297 lines
12 KiB
C#
297 lines
12 KiB
C#
using System.Diagnostics.Eventing.Reader;
|
|
using System.Globalization;
|
|
using System.Runtime.Versioning;
|
|
using System.Text.Json;
|
|
using System.Xml.Linq;
|
|
|
|
namespace OCSentinelCli;
|
|
|
|
[SupportedOSPlatform("windows")]
|
|
internal static class RansomwareFileChurnDetector
|
|
{
|
|
private const uint DeleteAccessMask = 0x00010000;
|
|
private const uint FileWriteAccessMask = 0x00000156;
|
|
private const string StateFileName = "ransomware-file-churn.json";
|
|
|
|
public static RansomwareFileChurnSummary Scan(ScannerConfiguration configuration, List<string> errors)
|
|
{
|
|
if (!configuration.RansomwareFileChurnEnabled)
|
|
{
|
|
return new RansomwareFileChurnSummary();
|
|
}
|
|
|
|
int windowMinutes = Math.Clamp(configuration.RansomwareFileChurnWindowMinutes, 1, 60);
|
|
int maximumAuditEvents = Math.Clamp(configuration.RansomwareFileChurnMaxAuditEvents, 100, 20000);
|
|
DateTimeOffset windowStart = DateTimeOffset.UtcNow.AddMinutes(-windowMinutes);
|
|
var observed = new List<FileAuditActivity>();
|
|
bool isTruncated = false;
|
|
|
|
try
|
|
{
|
|
long milliseconds = Math.Max(1, (long)(DateTimeOffset.UtcNow - windowStart).TotalMilliseconds);
|
|
string query = $"*[System[(EventID=4663) and TimeCreated[timediff(@SystemTime) <= {milliseconds}]]]";
|
|
using var reader = new EventLogReader(new EventLogQuery("Security", PathType.LogName, query));
|
|
int inspected = 0;
|
|
for (EventRecord? record = reader.ReadEvent(); record is not null; record = reader.ReadEvent())
|
|
{
|
|
using (record)
|
|
{
|
|
if (++inspected > maximumAuditEvents)
|
|
{
|
|
isTruncated = true;
|
|
break;
|
|
}
|
|
|
|
if (TryCreateActivity(record, configuration, out FileAuditActivity? activity) && activity is not null)
|
|
{
|
|
observed.Add(activity);
|
|
}
|
|
}
|
|
}
|
|
}
|
|
catch (UnauthorizedAccessException exception)
|
|
{
|
|
errors.Add($"Ransomware file churn cannot read the Security log: {exception.Message}");
|
|
return Unavailable(windowMinutes);
|
|
}
|
|
catch (EventLogNotFoundException)
|
|
{
|
|
return Unavailable(windowMinutes);
|
|
}
|
|
catch (Exception exception)
|
|
{
|
|
errors.Add($"Ransomware file churn query failed: {exception.Message}");
|
|
return Unavailable(windowMinutes);
|
|
}
|
|
|
|
if (isTruncated)
|
|
{
|
|
return BuildSummary(observed, windowMinutes, isTruncated: true);
|
|
}
|
|
|
|
List<FileAuditActivity> rollingActivities = MergeWithState(observed, windowStart, errors);
|
|
return BuildSummary(rollingActivities, windowMinutes, isTruncated: false);
|
|
}
|
|
|
|
public static RansomwareSignal? CreateSignal(RansomwareFileChurnSummary summary, ScannerConfiguration configuration)
|
|
{
|
|
if (!summary.Enabled || !summary.DataAvailable || summary.IsTruncated)
|
|
{
|
|
return null;
|
|
}
|
|
|
|
int warningDeletes = Math.Max(1, configuration.RansomwareFileChurnWarningDeleteCount);
|
|
int warningWrites = Math.Max(1, configuration.RansomwareFileChurnWarningWriteCount);
|
|
int criticalDeletes = Math.Max(warningDeletes, configuration.RansomwareFileChurnCriticalDeleteCount);
|
|
int criticalWrites = Math.Max(warningWrites, configuration.RansomwareFileChurnCriticalWriteCount);
|
|
bool critical = summary.DeleteOperationCount >= criticalDeletes && summary.WriteOperationCount >= criticalWrites;
|
|
bool warning = summary.DeleteOperationCount >= warningDeletes && summary.WriteOperationCount >= warningWrites;
|
|
if (!warning)
|
|
{
|
|
return null;
|
|
}
|
|
|
|
RansomwareFileChurnProcess? topProcess = summary.TopProcesses.FirstOrDefault();
|
|
string evidence = $"delete={summary.DeleteOperationCount}; write={summary.WriteOperationCount}; processes={summary.DistinctProcessCount}; window={summary.WindowMinutes}m";
|
|
return new RansomwareSignal
|
|
{
|
|
Timestamp = DateTimeOffset.Now,
|
|
Category = critical ? "file-churn-critical" : "file-churn",
|
|
Confidence = critical ? "medium" : "low",
|
|
Process = topProcess?.Process ?? "[multiple]",
|
|
Source = "Security file audit",
|
|
EventId = 4663,
|
|
Evidence = evidence
|
|
};
|
|
}
|
|
|
|
private static RansomwareFileChurnSummary Unavailable(int windowMinutes)
|
|
{
|
|
return new RansomwareFileChurnSummary
|
|
{
|
|
Enabled = true,
|
|
WindowMinutes = windowMinutes
|
|
};
|
|
}
|
|
|
|
private static bool TryCreateActivity(EventRecord record, ScannerConfiguration configuration, out FileAuditActivity? activity)
|
|
{
|
|
activity = null;
|
|
if (!record.TimeCreated.HasValue)
|
|
{
|
|
return false;
|
|
}
|
|
|
|
IReadOnlyDictionary<string, string> data = ReadEventData(record);
|
|
if (!data.TryGetValue("ObjectType", out string? objectType) || !string.Equals(objectType, "File", StringComparison.OrdinalIgnoreCase))
|
|
{
|
|
return false;
|
|
}
|
|
|
|
if (!data.TryGetValue("AccessMask", out string? accessMaskText) || !TryParseAccessMask(accessMaskText, out uint accessMask))
|
|
{
|
|
return false;
|
|
}
|
|
|
|
bool isDelete = (accessMask & DeleteAccessMask) != 0;
|
|
bool isWrite = (accessMask & FileWriteAccessMask) != 0;
|
|
if (!isDelete && !isWrite)
|
|
{
|
|
return false;
|
|
}
|
|
|
|
string process = data.TryGetValue("ProcessName", out string? processPath) ? Path.GetFileName(processPath.Trim()) : string.Empty;
|
|
if (string.IsNullOrWhiteSpace(process))
|
|
{
|
|
process = "[unknown]";
|
|
}
|
|
|
|
if (configuration.RansomwareExcludedProcesses.Any(item => string.Equals(item, process, StringComparison.OrdinalIgnoreCase)))
|
|
{
|
|
return false;
|
|
}
|
|
|
|
activity = new FileAuditActivity
|
|
{
|
|
Timestamp = new DateTimeOffset(record.TimeCreated.Value).ToUniversalTime(),
|
|
RecordId = record.RecordId ?? 0,
|
|
Process = process,
|
|
IsDelete = isDelete,
|
|
IsWrite = isWrite
|
|
};
|
|
return true;
|
|
}
|
|
|
|
private static IReadOnlyDictionary<string, string> ReadEventData(EventRecord record)
|
|
{
|
|
XDocument document = XDocument.Parse(record.ToXml());
|
|
return document.Descendants().Where(element => element.Name.LocalName == "Data")
|
|
.Where(element => element.Attribute("Name") is not null)
|
|
.ToDictionary(element => element.Attribute("Name")!.Value, element => element.Value.Trim(), StringComparer.OrdinalIgnoreCase);
|
|
}
|
|
|
|
private static bool TryParseAccessMask(string value, out uint result)
|
|
{
|
|
string normalized = value.Trim();
|
|
NumberStyles style = NumberStyles.Integer;
|
|
if (normalized.StartsWith("0x", StringComparison.OrdinalIgnoreCase))
|
|
{
|
|
normalized = normalized[2..];
|
|
style = NumberStyles.AllowHexSpecifier;
|
|
}
|
|
|
|
return uint.TryParse(normalized, style, CultureInfo.InvariantCulture, out result);
|
|
}
|
|
|
|
private static List<FileAuditActivity> MergeWithState(List<FileAuditActivity> observed, DateTimeOffset windowStart, List<string> errors)
|
|
{
|
|
FileChurnState stored = LoadState(errors);
|
|
long highestObservedRecordId = observed.Count == 0 ? 0 : observed.Max(activity => activity.RecordId);
|
|
bool securityLogReset = stored.LastSecurityRecordId > 0 && highestObservedRecordId > 0 && highestObservedRecordId < stored.LastSecurityRecordId;
|
|
IEnumerable<FileAuditActivity> fresh = securityLogReset
|
|
? observed
|
|
: observed.Where(activity => activity.RecordId == 0 || activity.RecordId > stored.LastSecurityRecordId);
|
|
List<FileAuditActivity> rolling = (securityLogReset ? [] : stored.Activities)
|
|
.Concat(fresh)
|
|
.Where(activity => activity.Timestamp >= windowStart)
|
|
.GroupBy(activity => activity.RecordId > 0 ? activity.RecordId.ToString(CultureInfo.InvariantCulture) : $"{activity.Timestamp:O}|{activity.Process}|{activity.IsDelete}|{activity.IsWrite}")
|
|
.Select(group => group.First())
|
|
.OrderBy(activity => activity.Timestamp)
|
|
.ToList();
|
|
|
|
SaveState(new FileChurnState
|
|
{
|
|
LastSecurityRecordId = securityLogReset ? highestObservedRecordId : Math.Max(stored.LastSecurityRecordId, highestObservedRecordId),
|
|
Activities = rolling
|
|
}, errors);
|
|
return rolling;
|
|
}
|
|
|
|
private static RansomwareFileChurnSummary BuildSummary(List<FileAuditActivity> activities, int windowMinutes, bool isTruncated)
|
|
{
|
|
return new RansomwareFileChurnSummary
|
|
{
|
|
Enabled = true,
|
|
DataAvailable = true,
|
|
IsTruncated = isTruncated,
|
|
WindowMinutes = windowMinutes,
|
|
FileOperationCount = activities.Count,
|
|
DeleteOperationCount = activities.Count(activity => activity.IsDelete),
|
|
WriteOperationCount = activities.Count(activity => activity.IsWrite),
|
|
DistinctProcessCount = activities.Select(activity => activity.Process).Distinct(StringComparer.OrdinalIgnoreCase).Count(),
|
|
TopProcesses = activities.GroupBy(activity => activity.Process, StringComparer.OrdinalIgnoreCase)
|
|
.Select(group => new RansomwareFileChurnProcess
|
|
{
|
|
Process = group.Key,
|
|
DeleteOperationCount = group.Count(activity => activity.IsDelete),
|
|
WriteOperationCount = group.Count(activity => activity.IsWrite)
|
|
})
|
|
.OrderByDescending(process => process.DeleteOperationCount + process.WriteOperationCount)
|
|
.ThenBy(process => process.Process, StringComparer.OrdinalIgnoreCase)
|
|
.Take(5)
|
|
.ToList()
|
|
};
|
|
}
|
|
|
|
private static FileChurnState LoadState(List<string> errors)
|
|
{
|
|
string path = GetStatePath();
|
|
if (!File.Exists(path))
|
|
{
|
|
return new FileChurnState();
|
|
}
|
|
|
|
try
|
|
{
|
|
return JsonSerializer.Deserialize<FileChurnState>(File.ReadAllText(path), JsonOptions.Default) ?? new FileChurnState();
|
|
}
|
|
catch (Exception exception)
|
|
{
|
|
errors.Add($"Ransomware file churn state could not be read: {exception.Message}");
|
|
return new FileChurnState();
|
|
}
|
|
}
|
|
|
|
private static void SaveState(FileChurnState state, List<string> errors)
|
|
{
|
|
try
|
|
{
|
|
string path = GetStatePath();
|
|
string directory = Path.GetDirectoryName(path)!;
|
|
Directory.CreateDirectory(directory);
|
|
string temporaryPath = path + ".tmp";
|
|
File.WriteAllText(temporaryPath, JsonSerializer.Serialize(state, JsonOptions.Default));
|
|
File.Move(temporaryPath, path, overwrite: true);
|
|
}
|
|
catch (Exception exception)
|
|
{
|
|
errors.Add($"Ransomware file churn state could not be saved: {exception.Message}");
|
|
}
|
|
}
|
|
|
|
private static string GetStatePath()
|
|
{
|
|
return Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.CommonApplicationData), "OCSentinel", "state", StateFileName);
|
|
}
|
|
|
|
private sealed record FileChurnState
|
|
{
|
|
public long LastSecurityRecordId { get; init; }
|
|
|
|
public List<FileAuditActivity> Activities { get; init; } = [];
|
|
}
|
|
|
|
private sealed record FileAuditActivity
|
|
{
|
|
public DateTimeOffset Timestamp { get; init; }
|
|
|
|
public long RecordId { get; init; }
|
|
|
|
public string Process { get; init; } = string.Empty;
|
|
|
|
public bool IsDelete { get; init; }
|
|
|
|
public bool IsWrite { get; init; }
|
|
}
|
|
}
|