Add passive file churn sensor beta
This commit is contained in:
OfficeCom Codex
296
src/OCSentinelCli/RansomwareFileChurnDetector.cs
Normal file
296
src/OCSentinelCli/RansomwareFileChurnDetector.cs
Normal file
@@ -0,0 +1,296 @@
|
||||
using System.Diagnostics.Eventing.Reader;
|
||||
using System.Globalization;
|
||||
using System.Runtime.Versioning;
|
||||
using System.Text.Json;
|
||||
using System.Xml.Linq;
|
||||
|
||||
namespace OCSentinelCli;
|
||||
|
||||
[SupportedOSPlatform("windows")]
|
||||
internal static class RansomwareFileChurnDetector
|
||||
{
|
||||
private const uint DeleteAccessMask = 0x00010000;
|
||||
private const uint FileWriteAccessMask = 0x00000156;
|
||||
private const string StateFileName = "ransomware-file-churn.json";
|
||||
|
||||
public static RansomwareFileChurnSummary Scan(ScannerConfiguration configuration, List<string> errors)
|
||||
{
|
||||
if (!configuration.RansomwareFileChurnEnabled)
|
||||
{
|
||||
return new RansomwareFileChurnSummary();
|
||||
}
|
||||
|
||||
int windowMinutes = Math.Clamp(configuration.RansomwareFileChurnWindowMinutes, 1, 60);
|
||||
int maximumAuditEvents = Math.Clamp(configuration.RansomwareFileChurnMaxAuditEvents, 100, 20000);
|
||||
DateTimeOffset windowStart = DateTimeOffset.UtcNow.AddMinutes(-windowMinutes);
|
||||
var observed = new List<FileAuditActivity>();
|
||||
bool isTruncated = false;
|
||||
|
||||
try
|
||||
{
|
||||
long milliseconds = Math.Max(1, (long)(DateTimeOffset.UtcNow - windowStart).TotalMilliseconds);
|
||||
string query = $"*[System[(EventID=4663) and TimeCreated[timediff(@SystemTime) <= {milliseconds}]]]";
|
||||
using var reader = new EventLogReader(new EventLogQuery("Security", PathType.LogName, query));
|
||||
int inspected = 0;
|
||||
for (EventRecord? record = reader.ReadEvent(); record is not null; record = reader.ReadEvent())
|
||||
{
|
||||
using (record)
|
||||
{
|
||||
if (++inspected > maximumAuditEvents)
|
||||
{
|
||||
isTruncated = true;
|
||||
break;
|
||||
}
|
||||
|
||||
if (TryCreateActivity(record, configuration, out FileAuditActivity? activity) && activity is not null)
|
||||
{
|
||||
observed.Add(activity);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
catch (UnauthorizedAccessException exception)
|
||||
{
|
||||
errors.Add($"Ransomware file churn cannot read the Security log: {exception.Message}");
|
||||
return Unavailable(windowMinutes);
|
||||
}
|
||||
catch (EventLogNotFoundException)
|
||||
{
|
||||
return Unavailable(windowMinutes);
|
||||
}
|
||||
catch (Exception exception)
|
||||
{
|
||||
errors.Add($"Ransomware file churn query failed: {exception.Message}");
|
||||
return Unavailable(windowMinutes);
|
||||
}
|
||||
|
||||
if (isTruncated)
|
||||
{
|
||||
return BuildSummary(observed, windowMinutes, isTruncated: true);
|
||||
}
|
||||
|
||||
List<FileAuditActivity> rollingActivities = MergeWithState(observed, windowStart, errors);
|
||||
return BuildSummary(rollingActivities, windowMinutes, isTruncated: false);
|
||||
}
|
||||
|
||||
public static RansomwareSignal? CreateSignal(RansomwareFileChurnSummary summary, ScannerConfiguration configuration)
|
||||
{
|
||||
if (!summary.Enabled || !summary.DataAvailable || summary.IsTruncated)
|
||||
{
|
||||
return null;
|
||||
}
|
||||
|
||||
int warningDeletes = Math.Max(1, configuration.RansomwareFileChurnWarningDeleteCount);
|
||||
int warningWrites = Math.Max(1, configuration.RansomwareFileChurnWarningWriteCount);
|
||||
int criticalDeletes = Math.Max(warningDeletes, configuration.RansomwareFileChurnCriticalDeleteCount);
|
||||
int criticalWrites = Math.Max(warningWrites, configuration.RansomwareFileChurnCriticalWriteCount);
|
||||
bool critical = summary.DeleteOperationCount >= criticalDeletes && summary.WriteOperationCount >= criticalWrites;
|
||||
bool warning = summary.DeleteOperationCount >= warningDeletes && summary.WriteOperationCount >= warningWrites;
|
||||
if (!warning)
|
||||
{
|
||||
return null;
|
||||
}
|
||||
|
||||
RansomwareFileChurnProcess? topProcess = summary.TopProcesses.FirstOrDefault();
|
||||
string evidence = $"delete={summary.DeleteOperationCount}; write={summary.WriteOperationCount}; processes={summary.DistinctProcessCount}; window={summary.WindowMinutes}m";
|
||||
return new RansomwareSignal
|
||||
{
|
||||
Timestamp = DateTimeOffset.Now,
|
||||
Category = critical ? "file-churn-critical" : "file-churn",
|
||||
Confidence = critical ? "medium" : "low",
|
||||
Process = topProcess?.Process ?? "[multiple]",
|
||||
Source = "Security file audit",
|
||||
EventId = 4663,
|
||||
Evidence = evidence
|
||||
};
|
||||
}
|
||||
|
||||
private static RansomwareFileChurnSummary Unavailable(int windowMinutes)
|
||||
{
|
||||
return new RansomwareFileChurnSummary
|
||||
{
|
||||
Enabled = true,
|
||||
WindowMinutes = windowMinutes
|
||||
};
|
||||
}
|
||||
|
||||
private static bool TryCreateActivity(EventRecord record, ScannerConfiguration configuration, out FileAuditActivity? activity)
|
||||
{
|
||||
activity = null;
|
||||
if (!record.TimeCreated.HasValue)
|
||||
{
|
||||
return false;
|
||||
}
|
||||
|
||||
IReadOnlyDictionary<string, string> data = ReadEventData(record);
|
||||
if (!data.TryGetValue("ObjectType", out string? objectType) || !string.Equals(objectType, "File", StringComparison.OrdinalIgnoreCase))
|
||||
{
|
||||
return false;
|
||||
}
|
||||
|
||||
if (!data.TryGetValue("AccessMask", out string? accessMaskText) || !TryParseAccessMask(accessMaskText, out uint accessMask))
|
||||
{
|
||||
return false;
|
||||
}
|
||||
|
||||
bool isDelete = (accessMask & DeleteAccessMask) != 0;
|
||||
bool isWrite = (accessMask & FileWriteAccessMask) != 0;
|
||||
if (!isDelete && !isWrite)
|
||||
{
|
||||
return false;
|
||||
}
|
||||
|
||||
string process = data.TryGetValue("ProcessName", out string? processPath) ? Path.GetFileName(processPath.Trim()) : string.Empty;
|
||||
if (string.IsNullOrWhiteSpace(process))
|
||||
{
|
||||
process = "[unknown]";
|
||||
}
|
||||
|
||||
if (configuration.RansomwareExcludedProcesses.Any(item => string.Equals(item, process, StringComparison.OrdinalIgnoreCase)))
|
||||
{
|
||||
return false;
|
||||
}
|
||||
|
||||
activity = new FileAuditActivity
|
||||
{
|
||||
Timestamp = new DateTimeOffset(record.TimeCreated.Value).ToUniversalTime(),
|
||||
RecordId = record.RecordId ?? 0,
|
||||
Process = process,
|
||||
IsDelete = isDelete,
|
||||
IsWrite = isWrite
|
||||
};
|
||||
return true;
|
||||
}
|
||||
|
||||
private static IReadOnlyDictionary<string, string> ReadEventData(EventRecord record)
|
||||
{
|
||||
XDocument document = XDocument.Parse(record.ToXml());
|
||||
return document.Descendants().Where(element => element.Name.LocalName == "Data")
|
||||
.Where(element => element.Attribute("Name") is not null)
|
||||
.ToDictionary(element => element.Attribute("Name")!.Value, element => element.Value.Trim(), StringComparer.OrdinalIgnoreCase);
|
||||
}
|
||||
|
||||
private static bool TryParseAccessMask(string value, out uint result)
|
||||
{
|
||||
string normalized = value.Trim();
|
||||
NumberStyles style = NumberStyles.Integer;
|
||||
if (normalized.StartsWith("0x", StringComparison.OrdinalIgnoreCase))
|
||||
{
|
||||
normalized = normalized[2..];
|
||||
style = NumberStyles.AllowHexSpecifier;
|
||||
}
|
||||
|
||||
return uint.TryParse(normalized, style, CultureInfo.InvariantCulture, out result);
|
||||
}
|
||||
|
||||
private static List<FileAuditActivity> MergeWithState(List<FileAuditActivity> observed, DateTimeOffset windowStart, List<string> errors)
|
||||
{
|
||||
FileChurnState stored = LoadState(errors);
|
||||
long highestObservedRecordId = observed.Count == 0 ? 0 : observed.Max(activity => activity.RecordId);
|
||||
bool securityLogReset = stored.LastSecurityRecordId > 0 && highestObservedRecordId > 0 && highestObservedRecordId < stored.LastSecurityRecordId;
|
||||
IEnumerable<FileAuditActivity> fresh = securityLogReset
|
||||
? observed
|
||||
: observed.Where(activity => activity.RecordId == 0 || activity.RecordId > stored.LastSecurityRecordId);
|
||||
List<FileAuditActivity> rolling = (securityLogReset ? [] : stored.Activities)
|
||||
.Concat(fresh)
|
||||
.Where(activity => activity.Timestamp >= windowStart)
|
||||
.GroupBy(activity => activity.RecordId > 0 ? activity.RecordId.ToString(CultureInfo.InvariantCulture) : $"{activity.Timestamp:O}|{activity.Process}|{activity.IsDelete}|{activity.IsWrite}")
|
||||
.Select(group => group.First())
|
||||
.OrderBy(activity => activity.Timestamp)
|
||||
.ToList();
|
||||
|
||||
SaveState(new FileChurnState
|
||||
{
|
||||
LastSecurityRecordId = securityLogReset ? highestObservedRecordId : Math.Max(stored.LastSecurityRecordId, highestObservedRecordId),
|
||||
Activities = rolling
|
||||
}, errors);
|
||||
return rolling;
|
||||
}
|
||||
|
||||
private static RansomwareFileChurnSummary BuildSummary(List<FileAuditActivity> activities, int windowMinutes, bool isTruncated)
|
||||
{
|
||||
return new RansomwareFileChurnSummary
|
||||
{
|
||||
Enabled = true,
|
||||
DataAvailable = true,
|
||||
IsTruncated = isTruncated,
|
||||
WindowMinutes = windowMinutes,
|
||||
FileOperationCount = activities.Count,
|
||||
DeleteOperationCount = activities.Count(activity => activity.IsDelete),
|
||||
WriteOperationCount = activities.Count(activity => activity.IsWrite),
|
||||
DistinctProcessCount = activities.Select(activity => activity.Process).Distinct(StringComparer.OrdinalIgnoreCase).Count(),
|
||||
TopProcesses = activities.GroupBy(activity => activity.Process, StringComparer.OrdinalIgnoreCase)
|
||||
.Select(group => new RansomwareFileChurnProcess
|
||||
{
|
||||
Process = group.Key,
|
||||
DeleteOperationCount = group.Count(activity => activity.IsDelete),
|
||||
WriteOperationCount = group.Count(activity => activity.IsWrite)
|
||||
})
|
||||
.OrderByDescending(process => process.DeleteOperationCount + process.WriteOperationCount)
|
||||
.ThenBy(process => process.Process, StringComparer.OrdinalIgnoreCase)
|
||||
.Take(5)
|
||||
.ToList()
|
||||
};
|
||||
}
|
||||
|
||||
private static FileChurnState LoadState(List<string> errors)
|
||||
{
|
||||
string path = GetStatePath();
|
||||
if (!File.Exists(path))
|
||||
{
|
||||
return new FileChurnState();
|
||||
}
|
||||
|
||||
try
|
||||
{
|
||||
return JsonSerializer.Deserialize<FileChurnState>(File.ReadAllText(path), JsonOptions.Default) ?? new FileChurnState();
|
||||
}
|
||||
catch (Exception exception)
|
||||
{
|
||||
errors.Add($"Ransomware file churn state could not be read: {exception.Message}");
|
||||
return new FileChurnState();
|
||||
}
|
||||
}
|
||||
|
||||
private static void SaveState(FileChurnState state, List<string> errors)
|
||||
{
|
||||
try
|
||||
{
|
||||
string path = GetStatePath();
|
||||
string directory = Path.GetDirectoryName(path)!;
|
||||
Directory.CreateDirectory(directory);
|
||||
string temporaryPath = path + ".tmp";
|
||||
File.WriteAllText(temporaryPath, JsonSerializer.Serialize(state, JsonOptions.Default));
|
||||
File.Move(temporaryPath, path, overwrite: true);
|
||||
}
|
||||
catch (Exception exception)
|
||||
{
|
||||
errors.Add($"Ransomware file churn state could not be saved: {exception.Message}");
|
||||
}
|
||||
}
|
||||
|
||||
private static string GetStatePath()
|
||||
{
|
||||
return Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.CommonApplicationData), "OCSentinel", "state", StateFileName);
|
||||
}
|
||||
|
||||
private sealed record FileChurnState
|
||||
{
|
||||
public long LastSecurityRecordId { get; init; }
|
||||
|
||||
public List<FileAuditActivity> Activities { get; init; } = [];
|
||||
}
|
||||
|
||||
private sealed record FileAuditActivity
|
||||
{
|
||||
public DateTimeOffset Timestamp { get; init; }
|
||||
|
||||
public long RecordId { get; init; }
|
||||
|
||||
public string Process { get; init; } = string.Empty;
|
||||
|
||||
public bool IsDelete { get; init; }
|
||||
|
||||
public bool IsWrite { get; init; }
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user