Log Analysis & SIEM Integration

日志分析与 SIEM 集成

目的

让 Claude 能够协助分析所有主流平台的安全日志。Claude 会直接解析和分析用户提供的日志样本，为任何平台构建 SIEM 查询，创建可移植的检测 Sigma 规则，开发关联规则，并识别日志数据中的异常模式。

---

激活条件

用户询问以下内容时，此技能会激活：

• 解析 Windows 事件日志、Linux syslog 或应用程序日志
• 构建 Splunk SPL、Elastic KQL/EQL、QRadar AQL 或 Sentinel KQL 查询
• 创建用于平台无关检测的 Sigma 规则
• 检测日志数据中的异常或攻击模式
• 为复杂攻击场景构建 SIEM 关联规则
• 在不同 SIEM 平台之间转换查询
• 监控日志源运行状况并分析缺口
• 在日志中检测横向移动、权限提升或持久化
• 分析 EVTX 或审查 Windows 审计日志

---

前提条件

pip install pandas pyyaml python-dateutil

平台工具：

• Splunk — Splunk Web、SPL 和 SOAR
• Elastic Stack — Kibana、KQL、EQL
• Microsoft Sentinel — KQL、Workbooks
• IBM QRadar — AQL、规则
• Sigma — 平台无关的规则格式
• python-evtx — 无需 Windows 即可解析 Windows .evtx 文件

---

核心功能

1. 日志解析与分析

用户粘贴日志或提供日志文件时：

Claude 会直接读取并分析日志，提取与安全相关的事件。

Windows 事件日志 — 关键事件 ID：

事件 ID	日志	描述
4624	Security	登录成功 — 登录类型 3（网络）值得关注
4625	Security	登录失败 — 跟踪源 IP 以检测暴力破解
4648	Security	使用显式凭据登录（RunAs）
4688	Security	创建新进程 — 需要启用 CommandLine 审计
4698	Security	创建计划任务
4702	Security	更新计划任务
4720	Security	创建用户帐户
4728/4732	Security	将成员添加到安全组/本地组
4768/4769	Security	请求 Kerberos TGT/TGS
4776	Security	NTLM 身份验证
4946	Security	添加 Windows 防火墙规则
5140	Security	访问网络共享
5145	Security	访问网络共享文件
7045	System	安装新服务
1102	Security	清除审计日志
4103/4104	PowerShell	PowerShell 模块/脚本块日志记录

Linux 日志分析 — 关键模式：

# Failed SSH logins
grep "Failed password" /var/log/auth.log | awk '{print $1,$2,$3,$11}' | sort | uniq -c | sort -rn

# Successful logins after failures (brute force success)
grep "Accepted password\|Accepted publickey" /var/log/auth.log

# Sudo usage
grep "sudo:" /var/log/auth.log | grep -v "session"

# Cron job execution
grep CRON /var/log/syslog

# New user creation
grep "useradd\|usermod" /var/log/auth.log

# Privilege escalation
grep "su\b" /var/log/auth.log

日志解析脚本：

python scripts/log_parser.py --input /var/log/auth.log --format json --output parsed.json
python scripts/log_parser.py --input events.evtx --normalize ecs --output normalized.json

2. SIEM 查询库

用户要求构建检测查询时：

Splunk SPL — 攻击模式查询

// Brute force attack detection
index=windows EventCode=4625
| bin _time span=5m
| stats count as FailedLogins, values(Account_Name) as Accounts by src_ip, _time
| where FailedLogins > 20
| sort -FailedLogins

// Pass-the-Hash detection (Logon Type 3 with NTLM)
index=windows EventCode=4624 Logon_Type=3 Authentication_Package=NTLM
| where NOT (Account_Name="ANONYMOUS LOGON" OR Account_Name="*$")
| stats count by Account_Name, Workstation_Name, src_ip
| where count > 1

// Lateral movement via PsExec / admin shares
index=windows EventCode=5145
| where (ShareName="\\\\*\\ADMIN$" OR ShareName="\\\\*\\C$") 
    AND RelativeTargetName="*PSEXESVC*"
| table _time, SubjectUserName, IpAddress, ShareName

// PowerShell encoded command execution
index=windows (source="WinEventLog:Microsoft-Windows-PowerShell/Operational" EventCode=4104)
    OR (EventCode=4688 CommandLine="*powershell*")
| search CommandLine IN ("*-EncodedCommand*", "*-enc *", "*-e *", "*-nop*", 
                          "*DownloadString*", "*IEX*", "*Invoke-Expression*")
| table _time, ComputerName, User, CommandLine

// Scheduled task creation for persistence
index=windows EventCode=4698
| rex field=TaskContent "<Command>(?P<command>[^<]+)</Command>"
| where NOT match(command, "(?i)\\\\windows\\\\|\\\\microsoft\\\\|\\\\system32\\\\")
| table _time, ComputerName, SubjectUserName, TaskName, command

// LSASS memory access (credential dumping)
index=sysmon EventCode=10 TargetImage="*lsass.exe"
| where NOT (SourceImage IN 
    ("C:\\Windows\\System32\\*", "C:\\Windows\\SysWOW64\\*",
     "C:\\Program Files\\*", "C:\\Program Files (x86)\\*"))
| table _time, SourceImage, GrantedAccess, CallTrace

// DCSync detection
index=windows EventCode=4662 
    (ObjectType="*domainDNS*" OR ObjectType="*19195a5b-6da0-11d0-afd3-00c04fd930c9*")
    (Properties="*Replicating Directory Changes All*" OR Properties="*1131f6ad*")
| where NOT match(SubjectUserName, "(?i)^.*\$$") 
| table _time, SubjectUserName, SubjectDomainName, Properties

// Kerberoasting detection
index=windows EventCode=4769 Ticket_Encryption_Type=0x17
| where NOT (Account_Name="*$" OR Service_Name IN ("krbtgt", "kadmin/changepw"))
| stats count by Account_Name, Client_Address, Service_Name
| where count > 3

Microsoft Sentinel KQL — 查询

// Impossible Travel (logins from geographically impossible locations)
let TimeDelta = 2h;
SigninLogs
| where ResultType == 0  // Successful logins only
| where TimeGenerated > ago(7d)
| project UserPrincipalName, Location, TimeGenerated, IPAddress
| sort by UserPrincipalName asc, TimeGenerated asc
| serialize
| extend PreviousLogin = prev(TimeGenerated), PreviousLocation = prev(Location)
| where UserPrincipalName == prev(UserPrincipalName)
| extend TimeDiff = TimeGenerated - PreviousLogin
| where TimeDiff < TimeDelta and Location != PreviousLocation
| project UserPrincipalName, Location, PreviousLocation, TimeDiff, IPAddress

// Azure AD privilege escalation
AuditLogs
| where OperationName in ("Add member to role", "Add eligible member to role")
| extend TargetUser = tostring(TargetResources[0].userPrincipalName)
| extend RoleAdded = tostring(TargetResources[0].displayName)  
| where RoleAdded in ("Global Administrator", "Security Administrator", 
                       "Exchange Administrator", "SharePoint Administrator")
| project TimeGenerated, TargetUser, RoleAdded, 
           InitiatedBy=tostring(InitiatedBy.user.userPrincipalName)

// Suspicious PowerShell activity
SecurityEvent
| where EventID == 4104
| where TimeGenerated > ago(24h)
| where ScriptBlockText has_any("IEX", "DownloadString", "EncodedCommand", 
                                  "WebClient", "Invoke-Expression", "bypass", "-nop")
| project TimeGenerated, Computer, Account, ScriptBlockText
| extend RiskScore = case(
    ScriptBlockText has "IEX" and ScriptBlockText has "DownloadString", 10,
    ScriptBlockText has "EncodedCommand", 7,
    ScriptBlockText has "bypass", 5, 3)
| where RiskScore >= 5
| order by RiskScore desc

Elastic EQL — 序列检测

// Detect fileless malware execution chain
sequence by host.name with maxspan=5m
  [process where event.type == "start" and
   process.name in ("outlook.exe", "winword.exe", "excel.exe")]
  [process where event.type == "start" and
   process.name in ("powershell.exe", "cmd.exe", "wscript.exe", "cscript.exe")]
  [network where network.direction == "egress" and
   not network.destination.ip in ("127.0.0.0/8", "10.0.0.0/8", "192.168.0.0/16")]

// Ransomware detection: mass file extension changes + shadow copy deletion
sequence by host.name with maxspan=30m
  [file where event.type == "creation" and
   file.extension in ("locked", "encrypted", "crypted", "enc", "readme")]
  [file where event.type == "creation" and
   file.name in ("README.txt", "DECRYPT.txt", "HOW_TO_DECRYPT.txt")]
  [process where event.type == "start" and
   process.command_line : "* delete shadows *"]

3. 异常检测方法

用户要求检测日志数据中的异常时：

统计异常检测：

# Claude's approach to analyzing log data for anomalies:
import pandas as pd
from datetime import timedelta

# 1. Volume anomalies
# Calculate rolling average, flag if current > mean + 3*stddev

# 2. Time-based anomalies (off-hours activity)
# Business hours: Mon-Fri 08:00-18:00 local time
# Flag: admin activities on weekends, logins at 03:00 UTC

# 3. Never-before-seen entities
# - New admin account created
# - First-time login from country
# - New process never seen before
# - New domain in DNS queries

# 4. Impossible travel
# Calculate geographic distance / time delta
# Flag if impossible to travel physically in the time window

python scripts/anomaly_detector.py --logs parsed.json --baseline baseline.json --output anomalies.json

异常类别：

类别	指标
事件量激增	5 分钟内事件速率达到正常水平的 10 倍
非工作时间活动	当地时间 03:00 发生管理员访问
新地理位置	从此前没有登录记录的国家登录
新进程	首次执行某个二进制文件
大量数据传输	上传量超过此用户/系统基线的 10 倍
日志源静默	超过 30 分钟未收到事件
身份验证模式	来自非管理员工作站的登录类型 3

4. Sigma 规则开发

用户要求创建 Sigma 规则时：

title: Credential Dumping via Procdump
id: e5eb5a27-4a98-4c34-8b39-1fbe552d2aa4
status: stable
description: Detects the use of ProcDump to dump LSASS memory for credential theft
author: SOC Analyst
date: 2025/05/28
references:
  - https://attack.mitre.org/techniques/T1003/001/
  - https://docs.microsoft.com/en-us/sysinternals/downloads/procdump
tags:
  - attack.credential_access
  - attack.t1003.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_tool:
    Image|endswith:
      - '\procdump.exe'
      - '\procdump64.exe'
  selection_lsass:
    CommandLine|contains:
      - 'lsass'
      - '-ma 4'      # PID 4 = System, sometimes used
  selection_flags:
    CommandLine|contains|all:
      - '-accepteula'
      - '-ma'
  condition: selection_tool and (selection_lsass or selection_flags)
falsepositives:
  - Legitimate use by administrators for debugging (rare, should be investigated)
level: high

将 Sigma 规则转换为 SIEM 平台查询：

# Install sigma-cli
pip install sigma-cli

# Convert to Splunk SPL
sigma convert -t splunk -p splunk_windows sigma_rule.yml

# Convert to Elastic KQL
sigma convert -t elasticsearch -p ecs_windows sigma_rule.yml

# Convert to Microsoft Sentinel KQL  
sigma convert -t kusto sigma_rule.yml

5. 关联规则开发

当用户要求为多事件检测创建关联规则时：

## Correlation Rule: Brute Force → Successful Login → Lateral Movement

**Trigger:** 
  Event 1: 4625 (Failed Login) × 20+ in 5 minutes (same source IP)
  THEN Event 2: 4624 (Successful Login) from same source IP within 10 minutes
  THEN Event 3: 5145 (Admin Share Access) from same host within 30 minutes

**Logic:**

步骤 1：按源 IP 对失败登录进行分组，时间窗口为 5 分钟 步骤 2：如果计数 > 20 → 将该 IP 标记为“暴力破解来源”
步骤 3：在 10 分钟内监控来自同一 IP 的成功登录 步骤 4：如果登录成功 → 将严重性升级为 HIGH 步骤 5：监控从成功登录的主机发起的横向移动 步骤 6：如果观察到全部 3 个事件，则声明发生事件

**Splunk Correlation (corr_rule.conf):**
```spl
index=windows EventCode=4625
| bin _time span=5m
| stats count by src_ip, _time
| where count > 20
| join src_ip [
    search index=windows EventCode=4624 
    | bin _time span=10m
    | stats count by src_ip, _time, Account_Name, Workstation_Name
]
| table _time, src_ip, Account_Name, Workstation_Name, count

抑制与去重：

• 首次触发后 1 小时内，抑制来自同一源 IP 的相同关联警报
• 排除已知漏洞扫描器（将扫描器 IP 范围添加到例外列表）
• 排除有已记录计划任务的服务账户

---

日志源运行状况监控

当用户询问日志源运行状况时：

// Splunk: Detect silent log sources (no events in 30 minutes)
| tstats count WHERE index=* BY host, sourcetype, _time span=30m
| where _time > relative_time(now(), "-30m@m")
| stats max(_time) as last_seen by host, sourcetype
| where last_seen < relative_time(now(), "-30m@m")
| eval lag = round((now() - last_seen) / 60, 1)
| table host, sourcetype, last_seen, lag
| sort -lag

---

脚本参考

log_parser.py

python scripts/log_parser.py --input /var/log/auth.log --format json --output parsed.json
python scripts/log_parser.py --input events.evtx --normalize ecs --output normalized.json

anomaly_detector.py

python scripts/anomaly_detector.py --logs parsed.json --baseline baseline.json --output anomalies.json

---

技能集成

条件	相邻技能
发现异常 → 升级至 SOC	→ 技能 11（CSOC 自动化）
异常是威胁狩猎线索	→ 技能 06（威胁狩猎）
为 IR 根据日志构建时间线	→ 技能 07（事件响应）
根据发现创建检测规则	→ 技能 15（蓝队防御）

---

参考资料

• Splunk SPL 参考
• Elastic EQL 文档
• Microsoft Sentinel KQL
• Sigma 规则 HQ 仓库
• Windows 安全审核策略
• OCSF 架构
• SANS Windows 日志速查表

---

v3.0 增强功能（2026 年更新）

标准化、可测试的检测内容：

• OCSF / ECS 标准化 — 将数据源映射到 Open Cybersecurity Schema Framework（或 Elastic Common Schema），使单个检测规则能够适用于不同数据源；在每条规则中注明所用架构。
• Sigma 关联规则 — 使用 Sigma 的关联扩展（count/temporal/value-count）进行多事件检测（例如，暴力破解 → 登录成功、缓慢渗透数据），而不只是匹配单个事件。
• 检测即代码 CI — 每条规则都有正向/负向样例事件的单元测试；部署前，在 CI 中对规则进行 lint 检查，并针对各后端进行转换（sigma convert）。
• UEBA 与身份分析 — 为每位用户/每台主机建立行为基线；针对偏差发出警报（新的管理员操作、异常数据量、不可能的行程），而不是使用固定阈值。
• 平台时效性 — 提供 Splunk（tstats/数据模型）、Microsoft Sentinel（KQL、ASIM 函数）和 Elastic（ES|QL/EQL）的示例。

**精度规则：**每条规则都要记录数据源 + 架构、误报条件、ATT&CK 映射以及经过测试的样例事件。