HowDefend Türkçe

Write Sigma rules and test them on real logs

HowDefend explains how to detect and prevent common attack techniques on Windows, teaches Sigma, the open format for detection rules, and tests rules on attack recordings and on the logs of a clean Windows machine. A rule is judged on two counts: did it catch the attack, and how many normal events did it flag.

How to defend against

One page per technique: what the attacker does, what it looks like in the logs, a detection rule with its measured result, what the rule misses and how to prevent it.

  1. 1mshta script execution
  2. 2Encoded PowerShell commands
  3. 3Run key persistence
  4. 4LSASS credential dumping
  5. 5Scheduled task abuse
  6. 6Remote service and WMI execution
  7. 7Copying the password hives
  8. 8Logging disabled via registry
  9. 9Logging disabled from the command line
  10. 10C2 traffic from hijacked processes

Lessons

Eight short lessons, from the parts of a rule to preparing it for a SIEM. Each ends with an exercise.

  1. 1The parts of a Sigma rule
  2. 2Log sources and field names
  3. 3Matching values
  4. 4Lists, searches and conditions
  5. 5False positives and how to narrow a rule
  6. 6Command lines that change shape
  7. 7Process access and access masks
  8. 8Making a rule ready for use

Challenges

One technique each, with every target event labelled and thousands of normal events to avoid.

  1. 1mshta running script code
  2. 2Encoded PowerShell commands
  3. 3Persistence through a Run key
  4. 4Access to LSASS memory
  5. 5Scheduled tasks that run a command
  6. 6Remote execution through services and WMI
  7. 7Copying the password hives and the AD database
  8. 8Turning off event logging through the registry
  9. 9Turning off logging from the command line
  10. 10Network connections from processes that should not have any

How a rule is checked

  1. You write the rule in YAML, as you would for any Sigma tool.
  2. It runs in this browser on the events of the lesson or challenge: attack events and normal events from the same machines and from a clean Windows 10 client.
  3. The result lists the attack events it caught and missed, and every normal event it matched.

The evaluator supports a defined part of the Sigma specification and is compared with pySigma on every data set in the build. A rule that uses an unsupported feature is rejected with a message, not evaluated differently.

Tools

NVD CPE Vendor/Product Selector