百晓安全-云影EDR规则

云影EDR规则

ATT&CK覆盖

discovery

t1087.001

• Local System Accounts Discovery

t1069.001

• Local Groups Discovery

t1046

• Linux Network Service Scanning

t1057

• Process Discovery

t1018

• Linux Remote System Discovery

t1518.001

• Security Software Discovery

t1082

• System Information Discovery

t1049

• system network connections discovery

t1016

• System Network Discovery

t1083

• File and Directory Discovery

lateral_movement

t1105 (Ingress Tool Transfer)

• Remote File Copy

defense_evasion

t1027 (Obfuscated Files or InformationObfuscated Files or Information)

• Decode Base64 Encoded Text

t1070.004

• File Deletion

xxx

• Connection Proxy

t1562.004

• Disabling Security Tools

t1222.001

• File and Directory Permissions Modification

privilege_escalation

t1548.001

• Setuid and Setgid
• Suid Privilege Escalation

t1611 (Escape to Host 虚机逃逸)

• container逃逸
• 通过错误配置使用定时任务逃逸

execution

1053.003

• Scheduled Cron Task/Job

persistence

1053.003

• Scheduled Cron Task/Job

t1136.001

• Creation Of A Local User Account

impect

t1489

• Service Stop

T1529

• System Shutdown/Reboot