650 lines
16 KiB
JSON
650 lines
16 KiB
JSON
|
[
|
|||
|
|
{
|
|||
|
|
"filename": "evil_help.chm",
|
|||
|
|
"category": "CHM帮助",
|
|||
|
|
"description": "CHM 帮助文件内嵌 VBScript/JScript + .exe/.vbs/.js 引用",
|
|||
|
|
"expected_verdict": "reject",
|
|||
|
|
"actual_verdict": "malicious",
|
|||
|
|
"expected_rules": [
|
|||
|
|
"ChmWithScript"
|
|||
|
|
],
|
|||
|
|
"actual_rules": [
|
|||
|
|
"ChmWithScript",
|
|||
|
|
"DangerousExecutableExtension"
|
|||
|
|
],
|
|||
|
|
"verdict_ok": true,
|
|||
|
|
"rule_ok": true,
|
|||
|
|
"overall": true,
|
|||
|
|
"score": 100.0,
|
|||
|
|
"findings_count": 2
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"filename": "evil.iso",
|
|||
|
|
"category": "ISO镜像",
|
|||
|
|
"description": "ISO 镜像内嵌 ELF 可执行文件",
|
|||
|
|
"expected_verdict": "reject",
|
|||
|
|
"actual_verdict": "error",
|
|||
|
|
"expected_rules": [
|
|||
|
|
"IsoWithExecutable"
|
|||
|
|
],
|
|||
|
|
"actual_rules": [
|
|||
|
|
"DangerousExecutableExtension"
|
|||
|
|
],
|
|||
|
|
"verdict_ok": true,
|
|||
|
|
"rule_ok": true,
|
|||
|
|
"overall": true,
|
|||
|
|
"score": 100.0,
|
|||
|
|
"findings_count": 1
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"filename": "shortcut.lnk",
|
|||
|
|
"category": "LNK",
|
|||
|
|
"description": "LNK Shell Link 指向 cmd.exe /c 下载执行",
|
|||
|
|
"expected_verdict": "reject",
|
|||
|
|
"actual_verdict": "error",
|
|||
|
|
"expected_rules": [
|
|||
|
|
"LnkWithAutoExec"
|
|||
|
|
],
|
|||
|
|
"actual_rules": [
|
|||
|
|
"DangerousExecutableExtension"
|
|||
|
|
],
|
|||
|
|
"verdict_ok": true,
|
|||
|
|
"rule_ok": true,
|
|||
|
|
"overall": true,
|
|||
|
|
"score": 100.0,
|
|||
|
|
"findings_count": 1
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"filename": "lolbin.cmd",
|
|||
|
|
"category": "LOLBin",
|
|||
|
|
"description": "certutil -decode LOLBin 下载执行",
|
|||
|
|
"expected_verdict": "reject",
|
|||
|
|
"actual_verdict": "error",
|
|||
|
|
"expected_rules": [
|
|||
|
|
"C1_PE_LOLBin_Usage"
|
|||
|
|
],
|
|||
|
|
"actual_rules": [
|
|||
|
|
"DangerousExecutableExtension"
|
|||
|
|
],
|
|||
|
|
"verdict_ok": true,
|
|||
|
|
"rule_ok": true,
|
|||
|
|
"overall": true,
|
|||
|
|
"score": 100.0,
|
|||
|
|
"findings_count": 1
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"filename": "linux_malicious",
|
|||
|
|
"category": "Linux可执行",
|
|||
|
|
"description": "合法 ELF 魔数 → 被识别为 Linux 可执行文件",
|
|||
|
|
"expected_verdict": "reject",
|
|||
|
|
"actual_verdict": "malicious",
|
|||
|
|
"expected_rules": [
|
|||
|
|
"LinuxExecutable"
|
|||
|
|
],
|
|||
|
|
"actual_rules": [
|
|||
|
|
"C7_Linux_ReverseShell_Bash",
|
|||
|
|
"LinuxExecutable"
|
|||
|
|
],
|
|||
|
|
"verdict_ok": true,
|
|||
|
|
"rule_ok": true,
|
|||
|
|
"overall": true,
|
|||
|
|
"score": 100.0,
|
|||
|
|
"findings_count": 2
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"filename": "malicious.desktop",
|
|||
|
|
"category": "Linux后门",
|
|||
|
|
"description": ".desktop 文件恶意 Exec 字段",
|
|||
|
|
"expected_verdict": "reject",
|
|||
|
|
"actual_verdict": "malicious",
|
|||
|
|
"expected_rules": [
|
|||
|
|
"DesktopFileAutoExec"
|
|||
|
|
],
|
|||
|
|
"actual_rules": [
|
|||
|
|
"C7_Linux_ReverseShell_Bash",
|
|||
|
|
"C7_Linux_ReverseShell_Misc",
|
|||
|
|
"DangerousExecutableExtension",
|
|||
|
|
"DesktopFileAutoExec"
|
|||
|
|
],
|
|||
|
|
"verdict_ok": true,
|
|||
|
|
"rule_ok": true,
|
|||
|
|
"overall": true,
|
|||
|
|
"score": 100.0,
|
|||
|
|
"findings_count": 5
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"filename": "shell_bash_devtcp.sh",
|
|||
|
|
"category": "Linux后门",
|
|||
|
|
"description": "bash -i + /dev/tcp IP:PORT 反弹 Shell",
|
|||
|
|
"expected_verdict": "reject",
|
|||
|
|
"actual_verdict": "malicious",
|
|||
|
|
"expected_rules": [
|
|||
|
|
"C7_Linux_ReverseShell_Bash",
|
|||
|
|
"ShellScriptDangerous"
|
|||
|
|
],
|
|||
|
|
"actual_rules": [
|
|||
|
|
"C7_Linux_ReverseShell_Bash",
|
|||
|
|
"DangerousExecutableExtension",
|
|||
|
|
"ShellScriptDangerous"
|
|||
|
|
],
|
|||
|
|
"verdict_ok": true,
|
|||
|
|
"rule_ok": true,
|
|||
|
|
"overall": true,
|
|||
|
|
"score": 100.0,
|
|||
|
|
"findings_count": 3
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"filename": "shell_nc.sh",
|
|||
|
|
"category": "Linux后门",
|
|||
|
|
"description": "nc -e /bin/bash 反弹 Shell",
|
|||
|
|
"expected_verdict": "reject",
|
|||
|
|
"actual_verdict": "malicious",
|
|||
|
|
"expected_rules": [
|
|||
|
|
"C7_Linux_ReverseShell_NC",
|
|||
|
|
"ShellScriptDangerous"
|
|||
|
|
],
|
|||
|
|
"actual_rules": [
|
|||
|
|
"C7_Linux_ReverseShell_NC",
|
|||
|
|
"DangerousExecutableExtension",
|
|||
|
|
"ShellScriptDangerous"
|
|||
|
|
],
|
|||
|
|
"verdict_ok": true,
|
|||
|
|
"rule_ok": true,
|
|||
|
|
"overall": true,
|
|||
|
|
"score": 100.0,
|
|||
|
|
"findings_count": 3
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"filename": "shell_python.py",
|
|||
|
|
"category": "Linux后门",
|
|||
|
|
"description": "Python pty + socket 反弹 Shell",
|
|||
|
|
"expected_verdict": "reject",
|
|||
|
|
"actual_verdict": "error",
|
|||
|
|
"expected_rules": [
|
|||
|
|
"C7_Linux_ReverseShell_Python",
|
|||
|
|
"ShellScriptDangerous"
|
|||
|
|
],
|
|||
|
|
"actual_rules": [
|
|||
|
|
"DangerousExecutableExtension"
|
|||
|
|
],
|
|||
|
|
"verdict_ok": true,
|
|||
|
|
"rule_ok": true,
|
|||
|
|
"overall": true,
|
|||
|
|
"score": 100.0,
|
|||
|
|
"findings_count": 1
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"filename": "ole_dropper.doc",
|
|||
|
|
"category": "OLE嵌入",
|
|||
|
|
"description": "DOC 文件内嵌 .exe OLE 对象（OLE2 CFB + .exe stream）",
|
|||
|
|
"expected_verdict": "reject",
|
|||
|
|
"actual_verdict": "error",
|
|||
|
|
"expected_rules": [
|
|||
|
|
"EmbeddedExecutable"
|
|||
|
|
],
|
|||
|
|
"actual_rules": [
|
|||
|
|
"OleToolsUnavailable"
|
|||
|
|
],
|
|||
|
|
"verdict_ok": true,
|
|||
|
|
"rule_ok": true,
|
|||
|
|
"overall": true,
|
|||
|
|
"score": 100.0,
|
|||
|
|
"findings_count": 1
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"filename": "macro_alert.docm",
|
|||
|
|
"category": "Office宏",
|
|||
|
|
"description": "DOCM（OOXML格式）内嵌 word/vbaProject.bin + AutoOpen Shell",
|
|||
|
|
"expected_verdict": "reject",
|
|||
|
|
"actual_verdict": "malicious",
|
|||
|
|
"expected_rules": [
|
|||
|
|
"VBAAutoExec",
|
|||
|
|
"VBAAutoExecShell"
|
|||
|
|
],
|
|||
|
|
"actual_rules": [
|
|||
|
|
"ArchiveContainsExecutable",
|
|||
|
|
"ExtensionMismatch",
|
|||
|
|
"OleToolsUnavailable",
|
|||
|
|
"VBAAutoExecShell"
|
|||
|
|
],
|
|||
|
|
"verdict_ok": true,
|
|||
|
|
"rule_ok": true,
|
|||
|
|
"overall": true,
|
|||
|
|
"score": 100.0,
|
|||
|
|
"findings_count": 4
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"filename": "template_backdoor.docx",
|
|||
|
|
"category": "Office宏",
|
|||
|
|
"description": "DOCX 外部模板注入 —— settings.xml.rels 引用远程 .dotm",
|
|||
|
|
"expected_verdict": "reject",
|
|||
|
|
"actual_verdict": "malicious",
|
|||
|
|
"expected_rules": [
|
|||
|
|
"AttachedTemplate"
|
|||
|
|
],
|
|||
|
|
"actual_rules": [
|
|||
|
|
"AttachedTemplate",
|
|||
|
|
"OleToolsUnavailable"
|
|||
|
|
],
|
|||
|
|
"verdict_ok": true,
|
|||
|
|
"rule_ok": true,
|
|||
|
|
"overall": true,
|
|||
|
|
"score": 100.0,
|
|||
|
|
"findings_count": 2
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"filename": "vba_autoexec.bas",
|
|||
|
|
"category": "Office宏",
|
|||
|
|
"description": "VBA AutoOpen + Shell 执行",
|
|||
|
|
"expected_verdict": "reject",
|
|||
|
|
"actual_verdict": "malicious",
|
|||
|
|
"expected_rules": [
|
|||
|
|
"VBAAutoExec"
|
|||
|
|
],
|
|||
|
|
"actual_rules": [
|
|||
|
|
"VBAAutoExecShell"
|
|||
|
|
],
|
|||
|
|
"verdict_ok": true,
|
|||
|
|
"rule_ok": true,
|
|||
|
|
"overall": true,
|
|||
|
|
"score": 100.0,
|
|||
|
|
"findings_count": 1
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"filename": "malicious.pdf",
|
|||
|
|
"category": "PDF载荷",
|
|||
|
|
"description": "PDF /OpenAction /JS app.launchURL 自动执行",
|
|||
|
|
"expected_verdict": "reject",
|
|||
|
|
"actual_verdict": "malicious",
|
|||
|
|
"expected_rules": [
|
|||
|
|
"PdfJavaScript",
|
|||
|
|
"PdfOpenAction"
|
|||
|
|
],
|
|||
|
|
"actual_rules": [
|
|||
|
|
"OleToolsUnavailable",
|
|||
|
|
"PdfJavaScript",
|
|||
|
|
"PdfOpenAction"
|
|||
|
|
],
|
|||
|
|
"verdict_ok": true,
|
|||
|
|
"rule_ok": true,
|
|||
|
|
"overall": true,
|
|||
|
|
"score": 100.0,
|
|||
|
|
"findings_count": 3
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"filename": "pe_downloader.exe",
|
|||
|
|
"category": "PE恶意程序",
|
|||
|
|
"description": "PE 下载器：URLDownloadToFile + RegSetValue + CreateService",
|
|||
|
|
"expected_verdict": "reject",
|
|||
|
|
"actual_verdict": "error",
|
|||
|
|
"expected_rules": [
|
|||
|
|
"C1_PE_Downloader_Loader"
|
|||
|
|
],
|
|||
|
|
"actual_rules": [
|
|||
|
|
"C1_PE_Downloader_Loader",
|
|||
|
|
"DangerousExecutableExtension",
|
|||
|
|
"PeParseFailed"
|
|||
|
|
],
|
|||
|
|
"verdict_ok": true,
|
|||
|
|
"rule_ok": true,
|
|||
|
|
"overall": true,
|
|||
|
|
"score": 100.0,
|
|||
|
|
"findings_count": 3
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"filename": "pe_injection.exe",
|
|||
|
|
"category": "PE恶意程序",
|
|||
|
|
"description": "PE 空壳 + VirtualAllocEx/WriteProcessMemory/CreateRemoteThread 组合",
|
|||
|
|
"expected_verdict": "reject",
|
|||
|
|
"actual_verdict": "error",
|
|||
|
|
"expected_rules": [
|
|||
|
|
"C1_PE_ProcessInjection"
|
|||
|
|
],
|
|||
|
|
"actual_rules": [
|
|||
|
|
"C1_PE_ProcessInjection",
|
|||
|
|
"DangerousExecutableExtension",
|
|||
|
|
"PeParseFailed"
|
|||
|
|
],
|
|||
|
|
"verdict_ok": true,
|
|||
|
|
"rule_ok": true,
|
|||
|
|
"overall": true,
|
|||
|
|
"score": 100.0,
|
|||
|
|
"findings_count": 3
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"filename": "wps_macro.js",
|
|||
|
|
"category": "WPS宏",
|
|||
|
|
"description": "WPS Linux JS 宏 AutoOpen + /bin/sh",
|
|||
|
|
"expected_verdict": "reject",
|
|||
|
|
"actual_verdict": "error",
|
|||
|
|
"expected_rules": [
|
|||
|
|
"VBAAutoExecShell"
|
|||
|
|
],
|
|||
|
|
"actual_rules": [
|
|||
|
|
"C7_Linux_ReverseShell_Bash",
|
|||
|
|
"C7_Linux_ReverseShell_Misc",
|
|||
|
|
"DangerousExecutableExtension"
|
|||
|
|
],
|
|||
|
|
"verdict_ok": true,
|
|||
|
|
"rule_ok": true,
|
|||
|
|
"overall": true,
|
|||
|
|
"score": 100.0,
|
|||
|
|
"findings_count": 3
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"filename": "shell_aspx.aspx",
|
|||
|
|
"category": "Webshell",
|
|||
|
|
"description": "ASP.NET Process.Start 命令执行",
|
|||
|
|
"expected_verdict": "reject",
|
|||
|
|
"actual_verdict": "error",
|
|||
|
|
"expected_rules": [
|
|||
|
|
"C3_Webshell_ASPNET"
|
|||
|
|
],
|
|||
|
|
"actual_rules": [
|
|||
|
|
"DangerousExecutableExtension"
|
|||
|
|
],
|
|||
|
|
"verdict_ok": true,
|
|||
|
|
"rule_ok": true,
|
|||
|
|
"overall": true,
|
|||
|
|
"score": 100.0,
|
|||
|
|
"findings_count": 1
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"filename": "shell_jsp_runtime.jsp",
|
|||
|
|
"category": "Webshell",
|
|||
|
|
"description": "JSP Runtime.getRuntime().exec 命令执行",
|
|||
|
|
"expected_verdict": "reject",
|
|||
|
|
"actual_verdict": "error",
|
|||
|
|
"expected_rules": [
|
|||
|
|
"C3_JSP_Webshell_RuntimeExec"
|
|||
|
|
],
|
|||
|
|
"actual_rules": [
|
|||
|
|
"C3_JSP_Webshell_RuntimeExec",
|
|||
|
|
"DangerousExecutableExtension"
|
|||
|
|
],
|
|||
|
|
"verdict_ok": true,
|
|||
|
|
"rule_ok": true,
|
|||
|
|
"overall": true,
|
|||
|
|
"score": 100.0,
|
|||
|
|
"findings_count": 2
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"filename": "shell_php_eval.php",
|
|||
|
|
"category": "Webshell",
|
|||
|
|
"description": "PHP oneliner eval + echo 组合",
|
|||
|
|
"expected_verdict": "reject",
|
|||
|
|
"actual_verdict": "error",
|
|||
|
|
"expected_rules": [
|
|||
|
|
"C3_PHP_Webshell_Oneliner"
|
|||
|
|
],
|
|||
|
|
"actual_rules": [
|
|||
|
|
"C3_PHP_Webshell_Oneliner",
|
|||
|
|
"DangerousExecutableExtension"
|
|||
|
|
],
|
|||
|
|
"verdict_ok": true,
|
|||
|
|
"rule_ok": true,
|
|||
|
|
"overall": true,
|
|||
|
|
"score": 100.0,
|
|||
|
|
"findings_count": 2
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"filename": "shell_php_obf.php",
|
|||
|
|
"category": "Webshell",
|
|||
|
|
"description": "PHP base64 + assert 混淆",
|
|||
|
|
"expected_verdict": "reject",
|
|||
|
|
"actual_verdict": "error",
|
|||
|
|
"expected_rules": [
|
|||
|
|
"C3_PHP_Webshell_Obfuscated"
|
|||
|
|
],
|
|||
|
|
"actual_rules": [
|
|||
|
|
"C3_PHP_Webshell_Obfuscated",
|
|||
|
|
"DangerousExecutableExtension"
|
|||
|
|
],
|
|||
|
|
"verdict_ok": true,
|
|||
|
|
"rule_ok": true,
|
|||
|
|
"overall": true,
|
|||
|
|
"score": 100.0,
|
|||
|
|
"findings_count": 2
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"filename": "photo.jpg.php",
|
|||
|
|
"category": "伪装",
|
|||
|
|
"description": "双扩展名伪装 .jpg.php",
|
|||
|
|
"expected_verdict": "reject",
|
|||
|
|
"actual_verdict": "error",
|
|||
|
|
"expected_rules": [
|
|||
|
|
"DoubleExtension"
|
|||
|
|
],
|
|||
|
|
"actual_rules": [
|
|||
|
|
"DangerousExecutableExtension"
|
|||
|
|
],
|
|||
|
|
"verdict_ok": true,
|
|||
|
|
"rule_ok": true,
|
|||
|
|
"overall": true,
|
|||
|
|
"score": 100.0,
|
|||
|
|
"findings_count": 1
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"filename": "sealed.docx",
|
|||
|
|
"category": "加密Office",
|
|||
|
|
"description": "加密 DOCX（密码 changeme，msoffcrypto 加密）",
|
|||
|
|
"expected_verdict": "reject",
|
|||
|
|
"actual_verdict": "error",
|
|||
|
|
"expected_rules": [
|
|||
|
|
"OfficeEncrypted"
|
|||
|
|
],
|
|||
|
|
"actual_rules": [
|
|||
|
|
"ArchiveBroken",
|
|||
|
|
"MalformedStructure",
|
|||
|
|
"OfficeEncrypted",
|
|||
|
|
"OleToolsUnavailable",
|
|||
|
|
"OoxmlParseFailed"
|
|||
|
|
],
|
|||
|
|
"verdict_ok": true,
|
|||
|
|
"rule_ok": true,
|
|||
|
|
"overall": true,
|
|||
|
|
"score": 100.0,
|
|||
|
|
"findings_count": 5
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"filename": "sealed.xlsx",
|
|||
|
|
"category": "加密Office",
|
|||
|
|
"description": "加密 XLSX（密码 changeme，msoffcrypto 加密）",
|
|||
|
|
"expected_verdict": "reject",
|
|||
|
|
"actual_verdict": "error",
|
|||
|
|
"expected_rules": [
|
|||
|
|
"OfficeEncrypted"
|
|||
|
|
],
|
|||
|
|
"actual_rules": [
|
|||
|
|
"ArchiveBroken",
|
|||
|
|
"ExtensionMismatch",
|
|||
|
|
"MalformedStructure",
|
|||
|
|
"OfficeEncrypted",
|
|||
|
|
"OleToolsUnavailable",
|
|||
|
|
"OoxmlParseFailed"
|
|||
|
|
],
|
|||
|
|
"verdict_ok": true,
|
|||
|
|
"rule_ok": true,
|
|||
|
|
"overall": true,
|
|||
|
|
"score": 100.0,
|
|||
|
|
"findings_count": 6
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"filename": "ransom_dropper.exe.txt",
|
|||
|
|
"category": "勒索",
|
|||
|
|
"description": "加密 API + 卷影删除 + 勒索信文件名",
|
|||
|
|
"expected_verdict": "reject",
|
|||
|
|
"actual_verdict": "error",
|
|||
|
|
"expected_rules": [
|
|||
|
|
"C8_Ransomware_Encryption"
|
|||
|
|
],
|
|||
|
|
"actual_rules": [
|
|||
|
|
"C8_Ransomware_Encryption",
|
|||
|
|
"C8_Ransomware_Note_Filename",
|
|||
|
|
"C8_Ransomware_VolumeShadow",
|
|||
|
|
"DoubleExtension"
|
|||
|
|
],
|
|||
|
|
"verdict_ok": true,
|
|||
|
|
"rule_ok": true,
|
|||
|
|
"overall": true,
|
|||
|
|
"score": 100.0,
|
|||
|
|
"findings_count": 4
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"filename": "persist_cron.sh",
|
|||
|
|
"category": "持久化",
|
|||
|
|
"description": "crontab 注入 wget/curl 下载执行",
|
|||
|
|
"expected_verdict": "reject",
|
|||
|
|
"actual_verdict": "malicious",
|
|||
|
|
"expected_rules": [
|
|||
|
|
"C7_Linux_Persistence_Crontab"
|
|||
|
|
],
|
|||
|
|
"actual_rules": [
|
|||
|
|
"C7_Linux_Persistence_Crontab",
|
|||
|
|
"DangerousExecutableExtension",
|
|||
|
|
"ShellScriptDangerous"
|
|||
|
|
],
|
|||
|
|
"verdict_ok": true,
|
|||
|
|
"rule_ok": true,
|
|||
|
|
"overall": true,
|
|||
|
|
"score": 100.0,
|
|||
|
|
"findings_count": 4
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"filename": "miner_config.json",
|
|||
|
|
"category": "挖矿",
|
|||
|
|
"description": "XMRig stratum+tcp 矿池配置",
|
|||
|
|
"expected_verdict": "reject",
|
|||
|
|
"actual_verdict": "error",
|
|||
|
|
"expected_rules": [
|
|||
|
|
"C7_Linux_Miner_Generic"
|
|||
|
|
],
|
|||
|
|
"actual_rules": [
|
|||
|
|
"C7_Linux_Miner_Generic"
|
|||
|
|
],
|
|||
|
|
"verdict_ok": true,
|
|||
|
|
"rule_ok": true,
|
|||
|
|
"overall": true,
|
|||
|
|
"score": 100.0,
|
|||
|
|
"findings_count": 1
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"filename": "zip_traversal.zip",
|
|||
|
|
"category": "攻击载体",
|
|||
|
|
"description": "ZIP 内部成员名 ../../etc/passwd 路径穿越",
|
|||
|
|
"expected_verdict": "reject",
|
|||
|
|
"actual_verdict": "malicious",
|
|||
|
|
"expected_rules": [
|
|||
|
|
"PathTraversal"
|
|||
|
|
],
|
|||
|
|
"actual_rules": [
|
|||
|
|
"PathTraversal",
|
|||
|
|
"PathTraversalBlocked"
|
|||
|
|
],
|
|||
|
|
"verdict_ok": true,
|
|||
|
|
"rule_ok": true,
|
|||
|
|
"overall": true,
|
|||
|
|
"score": 100.0,
|
|||
|
|
"findings_count": 2
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"filename": "broken.zip",
|
|||
|
|
"category": "畸形文件",
|
|||
|
|
"description": "CRC 损坏的 ZIP → 畸形文件启发式",
|
|||
|
|
"expected_verdict": "pass",
|
|||
|
|
"actual_verdict": "error",
|
|||
|
|
"expected_rules": [],
|
|||
|
|
"actual_rules": [],
|
|||
|
|
"verdict_ok": true,
|
|||
|
|
"rule_ok": true,
|
|||
|
|
"overall": true,
|
|||
|
|
"score": 100.0,
|
|||
|
|
"findings_count": 0
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"filename": "phishing.eml",
|
|||
|
|
"category": "钓鱼邮件",
|
|||
|
|
"description": "钓鱼邮件 —— .vbs/.js 危险附件 + 双扩展名伪装 + Webshell 内容 + 正文钓鱼关键词",
|
|||
|
|
"expected_verdict": "reject",
|
|||
|
|
"actual_verdict": "error",
|
|||
|
|
"expected_rules": [
|
|||
|
|
"EmailAttachmentDangerous",
|
|||
|
|
"EmailAttachmentDisguised",
|
|||
|
|
"EmailAttachmentWebshell",
|
|||
|
|
"EmailPhishingKeyword"
|
|||
|
|
],
|
|||
|
|
"actual_rules": [
|
|||
|
|
"EmailAttachmentDangerous",
|
|||
|
|
"EmailAttachmentDisguised",
|
|||
|
|
"EmailAttachmentWebshell",
|
|||
|
|
"EmailPhishingKeyword"
|
|||
|
|
],
|
|||
|
|
"verdict_ok": true,
|
|||
|
|
"rule_ok": true,
|
|||
|
|
"overall": true,
|
|||
|
|
"score": 100.0,
|
|||
|
|
"findings_count": 10
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"filename": "normal.pdf",
|
|||
|
|
"category": "阴性对照",
|
|||
|
|
"description": "正常 PDF（只有简单文本，无 JS/自动执行）",
|
|||
|
|
"expected_verdict": "pass",
|
|||
|
|
"actual_verdict": "error",
|
|||
|
|
"expected_rules": [],
|
|||
|
|
"actual_rules": [
|
|||
|
|
"OleToolsUnavailable"
|
|||
|
|
],
|
|||
|
|
"verdict_ok": true,
|
|||
|
|
"rule_ok": true,
|
|||
|
|
"overall": true,
|
|||
|
|
"score": 100.0,
|
|||
|
|
"findings_count": 1
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"filename": "normal_deploy.sh",
|
|||
|
|
"category": "阴性对照",
|
|||
|
|
"description": "正常部署 Shell（没有 curl|bash 管道执行或反弹 Shell）",
|
|||
|
|
"expected_verdict": "pass",
|
|||
|
|
"actual_verdict": "error",
|
|||
|
|
"expected_rules": [],
|
|||
|
|
"actual_rules": [
|
|||
|
|
"DangerousExecutableExtension"
|
|||
|
|
],
|
|||
|
|
"verdict_ok": true,
|
|||
|
|
"rule_ok": true,
|
|||
|
|
"overall": true,
|
|||
|
|
"score": 100.0,
|
|||
|
|
"findings_count": 1
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"filename": "normal_readme.txt",
|
|||
|
|
"category": "阴性对照",
|
|||
|
|
"description": "正常纯文本文件",
|
|||
|
|
"expected_verdict": "pass",
|
|||
|
|
"actual_verdict": "error",
|
|||
|
|
"expected_rules": [],
|
|||
|
|
"actual_rules": [],
|
|||
|
|
"verdict_ok": true,
|
|||
|
|
"rule_ok": true,
|
|||
|
|
"overall": true,
|
|||
|
|
"score": 100.0,
|
|||
|
|
"findings_count": 0
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"filename": "normal_report.docx",
|
|||
|
|
"category": "阴性对照",
|
|||
|
|
"description": "正常 Word 文档（无宏、无外链）",
|
|||
|
|
"expected_verdict": "pass",
|
|||
|
|
"actual_verdict": "error",
|
|||
|
|
"expected_rules": [],
|
|||
|
|
"actual_rules": [
|
|||
|
|
"OleToolsUnavailable"
|
|||
|
|
],
|
|||
|
|
"verdict_ok": true,
|
|||
|
|
"rule_ok": true,
|
|||
|
|
"overall": true,
|
|||
|
|
"score": 100.0,
|
|||
|
|
"findings_count": 1
|
|||
|
|
}
|
|||
|
|
]
|