||
| 9.A.5 | cmd.exe deletes system backups via vssadmin and del | 〇 | |||
| 10.A.1 | cmd.exe downloads C:\Users\Public\ryuk.exe | 〇 | |||
| 10.A.2 | ryuk.exe adjusts its token to include SE_PRIVILEGE_ENABLED via AdjustTokenPrivileges() | 〇 | |||
| 10.A.3 | ryuk.exe executes CreateToolhelp32Snapshot() | 〇 | |||
| 10.A.4 | ryuk.exe injects into notepad.exe via WriteProcessMemory() and CreateRemoteThread() | 〇 | |||
| 10.A.5 | ryuk.exe enumerates drives via GetLogicalDriveStrings() and GetDriveType() | 〇 | |||
| 10.A.6 | ryuk.exe enumerates files via FindFirstFile() and FindNextFile() | 〇 | |||
| 10.A.7 | notepad.exe encrypts various files using AES + RSA | 〇 | |||
| (合計) | 9 | 24 | 17 | 2 |
シナリオ２ Sandwormによるシステム破壊攻撃
| Step | Criteria | Malware Inside Behavior | Command Level Behavior | Network | File or data attribute |
| 11.A.1 | User fherbert successfully authenticates into 10.0.1.5 | 〇 | |||
| 11.A.2 | Adversary connects to 10.0.1.5 using SCP (port 22) | 〇 | |||
| 11.A.3 | Webshell payload (/tmp/search.php) is dropped to disk on 10.0.1.5 | 〇 | |||
| 11.A.4 | Webshell payload (search.php) is copied to /var/www/html then connected to over port 443 | 〇 | |||
| 12.A.1 | A shell is executed | 〇 | |||
| 12.A.2 | Shell executes whoami | 〇 | |||
| 12.A.3 | Shell executes uname -a | 〇 | |||
| 12.A.4 | Shell executes ls -lsahR | 〇 | |||
| 12.A.5 | Shell executes cat to read /etc/passwd | 〇 | |||
| 13.A.1 | /var/www/html/ centreon_module_linux_app64 is dropped to disk on 10.0.1.5 |
〇 | |||
| 13.A.2 | SUID binary /bin/backup isexecuted as root | 〇 | |||
| 13.A.3 | centreon_module_linux_app64 connects to 192.168.0.4 over protocol HTTPS | 〇 | |||
| 13.A.4 | centreon_module_linux_app64 connects to 192.168.0.4 over encrypted protocol HTTPS | 〇 | |||
| 13.A.5 | centreon_module_linux_app64 connects to 192.168.0.4 over protocol HTTPS on port 8443 | 〇 | |||
| 14.A.1 | centreon_module_linux_app64 spawns crontab to create a new job | 〇 | |||
| 14.A.2 | centreon_module_linux_app64 writes to /etc/systemd/system/ syslogd.service |
〇 | |||
| 14.A.3 | User root executes cat to read /etc/shadow | 〇 | |||
| 14.A.4 | User root executes cat to read /home/fherbert/.bash_history | 〇 | |||
| 14.A.5 | centreon_module_linux_app64 accesses /home/fherbert/.ssh/id_rsa and /home/fherbert/.ssh/id_rsa.pub | 〇 | |||
| 15.A.1 | User fherbert successfully authenticates into 10.0.1.7 via SMB | 〇 | |||
| 15.A.2 | Connection to 10.0.1.7 over protocol SMB | 〇 | |||
| 15.A.3 | C:\Windows\wsmprovav.exe is written to disk on 10.0.1.7 | 〇 | |||
| 15.A.4 | A service binary is written to disk in C:\Windows\on 10.0.1.7 | 〇 | |||
| 15.A.5 | New service Windows Check AV is created | 〇 | |||
| 15.A.7 | SecurityHealth Registry Run key is added using reg.exe | 〇 | |||
| 15.A.6 | Service binary in C:\Windows\ is executed | 〇 | |||
| 15.A.8 | Rundll32.exe executes wsmprovav.dll | 〇 | |||
| 15.A.9 | Rundll32 connects to 192.168.0.4 over protocol HTTPS | 〇 | |||
| 15.A.10 | Rundll32 connects to 192.168.0.4 over encrypted protocol HTTPS | 〇 | |||
| 16.A.1 | rundll32.exe executes user.Current() | 〇 | |||
| 16.A.2 | rundll32.exe queries HKLM\SOFTWARE\Microsoft\ Windows NT\CurrentVersion for various subkeys |
〇 | |||
| 16.A.3 | rundll32.exe lists files in C:\ | 〇 | |||
| 16.A.4 | rundll32.exe executes cmd.exe | 〇 | |||
| 16.A.5 | cmd.exe executes netstat.exe | 〇 | |||
| 17.A.1 | rundll32.exe creates the file oradump.exe | 〇 | |||
| 17.A.2 | oradump.exe reads passwords from local browsers DBs | 〇 | |||
| 17.A.3 | rundll32.exe creates the file mslog.exe | 〇 | |||
| 17.A.4 | mslog.exe executes SetWindowsHookEx() and GetKeyState() to collect keystrokes | 〇 | |||
| 17.A.5 | rundll32.exe RC4 encrypts data from mslog.txt | 〇 | |||
| 17.A.6 | rundll32.exe posts data from mslog.txt to 192.168.0.4 over HTTPS | 〇 | |||
| 17.A.7 | rundll32.exe executes dsquery.exe via cmd.exe | 〇 | |||
| 17.A.8 | rundll32.exe deletes oradump.exe, mslog.exe, and mslog.txt via cmd.exe | 〇 | |||
| 18.A.1 | User patreides successfully authenticates into 10.0.1.4 | 〇 | |||
| 18.A.2 | Adversary connects to 10.0.1.4 using RDP (port 3389) | 〇 | |||
| 18.A.3 | powershell.exe is executed | 〇 | |||
| 18.A.4 | powershell.exe downloads perfc.dat via copy | 〇 | |||
| 19.A.1 | rundll32.exe executes perfc.dat | 〇 | |||
| 19.A.2 | schtask.exe creates Restart task | 〇 | |||
| 19.A.3 | rundll32.exe executes GetIpNetTable() | 〇 | |||
| 19.A.4 | rundll32.exe executes CredEnumerateW() | 〇 | |||
| 19.A.5 | C:\Windows\perfc.dat is written to disk on 10.0.1.8 | 〇 | |||
| 19.A.6 | Remote WMI is used to execute rundll32.exe on 10.0.1.8 | 〇 | |||
| 19.A.7 | rundll32.exe encrypts various files using AES | 〇 | |||
| 19.A.8 | Event logs are cleared via wevtutil.exe | 〇 | |||
| 19.A.9 | USN change journal is cleared using fsutil.exe | 〇 | |||
| 19.A.10 | schtask.exe executes Restart task | 〇 | |||
| 19.A.11 | powershell.exe reboots the hosts via Restart-Computer | 〇 | |||
| (合計) | 11 | 27 | 19 | 0 |