carbon-black-cloud

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Carbon Black Cloud Enterprise EDR — content authoring

Carbon Black Cloud Enterprise EDR — 内容编写

This skill encodes operational context for authoring detection content in

configurations.carbon_black_cloud

blocks of OpenTide MDR objects. Carbon Black Cloud (CBC) Enterprise EDR (formerly CB ThreatHunter) is the relevant product surface; older CB Response (on-prem) is not the same product.

本 skill 梳理了为 OpenTide MDR 对象的

configurations.carbon_black_cloud

块编写检测内容时所需的操作背景。相关产品功能是 Carbon Black Cloud (CBC) Enterprise EDR（原 CB ThreatHunter）；旧版 CB Response（本地部署）并非同一产品。

1. Surface identification

1. 功能界面识别

Surface	Used for
Process Search (Investigate)	Ad-hoc hunting via the search bar / API
Watchlists	Recurring alert generation backed by Reports / IOCs
Scheduled Searches (via API)	Custom periodic queries with action hooks
Alerts	Notable events from Watchlist hits, sensor IOC matches, NGAV detections
Live Response	Constrained shell over the sensor for IR
Threat Intel Feeds	Subscribed third-party / Carbon Black-curated indicator streams

CBC's primary detection authoring surface is Watchlists (curated collections of Reports, each containing one or more IOCs/queries). Scheduled searches are a complementary mechanism for query-based detections that need richer aggregation.

功能界面	用途
Process Search (Investigate)	通过搜索栏或 API 进行临时狩猎
Watchlists	基于 Reports / IOCs 持续生成告警
Scheduled Searches（通过 API）	带 action hooks 的自定义周期性查询
Alerts	Watchlist 命中、sensor IOC 匹配、NGAV 检测等重要事件
Live Response	在 sensor 上提供受限 shell，用于 IR
Threat Intel Feeds	已订阅的第三方或 Carbon Black 精选 indicator 流

CBC 的主要检测编写界面是 Watchlists（由 Reports 组成的精选集合，每个 Report 包含一个或多个 IOCs/queries）。对于需要更丰富聚合能力的 query-based detections，Scheduled searches 是一种补充机制。

2. Process search query syntax

2. 进程搜索查询语法

CBC search syntax is Lucene-based (Solr under the hood). Field-level filters with boolean operators:

process_name:powershell.exe AND process_cmdline:*-EncodedCommand*

device_os:WINDOWS AND netconn_action:ACTION_CONNECTION_CREATE
    AND netconn_remote_port:443 AND -netconn_remote_ipv4:10.0.0.0/8

Operator	Meaning
`field:value`	Equality
`field:partial`	Wildcard match
`AND` , `OR` , `NOT` (or `-` )	Boolean
`field:[a TO b]`	Range
`()`	Grouping

Process fields:

Field	Description
`process_name`	Executable name (lowercase path)
`process_cmdline`	Full command line
`process_hash`	SHA256 and MD5 hashes (array)
`process_guid`	Stable per-process identifier (primary correlation key)
`process_pid`	Process ID (array — may recycle)
`process_username`	User context
`process_original_filename`	PE original filename (anti-rename detection)
`process_effective_reputation`	CBC reputation: `TRUSTED_WHITE_LIST` , `LOCAL_WHITE` , `NOT_LISTED` , `KNOWN_MALWARE` , `SUSPECT_MALWARE` , `PUP` , `ADAPTIVE_WHITE_LIST` , `COMPANY_BLACK_LIST`
`process_elevated`	Boolean — running with elevated privileges
`process_integrity_level`	`SYSTEM` , `HIGH` , `MEDIUM` , `LOW`
`process_company_name`	PE company name metadata
`process_internal_name`	PE internal name
`process_service_name`	Windows service name (if applicable)
`process_start_time`	ISO 8601 process start timestamp

Parent fields:

parent_name

parent_cmdline

parent_hash

parent_guid

parent_pid

parent_reputation

parent_effective_reputation

Device fields:

device_name

device_id

device_os

(

WINDOWS

LINUX

MAC

device_policy

device_policy_id

device_external_ip

device_internal_ip

device_sensor_version

device_target_priority

device_location

Event count fields (per-process aggregates):

childproc_count

crossproc_count

filemod_count

modload_count

netconn_count

regmod_count

scriptload_count

Time scope: Set via

time_range

in API (

window: "-2w"

, or

start

end

ISO 8601), or via the search interface time picker.

CBC search syntax 基于 Lucene（底层使用 Solr）。支持带布尔运算符的字段级筛选：

process_name:powershell.exe AND process_cmdline:*-EncodedCommand*

device_os:WINDOWS AND netconn_action:ACTION_CONNECTION_CREATE
    AND netconn_remote_port:443 AND -netconn_remote_ipv4:10.0.0.0/8

运算符	含义
`field:value`	等值匹配
`field:partial`	通配符匹配
`AND` 、 `OR` 、 `NOT` （或 `-` ）	布尔运算
`field:[a TO b]`	范围匹配
`()`	分组

进程字段：

字段	说明
`process_name`	可执行文件名称（小写路径）
`process_cmdline`	完整命令行
`process_hash`	SHA256 和 MD5 哈希值（数组）
`process_guid`	稳定的单进程标识符（主要关联键）
`process_pid`	进程 ID（数组——可能会被复用）
`process_username`	用户上下文
`process_original_filename`	PE 原始文件名（检测文件重命名）
`process_effective_reputation`	CBC 信誉值： `TRUSTED_WHITE_LIST` 、 `LOCAL_WHITE` 、 `NOT_LISTED` 、 `KNOWN_MALWARE` 、 `SUSPECT_MALWARE` 、 `PUP` 、 `ADAPTIVE_WHITE_LIST` 、 `COMPANY_BLACK_LIST`
`process_elevated`	布尔值——以提升后的权限运行
`process_integrity_level`	`SYSTEM` 、 `HIGH` 、 `MEDIUM` 、 `LOW`
`process_company_name`	PE company name 元数据
`process_internal_name`	PE internal name
`process_service_name`	Windows service name（如适用）
`process_start_time`	ISO 8601 进程启动时间戳

父进程字段：

parent_name

、

parent_cmdline

、

parent_hash

、

parent_guid

、

parent_pid

、

parent_reputation

、

parent_effective_reputation

设备字段：

device_name

、

device_id

、

device_os

（

WINDOWS

LINUX

MAC

）、

device_policy

、

device_policy_id

、

device_external_ip

、

device_internal_ip

、

device_sensor_version

、

device_target_priority

、

device_location

事件计数字段（按进程聚合）：

childproc_count

、

crossproc_count

、

filemod_count

、

modload_count

、

netconn_count

、

regmod_count

、

scriptload_count

时间范围：通过 API 中的

time_range

设置（

window: "-2w"

，或使用 ISO 8601 格式的

start

end

），也可通过搜索界面的时间选择器设置。

Event type taxonomy

事件类型分类

Each process has associated events of specific types:

Event type	Key fields	Detection use
`childproc`	`childproc_name` , `childproc_cmdline` , `childproc_guid`	Process spawning chains
`crossproc`	`crossproc_name` , `crossproc_action` ( `ACTION_OPEN_PROCESS_HANDLE` )	Process injection, LSASS access
`filemod`	`filemod_name` , `filemod_action`	File creation/modification/deletion
`modload`	`modload_name` , `modload_md5` , `modload_sha256`	DLL loading, side-loading
`netconn`	`netconn_action` , `netconn_remote_ipv4` , `netconn_remote_port` , `netconn_protocol` , `netconn_local_port` , `netconn_inbound`	C2, lateral movement, exfiltration
`regmod`	`regmod_name` , `regmod_action`	Registry persistence, configuration changes
`scriptload`	`scriptload_name` , `scriptload_content` , `fileless_scriptload_cmdline`	Script execution, AMSI content

每个进程都关联特定类型的事件：

事件类型	关键字段	检测用途
`childproc`	`childproc_name` 、 `childproc_cmdline` 、 `childproc_guid`	进程派生链
`crossproc`	`crossproc_name` 、 `crossproc_action` （ `ACTION_OPEN_PROCESS_HANDLE` ）	进程注入、LSASS 访问
`filemod`	`filemod_name` 、 `filemod_action`	文件创建、修改或删除
`modload`	`modload_name` 、 `modload_md5` 、 `modload_sha256`	DLL 加载、side-loading
`netconn`	`netconn_action` 、 `netconn_remote_ipv4` 、 `netconn_remote_port` 、 `netconn_protocol` 、 `netconn_local_port` 、 `netconn_inbound`	C2、横向移动、数据外泄
`regmod`	`regmod_name` 、 `regmod_action`	注册表持久化、配置更改
`scriptload`	`scriptload_name` 、 `scriptload_content` 、 `fileless_scriptload_cmdline`	脚本执行、AMSI 内容

Critical query patterns

关键查询模式

Enriched event exclusion: Append

-enriched:true

to watchlist IOC queries to avoid duplicate hits from enriched events.

process_name:powershell.exe AND process_cmdline:*-EncodedCommand* -enriched:true

Renamed binary detection: Use

process_original_filename

to catch renamed executables:

!process_name:sethc.exe AND process_original_filename:sethc.exe

Event count thresholds: Filter processes by activity volume:

process_name:wscript.exe AND netconn_count:[1 TO *]

Reputation filtering: Focus on unknown or untrusted binaries:

process_effective_reputation:NOT_LISTED AND netconn_count:[1 TO *]

富化事件排除：在 watchlist IOC queries 末尾附加

-enriched:true

，避免富化事件产生重复命中。

process_name:powershell.exe AND process_cmdline:*-EncodedCommand* -enriched:true

重命名二进制检测：使用

process_original_filename

捕获被重命名的可执行文件：

!process_name:sethc.exe AND process_original_filename:sethc.exe

事件计数阈值：根据活动量筛选进程：

process_name:wscript.exe AND netconn_count:[1 TO *]

信誉过滤：聚焦未知或不受信任的二进制文件：

process_effective_reputation:NOT_LISTED AND netconn_count:[1 TO *]

3. Watchlists, Reports, and IOCs

3. Watchlists、Reports 与 IOCs

CBC's authoring hierarchy:

Watchlist  ──contains──▶  Report  ──contains──▶  IOC(s)
                                              │  ├─ query (saved process search)
                                              │  ├─ equality (atomic value match)
                                              │  └─ regex (pattern match)

Concept	Description
Watchlist	Subscription unit — a tenant subscribes to a Watchlist and receives alerts for any matching report
Report	A named detection — title, description, severity, IOCs, optional tags, optional MITRE mapping
IOC	The atomic match — query, equality, or regex

CBC 的编写层级：

Watchlist  ──contains──▶  Report  ──contains──▶  IOC(s)
                                              │  ├─ query (saved process search)
                                              │  ├─ equality (atomic value match)
                                              │  └─ regex (pattern match)

概念	说明
Watchlist	订阅单元——tenant 订阅 Watchlist 后，任何匹配的 report 都会触发告警
Report	命名的检测——包含 title、description、severity、IOCs、可选 tags 和可选 MITRE mapping
IOC	原子匹配项——query、equality 或 regex

Authoring discipline

编写规范

One TTP per Report. Do not pack multiple unrelated detections into a single Report (CBC's analogue of AP-H2 Kitchen Sink).
Severity calibration. Reserve Severity 8–10 for high-confidence detections that justify analyst paging. Most behavioural detections sit at Severity 5–7.
MITRE mapping populated in the Report metadata, not just inline.
Report tags for taxonomy (e.g.
```
T1059
```
,
```
Initial Access
```
,
```
RansomwarePrecursor
```
).
Description prose documents intent, FP scenarios, and triage steps — CBC alerts surface this directly to analysts.

每个 Report 只对应一个 TTP。 不要将多个不相关的检测项放入同一个 Report（这相当于 AP-H2 Kitchen Sink）。
严重性校准。 Severity 8–10 仅用于高置信度且值得呼叫分析师的检测。大多数行为检测应设为 Severity 5–7。
MITRE mapping 应填写在 Report metadata 中，而不只是内联内容。
使用 Report tags 标注分类体系，例如
```
T1059
```
、
```
Initial Access
```
、
```
RansomwarePrecursor
```
。
Description prose 应记录检测意图、FP 场景和分诊步骤——CBC alerts 会直接向分析师显示这些内容。

Watchlist hygiene

Watchlist 维护规范

Custom watchlists scoped to a tenant; subscribed alongside vendor watchlists.
Periodic review of report-level alert volume — high-volume reports tune or disable.
Keep IOC-only reports separate from query reports; they have different update cadences.

自定义 watchlists 的范围限定到 tenant，并与 vendor watchlists 一同订阅。
定期审查 report-level 告警量——对高告警量 reports 进行调优或禁用。
将仅包含 IOC 的 reports 与 query reports 分开管理；两者的更新周期不同。

4. Scheduled searches (API-driven)

4. Scheduled Searches（API 驱动）

For detections requiring aggregation across many events (e.g. beaconing, frequency-based anomaly), use the Scheduled Search API:

Field	Detail
`query`	CBC process search query
`interval`	Cadence (configurable)
`device_filter`	Optional scope filter
`notification_action`	Email / webhook / SOAR endpoint on hit

Scheduled searches do not generate alerts in the alert pipeline by default — they fire notifications. For alert-pipeline integration, the workflow typically writes results back into a Watchlist Report or SIEM.

对于需要跨大量事件进行聚合的检测，例如 beaconing、基于频率的异常，应使用 Scheduled Search API：

字段	详情
`query`	CBC process search query
`interval`	执行频率（可配置）
`device_filter`	可选范围筛选器
`notification_action`	命中时通过 Email、webhook 或 SOAR endpoint 发送通知

Scheduled searches 默认不会在告警管道中生成 alerts，而是触发 notifications。若要集成到告警管道，工作流通常会将结果写回 Watchlist Report 或 SIEM。

5. Sensor capability boundaries

5. Sensor 能力边界

Capability	Windows	macOS	Linux
Process tree	Full	Full	Full
Command line	Full	Full	Full (per kernel)
File modifications	Full	Full	Full
Network connections	Full	Full	Full
Registry	Full	n/a	n/a
DNS	Full (Endpoint Standard tier)	Full	Limited
Cross-process events	Full	Limited	Limited
ScriptBlock content (PowerShell)	Full	Limited	n/a

Tier matters: Endpoint Standard (NGAV-only) is not the same SKU as Enterprise EDR. Detection content requiring process-tree depth or behavioural data needs Enterprise EDR licensing on the host.

能力	Windows	macOS	Linux
进程树	完整	完整	完整
命令行	完整	完整	完整（按内核）
文件修改	完整	完整	完整
网络连接	完整	完整	完整
注册表	完整	不适用	不适用
DNS	完整（Endpoint Standard tier）	完整	有限
跨进程事件	完整	有限	有限
ScriptBlock 内容（PowerShell）	完整	有限	不适用

Tier 很重要：Endpoint Standard（仅 NGAV）并非 Enterprise EDR 这一 SKU。需要深层进程树或行为数据的检测内容，所在主机必须具备 Enterprise EDR 许可。

6. NGAV alerts vs EDR detections

6. NGAV alerts 与 EDR detections

Two separate alert categories on the same sensor:

Source	Alert type	Notes
NGAV (Predictive Cloud Engine)	TTP / Carbon Black Reputation / Malware	Sensor-side prevention/detection
Watchlist	Custom or subscribed Report hit	Cloud-side analysis
CB Threat Intel feeds	Vendor / CB-curated IOC matches	Hash, IP, domain

Custom detection content lives in Watchlists. NGAV behavioural rules are vendor-managed.

同一 sensor 上存在两类独立的 alert categories：

来源	Alert 类型	说明
NGAV（Predictive Cloud Engine）	TTP / Carbon Black Reputation / Malware	sensor 端预防或检测
Watchlist	自定义或已订阅的 Report 命中	cloud 端分析
CB Threat Intel feeds	Vendor / CB 精选 IOC 匹配	Hash、IP、domain

自定义检测内容存放在 Watchlists 中。NGAV behavioural rules 由 vendor 管理。

7. Alert override / interrupt

CBC supports override rules for known-good behaviour:

Override type	Scope
Hash override	Allow a specific SHA256
Path override	Allow a specific binary path
Cert override	Allow a specific signer
IT tool override	Sanction enterprise tools that trigger NGAV

Author detection content with awareness of overrides — a generic ransomware detection that hits because of a backup tool will be silenced via override rather than tuned in the rule. Document expected override patterns in the Report description.

CBC 支持针对已知良性行为的 override rules：

Override 类型	范围
Hash override	允许特定 SHA256
Path override	允许特定 binary path
Cert override	允许特定 signer
IT tool override	批准会触发 NGAV 的 enterprise tools

编写检测内容时应了解 overrides——如果某条通用勒索软件检测因 backup tool 而命中，该告警会通过 override 被抑制，而不是在规则中进行调优。应在 Report description 中记录预期的 override patterns。

8. Live Response

Constrained sensor-side shell. Commands include:

Category	Examples
Read-only	`ps` , `dir` , `cat` , `reg query` , `netstat`
Investigative	`memdump` , `get` , `kill`
State-changing	`put` , `rm` , `delete` , `execfg`

Same authoring discipline as CrowdStrike RTR: read-only first, document intent before automation, no embedded secrets.

受限的 sensor 端 shell。命令包括：

类别	示例
只读	`ps` 、 `dir` 、 `cat` 、 `reg query` 、 `netstat`
调查操作	`memdump` 、 `get` 、 `kill`
状态变更	`put` 、 `rm` 、 `delete` 、 `execfg`

应采用与 CrowdStrike RTR 相同的编写规范：优先执行只读操作，自动化前记录操作意图，不在脚本中嵌入 secrets。

9. SIEM ingestion patterns

9. SIEM 摄取模式

Table/index names are SIEM-specific. Consult your SIEM's CBC integration documentation for exact configurations.

CBC source	Telemetry type	Ingestion method	Notes
Alerts	Detection alerts (watchlist hits, NGAV, threat intel)	Data Forwarder → S3/Azure Blob → SIEM, or API polling	Primary alert source
Process events	Process creation, command-line, parent chain	Data Forwarder → S3/Azure Blob → SIEM	Requires Enterprise EDR
Network events	Connection metadata	Data Forwarder → S3/Azure Blob → SIEM	Requires Enterprise EDR
File/registry events	File and registry modifications	Data Forwarder → S3/Azure Blob → SIEM	Requires Enterprise EDR
Audit logs	Admin actions, policy changes	Audit Log API → SIEM	Always available

Table/index 名称取决于具体 SIEM。有关准确配置，请查阅对应 SIEM 的 CBC integration 文档。

CBC 来源	Telemetry 类型	摄取方式	说明
Alerts	检测告警（watchlist 命中、NGAV、threat intel）	Data Forwarder → S3/Azure Blob → SIEM，或 API polling	主要告警来源
Process events	进程创建、命令行、父进程链	Data Forwarder → S3/Azure Blob → SIEM	需要 Enterprise EDR
Network events	连接元数据	Data Forwarder → S3/Azure Blob → SIEM	需要 Enterprise EDR
File/registry events	文件和注册表修改	Data Forwarder → S3/Azure Blob → SIEM	需要 Enterprise EDR
Audit logs	管理员操作、策略更改	Audit Log API → SIEM	始终可用

Data Forwarder

CBC's Data Forwarder exports event data to AWS S3 or Azure Blob Storage in JSON format. The SIEM then ingests from the storage bucket. This is the recommended method for bulk event ingestion — API polling has rate limits.

CBC 的 Data Forwarder 以 JSON 格式将事件数据导出到 AWS S3 或 Azure Blob Storage，随后由 SIEM 从 storage bucket 摄取。这是批量事件摄取的首选方法——API polling 存在速率限制。

10. Entity identifier alignment

10. 实体标识符对齐

Concept	CBC	Microsoft Defender	Sentinel	CrowdStrike
Host	`device_id` , `device_name`	`DeviceId` , `DeviceName`	`Computer`	`aid` , `ComputerName`
User	`process_username`	`AccountName` , `AccountUpn`	`UserPrincipalName`	`UserName`
Process	`process_guid` (stable)	`ProcessUniqueId`	n/a	`ContextProcessId_decimal`
Hash	`process_hash` (SHA256/MD5)	`SHA256`	`FileHash`	`SHA256HashData`

process_guid

is CBC's stable per-process identifier — use it for chain correlation, not PIDs.

概念	CBC	Microsoft Defender	Sentinel	CrowdStrike
主机	`device_id` 、 `device_name`	`DeviceId` 、 `DeviceName`	`Computer`	`aid` 、 `ComputerName`
用户	`process_username`	`AccountName` 、 `AccountUpn`	`UserPrincipalName`	`UserName`
进程	`process_guid` （稳定）	`ProcessUniqueId`	不适用	`ContextProcessId_decimal`
哈希	`process_hash` （SHA256/MD5）	`SHA256`	`FileHash`	`SHA256HashData`

process_guid

是 CBC 稳定的单进程标识符——应使用它进行链式关联，而不是使用 PID。

11. Mapping into OpenTide MDR

11. 映射到 OpenTide MDR

When CBC content lives in

configurations.carbon_black_cloud

Identify the surface (Watchlist Report / Scheduled Search / API IOC) in the configuration block.
Watchlist Report metadata (title, description, severity, MITRE tags) populated; the MDR
```
description
```
mirrors / extends with operational context.
Sensor tier requirement declared (Endpoint Standard vs Enterprise EDR) so reviewers can assess fitness.
Coordinate with
```
opentide-detection-rule
```
for placement and
```
detection-engineering
```
for lifecycle.

当 CBC 内容位于

configurations.carbon_black_cloud

中时：

在 configuration block 中识别功能界面（Watchlist Report / Scheduled Search / API IOC）。
填写 Watchlist Report metadata（title、description、severity、MITRE tags）；MDR
```
description
```
应镜像或扩展这些内容，并补充操作背景。
声明 Sensor tier requirement（Endpoint Standard 或 Enterprise EDR），以便审查人员评估适用性。
与
```
opentide-detection-rule
```
协作确定内容放置位置，并与
```
detection-engineering
```
协作管理生命周期。

12. Worked detection patterns

12. 实战检测模式

LSASS credential dumping

LSASS 凭据转储

process_name:rundll32.exe AND process_cmdline:*comsvcs* AND process_cmdline:*MiniDump*

Watchlist Report: Severity 8, MITRE T1003.001. FP: legitimate crash dump tools — check

parent_name

for expected dump utilities.

process_name:rundll32.exe AND process_cmdline:*comsvcs* AND process_cmdline:*MiniDump*

Watchlist Report：Severity 8，MITRE T1003.001。FP：合法的 crash dump tools——检查

parent_name

，确认是否来自预期的 dump utilities。

Encoded PowerShell execution

编码 PowerShell 执行

process_name:powershell.exe AND process_cmdline:*-EncodedCommand*
    AND -parent_name:ccmexec.exe

Watchlist Report: Severity 6, MITRE T1059.001. FP: SCCM/ConfigMgr deployments use

-EncodedCommand

legitimately — exclude

ccmexec.exe

parent.

process_name:powershell.exe AND process_cmdline:*-EncodedCommand*
    AND -parent_name:ccmexec.exe

Watchlist Report：Severity 6，MITRE T1059.001。FP：SCCM/ConfigMgr deployments 会合法使用

-EncodedCommand

——排除父进程为

ccmexec.exe

的情况。

Suspicious service installation (PsExec pattern)

可疑服务安装（PsExec 模式）

device_os:WINDOWS AND process_name:psexesvc.exe

Watchlist Report: Severity 7, MITRE T1569.002. FP: legitimate admin use of PsExec — correlate with

process_username

and time of day.

device_os:WINDOWS AND process_name:psexesvc.exe

Watchlist Report：Severity 7，MITRE T1569.002。FP：管理员合法使用 PsExec——结合

process_username

和一天中的时间进行关联分析。

Scheduled task persistence

计划任务持久化

process_name:schtasks.exe AND process_cmdline:*/create* AND process_cmdline:*AppData*

Watchlist Report: Severity 5, MITRE T1053.005. FP: some legitimate software creates tasks in AppData — check

process_effective_reputation

process_name:schtasks.exe AND process_cmdline:*/create* AND process_cmdline:*AppData*

Watchlist Report：Severity 5，MITRE T1053.005。FP：某些合法软件会在 AppData 中创建任务——检查

process_effective_reputation

。

Accessibility feature hijack (renamed binary)

辅助功能劫持（重命名二进制文件）

((!process_name:sethc.exe AND process_original_filename:sethc.exe)
  OR (!process_name:utilman.exe AND process_original_filename:utilman.exe)
  OR (!process_name:osk.exe AND process_original_filename:osk.exe)
  OR (!process_name:Magnify.exe AND process_original_filename:Magnify.exe)
  OR (!process_name:Narrator.exe AND process_original_filename:Narrator.exe))
-enriched:true

Watchlist Report: Severity 8, MITRE T1546.008. FP: very rare — accessibility features should not be renamed.

((!process_name:sethc.exe AND process_original_filename:sethc.exe)
  OR (!process_name:utilman.exe AND process_original_filename:utilman.exe)
  OR (!process_name:osk.exe AND process_original_filename:osk.exe)
  OR (!process_name:Magnify.exe AND process_original_filename:Magnify.exe)
  OR (!process_name:Narrator.exe AND process_original_filename:Narrator.exe))
-enriched:true

Watchlist Report：Severity 8，MITRE T1546.008。FP：极为罕见——辅助功能不应被重命名。

Archive extraction from email/download path

从邮件或下载路径解压归档文件

process_name:7zFM.exe AND
  (process_cmdline:*.iso OR process_cmdline:*.img OR process_cmdline:*.dmg) AND
  (process_cmdline:*\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Content.Outlook\\*
   OR process_cmdline:*\\Downloads\\*)
-enriched:true

Watchlist Report: Severity 5, MITRE T1204.002. FP: legitimate archive extraction — check file reputation and source.

process_name:7zFM.exe AND
  (process_cmdline:*.iso OR process_cmdline:*.img OR process_cmdline:*.dmg) AND
  (process_cmdline:*\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Content.Outlook\\*
   OR process_cmdline:*\\Downloads\\*)
-enriched:true

Watchlist Report：Severity 5，MITRE T1204.002。FP：合法的归档文件解压——检查文件信誉和来源。

Outbound connection to rare port

连接到罕见端口的出站连接

device_os:WINDOWS AND netconn_action:ACTION_CONNECTION_CREATE
    AND netconn_remote_port:4444
    AND -netconn_remote_ipv4:10.0.0.0/8
    AND -netconn_remote_ipv4:172.16.0.0/12
    AND -netconn_remote_ipv4:192.168.0.0/16

Scheduled Search: common Metasploit/Meterpreter default port. Adjust port list per threat intel.

device_os:WINDOWS AND netconn_action:ACTION_CONNECTION_CREATE
    AND netconn_remote_port:4444
    AND -netconn_remote_ipv4:10.0.0.0/8
    AND -netconn_remote_ipv4:172.16.0.0/12
    AND -netconn_remote_ipv4:192.168.0.0/16

Scheduled Search：常见的 Metasploit/Meterpreter 默认端口。应根据 threat intel 调整端口列表。

13. Quality checklist

13. 质量检查清单

Surface identified (Watchlist Report / Scheduled Search / IOC).
One TTP per Report.
Severity calibrated (8–10 for paging-worthy, 5–7 for behavioural, 1–4 for informational).
MITRE mapping in Report metadata + MDR description.
Process correlation via
```
process_guid
```
, not PID.
Sensor tier requirement declared (Endpoint Standard vs Enterprise EDR).
```
-enriched:true
```
appended to watchlist IOC queries to avoid duplicate hits.
```
process_original_filename
```
used alongside
```
process_name
```
for renamed binary detection.
Event count thresholds used where appropriate (
```
netconn_count:[1 TO *]
```
).
Override patterns documented in Report description.
FP triage steps in description.
Live Response scripts reviewed before automation.
SIEM ingestion method documented (Data Forwarder vs API polling).
Reputation filtering considered (
```
process_effective_reputation:NOT_LISTED
```
).

已识别功能界面（Watchlist Report / Scheduled Search / IOC）。
每个 Report 只对应一个 TTP。
严重性已校准（8–10 用于值得呼叫的检测，5–7 用于行为检测，1–4 用于信息性检测）。
MITRE mapping 已写入 Report metadata 和 MDR description。
通过
```
process_guid
```
进行 process correlation，而非使用 PID。
已声明 Sensor tier requirement（Endpoint Standard 或 Enterprise EDR）。
watchlist IOC queries 末尾已附加
```
-enriched:true
```
，以避免重复命中。
使用
```
process_name
```
时已结合
```
process_original_filename
```
检测 renamed binary。
已在适当位置使用 event count thresholds（
```
netconn_count:[1 TO *]
```
）。
已在 Report description 中记录 Override patterns。
Description 中包含 FP 分诊步骤。
Live Response scripts 在自动化前已审核。
已记录 SIEM ingestion method（Data Forwarder 或 API polling）。
已考虑 Reputation filtering（
```
process_effective_reputation:NOT_LISTED
```
）。