Splunk 中分析 Windows 事件日志的 API 参考与实践事件 ID、登录类型与 SPL 检测模式Anthropic-Cybersecurity-Skills【免费下载链接】Anthropic-Cybersecurity-Skills817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATTCK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF MITRE F3 (Fight Fraud) · agentskills.io standard · Works with Claude Code, GitHub Copilot, Codex CLI, Cursor, Gemini CLI 20 platforms · 29 security domains · Apache 2.0项目地址: https://gitcode.com/GitHub_Trending/an/Anthropic-Cybersecurity-Skills本文是仓库中 analyzing-windows-event-logs-in-splunk 技能配套的 API 参考文档解读与实践指南。该技能面向 SOC 分析师、检测工程师与事件响应人员用于在 Splunk 中分析 Windows Security、System 与 Sysmon 事件日志检测认证攻击、权限提升、持久化机制与横向移动并将检测结果映射到 MITRE ATTCK 技术。读完本文你将掌握 splunk-sdk 的连接方式、Windows Security / Sysmon 核心事件 ID 速查表、登录类型Logon Type语义、可直接复制运行的 SPL 检测查询以及仓库中自动化 Agent 脚本的源码级调用链。一、技能定位与适用场景本技能名为analyzing-windows-event-logs-in-splunk属于soc-operations子域标签涵盖soc、splunk、windows-events、sysmon、event-logs、mitre-attack、active-directory。其官方描述为在 Splunk 中分析 Windows Security、System 与 Sysmon 事件日志使用映射到 MITRE ATTCK 技术的 SPL 查询检测认证攻击、权限提升、持久化机制与横向移动。适用时机见 SKILL.mdSOC 分析师调查与 Windows 认证、进程执行或 AD 变更相关的告警检测工程师为基于 Windows 的威胁构建 SPL 查询事件响应人员需要重建 Windows 端点或域控的取证时间线周期性威胁狩猎聚焦 Windows 特定的 ATTCK 技术。不适用于 Linux/macOS 端点分析或纯网络调查。前置条件包括Splunk 已接入 Windows 事件日志数据sourcetype 为WinEventLog:Security、WinEventLog:System、XmlWinEventLog:Microsoft-Windows-Sysmon/Operational端点已部署 SysmonSwiftOnSecurity 或 Olaf Hartong 配置Splunk CIM 已为 Endpoint 与 Authentication 数据模型开启加速熟悉 Windows Security 事件 ID 与 Sysmon 事件类型。二、splunk-sdk 连接API 参考与源码实现API 参考文档 api-reference.md 给出的最小连接示例import splunklib.client as client service client.connect(hostsplunk, port8089, usernameadmin, passwordpass)这是通过官方 Splunk SDK for Python 建立到 Splunk Enterprise REST API默认端口 8089的连接。仓库配套脚本 agent.py 对该连接做了工程化封装import splunklib.client as client import splunklib.results as results def connect(host, port, username, password): Connect to Splunk Enterprise. return client.connect( hosthost, portport, usernameusername, passwordpassword, autologinTrue )与 API 参考的最小示例相比脚本增加了autologinTrue参数会话过期后自动重新认证并支持从环境变量读取连接参数SPLUNK_HOST默认localhost、SPLUNK_PORT默认8089、SPLUNK_USERNAME默认admin、SPLUNK_PASSWORD默认空。生产环境建议通过环境变量注入凭据避免将密码硬编码在命令行中。脚本核心的搜索封装函数同样值得复用def search(service, query, earliest-24h, latestnow): Run a blocking Splunk search and return results. job service.jobs.create( fsearch {query}, **{earliest_time: earliest, latest_time: latest, exec_mode: blocking} ) reader results.JSONResultsReader(job.results(output_modejson)) rows [r for r in reader if isinstance(r, dict)] job.cancel() return rows该函数展示了完整的调用链service.jobs.create()创建搜索任务 →exec_modeblocking阻塞等待完成 →job.results(output_modejson)取回结果 →JSONResultsReader解析为 dict 列表 →job.cancel()释放任务资源。所有检测函数都基于这一search()封装。三、事件 ID 速查Windows Security 与 Sysmon 核心事件API 参考文档提供了两张直接可用的速查表是构建检测规则和解释告警的核心依据。3.1 Windows Security 事件 ID映射到 ATTCKEventCodeDescriptionATTCK Technique4624Successful logonT10784625Failed logonT11104648Explicit credential logonT10784672Special privileges assignedT11344688New process createdT10594698Scheduled task createdT1053.0054720User account createdT1136.0014732Member added to security groupT10984768Kerberos TGT requestedT15584769Kerberos service ticketT1558.0033.2 Sysmon 事件 IDEventCodeDescription1Process creation完整命令行、哈希3Network connection7Image loadedDLL10Process accessLSASS 凭据转储11File creation13Registry value set22DNS query3.3 登录类型Logon Type语义TypeDescriptionContext2Interactive本地控制台登录3NetworkSMB、WMI、PowerShell Remoting7Unlock工作站解锁9NewCredentialsrunas /netonly10RemoteInteractiveRDP 登录登录类型是区分攻击行为的关键上下文Logon Type 3网络登录是横向移动的核心指示器覆盖 SMB、WMI、PowerShell Remoting 等远程执行通道Logon Type 10RDP 登录对应 T1021.001 远程桌面横向移动Logon Type 2为本地交互登录。检测查询中普遍依据 Logon_Type 对暴力破解与横向移动进行分类。3.4 关键概念速览SKILL.md 还补充了核心概念定义便于在阅读告警时快速对齐语义TermDefinitionEventCode 4624成功登录事件 — Logon_Type 2交互、3网络、10RDP、7解锁EventCode 4625失败登录事件 — Status 码指示失败原因密码错误、账户锁定、禁用Sysmon EventCode 1进程创建含完整命令行、父进程与哈希信息Sysmon EventCode 3进程发起的网络连接 — 源/目标 IP、端口与进程上下文Logon Type 3网络登录SMB、WMI、PowerShell Remoting— 横向移动关键指示器Logon Type 10通过 RDP/终端服务的远程交互登录四、SPL 检测模式从参考示例到完整检测体系API 参考文档给出了三个开箱即用的 SPL 检测模式# Brute force detection indexwineventlog EventCode4625 | stats count by src_ip | where count 20 # Kerberoasting (T1558.003) indexwineventlog EventCode4769 Ticket_Encryption_Type0x17 | where ServiceName ! krbtgt # DCSync detection (T1003.006) indexwineventlog EventCode4662 | where ObjectType*domainDNS* | search Properties*Replicating Directory Changes*这三个查询分别对应暴力破解T1110、KerberoastingT1558.003RC4 加密类型0x17的服务票据、DCSyncT1003.006DS-Replication-Get-Changes复制目录变更的访问。SKILL.md 在此基础上扩展为完整的六步检测工作流下面逐节呈现。4.1 第一步认证攻击检测暴力破解检测EventCode 4625—— 相比 API 参考中的简单版本这里加入了登录类型分类与状态码语义化indexwineventlog sourcetypeWinEventLog:Security EventCode4625 | stats count, dc(TargetUserName) AS unique_users, values(TargetUserName) AS targeted_users by src_ip, Logon_Type, Status | where count 20 | eval attack_type case( Logon_Type3, Network Brute Force, Logon_Type10, RDP Brute Force, Logon_Type2, Interactive Brute Force, 11, Other ) | eval status_meaning case( Status0xc000006d, Bad Username or Password, Status0xc000006a, Incorrect Password (valid user), Status0xc0000234, Account Locked Out, Status0xc0000072, Account Disabled, 11, Status ) | sort - count | table src_ip, attack_type, status_meaning, count, unique_users, targeted_users其中0xc000006d用户名或密码错误、0xc000006a有效用户但密码错误、0xc0000234账户锁定、0xc0000072账户禁用是 Windows 登录失败状态码中的高频判据可用于区分猜测型攻击与针对性攻击。密码喷洒检测Password Spray—— 通过bin _time span10m做 10 分钟窗口聚合识别单一来源在短时间窗口内命中大量不同用户名、但总尝试次数不多小于unique_users * 3的喷洒特征indexwineventlog sourcetypeWinEventLog:Security EventCode4625 Logon_Type3 | bin _time span10m | stats dc(TargetUserName) AS unique_users, count AS total_attempts, values(TargetUserName) AS users_targeted by src_ip, _time | where unique_users 10 AND total_attempts unique_users * 3 | eval spray_confidence if(unique_users 25, HIGH, MEDIUM)失败后成功登录失陷指示器—— 聚合同一src_ip TargetUserName ComputerName组合的失败与成功事件命中「失败数 10 且存在成功」即疑似账号被攻破并计算从首次失败到成功的时间差indexwineventlog sourcetypeWinEventLog:Security (EventCode4625 OR EventCode4624) src_ip!127.0.0.1 | sort _time | stats earliest(_time) AS first_seen, latest(_time) AS last_seen, sum(eval(if(EventCode4625,1,0))) AS failures, sum(eval(if(EventCode4624,1,0))) AS successes by src_ip, TargetUserName, ComputerName | where failures 10 AND successes 0 | eval time_to_success round((last_seen - first_seen)/60, 1) | sort - failures4.2 第二步权限提升检测新建管理员账户T1136.001—— 用join将 4720账户创建与 4732加入 Administrators 组关联识别「新建后立刻提权」的典型后门路径indexwineventlog sourcetypeWinEventLog:Security EventCode4720 | join TargetUserName typeleft [ search indexwineventlog EventCode4732 TargetUserNameAdministrators | rename MemberName AS TargetUserName ] | table _time, SubjectUserName, TargetUserName, ComputerName | eval alert New account created and added to Administrators group特殊权限分配EventCode 4672—— 先排除内置服务账户SYSTEM / LOCAL SERVICE / NETWORK SERVICE再筛选高危特权SeDebugPrivilege、SeTcbPrivilege、SeBackupPrivilege、SeRestorePrivilege、SeAssignPrimaryTokenPrivilege其中SeDebugPrivilege常被 Mimikatz 类工具滥用indexwineventlog sourcetypeWinEventLog:Security EventCode4672 SubjectUserName!SYSTEM SubjectUserName!LOCAL SERVICE SubjectUserName!NETWORK SERVICE | stats count, values(PrivilegeList) AS privileges by SubjectUserName, ComputerName | where count 0 | search privileges IN (SeDebugPrivilege, SeTcbPrivilege, SeBackupPrivilege, SeRestorePrivilege, SeAssignPrimaryTokenPrivilege)令牌操作检测T1134—— 基于 Sysmon EventCode 10进程访问聚焦对lsass.exe的访问LSASS 凭据转储的必经目标用GrantedAccess过滤敏感访问掩码0x1010、0x1038、0x1fffff、0x40并排除合法系统进程噪声indexsysmon EventCode10 TargetImage*\\lsass.exe GrantedAccess IN (0x1010, 0x1038, 0x1fffff, 0x40) | stats count by SourceImage, SourceUser, Computer, GrantedAccess | where NOT match(SourceImage, (svchost|csrss|wininit|MsMpEng|CrowdStrike)) | sort - count4.3 第三步持久化机制检测计划任务创建T1053.005—— 将 Security 4698计划任务创建与 Sysmon EventCode 1schtasks.exe进程创建双源关联通过coalesce合并任务内容与命令行再匹配 PowerShell、cmd、http、Temp 目录等可疑特征indexwineventlog (sourcetypeWinEventLog:Security EventCode4698) OR (sourcetypeXmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode1 Image*\\schtasks.exe) | eval task_info coalesce(TaskContent, CommandLine) | search task_info*powershell* OR task_info*cmd* OR task_info*http* OR task_info*\\Temp\\* | table _time, Computer, SubjectUserName, TaskName, task_info注册表 Run 键修改T1547.001—— 基于 Sysmon EventCode 13注册表值设置监控Run、RunOnce、RunServices与Shell Folders等自启动键并排除安装类合法写入indexsysmon EventCode13 TargetObject IN ( *\\CurrentVersion\\Run\\*, *\\CurrentVersion\\RunOnce\\*, *\\CurrentVersion\\RunServices\\*, *\\Explorer\\Shell Folders\\* ) | stats count by Computer, Image, TargetObject, Details | where NOT match(Image, (explorer\.exe|msiexec\.exe|setup\.exe)) | sort - countWMI 事件订阅T1546.003—— 监控 Sysmon EventCode 20WmiEventFilter 活动与 21WmiEventConsumer 活动WMI 订阅是攻击者常用的无文件持久化手段indexsysmon EventCode20 OR EventCode21 | stats count by Computer, Operation, Consumer, EventNamespace | where count 04.4 第四步横向移动检测SMB / 管理共享远程服务利用T1021.002—— 以 Logon Type 3 网络登录为基础按源 IP 用户名聚合命中目标主机数超过 3 台即判定为横向移动模式indexwineventlog sourcetypeWinEventLog:Security EventCode4624 Logon_Type3 | stats dc(ComputerName) AS unique_destinations, values(ComputerName) AS targets by src_ip, TargetUserName | where unique_destinations 3 | sort - unique_destinations | table src_ip, TargetUserName, unique_destinations, targetsPsExec 检测T1021.002—— 通过 Sysmon EventCode 1 匹配psexec.exe/psexesvc.exe镜像及其父进程关系OriginalFileNamepsexec.c可捕获改名后的 PsExecindexsysmon EventCode1 (Image*\\psexec.exe OR Image*\\psexesvc.exe OR ParentImage*\\psexesvc.exe OR OriginalFileNamepsexec.c) | table _time, Computer, User, ParentImage, Image, CommandLineRDP 横向移动T1021.001—— 以 Logon Type 10 聚合单源登录超过 2 台 RDP 目标即告警indexwineventlog sourcetypeWinEventLog:Security EventCode4624 Logon_Type10 | stats count, dc(ComputerName) AS rdp_targets, values(ComputerName) AS destinations by src_ip, TargetUserName | where rdp_targets 2 | sort - rdp_targets4.5 第五步构建取证时间线针对被入侵主机构建综合时间线用case()将事件代码映射为人类可读描述覆盖登录、进程、计划任务、网络、文件、注册表等维度(indexwineventlog OR indexsysmon) ComputerWORKSTATION-042 earliest2024-03-14T00:00:00 latest2024-03-16T00:00:00 | eval event_description case( EventCode4624, Logon: .TargetUserName. (Type .Logon_Type.), EventCode4625, Failed Logon: .TargetUserName, EventCode4688 OR (sourcetypeXmlWinEventLog:*Sysmon* AND EventCode1), Process: .Image. CMD: .CommandLine, EventCode4698, Scheduled Task: .TaskName, EventCode3, Network: .DestinationIp.:.DestinationPort, EventCode11, File Created: .TargetFilename, EventCode13, Registry: .TargetObject, 11, Event .EventCode ) | sort _time | table _time, EventCode, event_description, User, src_ip4.6 第六步建立查找表Lookup做富化通过inputlookup引用事件 ID 富化表为告警补充描述、ATTCK 技术与严重级别若查找表不存在可按如下 CSV 结构创建SKILL.mdEventCode,Description,ATT_CK_Technique,Severity 4624,Successful Logon,T1078,Informational 4625,Failed Logon,T1110,Low 4648,Explicit Credential Logon,T1078,Medium 4672,Special Privileges Assigned,T1134,Medium 4688,New Process Created,T1059,Informational 4698,Scheduled Task Created,T1053.005,Medium 4720,User Account Created,T1136.001,High 4732,Member Added to Security Group,T1098,High 4768,Kerberos TGT Requested,T1558,Informational 4769,Kerberos Service Ticket,T1558.003,Low 4771,Kerberos Pre-Auth Failed,T1110,Low五、源码级自动化agent.py 检测函数一览API 参考中的 SPL 模式在仓库脚本 agent.py 中被封装为可直接调用的检测函数每一函数对应上文一个检测主题构成了「SPL 查询 → Python 函数 → 命令行动作」的完整链路函数检测目标对应 ATTCKdetect_brute_forceEventCode 4625 暴力破解含登录类型分类T1110detect_password_spray密码喷洒10 分钟窗口、置信度分级T1110detect_new_admin_accounts新账户加入 Administrators 组T1136.001detect_lsass_accessSysmon EventCode 10 访问 lsass.exeT1003.001detect_lateral_movement_smbType 3 登录多目标主机T1021.002detect_psexecPsExec 进程创建T1021.002build_forensic_timeline指定主机的取证时间线—脚本 CLI 支持--action参数brute_force、password_spray、new_admin、lsass_access、lateral_smb、psexec、timeline、full_hunt其中full_hunt会依次执行全部检测并输出 JSON 结构化结果。示例运行方式需已安装splunk-sdkpython3 agent.py --host splunk --username admin --password yourpass \ --action full_hunt --earliest -24h python3 agent.py --action timeline --hostname WORKSTATION-042 --earliest -24h六、常见攻击场景与 ATTCK 映射SKILL.md 总结了本技能可覆盖的高频攻击场景配合 API 参考中的事件 ID 速查表即可快速落地检测KerberoastingT1558.003检测 EventCode 4769 且加密类型为0x17RC4的非标准服务账户票据请求DCSyncT1003.006检测 EventCode 4662 中非域控来源触发的DS-Replication-Get-Changes复制操作黄金票据T1558.001检测 EventCode 4769 中票据异常属性超长生命周期、非标准加密哈希传递T1550.002检测 EventCode 4624 Logon Type 3 中来自非预期来源的 NTLM 认证DLL 侧加载T1574.002Sysmon EventCode 7 显示合法进程加载了未签名 DLL。技能元数据中声明的 MITRE ATTCK 技术覆盖为 T1110、T1053.005、T1547.001、T1021.002、T1558.003、T1003.006见 SKILL.md 头部 front matter与上文检测查询逐一对应同时映射到 NIST CSF 的 DE.CM-01、DE.AE-02、RS.MA-01、DE.AE-06 能力项可用于对齐组织安全框架。七、分析输出格式完成检测后可按 SKILL.md 给出的模板输出结构化结论包含统计摘要、可疑发现带严重级别与 ATTCK 映射WINDOWS EVENT LOG ANALYSIS — HOST: WORKSTATION-042 ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ Period: 2024-03-14 to 2024-03-15 Events: 12,847 total (Security: 9,231 | Sysmon: 3,616) Authentication Summary: Successful Logons (4624): 487 (Type 3: 312, Type 10: 45, Type 2: 130) Failed Logons (4625): 847 (from 192.168.1.105 — BRUTE FORCE) Explicit Creds (4648): 12 Suspicious Findings: [HIGH] 847 failed logons followed by success at 14:35 from 192.168.1.105 [HIGH] New user backdoor_admin created (4720) at 14:38 [HIGH] User added to Administrators group (4732) at 14:38 [MEDIUM] schtasks.exe creating persistence task at 14:42 [MEDIUM] PowerShell encoded command execution at 14:45 ATTCK Mapping: T1110.001 — Password Guessing (847 failed logons) T1136.001 — Local Account Creation (backdoor_admin) T1053.005 — Scheduled Task (persistence) T1059.001 — PowerShell (encoded execution)八、延伸阅读技能完整工作流与前置条件SKILL.md自动化检测脚本与 CLI 用法scripts/agent.py本技能的事件 ID 参考references/api-reference.md仓库级 MITRE ATTCK 覆盖总结mappings/mitre-attack/coverage-summary.md 与 mappings/attack-navigator-layer.json框架映射总览mappings/README.md将上文的事件 ID 速查表、登录类型语义与六步 SPL 检测工作流配合agent.py自动化执行即可在 Splunk 环境中构建一套覆盖认证攻击、权限提升、持久化与横向移动的 Windows 威胁检测与取证分析基线。【免费下载链接】Anthropic-Cybersecurity-Skills817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATTCK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF MITRE F3 (Fight Fraud) · agentskills.io standard · Works with Claude Code, GitHub Copilot, Codex CLI, Cursor, Gemini CLI 20 platforms · 29 security domains · Apache 2.0项目地址: https://gitcode.com/GitHub_Trending/an/Anthropic-Cybersecurity-Skills创作声明：本文部分内容由AI辅助生成（AIGC），仅供参考 Splunk 中分析 Windows 事件日志的 API 参考与实践：事件 ID、登录类型与 SPL 检测模式（Anthropic-Cybersecurity-Skills）
Splunk 中分析 Windows 事件日志的 API 参考与实践事件 ID、登录类型与 SPL 检测模式Anthropic-Cybersecurity-Skills【免费下载链接】Anthropic-Cybersecurity-Skills817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATTCK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF MITRE F3 (Fight Fraud) · agentskills.io standard · Works with Claude Code, GitHub Copilot, Codex CLI, Cursor, Gemini CLI 20 platforms · 29 security domains · Apache 2.0项目地址: https://gitcode.com/GitHub_Trending/an/Anthropic-Cybersecurity-Skills本文是仓库中 analyzing-windows-event-logs-in-splunk 技能配套的 API 参考文档解读与实践指南。该技能面向 SOC 分析师、检测工程师与事件响应人员用于在 Splunk 中分析 Windows Security、System 与 Sysmon 事件日志检测认证攻击、权限提升、持久化机制与横向移动并将检测结果映射到 MITRE ATTCK 技术。读完本文你将掌握 splunk-sdk 的连接方式、Windows Security / Sysmon 核心事件 ID 速查表、登录类型Logon Type语义、可直接复制运行的 SPL 检测查询以及仓库中自动化 Agent 脚本的源码级调用链。一、技能定位与适用场景本技能名为analyzing-windows-event-logs-in-splunk属于soc-operations子域标签涵盖soc、splunk、windows-events、sysmon、event-logs、mitre-attack、active-directory。其官方描述为在 Splunk 中分析 Windows Security、System 与 Sysmon 事件日志使用映射到 MITRE ATTCK 技术的 SPL 查询检测认证攻击、权限提升、持久化机制与横向移动。适用时机见 SKILL.mdSOC 分析师调查与 Windows 认证、进程执行或 AD 变更相关的告警检测工程师为基于 Windows 的威胁构建 SPL 查询事件响应人员需要重建 Windows 端点或域控的取证时间线周期性威胁狩猎聚焦 Windows 特定的 ATTCK 技术。不适用于 Linux/macOS 端点分析或纯网络调查。前置条件包括Splunk 已接入 Windows 事件日志数据sourcetype 为WinEventLog:Security、WinEventLog:System、XmlWinEventLog:Microsoft-Windows-Sysmon/Operational端点已部署 SysmonSwiftOnSecurity 或 Olaf Hartong 配置Splunk CIM 已为 Endpoint 与 Authentication 数据模型开启加速熟悉 Windows Security 事件 ID 与 Sysmon 事件类型。二、splunk-sdk 连接API 参考与源码实现API 参考文档 api-reference.md 给出的最小连接示例import splunklib.client as client service client.connect(hostsplunk, port8089, usernameadmin, passwordpass)这是通过官方 Splunk SDK for Python 建立到 Splunk Enterprise REST API默认端口 8089的连接。仓库配套脚本 agent.py 对该连接做了工程化封装import splunklib.client as client import splunklib.results as results def connect(host, port, username, password): Connect to Splunk Enterprise. return client.connect( hosthost, portport, usernameusername, passwordpassword, autologinTrue )与 API 参考的最小示例相比脚本增加了autologinTrue参数会话过期后自动重新认证并支持从环境变量读取连接参数SPLUNK_HOST默认localhost、SPLUNK_PORT默认8089、SPLUNK_USERNAME默认admin、SPLUNK_PASSWORD默认空。生产环境建议通过环境变量注入凭据避免将密码硬编码在命令行中。脚本核心的搜索封装函数同样值得复用def search(service, query, earliest-24h, latestnow): Run a blocking Splunk search and return results. job service.jobs.create( fsearch {query}, **{earliest_time: earliest, latest_time: latest, exec_mode: blocking} ) reader results.JSONResultsReader(job.results(output_modejson)) rows [r for r in reader if isinstance(r, dict)] job.cancel() return rows该函数展示了完整的调用链service.jobs.create()创建搜索任务 →exec_modeblocking阻塞等待完成 →job.results(output_modejson)取回结果 →JSONResultsReader解析为 dict 列表 →job.cancel()释放任务资源。所有检测函数都基于这一search()封装。三、事件 ID 速查Windows Security 与 Sysmon 核心事件API 参考文档提供了两张直接可用的速查表是构建检测规则和解释告警的核心依据。3.1 Windows Security 事件 ID映射到 ATTCKEventCodeDescriptionATTCK Technique4624Successful logonT10784625Failed logonT11104648Explicit credential logonT10784672Special privileges assignedT11344688New process createdT10594698Scheduled task createdT1053.0054720User account createdT1136.0014732Member added to security groupT10984768Kerberos TGT requestedT15584769Kerberos service ticketT1558.0033.2 Sysmon 事件 IDEventCodeDescription1Process creation完整命令行、哈希3Network connection7Image loadedDLL10Process accessLSASS 凭据转储11File creation13Registry value set22DNS query3.3 登录类型Logon Type语义TypeDescriptionContext2Interactive本地控制台登录3NetworkSMB、WMI、PowerShell Remoting7Unlock工作站解锁9NewCredentialsrunas /netonly10RemoteInteractiveRDP 登录登录类型是区分攻击行为的关键上下文Logon Type 3网络登录是横向移动的核心指示器覆盖 SMB、WMI、PowerShell Remoting 等远程执行通道Logon Type 10RDP 登录对应 T1021.001 远程桌面横向移动Logon Type 2为本地交互登录。检测查询中普遍依据 Logon_Type 对暴力破解与横向移动进行分类。3.4 关键概念速览SKILL.md 还补充了核心概念定义便于在阅读告警时快速对齐语义TermDefinitionEventCode 4624成功登录事件 — Logon_Type 2交互、3网络、10RDP、7解锁EventCode 4625失败登录事件 — Status 码指示失败原因密码错误、账户锁定、禁用Sysmon EventCode 1进程创建含完整命令行、父进程与哈希信息Sysmon EventCode 3进程发起的网络连接 — 源/目标 IP、端口与进程上下文Logon Type 3网络登录SMB、WMI、PowerShell Remoting— 横向移动关键指示器Logon Type 10通过 RDP/终端服务的远程交互登录四、SPL 检测模式从参考示例到完整检测体系API 参考文档给出了三个开箱即用的 SPL 检测模式# Brute force detection indexwineventlog EventCode4625 | stats count by src_ip | where count 20 # Kerberoasting (T1558.003) indexwineventlog EventCode4769 Ticket_Encryption_Type0x17 | where ServiceName ! krbtgt # DCSync detection (T1003.006) indexwineventlog EventCode4662 | where ObjectType*domainDNS* | search Properties*Replicating Directory Changes*这三个查询分别对应暴力破解T1110、KerberoastingT1558.003RC4 加密类型0x17的服务票据、DCSyncT1003.006DS-Replication-Get-Changes复制目录变更的访问。SKILL.md 在此基础上扩展为完整的六步检测工作流下面逐节呈现。4.1 第一步认证攻击检测暴力破解检测EventCode 4625—— 相比 API 参考中的简单版本这里加入了登录类型分类与状态码语义化indexwineventlog sourcetypeWinEventLog:Security EventCode4625 | stats count, dc(TargetUserName) AS unique_users, values(TargetUserName) AS targeted_users by src_ip, Logon_Type, Status | where count 20 | eval attack_type case( Logon_Type3, Network Brute Force, Logon_Type10, RDP Brute Force, Logon_Type2, Interactive Brute Force, 11, Other ) | eval status_meaning case( Status0xc000006d, Bad Username or Password, Status0xc000006a, Incorrect Password (valid user), Status0xc0000234, Account Locked Out, Status0xc0000072, Account Disabled, 11, Status ) | sort - count | table src_ip, attack_type, status_meaning, count, unique_users, targeted_users其中0xc000006d用户名或密码错误、0xc000006a有效用户但密码错误、0xc0000234账户锁定、0xc0000072账户禁用是 Windows 登录失败状态码中的高频判据可用于区分猜测型攻击与针对性攻击。密码喷洒检测Password Spray—— 通过bin _time span10m做 10 分钟窗口聚合识别单一来源在短时间窗口内命中大量不同用户名、但总尝试次数不多小于unique_users * 3的喷洒特征indexwineventlog sourcetypeWinEventLog:Security EventCode4625 Logon_Type3 | bin _time span10m | stats dc(TargetUserName) AS unique_users, count AS total_attempts, values(TargetUserName) AS users_targeted by src_ip, _time | where unique_users 10 AND total_attempts unique_users * 3 | eval spray_confidence if(unique_users 25, HIGH, MEDIUM)失败后成功登录失陷指示器—— 聚合同一src_ip TargetUserName ComputerName组合的失败与成功事件命中「失败数 10 且存在成功」即疑似账号被攻破并计算从首次失败到成功的时间差indexwineventlog sourcetypeWinEventLog:Security (EventCode4625 OR EventCode4624) src_ip!127.0.0.1 | sort _time | stats earliest(_time) AS first_seen, latest(_time) AS last_seen, sum(eval(if(EventCode4625,1,0))) AS failures, sum(eval(if(EventCode4624,1,0))) AS successes by src_ip, TargetUserName, ComputerName | where failures 10 AND successes 0 | eval time_to_success round((last_seen - first_seen)/60, 1) | sort - failures4.2 第二步权限提升检测新建管理员账户T1136.001—— 用join将 4720账户创建与 4732加入 Administrators 组关联识别「新建后立刻提权」的典型后门路径indexwineventlog sourcetypeWinEventLog:Security EventCode4720 | join TargetUserName typeleft [ search indexwineventlog EventCode4732 TargetUserNameAdministrators | rename MemberName AS TargetUserName ] | table _time, SubjectUserName, TargetUserName, ComputerName | eval alert New account created and added to Administrators group特殊权限分配EventCode 4672—— 先排除内置服务账户SYSTEM / LOCAL SERVICE / NETWORK SERVICE再筛选高危特权SeDebugPrivilege、SeTcbPrivilege、SeBackupPrivilege、SeRestorePrivilege、SeAssignPrimaryTokenPrivilege其中SeDebugPrivilege常被 Mimikatz 类工具滥用indexwineventlog sourcetypeWinEventLog:Security EventCode4672 SubjectUserName!SYSTEM SubjectUserName!LOCAL SERVICE SubjectUserName!NETWORK SERVICE | stats count, values(PrivilegeList) AS privileges by SubjectUserName, ComputerName | where count 0 | search privileges IN (SeDebugPrivilege, SeTcbPrivilege, SeBackupPrivilege, SeRestorePrivilege, SeAssignPrimaryTokenPrivilege)令牌操作检测T1134—— 基于 Sysmon EventCode 10进程访问聚焦对lsass.exe的访问LSASS 凭据转储的必经目标用GrantedAccess过滤敏感访问掩码0x1010、0x1038、0x1fffff、0x40并排除合法系统进程噪声indexsysmon EventCode10 TargetImage*\\lsass.exe GrantedAccess IN (0x1010, 0x1038, 0x1fffff, 0x40) | stats count by SourceImage, SourceUser, Computer, GrantedAccess | where NOT match(SourceImage, (svchost|csrss|wininit|MsMpEng|CrowdStrike)) | sort - count4.3 第三步持久化机制检测计划任务创建T1053.005—— 将 Security 4698计划任务创建与 Sysmon EventCode 1schtasks.exe进程创建双源关联通过coalesce合并任务内容与命令行再匹配 PowerShell、cmd、http、Temp 目录等可疑特征indexwineventlog (sourcetypeWinEventLog:Security EventCode4698) OR (sourcetypeXmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode1 Image*\\schtasks.exe) | eval task_info coalesce(TaskContent, CommandLine) | search task_info*powershell* OR task_info*cmd* OR task_info*http* OR task_info*\\Temp\\* | table _time, Computer, SubjectUserName, TaskName, task_info注册表 Run 键修改T1547.001—— 基于 Sysmon EventCode 13注册表值设置监控Run、RunOnce、RunServices与Shell Folders等自启动键并排除安装类合法写入indexsysmon EventCode13 TargetObject IN ( *\\CurrentVersion\\Run\\*, *\\CurrentVersion\\RunOnce\\*, *\\CurrentVersion\\RunServices\\*, *\\Explorer\\Shell Folders\\* ) | stats count by Computer, Image, TargetObject, Details | where NOT match(Image, (explorer\.exe|msiexec\.exe|setup\.exe)) | sort - countWMI 事件订阅T1546.003—— 监控 Sysmon EventCode 20WmiEventFilter 活动与 21WmiEventConsumer 活动WMI 订阅是攻击者常用的无文件持久化手段indexsysmon EventCode20 OR EventCode21 | stats count by Computer, Operation, Consumer, EventNamespace | where count 04.4 第四步横向移动检测SMB / 管理共享远程服务利用T1021.002—— 以 Logon Type 3 网络登录为基础按源 IP 用户名聚合命中目标主机数超过 3 台即判定为横向移动模式indexwineventlog sourcetypeWinEventLog:Security EventCode4624 Logon_Type3 | stats dc(ComputerName) AS unique_destinations, values(ComputerName) AS targets by src_ip, TargetUserName | where unique_destinations 3 | sort - unique_destinations | table src_ip, TargetUserName, unique_destinations, targetsPsExec 检测T1021.002—— 通过 Sysmon EventCode 1 匹配psexec.exe/psexesvc.exe镜像及其父进程关系OriginalFileNamepsexec.c可捕获改名后的 PsExecindexsysmon EventCode1 (Image*\\psexec.exe OR Image*\\psexesvc.exe OR ParentImage*\\psexesvc.exe OR OriginalFileNamepsexec.c) | table _time, Computer, User, ParentImage, Image, CommandLineRDP 横向移动T1021.001—— 以 Logon Type 10 聚合单源登录超过 2 台 RDP 目标即告警indexwineventlog sourcetypeWinEventLog:Security EventCode4624 Logon_Type10 | stats count, dc(ComputerName) AS rdp_targets, values(ComputerName) AS destinations by src_ip, TargetUserName | where rdp_targets 2 | sort - rdp_targets4.5 第五步构建取证时间线针对被入侵主机构建综合时间线用case()将事件代码映射为人类可读描述覆盖登录、进程、计划任务、网络、文件、注册表等维度(indexwineventlog OR indexsysmon) ComputerWORKSTATION-042 earliest2024-03-14T00:00:00 latest2024-03-16T00:00:00 | eval event_description case( EventCode4624, Logon: .TargetUserName. (Type .Logon_Type.), EventCode4625, Failed Logon: .TargetUserName, EventCode4688 OR (sourcetypeXmlWinEventLog:*Sysmon* AND EventCode1), Process: .Image. CMD: .CommandLine, EventCode4698, Scheduled Task: .TaskName, EventCode3, Network: .DestinationIp.:.DestinationPort, EventCode11, File Created: .TargetFilename, EventCode13, Registry: .TargetObject, 11, Event .EventCode ) | sort _time | table _time, EventCode, event_description, User, src_ip4.6 第六步建立查找表Lookup做富化通过inputlookup引用事件 ID 富化表为告警补充描述、ATTCK 技术与严重级别若查找表不存在可按如下 CSV 结构创建SKILL.mdEventCode,Description,ATT_CK_Technique,Severity 4624,Successful Logon,T1078,Informational 4625,Failed Logon,T1110,Low 4648,Explicit Credential Logon,T1078,Medium 4672,Special Privileges Assigned,T1134,Medium 4688,New Process Created,T1059,Informational 4698,Scheduled Task Created,T1053.005,Medium 4720,User Account Created,T1136.001,High 4732,Member Added to Security Group,T1098,High 4768,Kerberos TGT Requested,T1558,Informational 4769,Kerberos Service Ticket,T1558.003,Low 4771,Kerberos Pre-Auth Failed,T1110,Low五、源码级自动化agent.py 检测函数一览API 参考中的 SPL 模式在仓库脚本 agent.py 中被封装为可直接调用的检测函数每一函数对应上文一个检测主题构成了「SPL 查询 → Python 函数 → 命令行动作」的完整链路函数检测目标对应 ATTCKdetect_brute_forceEventCode 4625 暴力破解含登录类型分类T1110detect_password_spray密码喷洒10 分钟窗口、置信度分级T1110detect_new_admin_accounts新账户加入 Administrators 组T1136.001detect_lsass_accessSysmon EventCode 10 访问 lsass.exeT1003.001detect_lateral_movement_smbType 3 登录多目标主机T1021.002detect_psexecPsExec 进程创建T1021.002build_forensic_timeline指定主机的取证时间线—脚本 CLI 支持--action参数brute_force、password_spray、new_admin、lsass_access、lateral_smb、psexec、timeline、full_hunt其中full_hunt会依次执行全部检测并输出 JSON 结构化结果。示例运行方式需已安装splunk-sdkpython3 agent.py --host splunk --username admin --password yourpass \ --action full_hunt --earliest -24h python3 agent.py --action timeline --hostname WORKSTATION-042 --earliest -24h六、常见攻击场景与 ATTCK 映射SKILL.md 总结了本技能可覆盖的高频攻击场景配合 API 参考中的事件 ID 速查表即可快速落地检测KerberoastingT1558.003检测 EventCode 4769 且加密类型为0x17RC4的非标准服务账户票据请求DCSyncT1003.006检测 EventCode 4662 中非域控来源触发的DS-Replication-Get-Changes复制操作黄金票据T1558.001检测 EventCode 4769 中票据异常属性超长生命周期、非标准加密哈希传递T1550.002检测 EventCode 4624 Logon Type 3 中来自非预期来源的 NTLM 认证DLL 侧加载T1574.002Sysmon EventCode 7 显示合法进程加载了未签名 DLL。技能元数据中声明的 MITRE ATTCK 技术覆盖为 T1110、T1053.005、T1547.001、T1021.002、T1558.003、T1003.006见 SKILL.md 头部 front matter与上文检测查询逐一对应同时映射到 NIST CSF 的 DE.CM-01、DE.AE-02、RS.MA-01、DE.AE-06 能力项可用于对齐组织安全框架。七、分析输出格式完成检测后可按 SKILL.md 给出的模板输出结构化结论包含统计摘要、可疑发现带严重级别与 ATTCK 映射WINDOWS EVENT LOG ANALYSIS — HOST: WORKSTATION-042 ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ Period: 2024-03-14 to 2024-03-15 Events: 12,847 total (Security: 9,231 | Sysmon: 3,616) Authentication Summary: Successful Logons (4624): 487 (Type 3: 312, Type 10: 45, Type 2: 130) Failed Logons (4625): 847 (from 192.168.1.105 — BRUTE FORCE) Explicit Creds (4648): 12 Suspicious Findings: [HIGH] 847 failed logons followed by success at 14:35 from 192.168.1.105 [HIGH] New user backdoor_admin created (4720) at 14:38 [HIGH] User added to Administrators group (4732) at 14:38 [MEDIUM] schtasks.exe creating persistence task at 14:42 [MEDIUM] PowerShell encoded command execution at 14:45 ATTCK Mapping: T1110.001 — Password Guessing (847 failed logons) T1136.001 — Local Account Creation (backdoor_admin) T1053.005 — Scheduled Task (persistence) T1059.001 — PowerShell (encoded execution)八、延伸阅读技能完整工作流与前置条件SKILL.md自动化检测脚本与 CLI 用法scripts/agent.py本技能的事件 ID 参考references/api-reference.md仓库级 MITRE ATTCK 覆盖总结mappings/mitre-attack/coverage-summary.md 与 mappings/attack-navigator-layer.json框架映射总览mappings/README.md将上文的事件 ID 速查表、登录类型语义与六步 SPL 检测工作流配合agent.py自动化执行即可在 Splunk 环境中构建一套覆盖认证攻击、权限提升、持久化与横向移动的 Windows 威胁检测与取证分析基线。【免费下载链接】Anthropic-Cybersecurity-Skills817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATTCK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF MITRE F3 (Fight Fraud) · agentskills.io standard · Works with Claude Code, GitHub Copilot, Codex CLI, Cursor, Gemini CLI 20 platforms · 29 security domains · Apache 2.0项目地址: https://gitcode.com/GitHub_Trending/an/Anthropic-Cybersecurity-Skills创作声明：本文部分内容由AI辅助生成（AIGC），仅供参考