detecting-fileless-attacks-on-endpoints

检测终端上的无文件攻击

何时使用

在以下情况下使用本技能：

• 为完全在内存中运行的无文件恶意软件构建检测规则
• 搜寻基于 PowerShell 的攻击、反射式 DLL 注入和 WMI 滥用
• 配置终端遥测（Sysmon、AMSI、PowerShell 日志记录）以捕获无文件攻击指标
• 调查传统 AV 未发现任何恶意文件的 incident

不要使用本技能检测基于文件的恶意软件或进行恶意软件逆向工程。

前提条件

• 已启用进程创建和 WMI 事件日志记录的 Sysmon
• 已启用 PowerShell 脚本块日志记录和模块日志记录
• 已启用 AMSI（反恶意软件扫描接口）以检查脚本内容
• 具备行为检测能力的 EDR（MDE、CrowdStrike、SentinelOne）

工作流

步骤 1：启用所需遥测

# Enable PowerShell Script Block Logging (GPO or registry)
New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" `
  -Name EnableScriptBlockLogging -Value 1 -PropertyType DWORD -Force

# Enable PowerShell Module Logging
New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging" `
  -Name EnableModuleLogging -Value 1 -PropertyType DWORD -Force

# Enable PowerShell Transcription
New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription" `
  -Name EnableTranscripting -Value 1 -PropertyType DWORD -Force

# Sysmon config for fileless detection (key events):
# Event ID 1: Process creation (captures CommandLine)
# Event ID 7: Image loaded (DLL loading)
# Event ID 8: CreateRemoteThread (injection)
# Event ID 10: Process access (LSASS access)
# Event ID 19/20/21: WMI events

步骤 2：检测基于 PowerShell 的攻击

# Indicators of malicious PowerShell:

# Encoded command execution
EventID: 1
CommandLine contains: "powershell" AND ("-enc" OR "-e " OR "-encodedcommand" OR "FromBase64String")

# Download cradle patterns
CommandLine contains: "IEX" AND ("Net.WebClient" OR "DownloadString" OR "Invoke-WebRequest")
CommandLine contains: "Invoke-Expression" AND "New-Object"

# AMSI bypass attempts (Event ID 4104 - Script Block)
ScriptBlock contains: ("Amsi"+"Utils") OR ("amsi"+"InitFailed") OR "SetValue.*amsi"

# Splunk query for suspicious PowerShell:
index=windows source="WinEventLog:Microsoft-Windows-PowerShell/Operational" EventCode=4104
| where match(ScriptBlockText, "(?i)(iex|invoke-expression|downloadstring|net\.webclient|frombase64|bypass|amsi.utils)")
| table _time host ScriptBlockText

步骤 3：检测进程注入技术

# Reflective DLL injection - loads DLL from memory without touching disk
# Detection: Sysmon Event 7 (ImageLoaded) where image path is unusual
EventID: 7
ImageLoaded NOT starts with: "C:\Windows\" AND NOT starts with: "C:\Program Files"

# Process hollowing - creates process in suspended state, replaces memory
# Detection: Process creation followed by immediate memory write
EventID: 1 + 10 correlation
# Process created then accessed with PROCESS_VM_WRITE

# APC injection - queues code to thread's async procedure call queue
# Detection: Sysmon CreateRemoteThread from non-system process
EventID: 8
SourceImage NOT IN (known_legitimate_sources)

# MDE KQL:
DeviceEvents
| where ActionType in ("CreateRemoteThreadApiCall", "NtAllocateVirtualMemoryApiCall")
| where InitiatingProcessFileName !in ("MsMpEng.exe", "svchost.exe")
| project Timestamp, DeviceName, ActionType, InitiatingProcessFileName,
    InitiatingProcessCommandLine, FileName

步骤 4：检测基于 WMI 的持久化

# Sysmon Event IDs 19/20/21 for WMI events
EventID: 19  # WmiEventFilter activity detected
EventID: 20  # WmiEventConsumer activity detected
EventID: 21  # WmiEventConsumerToFilter activity detected

# Any WMI event subscription creation is suspicious unless expected
# Common malicious WMI persistence:
Consumer contains: "CommandLineEventConsumer" OR "ActiveScriptEventConsumer"

# Query for WMI subscriptions via osquery or PowerShell:
Get-WMIObject -Namespace root\Subscription -Class __EventFilter
Get-WMIObject -Namespace root\Subscription -Class __EventConsumer
Get-WMIObject -Namespace root\Subscription -Class __FilterToConsumerBinding

步骤 5：检测基于注册表的执行

# Malware stored in registry values and executed via PowerShell
# Sysmon Event 13 - Registry value set with encoded content
EventID: 13
TargetObject contains: "CurrentVersion\Run"
Details: unusually long value or Base64-encoded content

# Detection query:
index=sysmon EventCode=13
| where match(Details, "[A-Za-z0-9+/=]{100,}")
| table _time host TargetObject Details Image

关键概念

术语	定义
无文件恶意软件	完全在内存中运行、不将可执行文件写入磁盘的恶意软件
AMSI	反恶意软件扫描接口；允许安全产品在执行前检查脚本内容的 Windows API
反射式 DLL 注入	从内存而非磁盘加载 DLL，从而规避基于文件的检测
进程镂空	以挂起状态创建合法进程，并用恶意代码替换其内存
脚本块日志记录	PowerShell 日志记录功能，可捕获反混淆后的脚本内容（事件 ID 4104）

工具与系统

• Sysmon：内核级进程、DLL 和 WMI 监控
• AMSI：Windows 脚本内容检查 API
• PowerShell 日志记录：脚本块、模块和转录日志记录
• Microsoft Defender for Endpoint：针对无文件技术的行为检测
• Volatility 3：用于事件后无文件恶意软件分析的内存取证

常见陷阱

• 依赖基于文件的 AV：扫描磁盘文件的传统 AV 会完全漏掉无文件攻击。需要行为检测和 AMSI。
• PowerShell 日志记录被禁用：如果没有脚本块日志记录，防御者将无法看到反混淆后的 PowerShell 命令。
• 未检测到 AMSI 绕过：高级攻击者会在执行 payload 前绕过 AMSI。应将 AMSI 绕过企图检测为高优先级警报。
• 未监控 WMI 事件：WMI 持久化是 APT 组织青睐的技术。必须启用 Sysmon 事件 19-21。