| หมวดหมู่ | เครื่องมือ/เทคโนโลยี | สิ่งที่ตรวจจับได้ |
|---|
| Network-based (NIDS/NIPS) | Suricata, Snort, Zeek (Bro), Palo Alto, FortiGate IPS, Cisco Firepower, Corelight | Suspicious Traffic Patterns, Known Attack Signatures, C2 Beaconing, Lateral Movement (SMB/RPC), Data Exfiltration, Port Scans |
| Host-based (HIDS/EDR/XDR) | Wazuh/OSSEC, CrowdStrike, SentinelOne, Microsoft Defender for Endpoint, Elastic Endpoint, Velociraptor | Process Injection, Credential Dumping (LSASS), Persistence (Scheduled Tasks, Run Keys), Fileless Malware, Unauthorized Login |
| SIEM / Log Analytics | Splunk, Elastic, Microsoft Sentinel, IBM QRadar, LogRhythm, Graylog | Correlation Rules: Brute Force, Impossible Travel, Privilege Escalation, Golden Ticket, DCSync, Data Staging |
| Network Traffic Analysis (NTA/NDR) | Darktrace, Vectra AI, ExtraHop, Corelight, Awake Security | Anomalous Behavior (ML/UEBA): Beaconing, Lateral Movement, Data Exfil, Encrypted Traffic Analysis (ETA) |
| Vulnerability / Exposure Scanners | Tenable, Qualys, Rapid7, Runecast, Nuclei | Unpatched Systems, Misconfigurations, Exposed Services (Shadow IT) |
| Deception / Honeypots | Canary Tokens, Thinkst Canary, Cowrie, Dionaea, Active Directory Deception (Acalvio, Attivo) | Early Warning: การสัมผัส Decoy = High-fidelity Alert |
2. สัญญาณเตือน (Indicators of Compromise - IOCs / Behavioral Indicators)
- Network: ไปยัง IP/Domain Reputation ร้าย, Unusual Port/Protocol, Large Data Transfer (Off-hours), DNS Tunneling, Beaconing (Regular Intervals), SMB/PSExec Lateral Movement
- Host: Process Tree ผิดปกติ (Word สั่ง PowerShell), LSASS Access, Scheduled Task/Service Creation, WMI/WinRM Abuse, Clearing Event Logs (wevtutil cl), Driver Load (Unsigned)
- Identity: Failed Logon Storm (4625), Successful Logon from New Geo/Device (4624), Privilege Escalation (4672), Kerberos Delegation Abuse, Golden/Silver Ticket (Event ID 4769 w/ RC4)
- Cloud: Unusual API Calls (AssumeRole, CreateAccessKey), Security Group Changes, S3 Public Bucket, Container Escape, Crypto Mining
3. วิธีการตรวจสอบ "ตอนนี้มีผู้บุกรุกหรือไม่" (Quick Triage)
- Check SIEM/EDR Alerts: Critical/High Severity Alerts 24h ที่ยังไม่ Triaged
- Active Directory:
Get-ADUser -Filter {LastLogon -gt (Get-Date).AddDays(-7)} -Properties LastLogon หา Account ใหม่/ผิดปกติ
- Firewall/Proxy Logs: Top Talkers (Bytes Out), Connections to Newly Registered Domains (< 30 days), TOR Exit Nodes
- Endpoint Sweep: รัน
Velociraptor หรือ Osquery Query: SELECT * FROM processes WHERE name NOT IN ('legit_list') หรือ SELECT * FROM listening_ports WHERE port NOT IN (allowed_list)
- Threat Intel Enrichment: IOCs จากรายงานล่าสุด (CISA, Vendor Blogs, ISAC) นำไป Query ใน SIEM/EDR
4. กระบวนการตอบสนอง (Incident Response) เมื่อพบ Intruder
- Containment: Network Quarantine (VLAN/ACL), Disable Account, Block IP at Perimeter, EDR Isolation
- Evidence Preservation: Disk Image (FTK Imager, dc3dd), Memory Dump (WinPMEM, LiME), Log Archive (Immutable)
- Eradication: Remove Malware, Rotate All Credentials (KRBTGT 2x), Patch Vulnerability, Remove Persistence
- Recovery: Rebuild from Golden Image, Restore from Clean Backup, Verify Integrity
- Lessons Learned: Root Cause Analysis, Update Detection Rules, Improve Controls, Update Playbook
5. แนวทางป้องกันล่วงหน้า (Proactive Prevention)
- Zero Trust: Verify Every Request, Least Privilege, Micro-segmentation
- Identity Security: MFA ทุกที่ (Phishing-resistant: FIDO2/WebAuthn), PAM, JIT Access, Tiered Admin Model
- Hardening: CIS Benchmarks, Disable SMBv1, LLMNR/NBT-NS, Restrict PowerShell (Constrained Language Mode), AppLocker/WDAC
- Visibility: NetFlow/IPFIX ทุก Segment, TLS Decryption (Policy-based), EDR 100% Coverage
- Deception: Deploy Canaries ทุก Segment (High ROI, Low Noise)
