Use Case an ninh mạng (Security Use Case) là gì?
Security Use Case là một kịch bản cụ thể, có tài liệu hóa, mô tả **mối đe dọa / rủi ro** nào đó, **dữ liệu nguồn** cần thu thập, **logic phát hiện (detection logic)**, **hành động phản hồi (response actions)** và **chỉ số đo lường (metrics/KPIs)**. Mục đích: biến yêu cầu bảo mật trừu tượng thành quy tắc kỹ thuật có thể triển khai, kiểm thử và vận hành trong SOC/SIEM.
Cấu trúc một Use Case chuẩn (Template)
| Thành phần | Mô tả | Ví dụ |
|---|---|---|
| Use Case ID | Mã định danh duy nhất | UC-NET-001 |
| Title | Tên gọi rõ ràng | Brute Force SSH từ External IP |
| Threat / Risk | Mối đe dọa / rủi ro liên quan (MITRE ATT&CK) | T1110.001 - Password Guessing |
| Data Sources | Log source cần thiết | Linux auth.log, Windows 4625, Firewall deny, VPN log |
| Detection Logic | Query/Rule: điều kiện, ngưỡng, cửa sổ thời gian | >= 5 failed login trong 5 phút từ cùng src IP |
| Enrichment | Làm giàu context (GeoIP, ASN, Threat Intel, Asset criticality) | IP reputation (AbuseIPDB), Is critical server? |
| Severity / Priority | Critical / High / Medium / Low | High (nếu target là bastion/jump host) |
| False Positive Handling | Cách loại bỏ FP (whitelist, baseline, tuning) | Whitelist internal scanner IP, service account |
| Response Playbook | Bước xử lý: Triage → Contain → Eradicate → Recover | Block IP at FW, Reset password, Check lateral |
| Metrics / KPI | MTTD, MTTR, FP rate, Coverage | MTTD < 15 min, FP rate < 10% |
| Owner / Review Cycle | Ai phụ trách, review bao lâu một lần | SOC L2 Lead, Review quarterly |
Phân loại Use Case theo MITRE ATT&CK Tactic
1. Initial Access (Truy cập ban đầu)
- Phishing email với attachment/link độc hại (Email gateway + Sandbox + URL reputation).
- Exploit public-facing app (WAF alert + Vuln scanner correlation).
- Valid account abuse (VPN/RDP/SSH từ IP mới, geo-impossible, Tor/VPN exit node).
- Supply chain compromise (Software update anomaly, CI/CD pipeline anomaly).
2. Execution & Persistence
- Scheduled Task / Cron job / Service creation bất thường (Sysmon 4698/4699/7045).
- WMI Event Subscription persistence (Sysmon 19/20/21).
- Registry Run Key / Startup Folder modification (Sysmon 12/13/14).
- DLL Hijacking / Binary Proxy Execution (Sysmon 7 ImageLoad).
3. Privilege Escalation & Credential Access
- LSASS memory dump (procdump, comsvcs.dll, Task Manager) → Sysmon 10 (TargetImage=lsass.exe).
- Kerberoasting / AS-REP Roasting (Event 4769/4768 with RC4/DES).
- Credential dumping từ Registry (SAM/SECURITY), DCSync (Event 4662).
- Pass-the-Hash / Pass-the-Ticket / Overpass-the-Hash (Event 4624 Logon Type 9).
4. Discovery & Lateral Movement
- Network scan từ internal host (Zeek/Suricata: port scan, SMB enum).
- AD Recon: PowerView, BloodHound, SharpHound (Process command line, LDAP query volume).
- SMB/WinRM/SSH/RDP lateral movement (Event 4624 Type 3/10, SMB session creation).
- Remote Service Creation (PsExec, SC.exe, WMI) - Sysmon 7/8.
5. Command & Control (C2)
- Beaconing pattern: Regular interval, jitter, same destination (NetFlow/Zeek/DNS log).
- DNS Tunneling: High entropy subdomain, high query volume, TXT/NULL record abuse.
- Domain Generation Algorithm (DGA): NXDOMAIN rate, entropy, length.
- Legitimate service abuse: GitHub, Slack, Discord, Telegram, Cloud storage API as C2.
6. Exfiltration & Impact
- Large data transfer: Unusual upload volume, off-hours, to rare destination (NetFlow/Proxy/DLP).
- Cloud storage sync anomaly: rclone, azcopy, gsutil, aws s3 sync từ server production.
- Ransomware: Rapid file rename/encrypt (Sysmon 11 FileCreate + 23 FileDelete + entropy spike).
- Wiper / Disk destruction: Raw disk access, boot sector overwrite.
Use Case trong SIEM phổ biến (QRadar, Splunk, Sentinel, Elastic)
QRadar Use Case Manager (UCM)
- Mapping rule → MITRE ATT&CK Tactic/Technique.
- Building Block (BB): Reusable logic chunk (VD: BB:FailedLogin, BB:CriticalAsset).
- Rule: Sequence / Threshold / Anomaly / Behavioral.
- Offense: Correlation của nhiều rule → ticket.
Splunk / Elastic / Sentinel (KQL/SPL)
- Detection Rule = Saved Search / Scheduled Query / Analytics Rule.
- MITRE ATT&CK tagging (attack.tactic, attack.technique).
- Suppression / Exception list (allowlist) quản lý FP.
- SOAR Integration: Auto-enrichment, auto-containment (block IP, disable user).
Ví dụ Use Case cụ thể: "Brute Force SSH Internet-facing"
UC-NET-001: Brute Force SSH từ External
Data Source: Firewall (Palo Alto/Checkpoint/Fortinet), Linux auth.log (Syslog), CloudTrail (AWS SG)
Logic (KQL/Splunk):
| where EventID==4625 or (Firewall action=deny and port=22)
| summarize FailedCount=count() by SrcIP, DstIP, bin(TimeGenerated, 5m)
| where FailedCount >= 10
| lookup kind=leftouter ThreatIntel on SrcIP
| extend Severity=case(ThreatIntel.IsMalicious, "Critical", DstIP in (CriticalAssets), "High", "Medium")
Enrichment: GeoIP, ASN, AbuseIPDB, Shodan, Asset Tag (Bastion/Jump/DB/Web)
Response: 1) Auto-block SrcIP at Perimeter FW (SOAR) 2) Alert SOC 3) Check if any success login from same IP 4) Review target host for compromise
FP Tuning: Whitelist: Vuln Scanner IP, Internal Red Team IP, Known Partner IP
Metrics: Alert volume/day, FP%, MTTD, Block rate
Quy trình xây dựng Use Case (Use Case Engineering Lifecycle)
- Requirement: Threat modeling (STRIDE/PASTA), Risk assessment, Compliance requirement, Incident lessons learned.
- Design: Define logic, data source, enrichment, threshold, MITRE mapping.
- Develop: Write query/rule, test trên historical data (backtest), unit test.
- Validate: Purple Team exercise (Red chạy TTP → Blue check detect), FP measurement.
- Deploy: Push to SIEM Prod, enable alerting, link playbook.
- Operate: Triage, tune threshold, update enrichment, manage suppression.
- Review/Retire: Quarterly review: relevance, FP rate, coverage gap, MITRE coverage. Retire nếu obsolete.
Use Case vs Rule vs Alert
| Khái niệm | Mô tả |
|---|---|
| Use Case | Business/Threat context + Detection logic + Response + Metrics + Owner. Level chiến thuật. |
| Detection Rule | Query/Logic kỹ thuật thuần túy (Sigma, KQL, SPL, AQL). Triển khai trong SIEM. |
| Alert | Instance cụ thể khi rule match. Có timestamp, entity, severity, context. |
| Offense / Case / Incident | Correlation nhiều alert liên quan → assign cho analyst investigate. |
KPIs đo lường chất lượng Use Case Program
- Coverage: % MITRE ATT&CK techniques covered (mục tiêu > 80% core techniques).
- Detection Rate: % Red Team/Purple Team TTP detected.
- False Positive Rate: FP / Total Alerts < 20% (mục tiêu < 10% cho high-sev).
- MTTD (Mean Time To Detect): Thời gian từ attack xảy ra → alert tạo ra.
- MTTR (Mean Time To Respond): Thời gian từ alert → containment.
- Rule Tuning Frequency: Số lần tune/quarter (quá nhiều = rule kém, quá ít = stale).
- Stale Rule %: Rule không trigger > 90 ngày / không review > 6 tháng.
Kết luận
Security Use Case là **đơn vị cơ bản** vận hành SOC hiện đại. Không chỉ viết rule, mà phải có: Threat context → Data readiness → Detection logic → Enrichment → Response playbook → Measurement → Continuous improvement. Đầu tư Use Case Engineering tốt = SOC hiệu quả, analyst không burn-out vì alert fatigue.