101 lines
3.1 KiB
Plaintext
101 lines
3.1 KiB
Plaintext
|
/* MeshSafe 测试靶场 YARA 规则
|
|||
|
|
* 自动生成，覆盖 CSV L4-001 ~ L4-012
|
|||
|
|
* 引擎自动扫描 rules/*.yar，热加载
|
|||
|
|
*/
|
|||
|
|
|
|||
|
|
// L4-001: 基础规则 —— 正向命中 shell 反弹特征
|
|||
|
|
rule Test_ReverseShell_Basic {
|
|||
|
|
meta:
|
|||
|
|
family = "TestRules"
|
|||
|
|
author = "MeshSafe Test Suite"
|
|||
|
|
version = "1.0"
|
|||
|
|
description = "L4-001 基础规则: 匹配 nc 反弹 shell 特征"
|
|||
|
|
strings:
|
|||
|
|
$a = /nc\s+[0-9.]+\s+[0-9]+\s+-e/
|
|||
|
|
$b = /bash\s+-i\s+>&\s+\/dev\/tcp\//
|
|||
|
|
condition:
|
|||
|
|
$a or $b
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
// L4-004: 第二条规则 —— 同时命中验证
|
|||
|
|
rule Test_PowerShell_Download {
|
|||
|
|
meta:
|
|||
|
|
family = "TestRules"
|
|||
|
|
author = "MeshSafe Test Suite"
|
|||
|
|
description = "L4-004 多规则同时命中: 匹配 PowerShell 下载"
|
|||
|
|
strings:
|
|||
|
|
$c = /Invoke-WebRequest\s+-Uri/
|
|||
|
|
$d = /powershell\s+-w\s+hidden/
|
|||
|
|
condition:
|
|||
|
|
$c or $d
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
// L4-005: 新增规则（热加载验证）
|
|||
|
|
rule Newly_Added_Rule_Test {
|
|||
|
|
meta:
|
|||
|
|
family = "TestRules"
|
|||
|
|
author = "MeshSafe Test Suite"
|
|||
|
|
description = "L4-005 热加载验证: 运行时新增此规则后应能命中"
|
|||
|
|
strings:
|
|||
|
|
$e = "meshsafe-hot-reload-test-string"
|
|||
|
|
condition:
|
|||
|
|
$e
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
// L4-007: metadata 标签测试
|
|||
|
|
rule Meta_Label_Test {
|
|||
|
|
meta:
|
|||
|
|
family = "Trojan.Generic"
|
|||
|
|
author = "Security Researcher"
|
|||
|
|
description = "L4-007 metadata 输出验证: 规则带完整 meta 字段"
|
|||
|
|
severity = "high"
|
|||
|
|
strings:
|
|||
|
|
$f = "trojan-metadata-test"
|
|||
|
|
condition:
|
|||
|
|
$f
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
// L4-010: 正则型规则
|
|||
|
|
rule Regex_Shell_Pattern {
|
|||
|
|
meta:
|
|||
|
|
family = "TestRules"
|
|||
|
|
author = "MeshSafe Test Suite"
|
|||
|
|
description = "L4-010 正则匹配: powershell -enc 编码执行"
|
|||
|
|
strings:
|
|||
|
|
$g = /powershell\s+-e[nN][cC]\s+[A-Za-z0-9+\/]{20,}/
|
|||
|
|
condition:
|
|||
|
|
$g
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
// L4-011: count 条件（出现 ≥3 次才触发）
|
|||
|
|
rule Count_Condition_Test {
|
|||
|
|
meta:
|
|||
|
|
family = "TestRules"
|
|||
|
|
author = "MeshSafe Test Suite"
|
|||
|
|
description = "L4-011 count 条件: 文件内匹配串 ≥3 次命中"
|
|||
|
|
strings:
|
|||
|
|
$h = "malicious_token_count_test"
|
|||
|
|
condition:
|
|||
|
|
#h >= 3
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
// L4-012: size 条件（仅匹配 ≤10KB 的文件）
|
|||
|
|
rule Size_Condition_Test {
|
|||
|
|
meta:
|
|||
|
|
family = "TestRules"
|
|||
|
|
author = "MeshSafe Test Suite"
|
|||
|
|
description = "L4-012 size 条件: 仅匹配 size <= 10KB 的文件"
|
|||
|
|
strings:
|
|||
|
|
$i = "size_condition_test_payload"
|
|||
|
|
condition:
|
|||
|
|
$i and filesize <= 10KB
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
// L4-003: PE 内字符串（实际是 Test_PowerShell_Download 的 strings 也在 PE 里）
|
|||
|
|
// 已由 Test_PowerShell_Download 覆盖，因为 PE 里的 strings() 也会被 YARA 扫描
|
|||
|
|
|
|||
|
|
// L4-009: 加密包内无法扫描（不是规则缺失，是 zipfile 跳过加密内容）
|
|||
|
|
// L4-013: 大文件 YARA —— 由 Test_ReverseShell_Basic 自动覆盖大文件扫描
|
|||
|
|
// L4-014: 开关测试 —— 由引擎 is_enabled() 控制
|
|||
|
|
// L4-015: 哈希白名单 —— 需在 policy.yaml 配置，不是 .yar 文件
|