Spaces:

capta1n
/

bas3

Running

App Files Files Community

capta1n commited on Apr 21, 2025

Commit

056d336

verified ·

1 Parent(s): 03b69cb

Add 3 files

Browse files

Files changed (3) hide show

README.md +7 -5
index.html +637 -19
prompts.txt +1 -0

README.md CHANGED Viewed

@@ -1,10 +1,12 @@
 ---
-title: Bas3
-emoji: 🌍
-colorFrom: red
-colorTo: gray
 sdk: static
 pinned: false
 ---
-Check out the configuration reference at https://huggingface.co/docs/hub/spaces-config-reference

 ---
+title: bas3
+emoji: 🐳
+colorFrom: green
+colorTo: green
 sdk: static
 pinned: false
+tags:
+  - deepsite
 ---
+Check out the configuration reference at https://huggingface.co/docs/hub/spaces-config-reference

index.html CHANGED Viewed

@@ -1,19 +1,637 @@
-<!doctype html>
-<html>
-	<head>
-		<meta charset="utf-8" />
-		<meta name="viewport" content="width=device-width" />
-		<title>My static Space</title>
-		<link rel="stylesheet" href="style.css" />
-	</head>
-	<body>
-		<div class="card">
-			<h1>Welcome to your static Space!</h1>
-			<p>You can modify this app directly by editing <i>index.html</i> in the Files and versions tab.</p>
-			<p>
-				Also don't forget to check the
-				<a href="https://huggingface.co/docs/hub/spaces" target="_blank">Spaces documentation</a>.
-			</p>
-		</div>
-	</body>
-</html>

+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>Advanced Phishing Attack Kill Chain Visualization</title>
+    <script src="https://cdn.tailwindcss.com"></script>
+    <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.0/css/all.min.css">
+    <script src="https://unpkg.com/vis-network/standalone/umd/vis-network.min.js"></script>
+    <style>
+        #network {
+            width: 100%;
+            height: 500px;
+            border: 1px solid #e5e7eb;
+            border-radius: 0.5rem;
+            background-color: #f9fafb;
+        }
+        .node-tooltip {
+            position: absolute;
+            background: white;
+            border: 1px solid #e5e7eb;
+            border-radius: 0.5rem;
+            padding: 1rem;
+            box-shadow: 0 4px 6px -1px rgba(0, 0, 0, 0.1);
+            max-width: 400px;
+            z-index: 100;
+            pointer-events: none;
+            display: none;
+        }
+        .alert-item {
+            border-left: 4px solid;
+            transition: all 0.2s ease;
+        }
+        .alert-item:hover {
+            background-color: #f8fafc;
+        }
+        .severity-critical {
+            border-left-color: #ef4444;
+        }
+        .severity-high {
+            border-left-color: #f59e0b;
+        }
+        .severity-emergency {
+            border-left-color: #dc2626;
+        }
+        .node-phishing {
+            background-color: #fef2f2;
+            border-color: #fca5a5;
+        }
+        .node-execution {
+            background-color: #fffbeb;
+            border-color: #fcd34d;
+        }
+        .node-c2 {
+            background-color: #ecfdf5;
+            border-color: #6ee7b7;
+        }
+        .node-lateral {
+            background-color: #eff6ff;
+            border-color: #93c5fd;
+        }
+        .node-data-theft {
+            background-color: #f5f3ff;
+            border-color: #a78bfa;
+        }
+        .node-cloud {
+            background-color: #fce7f3;
+            border-color: #f9a8d4;
+        }
+        .node-exfiltration {
+            background-color: #fefce8;
+            border-color: #facc15;
+        }
+    </style>
+</head>
+<body class="bg-gray-50">
+    <div class="container mx-auto px-4 py-8">
+        <div class="flex justify-between items-center mb-6">
+            <div>
+                <h1 class="text-2xl font-bold text-gray-800">Advanced Phishing Attack Kill Chain</h1>
+                <p class="text-gray-600">Visualization of the complete attack flow from initial compromise to data exfiltration</p>
+            </div>
+            <div class="flex space-x-2">
+                <button id="zoom-in" class="p-2 bg-white rounded-md border border-gray-200 hover:bg-gray-50">
+                    <i class="fas fa-search-plus"></i>
+                </button>
+                <button id="zoom-out" class="p-2 bg-white rounded-md border border-gray-200 hover:bg-gray-50">
+                    <i class="fas fa-search-minus"></i>
+                </button>
+                <button id="fit-view" class="p-2 bg-white rounded-md border border-gray-200 hover:bg-gray-50">
+                    <i class="fas fa-expand"></i>
+                </button>
+            </div>
+        </div>
+        <div class="grid grid-cols-1 lg:grid-cols-3 gap-6">
+            <div class="lg:col-span-2">
+                <div id="network"></div>
+            </div>
+            <div class="bg-white rounded-lg shadow-sm border border-gray-200 p-4">
+                <div class="flex justify-between items-center mb-4">
+                    <h3 class="font-semibold text-lg">Attack Step Details</h3>
+                    <span id="step-number" class="bg-blue-100 text-blue-800 text-xs font-medium px-2.5 py-0.5 rounded">Step 1</span>
+                </div>
+                <div id="node-details" class="space-y-4">
+                    <div>
+                        <h4 class="font-medium text-gray-700 mb-1">Attack Behavior</h4>
+                        <div id="attack-behavior" class="bg-gray-50 p-3 rounded text-sm text-gray-700"></div>
+                    </div>
+                    <div>
+                        <h4 class="font-medium text-gray-700 mb-1">Triggered Defenses</h4>
+                        <div id="triggered-defenses" class="text-sm text-gray-700"></div>
+                    </div>
+                    <div>
+                        <h4 class="font-medium text-gray-700 mb-1">Security Alerts</h4>
+                        <div id="security-alerts" class="space-y-2"></div>
+                    </div>
+                </div>
+            </div>
+        </div>
+        <div class="mt-8 bg-white rounded-lg shadow-sm border border-gray-200 overflow-hidden">
+            <div class="border-b border-gray-200 px-4 py-3">
+                <h3 class="font-semibold text-gray-800">Attack Kill Chain Timeline</h3>
+            </div>
+            <div class="divide-y divide-gray-200">
+                <div id="timeline-container" class="divide-y divide-gray-200"></div>
+            </div>
+        </div>
+    </div>
+    <div id="node-tooltip" class="node-tooltip"></div>
+    <script>
+        // Attack steps data
+        const attackSteps = [
+            {
+                id: 1,
+                label: "1. Phishing Email",
+                title: "Phishing Email Delivery",
+                group: "phishing",
+                behavior: "Forged 'Embrace AI Change' notification email containing malicious file disguised as files.zip",
+                defenses: "Email Security Gateway",
+                alerts: [
+                    {
+                        severity: "critical",
+                        message: "Detected spoofed sender email | From: itsupport@fakecompany[.]com → To: victim@corp.com | Contains malicious attachment (SHA256: a1b2c3...) | Identified as Emotet phishing template"
+                    }
+                ],
+                x: -300,
+                y: 0
+            },
+            {
+                id: 2,
+                label: "2. Malware Execution",
+                title: "Trojan Execution",
+                group: "execution",
+                behavior: "Victim downloads malicious file triggering PowerShell script that downloads Cobalt Strike DLL and injects into legitimate process",
+                defenses: "Endpoint Detection & Response (EDR)",
+                alerts: [
+                    {
+                        severity: "high",
+                        message: "Suspicious process injection | Process: C:\\Windows\\System32\\explorer.exe → Loaded module: a09xdf.dll | DLL signature invalid and matches known Cobalt Strike signature"
+                    }
+                ],
+                x: -150,
+                y: -100
+            },
+            {
+                id: 3,
+                label: "3. C2 Establishment",
+                title: "C2 Channel & Lateral Movement",
+                group: "c2",
+                behavior: "HTTPS heartbeat communication via CDN domain (api.cloudfront[.]com), deploying reverse SSH tunnel to internal jump server",
+                defenses: "Network Traffic Analysis (NTA)",
+                alerts: [
+                    {
+                        severity: "emergency",
+                        message: "Anomalous outbound connection | Target IP: 54.231.1.1 (AWS Singapore) | Protocol: HTTPS | Abnormal certificate (CN=*.cloudfront[.]com but issued by wildcard Let's Encrypt cert)"
+                    }
+                ],
+                x: 0,
+                y: 0
+            },
+            {
+                id: 4,
+                label: "4. Credential Theft",
+                title: "Credential Theft & Browser Simulation",
+                group: "data-theft",
+                behavior: "Using Mimikatz to extract Chrome browser cookies and forging User-Agent (synchronizing victim's browser fingerprint)",
+                defenses: "User Behavior Analytics (UEBA)",
+                alerts: [
+                    {
+                        severity: "high",
+                        message: "Abnormal browser session | User: Victim_Account | Source IP: 172.16.1.23 → Device fingerprint changed (new VM characteristics/QEMU virtual GPU)"
+                    }
+                ],
+                x: 150,
+                y: -100
+            },
+            {
+                id: 5,
+                label: "5. Cloud Docs Access",
+                title: "Cloud Documentation Penetration",
+                group: "cloud",
+                behavior: "Hijacked Yuque API Token used to access 'Production Environment Operations Manual', extracting embedded SSH private key (Base64 encoded)",
+                defenses: "Data Loss Prevention (DLP)",
+                alerts: [
+                    {
+                        severity: "critical",
+                        message: "Sensitive data access | User: Victim_Account | Action: Downloaded document ID: YUQUE-1234 | Content matched keyword: 'prod_ssh_private_key'"
+                    }
+                ],
+                x: 300,
+                y: 0
+            },
+            {
+                id: 6,
+                label: "6. Production Access",
+                title: "Production Network Intrusion",
+                group: "lateral",
+                behavior: "Using SSH certificate from jump server to log into MySQL database server (IP: 10.8.8.88, account: dba_admin)",
+                defenses: "Host Intrusion Detection (HIDS)",
+                alerts: [
+                    {
+                        severity: "emergency",
+                        message: "Unusual time SSH login | Account: dba_admin | Source IP: 10.8.8.12 (test env jump server) | Action: Executed SHOW DATABASES"
+                    }
+                ],
+                x: 450,
+                y: -100
+            },
+            {
+                id: 7,
+                label: "7. Data Exfiltration",
+                title: "Data Exfiltration",
+                group: "exfiltration",
+                behavior: "Compressed and encrypted customer data (filename: taobaodata.tar.gz.enc) transmitted via DNS tunnel to alibaba-bas.com",
+                defenses: "Full Traffic Threat Analysis",
+                alerts: [
+                    {
+                        severity: "critical",
+                        message: "Abnormal data transfer | Protocol: DNS TXT records | Target domain: xyz.attacker[.]com | Data volume: 142MB (500% above threshold)"
+                    }
+                ],
+                x: 600,
+                y: 0
+            }
+        ];
+        // Create nodes and edges for the network
+        const nodes = new vis.DataSet(
+            attackSteps.map(step => ({
+                id: step.id,
+                label: step.label,
+                group: step.group,
+                title: step.title,
+                x: step.x,
+                y: step.y,
+                physics: false,
+                fixed: {
+                    x: false,
+                    y: false
+                }
+            }))
+        );
+        const edges = new vis.DataSet(
+            attackSteps.slice(0, -1).map((step, index) => ({
+                id: index + 1,
+                from: step.id,
+                to: attackSteps[index + 1].id,
+                arrows: "to",
+                smooth: {
+                    type: "curvedCW",
+                    roundness: 0.2
+                },
+                color: {
+                    color: "#9ca3af",
+                    highlight: "#3b82f6",
+                    hover: "#3b82f6"
+                },
+                width: 2
+            }))
+        );
+        // Network container
+        const container = document.getElementById("network");
+        const data = {
+            nodes: nodes,
+            edges: edges
+        };
+        const options = {
+            nodes: {
+                shape: "box",
+                size: 20,
+                borderWidth: 2,
+                shadow: {
+                    enabled: true,
+                    color: "rgba(0,0,0,0.2)",
+                    size: 10,
+                    x: 5,
+                    y: 5
+                },
+                font: {
+                    size: 12,
+                    face: "Inter",
+                    bold: {
+                        color: "#1f2937"
+                    }
+                },
+                widthConstraint: {
+                    maximum: 100
+                },
+                margin: 10
+            },
+            edges: {
+                smooth: {
+                    type: "curvedCW",
+                    roundness: 0.2
+                },
+                selectionWidth: 3,
+                arrowStrikethrough: false
+            },
+            groups: {
+                phishing: {
+                    color: {
+                        border: "#fca5a5",
+                        background: "#fef2f2",
+                        highlight: {
+                            border: "#ef4444",
+                            background: "#fee2e2"
+                        },
+                        hover: {
+                            border: "#ef4444",
+                            background: "#fee2e2"
+                        }
+                    }
+                },
+                execution: {
+                    color: {
+                        border: "#fcd34d",
+                        background: "#fffbeb",
+                        highlight: {
+                            border: "#f59e0b",
+                            background: "#fef3c7"
+                        },
+                        hover: {
+                            border: "#f59e0b",
+                            background: "#fef3c7"
+                        }
+                    }
+                },
+                c2: {
+                    color: {
+                        border: "#6ee7b7",
+                        background: "#ecfdf5",
+                        highlight: {
+                            border: "#10b981",
+                            background: "#d1fae5"
+                        },
+                        hover: {
+                            border: "#10b981",
+                            background: "#d1fae5"
+                        }
+                    }
+                },
+                "data-theft": {
+                    color: {
+                        border: "#a78bfa",
+                        background: "#f5f3ff",
+                        highlight: {
+                            border: "#8b5cf6",
+                            background: "#ede9fe"
+                        },
+                        hover: {
+                            border: "#8b5cf6",
+                            background: "#ede9fe"
+                        }
+                    }
+                },
+                cloud: {
+                    color: {
+                        border: "#f9a8d4",
+                        background: "#fce7f3",
+                        highlight: {
+                            border: "#ec4899",
+                            background: "#fbcfe8"
+                        },
+                        hover: {
+                            border: "#ec4899",
+                            background: "#fbcfe8"
+                        }
+                    }
+                },
+                lateral: {
+                    color: {
+                        border: "#93c5fd",
+                        background: "#eff6ff",
+                        highlight: {
+                            border: "#3b82f6",
+                            background: "#dbeafe"
+                        },
+                        hover: {
+                            border: "#3b82f6",
+                            background: "#dbeafe"
+                        }
+                    }
+                },
+                exfiltration: {
+                    color: {
+                        border: "#facc15",
+                        background: "#fefce8",
+                        highlight: {
+                            border: "#eab308",
+                            background: "#fef9c3"
+                        },
+                        hover: {
+                            border: "#eab308",
+                            background: "#fef9c3"
+                        }
+                    }
+                }
+            },
+            physics: {
+                enabled: true,
+                solver: "forceAtlas2Based",
+                forceAtlas2Based: {
+                    gravitationalConstant: -50,
+                    centralGravity: 0.01,
+                    springLength: 200,
+                    springConstant: 0.08,
+                    damping: 0.4
+                },
+                stabilization: {
+                    iterations: 100
+                }
+            },
+            interaction: {
+                dragNodes: true,
+                dragView: true,
+                hideEdgesOnDrag: false,
+                multiselect: false,
+                navigationButtons: false,
+                keyboard: {
+                    enabled: true,
+                    speed: {
+                        x: 10,
+                        y: 10,
+                        zoom: 0.02
+                    }
+                },
+                tooltipDelay: 100
+            },
+            layout: {
+                improvedLayout: true
+            }
+        };
+        // Initialize network
+        const network = new vis.Network(container, data, options);
+        // Tooltip handling
+        const tooltip = document.getElementById("node-tooltip");
+        network.on("hoverNode", function(params) {
+            const nodeId = params.node;
+            const node = nodes.get(nodeId);
+            const step = attackSteps.find(s => s.id === nodeId);
+            if (step) {
+                tooltip.innerHTML = `
+                    <h4 class="font-semibold text-gray-800 mb-2">${step.title}</h4>
+                    <p class="text-sm text-gray-600">${step.behavior}</p>
+                `;
+                const nodePos = network.getPositions([nodeId]);
+                const canvasPos = network.canvasToDOM({
+                    x: nodePos[nodeId].x,
+                    y: nodePos[nodeId].y
+                });
+                tooltip.style.left = `${canvasPos.x + 20}px`;
+                tooltip.style.top = `${canvasPos.y - 20}px`;
+                tooltip.style.display = "block";
+            }
+        });
+        network.on("blurNode", function() {
+            tooltip.style.display = "none";
+        });
+        // Node click handling
+        network.on("click", function(params) {
+            if (params.nodes.length > 0) {
+                const nodeId = params.nodes[0];
+                const step = attackSteps.find(s => s.id === nodeId);
+                if (step) {
+                    // Update step details
+                    document.getElementById("step-number").textContent = `Step ${step.id}`;
+                    document.getElementById("attack-behavior").textContent = step.behavior;
+                    document.getElementById("triggered-defenses").textContent = step.defenses;
+                    // Update alerts
+                    const alertsContainer = document.getElementById("security-alerts");
+                    alertsContainer.innerHTML = step.alerts.map(alert => `
+                        <div class="alert-item p-3 rounded ${`severity-${alert.severity}`}">
+                            <div class="text-sm font-medium text-gray-800">[${alert.severity.toUpperCase()}] ${alert.message}</div>
+                        </div>
+                    `).join("");
+                    // Highlight the timeline item
+                    document.querySelectorAll("#timeline-container div").forEach((el, idx) => {
+                        if (idx === step.id - 1) {
+                            el.classList.add("bg-blue-50");
+                        } else {
+                            el.classList.remove("bg-blue-50");
+                        }
+                    });
+                }
+            }
+        });
+        // Initialize timeline
+        const timelineContainer = document.getElementById("timeline-container");
+        timelineContainer.innerHTML = attackSteps.map(step => `
+            <div class="px-4 py-3 hover:bg-gray-50 cursor-pointer transition-colors duration-150" data-step="${step.id}">
+                <div class="flex items-start">
+                    <div class="flex-shrink-0 pt-0.5">
+                        <div class="w-3 h-3 rounded-full ${step.group === "phishing" ? "bg-red-500" :
+                           step.group === "execution" ? "bg-yellow-500" :
+                           step.group === "c2" ? "bg-green-500" :
+                           step.group === "data-theft" ? "bg-purple-500" :
+                           step.group === "cloud" ? "bg-pink-500" :
+                           step.group === "lateral" ? "bg-blue-500" : "bg-indigo-500"}"></div>
+                    </div>
+                    <div class="ml-3">
+                        <h4 class="text-sm font-medium text-gray-800">${step.title}</h4>
+                        <p class="text-xs text-gray-500 mt-1">${step.defenses}</p>
+                    </div>
+                </div>
+            </div>
+        `).join("");
+        // Timeline click handling
+        document.querySelectorAll("#timeline-container div[data-step]").forEach(el => {
+            el.addEventListener("click", function() {
+                const stepId = parseInt(this.getAttribute("data-step"));
+                network.selectNodes([stepId]);
+                network.focus(stepId, {
+                    animation: {
+                        duration: 500,
+                        easingFunction: "easeInOutQuad"
+                    }
+                });
+                // Simulate node click to update details
+                const step = attackSteps.find(s => s.id === stepId);
+                if (step) {
+                    document.getElementById("step-number").textContent = `Step ${step.id}`;
+                    document.getElementById("attack-behavior").textContent = step.behavior;
+                    document.getElementById("triggered-defenses").textContent = step.defenses;
+                    const alertsContainer = document.getElementById("security-alerts");
+                    alertsContainer.innerHTML = step.alerts.map(alert => `
+                        <div class="alert-item p-3 rounded ${`severity-${alert.severity}`}">
+                            <div class="text-sm font-medium text-gray-800">[${alert.severity.toUpperCase()}] ${alert.message}</div>
+                        </div>
+                    `).join("");
+                    // Highlight the timeline item
+                    document.querySelectorAll("#timeline-container div").forEach((el, idx) => {
+                        if (idx === step.id - 1) {
+                            el.classList.add("bg-blue-50");
+                        } else {
+                            el.classList.remove("bg-blue-50");
+                        }
+                    });
+                }
+            });
+        });
+        // Zoom controls
+        document.getElementById("zoom-in").addEventListener("click", function() {
+            network.moveTo({
+                scale: network.getScale() * 1.2,
+                animation: true
+            });
+        });
+        document.getElementById("zoom-out").addEventListener("click", function() {
+            network.moveTo({
+                scale: network.getScale() / 1.2,
+                animation: true
+            });
+        });
+        document.getElementById("fit-view").addEventListener("click", function() {
+            network.fit({
+                animation: {
+                    duration: 1000,
+                    easingFunction: "easeInOutQuad"
+                }
+            });
+        });
+        // Initialize with first step selected
+        setTimeout(() => {
+            network.selectNodes([1]);
+            network.focus(1, {
+                animation: {
+                    duration: 500,
+                    easingFunction: "easeInOutQuad"
+                }
+            });
+            const step = attackSteps[0];
+            document.getElementById("step-number").textContent = `Step ${step.id}`;
+            document.getElementById("attack-behavior").textContent = step.behavior;
+            document.getElementById("triggered-defenses").textContent = step.defenses;
+            const alertsContainer = document.getElementById("security-alerts");
+            alertsContainer.innerHTML = step.alerts.map(alert => `
+                <div class="alert-item p-3 rounded ${`severity-${alert.severity}`}">
+                    <div class="text-sm font-medium text-gray-800">[${alert.severity.toUpperCase()}] ${alert.message}</div>
+                </div>
+            `).join("");
+            // Highlight first timeline item
+            document.querySelector("#timeline-container div:first-child").classList.add("bg-blue-50");
+        }, 500);
+    </script>
+<p style="border-radius: 8px; text-align: center; font-size: 12px; color: #fff; margin-top: 16px;position: fixed; left: 8px; bottom: 8px; z-index: 10; background: rgba(0, 0, 0, 0.8); padding: 4px 8px;">Made with <img src="https://enzostvs-deepsite.hf.space/logo.svg" alt="DeepSite Logo" style="width: 16px; height: 16px; vertical-align: middle;display:inline-block;margin-right:3px;filter:brightness(0) invert(1);"><a href="https://enzostvs-deepsite.hf.space" style="color: #fff;text-decoration: underline;" target="_blank" >DeepSite</a> - 🧬 <a href="https://enzostvs-deepsite.hf.space?remix=capta1n/bas3" style="color: #fff;text-decoration: underline;" target="_blank" >Remix</a></p></body>
+</html>

prompts.txt ADDED Viewed

	@@ -0,0 +1 @@

+ 将以下攻击步骤转化为攻击拓扑图表的形式进行展示，在一个图表中完整按顺序展示攻击步骤，以攻击者为起点，每个节点为一个攻击行为，每个攻击节点之间按顺序用箭头进行连接，每个攻击节点点开后在图表侧边弹窗展示具体的攻击行为内容，图表下方展示每个步骤触发的防护产品名称和告警信息内容。图表设计要求 1. 图表中的连线和节点不要重叠 2. 缩小每个节点的大小确保图表可以完整清晰的展示全部攻击节点和节点之间的执行顺序 3. 节点和连线在图表上可以自由拖拽步骤1：钓鱼邮件投递 ● 攻击行为：伪造"拥抱AI变革"通知邮件，内含带恶意木马的文件（伪造成files.zip文件） ● 触发防护：邮件安全网关 ● 告警信息：[严重] 检测到仿冒发件人邮件 | 发件人: itsupport@fakecompany[.]com → 目标: victim@corp.com | 包含恶意附件哈希(SHA256: a1b2c3...) | 判定为Emotet钓鱼模板步骤2：木马执行 ● 攻击行为：受害者下载木马文件后触发PowerShell脚本，下载Cobalt Strike DLL并注入到合法进程 ● 触发防护：终端检测与响应（EDR） ● 告警信息：[高危] 可疑进程注入行为 | 进程: C:\Windows\System32\explorer.exe → 加载内存模块: a09xdf.dll | DLL签名无效且匹配已知Cobalt Strike特征码步骤3：C2通道建立与横向移动 ● 攻击行为：通过CDN域名的HTTPS心跳通信（如api.cloudfront[.]com），部署反向SSH隧道至内网跳板机 ● 触发防护：网络流量分析（NTA） ● 告警信息：[紧急] 异常外联行为 | 目标IP: 54.231.1.1（归属AWS新加坡） | 协议: HTTPS | 证书指纹异常（CN=*.cloudfront[.]com但签发者匹配Let's Encrypt野生证书）步骤4：凭据窃取与浏览器模拟 ● 攻击行为：利用Mimikatz提取Chrome浏览器Cookie并伪造User-Agent（同步受害者浏览器指纹） ● 触发防护：身份认证异常检测（UEBA） ● 告警信息:[高危] 异常浏览器会话 | 用户: Victim_Account | IP来源: 172.16.1.23 → 登录设备指纹突变（新增虚拟机特征/QEMU虚拟显卡）步骤5：云文档渗透 ● 攻击行为：通过劫持的语雀API Token访问《生产环境运维手册》，提取内嵌的SSH私钥（Base64编码） ● 触发防护：DLP（数据防泄漏） ● 告警信息：[严重] 敏感数据访问行为 | 用户: Victim_Account | 操作: 下载文档ID: YUQUE-1234 | 内容匹配关键字: "prod_ssh_private_key" 步骤6：生产网络入侵 ● 攻击行为：通过跳板机使用SSH证书登陆MySQL数据库服务器（IP: 10.8.8.88，账号: dba_admin） ● 触发防护：HIDS（主机入侵检测） ● 告警信息：[紧急] 非常规时间SSH登录 | 账号: dba_admin | 来源IP: 10.8.8.12（测试环境跳板机） | 操作: 执行SHOW DATABASES 步骤7：数据外泄 ● 攻击行为：将压缩加密后的客户数据（文件名: taobaodata.tar.gz.enc）通过DNS隧道传输到alibaba-bas.com ● 触发防护：全流量威胁回溯 ● 告警信息：[严重] 异常数据传输 | 协议: DNS TXT记录 | 目标域: xyz.attacker[.]com | 数据量: 142MB（超阈值500%）