端点无文件攻击检测实战指南基于 Anthropic-Cybersecurity-Skills 的 Fileless Malware 检测工程方案【免费下载链接】Anthropic-Cybersecurity-Skills817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATTCK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF MITRE F3 (Fight Fraud) · agentskills.io standard · Works with Claude Code, GitHub Copilot, Codex CLI, Cursor, Gemini CLI 20 platforms · 29 security domains · Apache 2.0项目地址: https://gitcode.com/GitHub_Trending/an/Anthropic-Cybersecurity-Skills本指南以 detecting-fileless-attacks-on-endpoints 技能文档为核心系统讲解如何在 Windows 端点上检测完全运行于内存中、不落盘写入文件的无文件恶意软件Fileless Malware。你将掌握如何开启 Sysmon、PowerShell 日志与 AMSI 遥测如何针对 PowerShell 编码命令、反射式 DLL 注入、WMI 持久化与注册表驻留恶意软件构建检测规则以及如何用仓库提供的 Python 检测 Agent 在 EVTX 与 CSV 日志上落地自动化扫描。何时使用本技能本技能适用于以下场景为完全在内存中运行、规避传统防病毒软件的文件型恶意软件构建检测规则针对 PowerShell 攻击、反射式 DLL 注入Reflective DLL Injection和 WMI 滥用进行威胁狩猎配置端点遥测Sysmon、AMSI、PowerShell 日志以捕获无文件攻击指标调查传统 AV 未能发现恶意文件的入侵事件。明确不要使用本技能的场景检测基于文件的恶意软件或对恶意软件进行逆向工程。该技能聚焦于内存中执行这一攻击面与同仓库的 detecting-fileless-malware-techniques、detecting-wmi-persistence、detecting-process-injection-techniques 等技能互为补充但在职责上有清晰边界。前置条件端点上必须存在的遥测能力在开始构建任何检测规则之前端点必须具备以下遥测基础Sysmon启用进程创建与 WMI 事件日志记录PowerShell Script Block Logging 与 Module Logging用于捕获脚本内容AMSIAntimalware Scan Interface在脚本内容执行前进行内容检查具备行为检测能力的 EDR如 MDE、CrowdStrike、SentinelOne。遥测缺失时再优秀的检测规则也是盲打。仓库在 API 参考 中给出了各事件源的检测价值对照PowerShell Script Block 事件 4104 用于捕获恶意脚本内容Sysmon 事件 1 用于发现编码命令执行事件 8 用于发现反射式 DLL 注入事件 19/20/21 用于发现 WMI 持久化。端到端检测工作流仓库在 workflows.md 中给出了完整的检测工作流[Enable telemetry (Sysmon, PS logging, AMSI)] → [Build detection rules per technique] → [Deploy rules in SIEM] → [Threat hunt for historical fileless indicators] → [Triage alerts] → [Investigate memory for confirmed incidents] → [Extract IOCs from memory analysis] → [Tune detections]可见检测不是单一环节而是一个持续闭环先建遥测基础再按技术分门别类构建规则并部署到 SIEM随后进行历史威胁狩猎对告警分级处理对确认的入侵事件开展内存取证可配合 Volatility 3最后从内存分析中提取 IOC 并持续调优规则。下文按此工作流的五个关键步骤展开。Step 1启用所需遥测无文件攻击的检测高度依赖日志与脚本内容可见性。以下 PowerShell 命令通过注册表GPO 同路径启用 PowerShell 关键日志# Enable PowerShell Script Block Logging (GPO or registry) New-ItemProperty -Path HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging -Name EnableScriptBlockLogging -Value 1 -PropertyType DWORD -Force # Enable PowerShell Module Logging New-ItemProperty -Path HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging -Name EnableModuleLogging -Value 1 -PropertyType DWORD -Force # Enable PowerShell Transcription New-ItemProperty -Path HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription -Name EnableTranscripting -Value 1 -PropertyType DWORD -ForceSysmon 配置需重点关注以下事件 ID它们是后续各类检测规则的数据源Event ID 1进程创建捕获 CommandLineEvent ID 7Image 加载DLL 加载Event ID 8CreateRemoteThread注入Event ID 10进程访问如访问 LSASSEvent ID 19/20/21WMI 事件。AMSI 方面仓库 api-reference.md 补充了状态检查与网络保护开启命令# Enable AMSI logging Set-MpPreference -EnableNetworkProtection Enabled # Check AMSI status Get-MpComputerStatus | Select AMServiceEnabled, AntispywareEnabledStep 2检测 PowerShell 攻击PowerShell 是无文件攻击最常见的载体。以下指标组合用于发现恶意 PowerShell 行为# Indicators of malicious PowerShell: # Encoded command execution EventID: 1 CommandLine contains: powershell AND (-enc OR -e OR -encodedcommand OR FromBase64String) # Download cradle patterns CommandLine contains: IEX AND (Net.WebClient OR DownloadString OR Invoke-WebRequest) CommandLine contains: Invoke-Expression AND New-Object # AMSI bypass attempts (Event ID 4104 - Script Block) ScriptBlock contains: (AmsiUtils) OR (amsiInitFailed) OR SetValue.*amsi # Splunk query for suspicious PowerShell: indexwindows sourceWinEventLog:Microsoft-Windows-PowerShell/Operational EventCode4104 | where match(ScriptBlockText, (?i)(iex|invoke-expression|downloadstring|net\.webclient|frombase64|bypass|amsi.utils)) | table _time host ScriptBlockText这些指标在仓库的 Python 实现中有更细粒度的正则支撑。process.py 内置了 7 大类检测模式encoded_command-enc/-e/-encodedcommand/frombase64string、download_cradledownloadstring/invoke-webrequest/net.webclient等、amsi_bypassamsiutils/amsiinitfailed/amsi.dll、reflection、wmi_abuse、credential_accessmimikatz/sekurlsa/logonpasswords、invoke_expression。而 agent.py 中的SUSPICIOUS_PS_PATTERNS则进一步将每个模式映射到 MITRE ATTCK 技术与严重级别例如Invoke-Expression|IEX\s*\(→ T1059.001HIGHInvoke-Mimikatz|Invoke-Kerberoast→ T1003CRITICALVirtualAlloc|VirtualProtect|CreateThread→ T1055CRITICALRegister-WMI|__EventFilter|__EventConsumer→ T1546.003CRITICAL。该技能在仓库 ATTACK_COVERAGE.md 中覆盖了 T1055进程注入、T1059.001、T1047WMI、T1140解码、T1105远程下载、T1546.003WMI 事件订阅持久化、T1547.001注册表 Run 键、T1562.001防御规避与 T1620反射式代码加载等十余个 MITRE ATTCK 技术点检测规则与攻击框架的映射关系非常清晰。Step 3检测进程注入技术# Reflective DLL injection - loads DLL from memory without touching disk # Detection: Sysmon Event 7 (ImageLoaded) where image path is unusual EventID: 7 ImageLoaded NOT starts with: C:\Windows\ AND NOT starts with: C:\Program Files # Process hollowing - creates process in suspended state, replaces memory # Detection: Process creation followed by immediate memory write EventID: 1 10 correlation # Process created then accessed with PROCESS_VM_WRITE # APC injection - queues code to threads async procedure call queue # Detection: Sysmon CreateRemoteThread from non-system process EventID: 8 SourceImage NOT IN (known_legitimate_sources) # MDE KQL: DeviceEvents | where ActionType in (CreateRemoteThreadApiCall, NtAllocateVirtualMemoryApiCall) | where InitiatingProcessFileName !in (MsMpEng.exe, svchost.exe) | project Timestamp, DeviceName, ActionType, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName其中 Event ID 8CreateRemoteThread的检测逻辑在 agent.py 的parse_sysmon_injection函数中落地它解析SourceImage与TargetImage字段对每条创建远程线程的记录标记为 HIGH 严重级别并映射到 T1055描述为CreateRemoteThread - possible reflective injection。Step 4检测 WMI 持久化WMI 事件订阅是 APT 组织钟爱的持久化手段其特点是完全通过 WMI 对象驻留无文件落盘# Sysmon Event IDs 19/20/21 for WMI events EventID: 19 # WmiEventFilter activity detected EventID: 20 # WmiEventConsumer activity detected EventID: 21 # WmiEventConsumerToFilter activity detected # Any WMI event subscription creation is suspicious unless expected # Common malicious WMI persistence: Consumer contains: CommandLineEventConsumer OR ActiveScriptEventConsumer # Query for WMI subscriptions via osquery or PowerShell: Get-WMIObject -Namespace root\Subscription -Class __EventFilter Get-WMIObject -Namespace root\Subscription -Class __EventConsumer Get-WMIObject -Namespace root\Subscription -Class __FilterToConsumerBindingagent.py 用WMI_PERSISTENCE_EVENTS字典将事件 19/20/21 分别解释为WMI EventFilter createdWMI EventConsumer createdWMI EventConsumerToFilter bindingparse_sysmon_wmi_persistence函数会抽取Name、Operation、Destinationconsumer 对象与User字段全部标记为 CRITICAL 严重级别并映射到 T1546.003。只要出现 WMI 事件订阅的创建行为就应视为可疑除非明确属于预期内的合规操作。Step 5检测注册表驻留执行# Malware stored in registry values and executed via PowerShell # Sysmon Event 13 - Registry value set with encoded content EventID: 13 TargetObject contains: CurrentVersion\Run Details: unusually long value or Base64-encoded content # Detection query: indexsysmon EventCode13 | where match(Details, [A-Za-z0-9/]{100,}) | table _time host TargetObject Details Image注册表驻留型无文件攻击将恶意载荷编码后存放在注册表值中典型如HKCU\...\Run与HKLM\...\Run再通过 PowerShell 读取执行。检测思路是注册表值被设置为超长字符串或 Base64 编码内容。这一模式同样被 agent.py 的正则HKCU:\\.*\\Run|HKLM:\\.*\\Run覆盖映射到 T1547.001Registry Run Keys / Startup Folder严重级别 HIGH。核心概念速查表TermDefinitionFileless MalwareMalware that operates entirely in memory without writing executable files to diskAMSIAntimalware Scan Interface; Windows API allowing security products to inspect script content before executionReflective DLL InjectionLoading a DLL from memory rather than disk, avoiding file-based detectionProcess HollowingCreating a legitimate process in suspended state and replacing its memory with malicious codeScript Block LoggingPowerShell logging feature that captures deobfuscated script content (Event ID 4104)工具与系统Sysmon内核级进程、DLL 与 WMI 监控AMSIWindows 脚本内容检查 APIPowerShell LoggingScript Block、Module 与 Transcription 日志Microsoft Defender for Endpoint面向无文件技术的行为检测Volatility 3用于事后无文件恶意软件分析的内存取证。此外本仓库为无文件攻击检测提供了两个可直接运行的 Python 脚本作为自动化辅助详见 scripts 目录agent.py —— 面向 EVTX 事件的检测 Agent该脚本基于python-evtx依赖缺失时会友好提示pip install python-evtx解析 Windows 事件日志文件支持三类检查--ps-log解析 PowerShell Operational 日志中的 Event 4104提取ScriptBlockText并逐一匹配SUSPICIOUS_PS_PATTERNS--check-wmi在 Sysmon 日志中检测 WMI 持久化事件 19/20/21--check-injection在 Sysmon 日志中检测 Event 8CreateRemoteThread注入行为。典型用法见 api-reference.mdpython agent.py --ps-log PowerShell-Operational.evtx python agent.py --sysmon-log Sysmon.evtx --check-wmi --check-injection输出为 JSON 格式包含命中时间戳、模式描述、对应 MITRE 技术编号、严重级别与脚本内容片段前 300 字符并汇总total_findings计数。process.py —— 面向 CSV 日志的批量扫描器python process.py powershell_logs.csv该脚本读取包含ScriptBlockText或Message字段的 CSV 导出日志按 7 类无文件模式匹配生成按技术分类的fileless_detection_report.json报告含by_technique统计与最多前 100 条命中详情适合对历史日志做批量回扫与狩猎。落地与验收模板仓库 assets/template.md 提供了一份可直接复用的检测工程验收模板包含三部分Telemetry Status记录 Sysmon/PowerShell Script Block/AMSI 是否启用及事件 ID 范围、Detection Rules逐条登记规则名称、对应技术、SIEM 查询与 Active/Draft 状态、Sign-OffDetection Engineer 与 SOC Lead 签字确认。建议在部署每一批规则后按此模板登记确保遥测与规则的可追溯性。常见陷阱依赖基于文件的 AV传统扫描磁盘文件的杀软会完全漏掉无文件攻击必须依赖行为检测与 AMSI禁用 PowerShell 日志缺少 Script Block Logging防御方将完全看不到去混淆后的 PowerShell 命令AMSI 绕过未被发现老练的攻击者在执行载荷前会先绕过 AMSI应将 AMSI 绕过尝试视为高优先级告警如AmsiUtils、amsiInitFailed模式不监控 WMI 事件WMI 持久化是 APT 组织偏爱的手法Sysmon 事件 19-21 必须启用。总结从遥测到规则再到自动化的完整链路无文件攻击检测的关键在于可见性 行为指标 自动化。本技能文档提供了从遥测启用到分技术构建检测规则的完整方法论仓库的 agent.py 与 process.py 将文档中的检测模式落为可执行代码并直接映射到 MITRE ATTCK 技术编号与严重级别与仓库 ATTACK_COVERAGE.md 的框架覆盖清单相互印证。落地时请牢记先保证遥测不缺位再逐技术构建规则用自动化脚本做批量回扫最后通过内存取证Volatility 3闭环确认并持续调优以减少误报。【免费下载链接】Anthropic-Cybersecurity-Skills817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATTCK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF MITRE F3 (Fight Fraud) · agentskills.io standard · Works with Claude Code, GitHub Copilot, Codex CLI, Cursor, Gemini CLI 20 platforms · 29 security domains · Apache 2.0项目地址: https://gitcode.com/GitHub_Trending/an/Anthropic-Cybersecurity-Skills创作声明：本文部分内容由AI辅助生成（AIGC），仅供参考