보안-03. Sigma 기초 — 룰 문법, logsource, detection 완전 분해

Sigma 룰 (YAML)
    │
    ▼
pySigma 변환기
    │
    ├─→  Splunk SPL: index=wineventlog EventID=4688 AND CommandLine=*base64*
    ├─→  Elastic DSL: {"query": {"bool": {"must": [...]}}}
    ├─→  Microsoft KQL: SecurityEvent | where EventID == 4688 | where CommandLine has "base64"
    └─→  QRadar AQL: SELECT * FROM events WHERE ...

title: Suspicious AWK Shell Spawn
id: 8c1a5675-cb85-452f-a298-b01b22a51856
related:
  - id: 11f9a6f7-72e6-4a12-bc73-3a8c2e6e5e24
    type: derived   # obsoletes | derived | merged | similar
status: test        # stable | test | experimental | deprecated | unsupported
description: |
  awk로 셸을 spawn하는 행위 탐지. GTFOBins에 기록된 권한 상승 기법.
references:
  - https://gtfobins.github.io/gtfobins/awk/#shell
author: Li Ling, Andy Parkidomo
date: 2024-09-02
modified: 2024-11-15
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: linux
detection:
  selection_img:
    Image|endswith:
      - '/awk'
      - '/gawk'
  selection_cli:
    CommandLine|contains:
      - '/bin/bash'
      - '/bin/sh'
  condition: all of selection_*
falsepositives:
  - 스크립트 개발 중 정상 사용
level: high

tags:
  - attack.execution          # 전술 (소문자, _ 구분)
  - attack.t1059              # 기법 ID
  - attack.t1059.004          # 세부 기법 (AWK = T1059.004 = Unix Shell)
  - attack.privilege_escalation
  - attack.t1548
  - detection.threat_hunting  # 위협 헌팅 전용 태그

logsource:
  product: windows     # 플랫폼
  category: process_creation   # 이벤트 유형
  # service: security  # 특정 서비스 (category와 배타적으로 쓰는 경우 多)

detection:
  selection:      # selection 블록 (여러 개 가능)
    field: value
  filter:
    field: value
  condition: selection and not filter   # 조건 표현식

detection:
  selection:
    EventID: 4688          # AND
    CommandLine|contains: 'base64'   # AND
    User|endswith: '$'     # 모두 만족해야 선택됨
  condition: selection

detection:
  selection:
    CommandLine|contains:
      - 'base64 -d'    # OR
      - 'base64 -D'    # OR
      - 'FromBase64'

# PowerShell -EncodedCommand 탐지
# -enc로 전달되는 base64 + UTF-16LE 조합
detection:
  selection:
    CommandLine|base64offset|contains:
      - 'IEX'     # Invoke-Expression
      - 'Invoke-Expression'
      - 'WebClient'

# 모든 값이 CommandLine에 있어야 함 (AND)
detection:
  selection:
    CommandLine|contains|all:
      - 'powershell'   # AND
      - '-nop'         # AND
      - '-enc'

# 하나라도 있으면 됨 (OR)
detection:
  selection:
    CommandLine|contains:
      - 'powershell'   # OR
      - '-nop'         # OR
      - '-enc'

condition: selection                  # 단일 블록
condition: selection and not filter   # AND NOT
condition: selection_a or selection_b # OR
condition: not selection              # NOT (단독 사용 지양)

# selection_A, selection_B, selection_C 중 하나 이상
condition: 1 of selection_*

# filter_로 시작하는 블록 중 하나도 안 맞으면
condition: selection and not 1 of filter_*

# filter_로 시작하는 모든 블록에 안 맞으면
condition: selection and not all of filter_*

detection:
  selection:
    Image|endswith: '\powershell.exe'
    CommandLine|contains: '-enc'
  filter_admin:
    User: SYSTEM
  filter_legit_path:
    Image|startswith: 'C:\Windows\System32\'
  condition: selection and not 1 of filter_*

detection:
  selection_image:
    Image|endswith:
      - '\nc.exe'
      - '\ncat.exe'
      - '\netcat.exe'
  selection_cmdline:
    CommandLine|contains|all:
      - ' -e '
      - '/bin/sh'
  condition: 1 of selection_*

detection:
  selection_parent:
    ParentImage|endswith: '\word.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\wscript.exe'
  condition: all of selection_*
# 해석: ParentImage가 word.exe이면서 동시에 Image가 cmd/ps/wscript 중 하나

# 기반 룰
- name: failed_login_attempt
  title: Failed Login Attempt
  logsource:
    product: windows
    service: security
  detection:
    selection:
      EventID: 4625   # 로그인 실패
    condition: selection

# 상관관계 룰
- title: Brute Force Attack
  type: event_count
  rules:
    failed_login: failed_login_attempt
  group-by:
    - TargetUserName   # 사용자별로 그룹화
    - IpAddress
  timespan: 5m
  condition:
    gte: 10            # 5분 안에 10번 이상 실패
  level: high
  tags: [attack.credential_access, attack.t1110]

title: Passwd File Read Attempt
id: a1b2c3d4-e5f6-7890-abcd-ef1234567890
status: experimental
description: 비루트 프로세스가 /etc/passwd를 읽으려 함
references:
  - https://attack.mitre.org/techniques/T1003/008/
author: My Name
date: 2026-06-15
tags:
  - attack.credential_access
  - attack.t1003.008
logsource:
  product: linux
  category: file_access
detection:
  selection:
    FileName: '/etc/passwd'
  filter_root:
    UserId: 0
  filter_legit:
    Image|endswith:
      - '/login'
      - '/passwd'
      - '/useradd'
  condition: selection and not filter_root and not 1 of filter_legit
falsepositives:
  - 관리 스크립트가 직접 읽는 경우
level: medium

title: PowerShell Encoded Command Execution
id: b2c3d4e5-f6a7-8901-bcde-f12345678901
status: test
description: PowerShell이 -EncodedCommand 플래그로 실행됨. 악성 스크립트가 탐지를 피하려 자주 씀.
references:
  - https://attack.mitre.org/techniques/T1059/001/
author: My Name
date: 2026-06-15
tags:
  - attack.execution
  - attack.t1059.001
  - attack.defense_evasion
  - attack.t1027
logsource:
  product: windows
  category: process_creation
detection:
  selection_encoded:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains|windash:
      - ' -EncodedCommand '
      - ' -enc '
      - ' -ec '
  filter_scheduled:
    ParentImage|endswith: '\taskhost.exe'
    CommandLine|contains: 'ScheduledTasks'
  condition: selection_encoded and not filter_scheduled
falsepositives:
  - SCCM, 관리 스크립트 일부
level: medium

title: Network Scanning Tool Execution
id: c3d4e5f6-a7b8-9012-cdef-123456789012
status: test
description: nmap, masscan 같은 네트워크 스캔 도구 실행
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: EXECVE
    a0|endswith:
      - '/nmap'
      - '/masscan'
      - '/zmap'
      - '/rustscan'
  condition: selection
falsepositives:
  - 네트워크 팀의 정기 스캔
  - 취약점 점검 업무
level: medium
tags:
  - attack.discovery
  - attack.t1046

# 설치
pip install sigma-cli

# 플러그인 목록 확인
sigma plugin list

# 백엔드 설치 (Elasticsearch)
sigma plugin install pySigma-backend-elasticsearch

# 변환
sigma convert \
  --target elasticsearch \
  --pipeline ecs_windows \
  rules/windows/process_creation/proc_creation_win_powershell_enc.yml

# 여러 룰 일괄 변환
sigma convert \
  --target splunk \
  --pipeline windows-splunk \
  rules/windows/process_creation/

# 파이프라인 지정
sigma convert \
  --target qradar \
  --pipeline sysmon \
  my_rule.yml