XDR

// XDR 위협 헌팅 쿼리 - KQL (Kusto Query Language)
// Microsoft Defender XDR, Azure Sentinel 등에서 사용

// ==============================================
// 1. 크로스-레이어 피싱 공격 체인 탐지
// ==============================================
// 이메일 → 엔드포인트 → 네트워크 상관 분석

let timeWindow = 1h;
let suspiciousEmails = EmailEvents
| where Timestamp > ago(timeWindow)
| where AttachmentCount > 0
| where ThreatTypes has_any ("Phish", "Malware")
| project EmailTimestamp=Timestamp, RecipientEmailAddress,
          SenderFromAddress, Subject, AttachmentCount;

let endpointActivity = DeviceProcessEvents
| where Timestamp > ago(timeWindow)
| where InitiatingProcessFileName in~
        ("outlook.exe", "thunderbird.exe", "excel.exe", "word.exe")
| where FileName in~
        ("powershell.exe", "cmd.exe", "wscript.exe", "mshta.exe")
| project ProcessTimestamp=Timestamp, DeviceName, AccountName,
          FileName, ProcessCommandLine, InitiatingProcessFileName;

suspiciousEmails
| join kind=inner (endpointActivity)
    on $left.RecipientEmailAddress == $right.AccountName
| where ProcessTimestamp between (EmailTimestamp .. (EmailTimestamp + timeWindow))
| project EmailTimestamp, ProcessTimestamp, RecipientEmailAddress,
          Subject, DeviceName, FileName, ProcessCommandLine
| extend AttackChain = "Email → Endpoint Execution"

// ==============================================
// 2. 자격증명 탈취 후 측면 이동 탐지
// ==============================================

let credentialTheft = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "lsass.exe" or
        ProcessCommandLine has_any ("mimikatz", "sekurlsa", "procdump")
| project CredTheftTime=Timestamp, DeviceName, AccountName;

let lateralMovement = DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemotePort in (445, 135, 3389, 5985)  // SMB, RPC, RDP, WinRM
| where RemoteIPType == "Private"
| summarize ConnectionCount=count(),
            TargetHosts=make_set(RemoteIP)
    by DeviceName, AccountName, bin(Timestamp, 1h);

credentialTheft
| join kind=inner (lateralMovement)
    on DeviceName, AccountName
| where Timestamp > CredTheftTime
| project CredTheftTime, Timestamp, DeviceName, AccountName,
          ConnectionCount, TargetHosts
| extend AttackStage = "Post-Credential Theft Lateral Movement"
| where ConnectionCount > 5

// ==============================================
// 3. C2 비콘 통신 패턴 탐지
// ==============================================

let beaconDetection = DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteIPType == "Public"
| summarize
    ConnectionCount = count(),
    AvgInterval = avg(datetime_diff('second', Timestamp,
                      prev(Timestamp, 1) over (partition by DeviceName,
                                               RemoteIP order by Timestamp))),
    IntervalStdDev = stdev(datetime_diff('second', Timestamp,
                           prev(Timestamp, 1) over (partition by DeviceName,
                                                    RemoteIP order by Timestamp))),
    FirstSeen = min(Timestamp),
    LastSeen = max(Timestamp),
    TotalBytes = sum(SentBytes + ReceivedBytes)
    by DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName
| where ConnectionCount > 10
| where IntervalStdDev < 60  // 규칙적인 간격 (편차 60초 미만)
| where AvgInterval between (30 .. 3600)  // 30초 ~ 1시간 간격
| extend BeaconScore = 100 - (IntervalStdDev / AvgInterval * 100)
| where BeaconScore > 70
| project DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName,
          ConnectionCount, AvgInterval, BeaconScore, FirstSeen, LastSeen

// ==============================================
// 4. 클라우드 서비스로 데이터 유출 탐지
// ==============================================

let cloudUploadDomains = dynamic([
    "dropbox.com", "drive.google.com", "onedrive.live.com",
    "mega.nz", "wetransfer.com", "box.com"
]);

let largeFileAccess = DeviceFileEvents
| where Timestamp > ago(4h)
| where ActionType == "FileRead"
| where FolderPath has_any ("Documents", "Desktop", "Downloads",
                            "Confidential", "Finance", "HR")
| summarize FileCount=count(), TotalSize=sum(FileSize)
    by DeviceName, AccountName, bin(Timestamp, 15m)
| where FileCount > 50 or TotalSize > 100000000;  // 50+ files or 100MB+

let cloudUploads = DeviceNetworkEvents
| where Timestamp > ago(4h)
| where RemoteUrl has_any (cloudUploadDomains)
| where SentBytes > 1000000  // 1MB+
| summarize UploadCount=count(), TotalUploaded=sum(SentBytes)
    by DeviceName, AccountName, RemoteUrl, bin(Timestamp, 15m);

largeFileAccess
| join kind=inner (cloudUploads)
    on DeviceName, AccountName
| where Timestamp1 between ((Timestamp - 15m) .. (Timestamp + 15m))
| project Timestamp, DeviceName, AccountName, FileCount, TotalSize,
          RemoteUrl, TotalUploaded
| extend AlertTitle = "Potential Data Exfiltration to Cloud Storage",
         Severity = "Critical"

// ==============================================
// 5. 통합 인시던트 뷰 - 공격 타임라인
// ==============================================

let incidentId = "INC-2024-001";
let targetUser = "john.doe@company.com";
let timeRange = 7d;

union
    (EmailEvents
    | where RecipientEmailAddress =~ targetUser
    | where Timestamp > ago(timeRange)
    | project Timestamp, Source="Email",
              Activity=strcat("Received: ", Subject),
              Details=strcat("From: ", SenderFromAddress)),

    (DeviceProcessEvents
    | where AccountName =~ targetUser
    | where Timestamp > ago(timeRange)
    | project Timestamp, Source="Endpoint",
              Activity=strcat("Process: ", FileName),
              Details=ProcessCommandLine),

    (DeviceNetworkEvents
    | where InitiatingProcessAccountName =~ targetUser
    | where Timestamp > ago(timeRange)
    | project Timestamp, Source="Network",
              Activity=strcat("Connection to ", RemoteIP),
              Details=strcat("Port: ", RemotePort)),

    (IdentityLogonEvents
    | where AccountUpn =~ targetUser
    | where Timestamp > ago(timeRange)
    | project Timestamp, Source="Identity",
              Activity=strcat("Logon: ", LogonType),
              Details=strcat("From: ", DeviceName))

| order by Timestamp asc
| extend IncidentId = incidentId
| project-reorder Timestamp, Source, Activity, Details

// XDR API 연동 및 자동화된 대응 - Node.js
// 여러 보안 도구를 통합하여 XDR 기능 구현

const axios = require('axios');
const { EventEmitter } = require('events');

class XDRPlatform extends EventEmitter {
    constructor(config) {
        super();
        this.config = config;

        // 연동된 보안 솔루션 클라이언트
        this.edr = new EDRClient(config.edr);
        this.ndr = new NDRClient(config.ndr);
        this.email = new EmailSecurityClient(config.emailSecurity);
        this.casb = new CASBClient(config.casb);
        this.identity = new IdentityClient(config.identity);

        // 통합 데이터 레이크
        this.dataLake = [];

        // 상관 분석 엔진
        this.correlationEngine = new CorrelationEngine();
    }

    // 모든 소스에서 이벤트 수집 시작
    async startCollection() {
        console.log('Starting XDR event collection from all sources...');

        // 각 소스에서 이벤트 스트림 설정
        this.edr.on('event', (event) => this.ingestEvent('endpoint', event));
        this.ndr.on('event', (event) => this.ingestEvent('network', event));
        this.email.on('event', (event) => this.ingestEvent('email', event));
        this.casb.on('event', (event) => this.ingestEvent('cloud', event));
        this.identity.on('event', (event) => this.ingestEvent('identity', event));

        // 연결 시작
        await Promise.all([
            this.edr.connect(),
            this.ndr.connect(),
            this.email.connect(),
            this.casb.connect(),
            this.identity.connect()
        ]);

        console.log('All security sources connected');
    }

    // 이벤트 정규화 및 수집
    ingestEvent(sourceType, rawEvent) {
        const normalizedEvent = this.normalizeEvent(sourceType, rawEvent);
        this.dataLake.push(normalizedEvent);

        // 실시간 상관 분석
        const incidents = this.correlationEngine.analyze(normalizedEvent, this.dataLake);

        for (const incident of incidents) {
            this.emit('incident', incident);
            this.handleIncident(incident);
        }
    }

    // 이벤트 정규화 - 통합 스키마로 변환
    normalizeEvent(sourceType, raw) {
        const normalized = {
            id: this.generateEventId(),
            timestamp: new Date(raw.timestamp || Date.now()).toISOString(),
            sourceType: sourceType,
            eventType: this.mapEventType(sourceType, raw),
            severity: raw.severity || 'info',

            // 공통 엔티티
            entities: {
                host: raw.hostname || raw.deviceName || raw.computerName,
                user: raw.user || raw.accountName || raw.userPrincipalName,
                sourceIp: raw.sourceIp || raw.srcIp || raw.clientIp,
                destIp: raw.destIp || raw.remoteIp || raw.targetIp,
                process: raw.processName || raw.fileName,
                fileHash: raw.sha256 || raw.md5 || raw.fileHash,
                url: raw.url || raw.requestUrl,
                domain: raw.domain || raw.remoteDomain
            },

            // 원본 데이터 보존
            rawData: raw,

            // 메타데이터
            meta: {
                source: sourceType,
                ingestedAt: new Date().toISOString(),
                enriched: false
            }
        };

        // 위협 인텔리전스 강화
        this.enrichEvent(normalized);

        return normalized;
    }

    mapEventType(sourceType, raw) {
        const mappings = {
            endpoint: {
                'ProcessCreate': 'process_create',
                'FileCreate': 'file_create',
                'NetworkConnect': 'network_connection',
                'RegistryModification': 'registry_modify'
            },
            network: {
                'dns': 'dns_query',
                'http': 'http_request',
                'flow': 'network_flow',
                'alert': 'ids_alert'
            },
            email: {
                'received': 'email_received',
                'attachment': 'attachment_detected',
                'link_click': 'link_clicked'
            },
            identity: {
                'logon': 'auth_logon',
                'logoff': 'auth_logoff',
                'failed': 'auth_failure',
                'mfa': 'mfa_challenge'
            }
        };

        const sourceMap = mappings[sourceType] || {};
        return sourceMap[raw.eventType] || raw.eventType || 'unknown';
    }

    async enrichEvent(event) {
        // 위협 인텔리전스 조회
        const iocs = [];

        if (event.entities.fileHash) {
            const hashReputation = await this.checkHashReputation(event.entities.fileHash);
            if (hashReputation.malicious) {
                iocs.push({ type: 'hash', value: event.entities.fileHash, ...hashReputation });
            }
        }

        if (event.entities.destIp) {
            const ipReputation = await this.checkIPReputation(event.entities.destIp);
            if (ipReputation.malicious) {
                iocs.push({ type: 'ip', value: event.entities.destIp, ...ipReputation });
            }
        }

        if (event.entities.domain) {
            const domainReputation = await this.checkDomainReputation(event.entities.domain);
            if (domainReputation.malicious) {
                iocs.push({ type: 'domain', value: event.entities.domain, ...domainReputation });
            }
        }

        event.threatIntel = {
            iocs: iocs,
            enrichedAt: new Date().toISOString()
        };

        event.meta.enriched = true;
    }

    async checkHashReputation(hash) {
        // VirusTotal, Hybrid Analysis 등 연동
        try {
            const response = await axios.get(
                `${this.config.threatIntel.url}/hash/${hash}`,
                { headers: { 'Authorization': `Bearer ${this.config.threatIntel.apiKey}` }}
            );
            return response.data;
        } catch {
            return { malicious: false };
        }
    }

    async checkIPReputation(ip) {
        // AbuseIPDB, GreyNoise 등 연동
        try {
            const response = await axios.get(
                `${this.config.threatIntel.url}/ip/${ip}`,
                { headers: { 'Authorization': `Bearer ${this.config.threatIntel.apiKey}` }}
            );
            return response.data;
        } catch {
            return { malicious: false };
        }
    }

    async checkDomainReputation(domain) {
        try {
            const response = await axios.get(
                `${this.config.threatIntel.url}/domain/${domain}`,
                { headers: { 'Authorization': `Bearer ${this.config.threatIntel.apiKey}` }}
            );
            return response.data;
        } catch {
            return { malicious: false };
        }
    }

    // 인시던트 자동 대응
    async handleIncident(incident) {
        console.log(`\n[INCIDENT] ${incident.id}: ${incident.title}`);
        console.log(`  Severity: ${incident.severity}`);
        console.log(`  Affected: ${Array.from(incident.affectedAssets).join(', ')}`);

        // 심각도별 자동 대응
        if (incident.severity === 'critical') {
            await this.executeCriticalResponse(incident);
        } else if (incident.severity === 'high') {
            await this.executeHighResponse(incident);
        }

        // SOAR/Ticketing 시스템 연동
        await this.createTicket(incident);

        // 알림 발송
        await this.sendAlerts(incident);
    }

    async executeCriticalResponse(incident) {
        const actions = [];

        for (const asset of incident.affectedAssets) {
            const [type, value] = asset.split(':');

            if (type === 'host') {
                // 엔드포인트 격리
                console.log(`  [ACTION] Isolating endpoint: ${value}`);
                actions.push(this.edr.isolateEndpoint(value));

                // 네트워크 차단
                console.log(`  [ACTION] Blocking network for: ${value}`);
                actions.push(this.ndr.blockHost(value));
            }

            if (type === 'user') {
                // 계정 비활성화
                console.log(`  [ACTION] Disabling account: ${value}`);
                actions.push(this.identity.disableAccount(value));

                // 모든 세션 종료
                console.log(`  [ACTION] Revoking sessions for: ${value}`);
                actions.push(this.identity.revokeSessions(value));
            }
        }

        const results = await Promise.allSettled(actions);

        incident.responseActions = results.map((r, i) => ({
            action: actions[i],
            status: r.status,
            result: r.value || r.reason
        }));
    }

    async executeHighResponse(incident) {
        // 고위험: 모니터링 강화 + 승인 후 조치
        for (const asset of incident.affectedAssets) {
            const [type, value] = asset.split(':');

            if (type === 'host') {
                console.log(`  [ACTION] Enhanced monitoring for: ${value}`);
                await this.edr.enableEnhancedMonitoring(value);
            }

            if (type === 'user') {
                console.log(`  [ACTION] Requiring MFA for: ${value}`);
                await this.identity.requireMFA(value);
            }
        }
    }

    async createTicket(incident) {
        // ServiceNow, Jira 등 연동
        const ticket = {
            title: `[XDR] ${incident.id}: ${incident.title}`,
            severity: incident.severity,
            description: this.formatIncidentDescription(incident),
            assignee: this.config.ticketing.defaultAssignee,
            labels: ['xdr', 'security-incident', incident.severity]
        };

        console.log(`  [TICKET] Created: ${ticket.title}`);
    }

    async sendAlerts(incident) {
        // Slack, Email, PagerDuty 연동
        if (incident.severity === 'critical') {
            // 긴급 알림
            console.log(`  [ALERT] Paging on-call: ${incident.title}`);
        }
    }

    formatIncidentDescription(incident) {
        return `
## XDR Incident Report

**ID:** ${incident.id}
**Severity:** ${incident.severity}
**Created:** ${incident.createdAt}

### Attack Chain
${incident.attackChain.join(' → ')}

### MITRE ATT&CK
${incident.mitreTechniques.join(', ')}

### Affected Assets
${Array.from(incident.affectedAssets).join('\n')}

### Events
${incident.events.length} related events detected

### Recommendations
${incident.recommendations.join('\n')}
        `;
    }

    generateEventId() {
        return `evt-${Date.now()}-${Math.random().toString(36).substr(2, 9)}`;
    }
}

// 클라이언트 클래스 (간략화)
class EDRClient extends EventEmitter {
    constructor(config) { super(); this.config = config; }
    async connect() { console.log('EDR connected'); }
    async isolateEndpoint(host) { return { success: true, host }; }
    async enableEnhancedMonitoring(host) { return { success: true, host }; }
}

class NDRClient extends EventEmitter {
    constructor(config) { super(); this.config = config; }
    async connect() { console.log('NDR connected'); }
    async blockHost(host) { return { success: true, host }; }
}

class EmailSecurityClient extends EventEmitter {
    constructor(config) { super(); this.config = config; }
    async connect() { console.log('Email Security connected'); }
}

class CASBClient extends EventEmitter {
    constructor(config) { super(); this.config = config; }
    async connect() { console.log('CASB connected'); }
}

class IdentityClient extends EventEmitter {
    constructor(config) { super(); this.config = config; }
    async connect() { console.log('Identity Provider connected'); }
    async disableAccount(user) { return { success: true, user }; }
    async revokeSessions(user) { return { success: true, user }; }
    async requireMFA(user) { return { success: true, user }; }
}

class CorrelationEngine {
    analyze(event, dataLake) {
        // 상관 분석 로직 (앞선 Python 예제 참조)
        return [];
    }
}

// 사용 예시
const xdr = new XDRPlatform({
    edr: { url: 'https://edr.company.com/api' },
    ndr: { url: 'https://ndr.company.com/api' },
    emailSecurity: { url: 'https://email-sec.company.com/api' },
    casb: { url: 'https://casb.company.com/api' },
    identity: { url: 'https://identity.company.com/api' },
    threatIntel: { url: 'https://threatintel.company.com/api', apiKey: 'xxx' },
    ticketing: { defaultAssignee: 'soc-team' }
});

xdr.on('incident', (incident) => {
    console.log(`New incident detected: ${incident.id}`);
});

xdr.startCollection();