Sysmon配置文件 - 检测勒索行为关键规则

# 安装: sysmon64.exe -accepteula -i sysmon_config.xml

# 兼容: Sysmon v13+(Windows 7 SP1+/Server 2008 R2+)

# 检测T1490: VSS删除(阻止系统恢复)

# 检测T1486: 批量文件加密

<Sysmon schemaversion="4.82">

  <EventFiltering>

  <RuleGroup name="Ransomware Detection" groupRelation="or">

  <!-- T1490: VSS删除 - vssadmin -->

  <Rule name="VSS_Delete_vssadmin" relation="or">

    <ProcessCreate onmatch="include">

      <CommandLine condition="contains">vssadmin delete shadows</CommandLine>

      <CommandLine condition="contains">vssadmin resize shadowstorage</CommandLine>

    </ProcessCreate>

  </Rule>

  <!-- T1490: VSS删除 - wmic -->

  <Rule name="VSS_Delete_wmic" relation="or">

    <ProcessCreate onmatch="include">

      <CommandLine condition="contains">wmic shadowcopy delete</CommandLine>

    </ProcessCreate>

  </Rule>

  <!-- T1490: 备份删除 - wbadmin -->

  <Rule name="Backup_Delete_wbadmin" relation="or">

    <ProcessCreate onmatch="include">

      <CommandLine condition="contains">wbadmin delete catalog</CommandLine>

      <CommandLine condition="contains">wbadmin delete systemstatebackup</CommandLine>

    </ProcessCreate>

  </Rule>

  <!-- T1490: 恢复禁用 - bcdedit -->

  <Rule name="Recovery_Disable_bcdedit" relation="or">

    <ProcessCreate onmatch="include">

      <CommandLine condition="contains">recoveryenabled no</CommandLine>

      <CommandLine condition="contains">bootstatuspolicy ignoreallfailures</CommandLine>

    </ProcessCreate>

  </Rule>

  <!-- T1486: 批量文件加密检测 -->

  <FileCreate onmatch="include">

    <TargetFilename condition="contains any">.locked;.lockbit;.akira;.play;.clop;.encrypted;.enc</TargetFilename>

  </FileCreate>

  <!-- 监控Office进程派生PowerShell/CMSTP -->

  <ProcessCreate onmatch="include">

    <ParentImage condition="is">WINWORD.EXE</ParentImage>

    <ParentImage condition="is">EXCEL.EXE</ParentImage>

    <ParentImage condition="is">POWERPNT.EXE</ParentImage>

    <Image condition="end with">powershell.exe</Image>

    <Image condition="end with">cmd.exe</Image>

    <Image condition="end with">wscript.exe</Image>

  </ProcessCreate>

  </RuleGroup>

  </EventFiltering>

</Sysmon>

文件熵值检测 - 识别已加密文件

# 加密文件熵值接近8.0(随机数据)，正常文件通常<6.0

# 用法: .\Detect-EncryptedFiles.ps1 -Path "C:\Shares" -Threshold 7.5

# 兼容: PowerShell 3.0+(Windows 8/Server 2012+)

# 依赖: .NET Framework 4.0+

param(

    [Parameter(Mandatory=$true)]

    [string]$Path,

    [float]$Threshold = 7.5,

    [int]$SampleSize = 4096

)

function Get-FileEntropy {

    param([string]$FilePath, [int]$SampleSize)

    try {

        $bytes = [System.IO.File]::ReadAllBytes($FilePath)

        if ($bytes.Length -eq 0) { return 0 }

        $sampleBytes = if ($bytes.Length -gt $SampleSize) {

            $bytes[0..($SampleSize - 1)]

        } else { $bytes }

        $freq = @{}

        foreach ($b in $sampleBytes) {

            if ($freq.ContainsKey($b)) { $freq[$b]++ }

            else { $freq[$b] = 1 }

        }

        $entropy = 0.0

        $len = $sampleBytes.Length

        foreach ($count in $freq.Values) {

            $p = $count / $len

            $entropy -= $p * [Math]::Log($p, 2)

        }

        return [Math]::Round($entropy, 4)

    } catch { return -1 }

}

Write-Host "[*] 扫描路径: $Path | 熵值阈值: $Threshold" -ForegroundColor Cyan

Write-Host "[*] 开始时间: $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')"

$suspiciousFiles = @()

$totalFiles = 0

Get-ChildItem -Path $Path -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {

    $totalFiles++

    $entropy = Get-FileEntropy -FilePath $_.FullName -SampleSize $SampleSize

    if ($entropy -ge $Threshold) {

        $suspiciousFiles += [PSCustomObject]@{

            FilePath = $_.FullName

            Entropy  = $entropy

            Size     = $_.Length

            Modified = $_.LastWriteTime

        }

        Write-Host "[!] 可疑文件(熵值=$entropy): $($_.FullName)" -ForegroundColor Red

    }

    if ($totalFiles % 500 -eq 0) {

        Write-Host "[*] 已扫描 $totalFiles 个文件..." -ForegroundColor Gray

    }

}

Write-Host "`n=== 扫描结果 ===" -ForegroundColor Cyan

Write-Host "总文件数: $totalFiles"

Write-Host "可疑文件数: $($suspiciousFiles.Count)"

if ($suspiciousFiles.Count -gt 0) {

    $exportPath = "C:\IR\encrypted_files_$(Get-Date -Format yyyyMMdd_HHmmss).csv"

    $suspiciousFiles | Export-Csv -Path $exportPath -NoTypeInformation

    Write-Host "[+] 可疑文件清单已导出: $exportPath" -ForegroundColor Green

    Write-Host "[!] 建议立即隔离受影响主机并上报安全团队" -ForegroundColor Red

}

受害主机应急隔离 - 断网+阻断C2+保留证据

# 需要本地管理员权限

# 兼容: PowerShell 4.0+(Windows 8.1/Server 2012 R2+)

# Win7替代: Get-WmiObject Win32_NetworkAdapter | ? {$_.NetEnabled} | % {$_.Disable()}

# 关键原则：先断网再处置，保留内存证据

$Hostname = $env:COMPUTERNAME

$Time = Get-Date -Format "yyyy-MM-dd HH:mm:ss"

Write-Host "[*] 勒索应急隔离启动: $Hostname ($Time)" -ForegroundColor Red

# 1. 紧急断网(禁用所有活跃网卡)

Write-Host "[+] 步骤1: 紧急断网..." -ForegroundColor Yellow

Get-NetAdapter | Where-Object Status -eq "Up" | ForEach-Object {

    Write-Host "  禁用网卡: $($_.Name) ($($_.InterfaceDescription))"

    $_ | Disable-NetAdapter -Confirm:$false

}

Write-Host "[+] 网卡已全部禁用，主机已物理隔离" -ForegroundColor Green

# 2. 保留内存证据(导出内存镜像供后续分析)

Write-Host "[+] 步骤2: 保留内存证据..." -ForegroundColor Yellow

$DumpPath = "C:\IR\memory.dmp"

# 使用WinDbg或ComSweep导出内存(需提前部署工具)

# 若无工具则跳过，优先保证断网速度

if (Test-Path "C:\IR\Tools\winpmem_mini_x64.exe") {

    & "C:\IR\Tools\winpmem_mini_x64.exe" $DumpPath

    Write-Host "  内存镜像已保存: $DumpPath"

} else {

    Write-Host "  [!] 内存取证工具未部署，跳过(建议预装WinPmem)" -ForegroundColor DarkYellow

}

# 3. 阻断已知C2域名(防火墙规则兜底)

Write-Host "[+] 步骤3: 阻断C2通信..." -ForegroundColor Yellow

$C2List = @(

    "c2-evil.example.com",

    "exfil-cdn.example.net"

)

foreach ($c2 in $C2List) {

    New-NetFirewallRule -DisplayName "Block-C2-$c2" `

        -Direction Outbound -Action Block `

        -RemoteAddress $c2 -Profile Any -ErrorAction SilentlyContinue

    Write-Host "  已阻断: $c2"

}

# 4. 终止可疑加密进程

Write-Host "[+] 步骤4: 终止可疑进程..." -ForegroundColor Yellow

$Suspicious = @("locker.exe","encryptor.exe","vssadmin.exe","wmic.exe")

Get-Process | Where-Object {

    $Suspicious -contains $_.ProcessName

} | ForEach-Object {

    Write-Host "  终止进程: $($_.ProcessName) (PID:$($_.Id))"

    $_ | Stop-Process -Force -ErrorAction SilentlyContinue

}

# 5. 禁用VSS删除权限(防止后续VSS被删)

Write-Host "[+] 步骤5: 保护VSS卷影副本..." -ForegroundColor Yellow

# 修改vssadmin权限为只读

$vssPath = (Get-Command vssadmin.exe -ErrorAction SilentlyContinue).Source

if ($vssPath) {

    $acl = Get-Acl $vssPath

    $rule = New-Object System.Security.AccessControl.FileSystemAccessRule(

        "Everyone","ExecuteFile","Deny"

    )

    $acl.AddAccessRule($rule)

    Set-Acl $vssPath $acl

    Write-Host "  vssadmin.exe执行权限已限制"

}

# 6. 记录隔离日志

$Log = "$Time ISOLATED $Hostname by IR-Team"

$Log | Out-File -Append "C:\IR\isolation.log"

Write-Host "`n[+] 应急隔离完成: $Time" -ForegroundColor Green

Write-Host "[+] 下一步: 上传勒索信和加密文件样本到ID Ransomware进行家族识别" -ForegroundColor Cyan

VSS卷影副本恢复 - 从卷影副本恢复已加密文件

# 前提: VSS未被删除或部分保留

# 兼容: PowerShell 3.0+(Windows 8/Server 2012+)

# 用法: .\Restore-FromVSS.ps1 -Volume "C:" -Dest "D:\Recovery"

param(

    [Parameter(Mandatory=$true)]

    [string]$Volume,

    [Parameter(Mandatory=$true)]

    [string]$Dest

)

Write-Host "[*] VSS卷影副本恢复工具" -ForegroundColor Cyan

Write-Host "[*] 源卷: $Volume | 恢复目录: $Dest"

# 1. 检查可用卷影副本

Write-Host "`n[+] 步骤1: 检查可用卷影副本..." -ForegroundColor Yellow

$shadows = vssadmin list shadows /for=$Volume 2>$null |

    Select-String "Shadow Copy Volume"

if (-not $shadows) {

    Write-Host "[!] 未找到卷影副本(VSS可能已被勒索软件删除)" -ForegroundColor Red

    Write-Host "[!] 建议: 1)检查离线备份 2)使用NoMoreRansom查找解密工具" -ForegroundColor DarkYellow

    exit 1

}

Write-Host "  发现 $($shadows.Count) 个卷影副本:"

$shadowPaths = @()

foreach ($s in $shadows) {

    $path = ($s -replace ".*Shadow Copy Volume: ","").Trim()

    $shadowPaths += $path

    Write-Host "  - $path"

}

# 2. 创建恢复目录

if (-not (Test-Path $Dest)) {

    New-Item -ItemType Directory -Path $Dest -Force | Out-Null

}

# 3. 创建符号链接访问卷影副本

$latestShadow = $shadowPaths[-1]

$linkPath = "C:\ShadowLink"

Write-Host "`n[+] 步骤2: 挂载最新卷影副本..." -ForegroundColor Yellow

cmd /c mklink /d $linkPath "\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy$($latestShadow -replace '.*ShadowCopy','')" 2>$null

# 4. 恢复文件

Write-Host "`n[+] 步骤3: 恢复文件到 $Dest..." -ForegroundColor Yellow

$restoredCount = 0

Get-ChildItem -Path $linkPath -Recurse -File -ErrorAction SilentlyContinue |

    Where-Object { $_.Extension -notin '.lockbit','.akira','.play','.enc','.encrypted' } |

    ForEach-Object {

        $relPath = $_.FullName.Substring($linkPath.Length)

        $targetPath = Join-Path $Dest $relPath

        $targetDir = Split-Path $targetPath -Parent

        if (-not (Test-Path $targetDir)) {

            New-Item -ItemType Directory -Path $targetDir -Force | Out-Null

        }

        Copy-Item $_.FullName $targetPath -Force -ErrorAction SilentlyContinue

        $restoredCount++

        if ($restoredCount % 100 -eq 0) {

            Write-Host "  已恢复 $restoredCount 个文件..." -ForegroundColor Gray

        }

    }

# 5. 清理符号链接

cmd /c rmdir $linkPath 2>$null

Write-Host "`n=== 恢复结果 ===" -ForegroundColor Cyan

Write-Host "恢复文件数: $restoredCount"

Write-Host "恢复目录: $Dest"

Write-Host "[!] 注意: 恢复的文件可能不完整，建议同时检查离线备份" -ForegroundColor DarkYellow

Write-Host "[!] 恢复后务必进行文件完整性校验" -ForegroundColor DarkYellow