Incident Response & Threat Hunting

# Etape 1 : Identifier les paires source/destination avec beaucoup de connexions
event.category: "network_traffic" AND network.direction: "outbound"
| stats count, avg(event.duration), stddev(event.duration) by source.ip, destination.ip, destination.port
| where count > 50 AND stddev(event.duration) < 5000

POST /network-*/_search
{
  "size": 0,
  "query": {
    "bool": {
      "must": [
        { "term": { "network.direction": "outbound" } },
        { "range": { "@timestamp": { "gte": "now-24h" } } }
      ],
      "must_not": [
        { "terms": { "destination.port": [80, 443, 53] } }
      ]
    }
  },
  "aggs": {
    "by_dest": {
      "composite": {
        "sources": [
          { "src": { "terms": { "field": "source.ip" } } },
          { "dst": { "terms": { "field": "destination.ip" } } }
        ]
      },
      "aggs": {
        "intervals": {
          "auto_date_histogram": { "field": "@timestamp", "buckets": 100 },
          "aggs": {
            "interval_stats": {
              "stats": { "field": "event.duration" }
            }
          }
        },
        "conn_count": { "value_count": { "field": "@timestamp" } },
        "regularity_filter": {
          "bucket_selector": {
            "buckets_path": { "count": "conn_count" },
            "script": "params.count > 100"
          }
        }
      }
    }
  }
}

# Identifier les connexions RDP entre postes de travail (pas serveurs)
event.category: "authentication" AND winlog.event_id: 4624
  AND winlog.logon_type: 10
  AND source.ip: 192.168.*
  AND NOT source.ip: (192.168.1.10 OR 192.168.1.11)  # Exclure les jump servers
| stats count by source.ip, destination.ip, user.name
| where count > 3

# Sysmon Event ID 1 (Process Creation) — outils de lateral movement
event.provider: "Microsoft-Windows-Sysmon" AND event.code: 1
  AND (
    process.name: ("psexec.exe" OR "psexec64.exe" OR "paexec.exe")
    OR process.name: ("wmic.exe" AND process.args: "/node:")
    OR (process.name: "powershell.exe" AND process.args: ("Invoke-Command" OR "Enter-PSSession"))
    OR process.name: "winrs.exe"
  )

# Sysmon Event ID 1 — Creation de tache planifiee
event.provider: "Microsoft-Windows-Sysmon" AND event.code: 1
  AND process.name: "schtasks.exe"
  AND process.args: ("/create" AND ("/sc" OR "/tn"))
  AND NOT process.parent.executable: (
    "C:\\Windows\\System32\\svchost.exe"
    OR "C:\\Windows\\CCM\\*"
  )

# Event ID 4698 — Tache planifiee creee (Security log)
winlog.event_id: 4698
  AND NOT winlog.event_data.TaskName: ("\\Microsoft\\*" OR "\\Google\\*")

# Sysmon Event ID 13 — Registry Value Set
event.provider: "Microsoft-Windows-Sysmon" AND event.code: 13
  AND registry.path: (
    "*\\CurrentVersion\\Run\\*"
    OR "*\\CurrentVersion\\RunOnce\\*"
    OR "*\\Winlogon\\Shell*"
    OR "*\\Winlogon\\Userinit*"
  )
  AND NOT process.executable: (
    "C:\\Windows\\System32\\*"
    OR "C:\\Program Files\\*"
    OR "C:\\Program Files (x86)\\*"
  )

# Utilisation d'outils de compression dans des repertoires temporaires
event.provider: "Microsoft-Windows-Sysmon" AND event.code: 1
  AND process.name: ("7z.exe" OR "rar.exe" OR "zip.exe" OR "tar.exe" OR "winrar.exe")
  AND process.args: (
    "C:\\Temp\\*" OR "C:\\Users\\*\\AppData\\Local\\Temp\\*"
    OR "C:\\ProgramData\\*" OR "C:\\Windows\\Temp\\*"
  )

# Detection PowerShell Compress-Archive
event.provider: "Microsoft-Windows-Sysmon" AND event.code: 1
  AND process.name: "powershell.exe"
  AND process.args: "Compress-Archive"

# Volumes d'upload anormaux (proxy logs)
event.category: "web" AND http.request.method: "POST"
| stats sum(http.request.bytes) as total_upload by source.ip, url.domain
| where total_upload > 104857600  # Plus de 100 MB uploade vers un meme domaine
| sort total_upload desc

# Alerte EDR sur FS01
event.kind: "alert" AND host.name: "FS01" AND event.severity: "critical"
| sort @timestamp desc
| limit 20

# Resultat :
# 14:32:05 — ALERT: Ransomware behavior detected — mass file encryption
#            process: C:\Windows\Temp\svchost_update.exe
#            files_encrypted: 847 in 45 seconds
#            technique: AES-256 + RSA-2048

# Arbre de processus — qui a lance svchost_update.exe ?
event.provider: "Microsoft-Windows-Sysmon" AND event.code: 1
  AND host.name: "FS01"
  AND process.executable: "C:\\Windows\\Temp\\svchost_update.exe"

# Resultat :
# Parent process: powershell.exe -enc SQBuAHYAbwBrAGUALQBXAGUA...
# Grand-parent: cmd.exe lancé via PsExec depuis 192.168.10.55 (WS-JMARTIN)

# Remonter sur le poste source WS-JMARTIN
event.provider: "Microsoft-Windows-Sysmon" AND event.code: 1
  AND host.name: "WS-JMARTIN"
  AND @timestamp < "2024-01-14T14:32:00"
| sort @timestamp desc
| limit 50

# Resultat :
# 14:15:22 — WINWORD.EXE lance powershell.exe (macro malveillante)
# 14:14:08 — OUTLOOK.EXE telecharge "Facture_Janvier_2024.docm"
# --> PATIENT ZERO : WS-JMARTIN (poste de Jean Martin)
# --> VECTEUR : phishing avec piece jointe Word macro

# Connexions sortantes depuis WS-JMARTIN (192.168.10.55)
event.category: "network_traffic" AND source.ip: "192.168.10.55"
  AND destination.port: (445 OR 135 OR 5985 OR 3389)
  AND @timestamp >= "2024-01-14T14:15:00" AND @timestamp <= "2024-01-14T14:32:00"
| stats count by destination.ip, destination.port
| sort count desc

# Resultat :
# 192.168.10.20 (FS01)     — port 445 (SMB)  — 23 connexions
# 192.168.10.10 (DC01)     — port 445 (SMB)  — 8 connexions
# 192.168.10.30 (DB01)     — port 445 (SMB)  — 5 connexions
# --> L'attaquant a scanne le reseau et accede a FS01, DC01 et DB01 via SMB

# Taches planifiees creees sur les machines compromises
winlog.event_id: 4698
  AND host.name: ("WS-JMARTIN" OR "FS01" OR "DC01" OR "DB01")
  AND @timestamp >= "2024-01-14T14:00:00"

# Resultat :
# FS01 — Task: "WindowsUpdate_Check" — Action: C:\Windows\Temp\svchost_update.exe
# DC01 — Task: "SystemHealthMonitor" — Action: powershell.exe -enc [base64]

# Services suspects crees
winlog.event_id: 7045
  AND host.name: ("WS-JMARTIN" OR "FS01" OR "DC01" OR "DB01")
  AND @timestamp >= "2024-01-14T14:00:00"

# Resultat :
# DC01 — Service: "WinDefenderUpdate" — Path: C:\ProgramData\defender_svc.exe
# --> PERSISTANCE CONFIRMEE sur FS01 et DC01

# Volumes d'upload inhabituels depuis les machines compromises
event.category: "web"
  AND source.ip: ("192.168.10.55" OR "192.168.10.20" OR "192.168.10.10")
  AND http.request.method: "POST"
  AND @timestamp >= "2024-01-14T14:00:00"
| stats sum(http.request.bytes) as total_bytes by source.ip, url.domain
| where total_bytes > 10000000
| sort total_bytes desc

# Resultat :
# 192.168.10.20 (FS01)  — mega-upload-cdn.xyz — 2.4 GB uploaded
# 192.168.10.10 (DC01)  — file-share-srv.xyz  — 340 MB uploaded
# --> EXFILTRATION CONFIRMEE : ~2.7 GB de donnees exfiltrees
# --> Double extortion : les donnees seront publiees si la rancon n'est pas payee

# 1. Isoler les machines compromises via EDR
$ crowdstrike-api contain-host --hosts FS01,WS-JMARTIN,DC01,DB01

# 2. Bloquer les domaines C2 dans le proxy et le DNS
$ firewall-cli block-domain mega-upload-cdn.xyz
$ firewall-cli block-domain file-share-srv.xyz
$ dns-sinkhole add mega-upload-cdn.xyz file-share-srv.xyz

# 3. Desactiver le compte de Jean Martin et forcer un reset global
$ ad-cli disable-account jmartin
$ ad-cli force-password-reset --scope "all-users" --priority high

# 4. Bloquer les hash du malware sur tous les endpoints
$ edr-cli block-hash sha256:a1b2c3d4e5f6... --scope global

# 5. Sauvegarder les preuves forensiques avant toute action destructive
$ velociraptor collect --host FS01 --artifact Windows.KapeFiles.Targets
$ velociraptor collect --host DC01 --artifact Windows.Memory.Acquisition

PLAN DE RECOVERY — Incident IR-2024-001
========================================

Priorite 1 (Immediat) :
  [x] Verifier l'integrite des backups (derniere sauvegarde saine : dimanche 02:00)
  [x] Confirmer que DC02 (DC de backup) n'est pas compromis
  [ ] Restaurer DC01 depuis une image propre + dernier backup AD
  [ ] Restaurer FS01 depuis le backup de dimanche

Priorite 2 (< 24h) :
  [ ] Reinstaller WS-JMARTIN depuis image standard
  [ ] Verifier et restaurer DB01 (base de donnees patients)
  [ ] Deployer les nouvelles regles EDR sur tout le parc

Priorite 3 (< 72h) :
  [ ] Audit complet de tous les mecanismes de persistance
  [ ] Rotation de tous les credentials de service
  [ ] Patch de la vulnerabilite exploitee (macro Office)
  [ ] Desactiver les macros Office pour les utilisateurs standard

Notifications :
  [ ] Direction generale — briefing T+3h
  [ ] ANSSI — notification dans les 72h (OIV)
  [ ] CNIL — si donnees patients exfiltrees (RGPD Article 33)
  [ ] Assurance cyber — declarer le sinistre