Security Verification and Offensive-Defensive Practice
Blue Team Manual ⑪ [Log Edition] Practical Guide to Enterprise-Level Security Log Analysis and Threat Detection
▌The Key to Enterprise Security Operations: Security Log Analysis
In today's digital era, enterprise operations are highly dependent on information technology, making cybersecurity the cornerstone of steady enterprise development. Enterprise-grade security log analysis acts like the "wise brain" of enterprise cybersecurity operations and is the core pillar for protecting enterprise information asset security. It runs through the complete lifecycle from data collection, processing and analysis to threat response, building a solid security line of defence for enterprises.
Analysis of the Overall Log Analysis Architecture
Layered Architecture Builds a Solid Foundation
The enterprise security log analysis system covers four layers: the data collection layer widely collects data, including network, security equipment, host, and application logs; the data processing layer cleans, standardises, and enriches data; the analysis engine layer uses signature detection, behaviour analysis, and other technologies to mine threats; the response and disposal layer is responsible for alert management, incident handling, and emergency response.
Key Data Sources Define the Analysis Focus
Before starting the security analysis journey, precisely targeting the log sources of focus is of vital importance. Different log sources are like "surveillance cameras" from different perspectives, each with its unique value, requiring differentiated collection and processing strategies.
Below are several of the most critical log sources in an enterprise environment:
Log Type | Key Fields | Analysis Value | Collection Method | Key Scenarios |
Network Traffic Logs | Source/Destination IP, Port, Protocol, Traffic Size | Detect network anomalies and attack behaviours | Bypass Mirroring, NetFlow | Scanning and probing, Trojan communication |
Security Device Logs | Attack Type, Threat Level, Signature Information | Identify known threats and attack signatures | Syslog, API Interface | Web attacks, Vulnerability exploitation |
Host System Logs | Process Information, User Operations, Privilege Changes | Detect abnormal behaviours and intrusion traces | Agent, File Collection | Privilege Escalation, Lateral Movement |
Application Access Logs | URL, Parameters, Response Code, Response Size | Business security analysis, Attack detection | File Collection, API | Interface anomalies, Data leakage |
Database Audit Logs | SQL Statements, Affected Rows, Execution Time | Data security analysis, Abnormal access | Audit system interface | Data theft, Injection attacks |
Log Processing Flow
Rigorous Flow Ensures Data Quality
After log data is collected, it must undergo a series of rigorous processing flows before entering the analysis phase. The standard processing flow includes the following steps:
▌Interpretation of Log Analysis Methodology
Systematic Analysis Flow Fortifies the Security Line of Defence
Security log analysis requires building a systematic and scientific analytical method to comprehensively identify and evaluate threats from multiple dimensions. A complete analysis flow typically includes the following steps:
Efficient Console Empowers Decision Making
A well-designed analysis console is the security analyst's powerful "combat command centre". It not only provides a bird's-eye view of the global security posture but also supports multi-dimensional data queries, enabling flexible alert management to assist analysts in quickly making wise decisions. For example, the security posture dashboard can intuitively present key security indicators, alert trends, and asset status, allowing security teams to understand the overall security situation at a glance and timely detect and respond to potential threats.
Complete Rule System Precisely Detects Threats
The detection rule system is the core "arsenal" of security log analysis, which must have multi-level and multi-dimensional rule coverage capabilities. Signature detection rules carry out precise strikes based on known signatures, quickly identifying common attack methods; behaviour analysis rules establish a baseline of normal behaviour to keenly detect unknown threats; and correlation analysis rules excel at multi-source data correlation, precisely restoring attack scenarios and improving detection accuracy to provide all-round support for security analysis.
Scientific Model Construction Improves Analysis Efficiency
img id="56">
The aforementioned rule system is mainly divided into three major categories:
Signature Detection Rules
Precise matching based on known signatures
Coverage of common attack methods
Support for rapid response to new threats
Easy for rule maintenance and optimisation
Behaviour Analysis Rules
Anomaly detection based on behaviour patterns
Establishment of a baseline for normal behaviour
Discovery of unknown threats
Reduction in the number of rules
Correlation Analysis Rules
Multi-dimensional data correlation
Restoration of attack scenarios
Improvement of detection accuracy
Assistance in analytical decision-making
Proactive Threat Hunting Strengthens Security Defence
Multi-strategy Driven Threat Hunting: Adopt IOC, TTP, and anomaly-driven strategies to confirm known threats, discover unknown threats, and capture new types of attacks through known indicator searches, attack pattern analysis, and baseline deviation detection, thereby enhancing insights.
Focus on Common Scenarios: In scenarios like Web attacks, identity credential theft, and intranet penetration, apply methods such as file signature, authentication behaviour, and network traffic analysis to timely detect and handle security hazards, protecting core assets.
Quantified Evaluation of Hunting Effectiveness: Evaluate the efficiency and precision of hunting activities through key indicators such as threat detection rate, false positive rate, and false negative rate, ensuring strong support for enterprise security operations.
▌Sharing of Threat Analysis Practice Cases
Deep Analysis of Web Attacks
Multi-dimensional Identification of Attack Types:
Multi-dimensional Analysis of Attack Behaviours: Combine signature analysis, behaviour analysis, and context analysis, utilizing multi-source data such as WAF logs and IDS alerts to mine attack features, access patterns, and paths, and evaluate the scope of impact.
Practical Skills for Handling Attacks: Use attack traceback skills to track attack sources from time, space, and behaviour dimensions, restoring the attack chain. Taking SQL injection attacks as an example, analyse signatures and take measures such as blocking, hardening, and tracing to ensure Web application security.
Identity Authentication Risk Insights
Precise Identification of Abnormal Authentication Scenarios:
Multi-dimensional Analysis of Authentication Risks: Through frequency, behaviour, and correlation analysis, combined with threshold indicators and multi-faceted features, comprehensively evaluate authentication risks to detect potential threats.
Assess Risks and Formulate Strategies: Build a risk assessment model, comprehensively considering various risk factors, and formulate response strategies based on scores, such as blocking access or secondary authentication, to ensure identity authentication security.
Rigorous Protection of Host Security
Fine Classification of Host Abnormal Behaviours: Cover types such as process anomalies, file anomalies, and system changes, detecting them through methods like signature matching and behaviour monitoring, while excluding false positives caused by O&M operations and third-party software.
Core Methods to Secure Host Security and Stability: Apply process behaviour analysis, file operation analysis, and system configuration analysis to monitor host status in real-time, ensuring safe host operation.
Efficiently Handle Advanced Threats and Emergencies: For advanced threats such as Rootkits and fileless attacks, use technologies like memory intrusion detection to timely discover and handle them, taking corresponding measures according to the disposal classification standards.
Intelligent Monitoring of Network Traffic
Scientifically Build a Traffic Analysis Framework: Cover multiple levels such as basic analysis, threat detection, and advanced analysis, comprehensively monitoring network traffic through technologies like protocol parsing to timely discover security threats.
Precisely Detect Traffic Anomalies and Protocol Risks: Based on traffic baseline models and anomaly detection indicator systems, accurately identify traffic anomalies and protocol risks to timely discover potential threats.
Cutting-edge Technologies Enhance Traffic Analysis Capability: Apply cutting-edge technologies like machine learning detection models to improve the accuracy and efficiency of network traffic analysis, effectively detecting and preventing complex threats.
All-round Protection of Data Security
Comprehensively Sort Out Data Security Risk Scenarios: Include risk scenarios such as data leakage and man-in-the-middle attacks, clarifying risk points to provide a basis for targeted protection.
Meticulously Monitor Data Behaviour to Ensure Security: Monitor data behaviour from dimensions such as access behaviour and operation behaviour to timely discover and handle abnormal behaviours, ensuring data security.
Strictly Standardise Data Circulation and Audit Flows: Establish a data circulation tracking model, strengthening the auditing of data access, operations, and transmission to ensure the compliance of data circulation and usage.
▌Review of Practical Cases and Summary of Experience
Supply Chain Attack Case
Attack Chain: Starting from a backdoor implanted in a supplier's system, infecting the enterprise's intranet through software update mechanisms, and carrying out lateral movement and data theft after privilege escalation.
Attack Tactics: Include initial infection, intranet spreading, and data theft, using legitimate signatures, system tools, encrypted channels, etc., to evade detection.
Defence Experience: Strengthen supply chain security control, implement measures such as supplier evaluation, software package validation, and upgrade package control, and reinforce intranet and data security.
Intranet APT Attack Case
Attack Chain: Include stages such as initial access, persistence, and lateral movement, utilising techniques like spear-phishing, DLL hijacking, and NTLM relaying.
Technical Analysis: Display MITRE ATT&CK technique IDs and detection methods, emphasizing detection difficulties such as customised samples and unknown vulnerabilities.
Emergency Response: Rapid response, including discovery confirmation, blocking control, and removal/remediation.
Protection Strategy: Optimise boundary, host, and data protection to improve detection rates and response speed; validate the effectiveness of defence and detection through security verification solutions.
Data Leakage Case
Leakage Path: Show the data leakage process through anomaly detection, including data access, processing, and exfiltration anomalies.
Technical Features: Provide detection rules and analyse access and processing behaviour characteristics.
Protection Strategy: Emphasise data classification and grading, deploy DLP systems, monitor data circulation, and strengthen sensitive data access audits; validate the effectiveness of defence and detection through security verification solutions.
Web Cluster Attack Case
Attack Features: Analyse attack traffic features, such as source IP distribution, request features, and time features.
Attack Tactics: Include resource probing, breaking through protection, and continuous attacks, utilising various means to attack Web clusters.
Protection Effectiveness: Evaluate existing protection and propose improvement suggestions, such as intelligent cleaning, deep detection, and elastic protection; validate the effectiveness of defence and detection through security verification solutions.
Emergency Response: Formulate disposal measures and automated flows for different response levels.
Ransomware Attack Case
Attack Chain: Display the attack process through key time nodes, including initial access, intranet penetration, and encryption deployment.
Behavioural Features: Provide detection rules and analyse file operation, system behaviour, and network activity characteristics.
Protection Blind Spots: Point out issues in boundary, endpoint, and data protection levels, and propose improvement suggestions.
Protection Measures: Implement real-time detection mechanisms, deploy comprehensive ransomware defence solutions, and strengthen backup and encryption; validate the effectiveness of defence and detection through security verification solutions.
Recovery Plan: Formulate rapid, complete, and long-term recovery plans to ensure business continuity.
▌Conclusion
Enterprise-grade security log analysis will continue to innovate and develop in the future, becoming a more core and powerful component of the enterprise cybersecurity defence system. Enterprises should pay close attention to these development trends, actively introduce new technologies and concepts, and continuously optimise security log analysis strategies and capabilities to cope with evolving cybersecurity challenges and ensure the secure and stable development of enterprises in the digital era.
