From 57793d24baf55e31b44f4bdffa256b28fd9a381a Mon Sep 17 00:00:00 2001 From: PTah Date: Thu, 4 Jun 2026 10:14:14 +1000 Subject: [PATCH] feat: SAC support smb.admin_share.access events from RDP agent Co-authored-by: Cursor --- README.md | 4 ++-- backend/app/constants/event_types.py | 1 + backend/app/services/telegram_templates.py | 27 ++++++++++++++++++++++ docs/agent-integration.md | 4 +++- docs/event-schema-v1.json | 1 + schemas/event-schema-v1.json | 1 + 6 files changed, 35 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index ffe352a..e5608f9 100644 --- a/README.md +++ b/README.md @@ -29,10 +29,10 @@ События приходят от агентов по [контракту ingest](docs/agent-integration.md) (`type`, `severity`, `details`): - **Linux — [ssh-monitor](https://git.kalinamall.ru/PapaTramp/ssh-monitor):** SSH (успех/неудача), **sudo**, **systemd-logind** (сессии), брутфорс и баны IP (ipset), пороги без бана, ежедневный отчёт, heartbeat. -- **Windows — [RDP-login-monitor](https://git.kalinamall.ru/PapaTramp/RDP-login-monitor):** **RDP/RDS** (4624/4625), **RD Gateway** (302/303), **WinRM / PowerShell Remoting** (Enter-PSSession, WinRM Operational ID 91), **RDP Shadow Control** (RCM 20506/20507/20510), явные учётные данные (4648), блокировка учётки (4740), брутфорс 4625, отчёт, heartbeat. +- **Windows — [RDP-login-monitor](https://git.kalinamall.ru/PapaTramp/RDP-login-monitor):** **RDP/RDS** (4624/4625), **RD Gateway** (302/303), **WinRM / PowerShell Remoting** (Enter-PSSession), **admin share C$/ADMIN$** (5140), **RDP Shadow Control** (RCM), блокировка учётки (4740), отчёт, heartbeat. - **В самом SAC:** корреляция **problems**, уведомления Telegram/email/webhook, лимит попыток входа в UI, SSE-дашборд. -Примеры типов: `ssh.login.*`, `privilege.sudo.command`, `rdp.login.*`, `winrm.session.started`, `rdp.shadow.control.*`, `rdg.connection.*`, `agent.heartbeat` — полная таблица в [docs/agent-integration.md §3](docs/agent-integration.md#3-маппинг-уведомлений--типы-событий). +Примеры типов: `ssh.login.*`, `privilege.sudo.command`, `rdp.login.*`, `winrm.session.started`, `smb.admin_share.access`, `rdp.shadow.control.*`, `rdg.connection.*`, `agent.heartbeat` — полная таблица в [docs/agent-integration.md §3](docs/agent-integration.md#3-маппинг-уведомлений--типы-событий). ### Текущее состояние (июнь 2026) diff --git a/backend/app/constants/event_types.py b/backend/app/constants/event_types.py index 58a9a26..9764793 100644 --- a/backend/app/constants/event_types.py +++ b/backend/app/constants/event_types.py @@ -26,6 +26,7 @@ DEFAULT_EVENT_SEVERITIES: dict[str, str] = { "rdp.shadow.control.stopped": "info", "rdp.shadow.control.permission": "warning", "winrm.session.started": "warning", + "smb.admin_share.access": "warning", "auth.explicit.credentials": "warning", "report.daily.rdp": "info", "rdp.ip.banned": "high", diff --git a/backend/app/services/telegram_templates.py b/backend/app/services/telegram_templates.py index 89d3df4..8a3e2ff 100644 --- a/backend/app/services/telegram_templates.py +++ b/backend/app/services/telegram_templates.py @@ -309,6 +309,30 @@ def format_winrm_session_html(event: Event) -> str: return msg.rstrip() +def format_smb_admin_share_html(event: Event) -> str: + details = _details_dict(event) + msg = "📁 Доступ к админ-шару (5140)\n" + msg += _line("🏢", "Сервер", host_label(event.host)) + msg += _line("👤", "Пользователь", html_escape(_detail(details, "user", "username"))) + ip = _detail(details, "source_ip", "ip_address", "ip") + if ip != "-": + msg += _line("🌐", "IP клиента", html_escape(ip)) + share = _detail(details, "share_name", default="") + if share != "-": + msg += _line("📂", "Share", html_escape(share)) + path = _detail(details, "share_path", default="") + if path != "-": + msg += _line("📍", "Путь", html_escape(path)) + target = _detail(details, "relative_target", default="") + if target != "-": + msg += _line("📄", "Объект", html_escape(target)) + msg += _line("🕐", "Время", format_time(event.occurred_at)) + win_id = _detail(details, "event_id_windows", default="") + if win_id != "-": + msg += f"🔢 Event ID: {html_escape(win_id)} (File Share)" + return msg.rstrip() + + def format_generic_event_html(event: Event) -> str: sev = event.severity.upper() msg = f"🚨 SAC: {html_escape(event.title)}\n" @@ -427,6 +451,8 @@ def _format_event_body_html(event: Event) -> str: return format_rdp_shadow_html(event) if event.type.startswith("winrm."): return format_winrm_session_html(event) + if event.type.startswith("smb."): + return format_smb_admin_share_html(event) return format_generic_event_html(event) @@ -480,6 +506,7 @@ def format_problem_telegram_html(problem: Problem, event: Event | None = None) - "rdp.shadow.control.stopped", "rdp.shadow.control.permission", "winrm.session.started", + "smb.admin_share.access", ): msg += "\n" + _format_event_body_html(event) return append_notification_source_html(msg, generated_by="sac") diff --git a/docs/agent-integration.md b/docs/agent-integration.md index a6af1b7..4a80d08 100644 --- a/docs/agent-integration.md +++ b/docs/agent-integration.md @@ -187,6 +187,7 @@ Idempotency-Key: 550e8400-e29b-41d4-a716-446655440000 | RCM **20507** Shadow Control stopped | `rdp.shadow.control.stopped` | **warning** | | RCM **20510** Shadow Control permission | `rdp.shadow.control.permission` | **warning** | | WinRM **91** inbound shell (Enter-PSSession) | `winrm.session.started` | **warning** | +| Security **5140** admin share (`C$`, `ADMIN$`) | `smb.admin_share.access` | **warning** | | 4648 | `auth.explicit.credentials` | warning | | RD Gateway 302 | `rdg.connection.success` | info | | RD Gateway 303 | `rdg.connection.failed` | warning | @@ -198,10 +199,11 @@ Idempotency-Key: 550e8400-e29b-41d4-a716-446655440000 - `event_id_windows`, `logon_type`, `ip_address`, `workstation_name` - Shadow: `shadower_user`, `target_user`, `session_id`, `shadow_mode`, `shadow_action` - WinRM: `source_ip`, `resource_uri`, `transport` +- Admin share 5140: `share_name`, `share_path`, `relative_target`, `access_mask` - `gateway_target`, `gateway_error_code` - `filtered_out`, `filter_reason` -**Переключатели в `login_monitor.settings.ps1` (≥ 1.2.23-SAC):** `$EnableRcmShadowControlMonitoring`, `$EnableWinRmInboundMonitoring` (по умолчанию `1`). Подавление: `ignore.lst` с префиксами `shadow:` и `winrm:`. +**Переключатели в `login_monitor.settings.ps1` (≥ 1.2.23-SAC):** `$EnableRcmShadowControlMonitoring`, `$EnableWinRmInboundMonitoring`, `$EnableAdminShareMonitoring` (по умолчанию `1`; Security **5140**, audit File Share). Подавление: `ignore.lst` с префиксами `shadow:`, `winrm:`, `smb:` / `5140:`. --- diff --git a/docs/event-schema-v1.json b/docs/event-schema-v1.json index 35631ba..5d9b725 100644 --- a/docs/event-schema-v1.json +++ b/docs/event-schema-v1.json @@ -98,6 +98,7 @@ "rdp.shadow.control.stopped", "rdp.shadow.control.permission", "winrm.session.started", + "smb.admin_share.access", "rdg.connection.success", "report.daily.ssh", "agent.heartbeat", diff --git a/schemas/event-schema-v1.json b/schemas/event-schema-v1.json index d5004d4..99aff47 100644 --- a/schemas/event-schema-v1.json +++ b/schemas/event-schema-v1.json @@ -98,6 +98,7 @@ "rdp.shadow.control.stopped", "rdp.shadow.control.permission", "winrm.session.started", + "smb.admin_share.access", "rdg.connection.success", "rdg.connection.disconnected", "rdg.connection.failed",