오로라 라이트: 탐지 엔지니어링 및 시그마 규칙 살펴보기

### 오로라 살펴보기: 탐지 엔지니어링에 대한 심층 분석
* 🔍 이 비디오에서는 탐지 엔지니어링을 위한 기능과 이를 효과적으로 활용하는 방법에 초점을 맞춰 **Nextron Systems의 Aurora 에이전트**에 대해 간략하게 살펴봅니다.
* 💻 Aurora는 **시그마 규칙을 기반으로 작동하는 엔드포인트 탐지 및 대응(EDR) 플랫폼**으로, 사용자가 시스템에서 악성 활동을 탐지할 수 있도록 합니다.
* 📚 Aurora 에이전트 사용 설명서에는 **대시보드 기능으로 실행하여 대화형 환경**을 제공하는 옵션을 포함하여 **설정 및 설치에 대한 포괄적인 설명서**가 나와 있습니다.
* 📊 시그마 규칙에 액세스하여 사용자는 **PowerShell에서 만든 의심스러운 하위 프로세스를 대상으로 하는 규칙**을 포함하여 다양한 탐지 기능을 탐색할 수 있습니다.
* 🛠 이 동영상에서는 잠재적 위협을 식별하는 데 있어 **실시간 모니터링의 중요성**을 강조하면서 **시그마 규칙을 조작하고 사용자 지정**하여 탐지 노력을 강화하는 방법을 보여줍니다.
* 🎉 또한 이 동영상은 다가오는 SOC 분석가 감사의 날을 강조하며 **사이버 보안 방어에 중요한 역할**을 하는 보안 운영 센터에서 근무하는 사람들을 응원하도록 시청자를 독려합니다.
* 📅 시청자는 사이버 보안 분야에 대한 직업 중심 세션과 인사이트를 제공하는 동시에 **탐지 엔지니어링에 Aurora를 효과적으로 사용하는 방법**을 배우는 감사의 날에 참여할 수 있습니다.
* 🚀 전반적으로 이 동영상은 **Aurora의 기능**을 소개하는 역할을 하며, 향후 **사용자 지정 탐지 규칙을 만들고 사이버 보안 관행을 개선하기 위한 탐색의 발판**을 마련합니다.

Aurora 에이전트는 사이버 보안 애호가를 위한 효과적인 탐지 엔지니어링과 맞춤형 위협 모니터링을 지원합니다.

you're going to get hacked. You know there's a thing that we say in cybersecurity across the industry: it's not a matter of if, it's a matter of when. Because you will be compromised at some point, whether some software that you're running is vulnerable, maybe you fell for a phishing link, or you clicked on something that you shouldn't have. It just happens, and you can't always rely on prevention or preventative measures to stop it. Hey, antivirus, maybe you just turn that on and forget it. Sometimes it misses, so you also need to blend in some detection capabilities in finding and seeing the threats so that you can then respond and do whatever cleanup remediation you have to. So, in this video, I'd love to kind of open the door for us to maybe explore soon enough some detection engineering, and the way that we can do that is super easy. So, here I am on my computer, and I'm going to go over to Firefox, open up the web browser, and I just want to search for the Aurora light. Here we go, there's the

result I'm looking for Aurora agent from Nextron Systems. Now, Aurora is an example of an EDR or an endpoint detection and response platform. Yep, fine, you can take my cookies, I don't care. The thing is, Aurora is based on Sigma rules, and these are these rules that we've talked about before, or at least will be very, very soon, on how you can detect or look for and hunt for malicious activity and bad things happening on your computer. One of the coolest things is that Aurora is completely transparent and fully customizable because you can change and manipulate the Sigma rules under the hood that it might try to detect or flag things off of. Doesn't really use a whole lot of bandwidth or storage across your network, and it's all on-premise. Like, you could literally run this on your virtual machine or on your computer or whatever you want and just kind of play. And to be honest, for our purposes of a YouTube video and maybe a series on education of detection engineering, look, there's a free version with Aurora Light where we

can play with any of these Sigma rules and maybe learn some detection engineering in my mind. That is the best part, and that is why I thought, Hey, that would be perfect for a little bit of a sandbox, a playground environment for us to learn, learn, and get some education in. We can kind of kick the tires, see what Aurora does out of the box, and then maybe try to set up our own Sigma rules, maybe start with a clean slate, and try to craft and create some detection efforts that, Hey, we just build out on our own. And let me say, Aurora is put together by Nextron Systems, and you might be familiar with a lot of their other stuff, like Thor or other maybe open-source and freely accessible tooling, all offered by the great folks over at Nextron Systems. And they're kind of champion Florian Roth. I'm sure you're familiar with a lot of his great work over on the internet for cyber threat intelligence and tracking adversaries. Great stuff there, kudos for credit is due. This is all big thanks to Floran and

nextron systems, but let me showcase Aurora Light, the free Community Edition that you can just go ahead and download, grab off the internet here, click on download Aurora Light. The only thing that you need to enter here for the free edition is just a name and email address that they'll send you the download to, super quick and easy. You'll get an email to confirm, and once you've confirmed, you'll receive another email with the personal license file and the download link for Aurora Light. Here it is, we can click on download your license and download Aurora Light and get these on our computer. I am downloading for Windows here. They include the SHA-1 hash so you can do a little like integrity check, validate the download here, cruise through the end-user license agreement, and with that, we can download. All right, so in my downloads directory, I have this ZIP archive. I can go and extract all here, just leave that in, I don't know, maybe our desktop, that's fine. We'll put it in just an Aurora folder here, and what I'm going to do is just

copy and paste this license file and put it in the same directory. Here we'll open that folder up and I'll just paste it in and I think that should be good. I'll close these windows and I'll open up a terminal here, just the command prompt so that I can move into my desktop. I'll CD into desktop and move into the Aurora directory that we've created. We have all of this stuff here but of course the Aurora agent 64-bit executable that we want to fire off. So let me just do /Aurora agent 64bits. I'll hit enter and okay hey do you want to allow this app to make changes to your device. Sure thing this will protect my computer and hey get a little bit more of that detection and response in action. Let's hit yes and Aurora light is firing up. Takes just a moment to get things loaded. It's going to be cruising through all of those different Sigma rules and now hey Aurora is doing its thing. Look we can keep kicking the tires in just a second but I do want to drive

the point home seriously. You listening in whether your organization, business, company, whatever. I don't know. Look, doing this in one way, in any way, shape, or form, hooking up some events that you might be tracking, some information and telemetry that you could get and pour over into a SIEM or an SEM, the Security Information Event Management thing, getting that SIEM or SIM, whatever, however you want to pronounce it, getting that actually put together and building out this detection capabilities. You could probably, like, pretty likely, practically prevent, like, almost 60 to 70, maybe even higher, of the incidents and breaches that still happen in today's world. It's all a matter of getting folks actually taking a look at the event, you know, like a SOC or a Security Operation Center, and SOC analysts, great folks that are always cruising through that. Hey, they need a little bit of love, and seriously, they do great work. If you don't mind, I'd love to tell you about something that our great friends over at DVO are doing to celebrate and appreciate those security.

operations center analysts and hey all of us in the industry doing great work to better cyber security sock analyst Appreciation Day Security operation Center analysts are always in the trenches they fight on the front lines for cyber security defense and oftentimes it's a thankless job they are the unsung heroes of our industry so to help celebrate these Champions dvo is hosting the third annual sock analyst Appreciation Day a completely free event on October 18th dvo established the sock analyst appreciation day to give some long overdue kudos to Sock analysts and encourage organizations to improve job satisfaction and mental well-being packed full with career-focused sessions like finding your role in Niche digging into automation transitioning from public sector to private sector cyber security work and so much more I'll be speaking on the rapid response efforts during the 3cx supply chain compromise and I'd love to see you there if you're a current Security operation Center analyst or you're fascinated by the work and you want to become one you should

Absolutely tune into the sock analyst appreciation day. It's completely free and a day dedicated to celebrate you and your great efforts. Sign up for the sock analyst Appreciation Day on October 18th with my link below in the video description jh. slock. Huge thanks to dvo for sponsoring this video. Okay, so Aurora light is up and running on our computer. And look, let's just kind of play pretend. Let's say that I am an adversary, I'm a threat actor, I'm a hacker. I've compromised this computer, and maybe I can just do anything I want now. I've got control over it with like a reverse shell or commanding control, some implant or Beacon. And say that I was running from the command line, just the usual immediate quick and easy enumeration. Hey, what user am I? Who did I land as with the shell that I want to be interacting with? Who am I? Let me run this, and you'll note, ooh, okay, uh, couple of entries already firing off from Aurora. Now, this is small, simple, hey, just in the

text here, but wouldn't it be nice if we got a little bit better notification for that or we could dig into it? Yeah, yes, exactly. So look, honestly, I'm going to hit control C, and I'm going to close Aurora, and I'm going to try and run that again, but I want to use some other little command line arguments or other things that we could do here. I think Tac H will show me the help. No, maybe we could just go ahead and check out the documentation online. Here it is. This is the Aurora agent user manual, and you could kind of dig into all the stuff here to get it spun up, get it installed, just as we did. But the Aurora agent dashboard, that seems kind of neat. I do want to be able to dig into that so we have more of an interface, and we can see stuff happening rather than just in that simple command line. Aurora can be started or installed with a dashboard feature using the dash dash dashboard flag. Saying Dash three times was kind of weird. Dashboard can be accessed with

whatever web browser going to port 17494, and with that, we could change or manipulate some of the notifications or any of the other settings that we might like. So, let's try that. Let's try to run our Aurora agent 64-bit with TCT Tac dashboard. And the moment I fire that up, we should be able to see, Hey, Aurora's fired up, and Ooh, we get a little notification, the Windows balloons or the toast that it shows, 'Hey, Nextron Notifier is started.' And now we could go navigate in our web browser to the dashboard that was on what? Local Host? Yeah, 17494. Now, this is Aurora running in the current context, like the current session of this invoked rendition and runtime of Aurora, right? So, we don't see the Hami command that we had just a moment ago, but here we could see all of the flagged rules or the detection of events that we saw. And we could, I don't know, dig into the settings, the status, if you wanted to change any of these configuration values.

for the notifications, you totally could, of course, find the documentation and hey, maybe grab the full version if you would like to. But look, let's say I'm more of a sophisticated hacker now and look, I'm going to use some of those living off the land techniques or lull bins, living off the land binaries or L Bass with scripts and other libraries. And let's try to use something a little bit more shady or nefarious other than then who am I, right? We could do, I don't know, something simple again as a proof of concept, like just fire up in the calculator or the command prompt or some process that may might want to start. But at least we can Maser it or hide it, let it blend in a little bit by trying to use some other utility to proxy it. I'll use script Runner because this is super quick and easy, and we just go ahead and execute whatever we want underneath script Runner. This should be able to get maybe some notifications here for us because we can go see what

rule or even what Sigma rule is actually going to see this. Let's minimize this, get back to a command prompt, and let me just, I don't know, we could paste this in where we run calc.exe. Does this fire for one thing? Yes, it does. And take a look, potentially suspicious Powershell child. Ooh, because we got to run script runner. Exe out of Powershell. Let's close out the calculator and let's go view that event over in our dashboard. Let me toggle back over here to the dashboard and take a look. Sigma did find this event fire. We drill down into this. There is a potentially suspicious Powershell child process. 'Cause we hey fired up something weird. Now the cool thing is it gives us all of the resources that tell us what fired here and how we could go dig into this Sigma Rule and like where it actually exists inside of our installation of Aurora. Let me copy this path and let's get back to our file explorer because in the desktop on that Aurora directory that we created, we could actually go into maybe taking a

look at some of the signatures here. Here we can go into the sigma rules, and then in this public directory, we know we'll start to fall down the sort of path in the file system that tells us which of these actually are in action. Let me go toggle the location here. I'll just paste in that path for our public so we can drill down into the specific one under Windows process creation, proc creation, wind Powershell suspicious child process. Let's remove that file name here, but let's just go see all of the potential Sigma rules that could be ran here. Take a look at all these kind of tagged with lull bins, with those living off those land techniques, and this is just like the open-source data set. Now let's try and filter that down to just the rule that fired our process creation, wind Powershell suspicious child process. Can I go ahead and open that? Let's use Sublime Text just to see that in a text editor with the yaml syntax highlighting, and take a look. This is the sigma rule that fired potentially suspicious child.

process yep hey we've got a little uh note here for the description, maybe an ID, experimental status, and maybe a reference as to where this was flagged, and some miter attack techniques if you're tracking a lot of the miter attack uh kind of vernacular and terminology here. So, this is the detection logic. We're going to try to select and build the criteria out for the image, the parent image, right, the process ID, or the process that ran, whether it's powershell.exe, maybe isse for that integrated scripting environment, and whatever process the image flag, the field set for the process name, and the command line actually ends with, whether it's BH bits admin, CT util, or any of these. You can see our script Runner executable is in that list. And of course, the condition here, hey, we do want to check in any of the selection criteria, and maybe some other optional filters that we're going to be tracking. The question is though, this LOL basing, did we actually see this in action? The one that Lins recommended, they suggested.

with here is this actually present in our set. I think it is. Let me go ahead and search for this. Let me paste that into the search bar here. But it doesn't exist. What about I don't know higher than this. Oh shim database is firing off something weird is going on. By the way, not to completely derail, but I think that's one of the coolest things. You also get a little bit of visibility to when you're just like using your computer. You can see some of the stuff that just naturally happens on Windows. And then you get a little bit more of the security research. I don't know, maybe intuition in there and explore different things that just happen. Let me go up to a higher directory. If I just search for this yaml file. No, even in like I. Let's go to the very, very top of Aurora. That doesn't exist. So could we just create this? Like we could copy and paste this and go put this into Aurora's rule set. But look, let's dig into some of this logic here because the selection component is

actually checking if the parent process is serve you. Maybe that's a little bit more specific to some specific threat, like hey, threat actors targeting solar wind software with some exploit chain. Maybe that's not what we just got to fire off, but it does look like the actual process could end with script Runner, so maybe that isn't exactly what we want here. But we could tweak this, like we could manipulate this, we could write our own, and maybe even build out as many as we want of these like living off-the-land binaries and small Sigma rules to be able to detect them. And if we actually dig more into the documentation of Aurora, then look, maybe we could manipulate or change what rules are actually at it or what configuration is set, or maybe running Aurora as a service so it's in the background and you don't have that foreground little command prompt there. But if we did want to start to write our own rules for Sigma, we could dig into the Sigma repository again, totally free, available online on the open internet, on GitHub, and we could

Hey, go figure out that syntax, maybe kind of baseline off of the other rules that exist, and see how we could get started writing our own rules. Now, we could just do small, simple stuff like this is just kind of our own educational exploratory sandbox and playground. But if we were to try to, hey, play with these rules, could we actually detect our invocation of Script Runner? If we drill down into the Sigma specification, we might be able to go see, hey, what do we need to actually refer to the arguments that are included in the command line? But I think that is a fine enough cliffhanger because at least now we've kicked the tires on Aurora, got it set up, and now we can start to write our own Sigma rules. But now we've got a real-time environment in a virtual machine that we can just test rapidly in the moment, see, hey, will our activity, will this behavior, will this threat, like a real actor, threat actor, hacker, and adversary, could that be something that we could see in the environment? I'm really excited about.

different videos maybe along that idea like hey we could roll through L bins, craft our own canvas of detection engineering rules and rule sets, or maybe I don't know, start to look through the DF report, the defer report. Maybe we could look through new write-ups or threat intel and analysis shared by tons of vendors out there. Like we could have a whole lot of fun, and I hope you are enjoying that sort of material and content. A little bit of blue team, a little bit of defense, a little bit of detection engineering. And with that, hey, kudos for credit is due, Nextron Systems in Aurora and Florian in the mix here. And also please, if you'd like to support and maybe give some love and support to those SOC analyst Security Operation Center folks that do this work day in and day out, tracking these alerts and notifications, seeing what detection rules fire. Please go take a look at D's SOC Analyst Appreciation Day link in the video description, and I'm excited to go give a little bit of a presentation there. I hope that'll be fun, so hope you

enjoyed this video. Little quick dip in our toes in the water for detection inuring, and we'll do more soon. Thanks for watching. See you in the next video.

Detect Hackers & Malware on your Computer (literally for free)

Free Cybersecurity Education and Ethical Hacking.

John Hammond

Aurora의 라이선스 파일은 실행 파일과 동일한 디렉터리에 복사해야 합니다.

그런 다음 명령 프롬프트에서 Aurora 에이전트를 실행하면 시그마 규칙을 로드하고 위협을 탐지하는 프로세스가 시작됩니다.

이 동영상에서는 사이버 보안에서 예방 및 탐지 기능을 혼합하는 것의 중요성에 대해 설명하고 탐지 엔지니어링을 살펴보는 방법을 소개합니다.

오로라 에이전트 및 SOC 분석가 감사의 날

Aurora 에이전트는 포트 17494에서 실행 중이며 웹 브라우저를 통해 알림 및 설정을 조작할 수 있습니다.

대시보드에는 플래그가 지정된 규칙과 이벤트 탐지가 표시되어 보안 이벤트 추적 및 관리의 중요성을 강조하여 사고와 침해를 예방할 수 있습니다.

DVO는 10월 18일에 제3회 연례 SOC 분석가 감사의 날을 개최하여 보안 운영 센터 분석가를 축하하고 지원하기 위해 경력에 초점을 맞춘 세션을 무료로 제공합니다.

이 데모는 Aurora 설치에서 시그마 규칙에 의해 플래그가 지정된 잠재적으로 의심스러운 PowerShell 하위 프로세스를 실행하는 것을 포함합니다.

발표자는 탐지 엔지니어링 리소스를 위한 Aurora 디렉터리를 살펴보고 SOC 분석가 지원의 중요성을 강조합니다.

의심스러운 활동을 식별하기 위해 이미지, 상위 이미지, 프로세스 ID, 명령줄과 같은 기준에 초점을 맞춘 탐지 로직이 설명됩니다.

오로라 라이트 살펴보기: 무료 커뮤니티 에디션

오로라 라이트는 이름과 이메일 주소만 입력하면 무료로 다운로드할 수 있는 커뮤니티 에디션을 제공합니다.

이 소프트웨어는 시스템 활동 및 보안 조사에 대한 가시성을 제공하므로 사용자에게 유용한 도구입니다.

다운로드에는 무결성 검증을 위한 SHA-1 해시가 포함되어 있으며, 확인 시 개인 라이선스 파일을 제공합니다.

Aurora 살펴보기: 시그마 룰 탐지를 위한 EDR 플랫폼 살펴보기

Nextron Systems의 Aurora는 악성 활동을 탐지하기 위한 시그마 규칙을 기반으로 하는 엔드포인트 탐지 및 대응 플랫폼입니다.

이 플랫폼은 투명하고 사용자 정의가 가능하며 가상 머신이나 컴퓨터에서 실행할 수 있어 탐지 엔지니어링 학습을 위한 훌륭한 샌드박스입니다.

Aurora는 무료 버전인 Aurora Light를 제공하여 사용자가 시그마 규칙을 사용해보고 자체적인 탐지 활동을 구축할 수 있도록 지원합니다.

탐지용 오로라 에이전트 살펴보기

이 동영상은 Aurora 에이전트를 사용하여 탐지하는 방법에 대한 간략한 개요를 제공하며, 더 나은 알림과 사용자 친화적인 인터페이스의 중요성을 강조합니다.

Aurora 에이전트는 대시보드 기능으로 시작하여 쉽게 탐색할 수 있습니다.

또한 이 비디오에서는 시그마 규칙과 실사용 기법을 살펴보고 잠재적으로 의심스러운 프로세스에 사용하는 방법을 보여줍니다.