308 lines
12 KiB
Plaintext
308 lines
12 KiB
Plaintext
|
// =============================================================================
|
|||
|
|
// MeshSafe L2B YARA 规则集 —— Linux / 跨平台后门专项（C7）
|
|||
|
|
// =============================================================================
|
|||
|
|
//
|
|||
|
|
// 设计原则：
|
|||
|
|
// - 光闸摆渡场景，所有规则 2-3 特征组合命中，避免单一关键词误伤合法 Shell/Python 代码
|
|||
|
|
// - 覆盖范围：反弹 Shell、持久化（crontab/authorized_keys/systemd/LD_PRELOAD）、
|
|||
|
|
// Rootkit 特征、挖矿通用特征
|
|||
|
|
// - 命中后作为 finding 交给 PolicyEngine 权重累加
|
|||
|
|
//
|
|||
|
|
// 维护：
|
|||
|
|
// - 新后门工具/家族出现时优先补充 "工具名 + 持久化手段" 组合
|
|||
|
|
// =============================================================================
|
|||
|
|
|
|||
|
|
|
|||
|
|
// =============================================================================
|
|||
|
|
// C7-1 反弹 Shell（多种语言实现）
|
|||
|
|
// =============================================================================
|
|||
|
|
|
|||
|
|
rule C7_Linux_ReverseShell_Bash {
|
|||
|
|
meta:
|
|||
|
|
risk_level = "critical"
|
|||
|
|
category = "C7"
|
|||
|
|
false_positive_rate = "low"
|
|||
|
|
reference = "MITRE ATT&CK T1059.004 Bash"
|
|||
|
|
description = "Bash 反弹 Shell 组合：/dev/tcp + bash -i 或 sh -c"
|
|||
|
|
strings:
|
|||
|
|
$devtcp = /\/dev\/tcp\/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{2,5}/ ascii
|
|||
|
|
$bash_i = "bash -i" ascii
|
|||
|
|
$sh_c = /sh\s+-c\s+['"]bash -i/ ascii
|
|||
|
|
$exec3 = "exec 3<>/dev/tcp/" ascii
|
|||
|
|
$exec4 = "exec 4>&0 0>&1 1>&4" ascii
|
|||
|
|
condition:
|
|||
|
|
// /dev/tcp/IP:PORT + bash -i 这两个必须同时出现
|
|||
|
|
$devtcp and ($bash_i or $sh_c or $exec3)
|
|||
|
|
or
|
|||
|
|
// exec fd 重定向链
|
|||
|
|
$exec3 and $exec4
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
rule C7_Linux_ReverseShell_NC {
|
|||
|
|
meta:
|
|||
|
|
risk_level = "critical"
|
|||
|
|
category = "C7"
|
|||
|
|
false_positive_rate = "medium"
|
|||
|
|
reference = "MITRE ATT&CK T1059.004 Netcat"
|
|||
|
|
description = "nc/ncat 反弹 Shell：-e/-c 参数指定 bash 或 sh"
|
|||
|
|
strings:
|
|||
|
|
$nc1 = /nc\s+[\w.-]+\s+\d{2,5}\s+-e\s+(\/bin\/(ba)?sh|bash|sh)/ ascii
|
|||
|
|
$nc2 = /ncat\s+[\w.-]+\s+\d{2,5}\s+-e\s+(\/bin\/(ba)?sh|bash|sh)/ ascii
|
|||
|
|
$nc3 = /nc\s+[\w.-]+\s+\d{2,5}\s+-c\s+(\/bin\/(ba)?sh|bash|sh)/ ascii
|
|||
|
|
$nc4 = /netcat\s+[\w.-]+\s+\d{2,5}\s+-e/ ascii
|
|||
|
|
$mkfifo = /mkfifo\s+\/tmp\/\w+;\s*(nc|ncat)\s+/ ascii
|
|||
|
|
condition:
|
|||
|
|
any of ($*)
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
rule C7_Linux_ReverseShell_Python {
|
|||
|
|
meta:
|
|||
|
|
risk_level = "high"
|
|||
|
|
category = "C7"
|
|||
|
|
false_positive_rate = "medium"
|
|||
|
|
reference = "MITRE ATT&CK T1059.006 Python"
|
|||
|
|
description = "Python 反弹 Shell：socket + exec/bin/sh + pty"
|
|||
|
|
strings:
|
|||
|
|
$socket1 = "import socket" ascii
|
|||
|
|
$socket2 = "socket.socket" ascii
|
|||
|
|
$pty = "import pty" ascii
|
|||
|
|
$sub = "import subprocess" ascii
|
|||
|
|
$sh = /\/bin\/(ba)?sh/ ascii
|
|||
|
|
$osdup2 = "os.dup2" ascii
|
|||
|
|
$execv = "os.execv" ascii
|
|||
|
|
condition:
|
|||
|
|
// socket + pty + /bin/bash = 完整 Python pty 反弹
|
|||
|
|
($socket1 or $socket2) and $pty and $sh
|
|||
|
|
or
|
|||
|
|
// socket + subprocess + /bin/sh + dup2 = 经典模式
|
|||
|
|
($socket1 or $socket2) and $sub and $sh and $osdup2
|
|||
|
|
or
|
|||
|
|
// socket + os.execv + /bin/bash
|
|||
|
|
($socket1 or $socket2) and $execv and $sh
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
rule C7_Linux_ReverseShell_Perl {
|
|||
|
|
meta:
|
|||
|
|
risk_level = "high"
|
|||
|
|
category = "C7"
|
|||
|
|
false_positive_rate = "medium"
|
|||
|
|
reference = "MITRE ATT&CK T1059.005 Perl"
|
|||
|
|
description = "Perl 反弹 Shell：IO::Socket + exec + /bin/sh"
|
|||
|
|
strings:
|
|||
|
|
$iosocket = "IO::Socket::INET" ascii nocase
|
|||
|
|
$socketvar = /\$s\s*=\s*IO::Socket/ ascii
|
|||
|
|
$exec = /exec\s+['"]\/bin\/(ba)?sh['"]/ ascii
|
|||
|
|
$open = /open\s*\(.*<&\$\{?s\}?/ ascii
|
|||
|
|
$eval = /eval\s+reverse\s+['"]/ ascii
|
|||
|
|
condition:
|
|||
|
|
($iosocket or $socketvar) and ($exec or $open or $eval)
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
rule C7_Linux_ReverseShell_Socat {
|
|||
|
|
meta:
|
|||
|
|
risk_level = "high"
|
|||
|
|
category = "C7"
|
|||
|
|
false_positive_rate = "low"
|
|||
|
|
reference = "MITRE ATT&CK T1059.004 Socat"
|
|||
|
|
description = "socat 反弹 Shell：TCP-LISTEN + EXEC:/bin/bash"
|
|||
|
|
strings:
|
|||
|
|
$socat1 = /socat\s+(TCP-LISTEN:\d{2,5},?\s*(reuseaddr|fork)?|TCP4:\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}:\d{2,5})/ ascii
|
|||
|
|
$socat2 = /EXEC:\/bin\/(ba)?sh/ ascii
|
|||
|
|
$socat3 = /EXEC:'\/bin\/(ba)?sh'/ ascii
|
|||
|
|
condition:
|
|||
|
|
any of ($socat1*) and any of ($socat2, $socat3)
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
rule C7_Linux_ReverseShell_Misc {
|
|||
|
|
meta:
|
|||
|
|
risk_level = "medium"
|
|||
|
|
category = "C7"
|
|||
|
|
false_positive_rate = "medium"
|
|||
|
|
reference = "多种语言反弹 Shell 通用特征"
|
|||
|
|
description = "通用反弹 Shell 标记：/dev/tcp 或 /dev/udp 或 reverse shell 工具名"
|
|||
|
|
strings:
|
|||
|
|
$devudp = /\/dev\/udp\/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{2,5}/ ascii
|
|||
|
|
$bashc = /bash\s+-c\s+['"].*\/dev\/(tcp|udp)/ ascii
|
|||
|
|
$dash_e = /\/bin\/bash\s+-e\s+['"]/ ascii
|
|||
|
|
$hydra = /Hydra|crackmap|weevely|meterpreter|msfconsole|msfvenom/ ascii nocase
|
|||
|
|
$reverseshell = /reverse[_\s]?shell|shell[_\s]?shock/ ascii nocase
|
|||
|
|
condition:
|
|||
|
|
any of ($devudp, $bashc, $dash_e) or any of ($hydra, $reverseshell)
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
|
|||
|
|
// =============================================================================
|
|||
|
|
// C7-2 持久化 —— crontab / authorized_keys / systemd
|
|||
|
|
// =============================================================================
|
|||
|
|
|
|||
|
|
rule C7_Linux_Persistence_Crontab {
|
|||
|
|
meta:
|
|||
|
|
risk_level = "high"
|
|||
|
|
category = "C7"
|
|||
|
|
false_positive_rate = "medium"
|
|||
|
|
reference = "MITRE ATT&CK T1053.003 Cron"
|
|||
|
|
description = "crontab 持久化：下载执行 + .bashrc 注入 + /tmp/.hidden 目录"
|
|||
|
|
strings:
|
|||
|
|
$crontab1 = /\*\s+\*\s+\*\s+\*\s+\*\s+(curl|wget)\s+['"]?https?:/ ascii
|
|||
|
|
$crontab2 = /\*\s+\*\s+\*\s+\*\s+\*\s+(bash|sh)\s+\S+\s+['"]\/dev\/tcp/ ascii
|
|||
|
|
$crontab3 = /crontab\s+-[lre]?\s+\/tmp\/\w+/ ascii
|
|||
|
|
$bashrc = /\.bashrc|\.bash_profile|\.profile/ ascii
|
|||
|
|
$wget = /wget\s+https?:/ ascii
|
|||
|
|
$curl = /curl\s+.*\|\s*(bash|sh)/ ascii
|
|||
|
|
$hidden = /\/tmp\/\.?\w+\s+&&/ ascii
|
|||
|
|
condition:
|
|||
|
|
any of ($crontab1, $crontab2, $crontab3)
|
|||
|
|
or
|
|||
|
|
$bashrc and ($wget or $curl) and $hidden
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
rule C7_Linux_Persistence_AuthorizedKeys {
|
|||
|
|
meta:
|
|||
|
|
risk_level = "high"
|
|||
|
|
category = "C7"
|
|||
|
|
false_positive_rate = "low"
|
|||
|
|
reference = "MITRE ATT&CK T1098 SSH Authorized Keys"
|
|||
|
|
description = "authorized_keys 写入：下载公钥 + 追加到 .ssh/authorized_keys + chmod 600"
|
|||
|
|
strings:
|
|||
|
|
$authkeys = /\.ssh\/authorized_keys/ ascii
|
|||
|
|
$wgetkey = /wget\s+-O\s+.*authorized_keys/ ascii
|
|||
|
|
$curlkey = /curl\s+.*authorized_keys/ ascii
|
|||
|
|
$echokey = /echo\s+['"]ssh-(rsa|ecdsa|ed25519)/ ascii
|
|||
|
|
$chmod = /chmod\s+\d{3,4}\s+\$\{?SSH_DIR\}?authorized_keys/ ascii
|
|||
|
|
condition:
|
|||
|
|
any of ($wgetkey, $curlkey, $echokey) or ($authkeys and any of ($wgetkey, $curlkey, $chmod))
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
rule C7_Linux_Persistence_SystemD {
|
|||
|
|
meta:
|
|||
|
|
risk_level = "high"
|
|||
|
|
category = "C7"
|
|||
|
|
false_positive_rate = "medium"
|
|||
|
|
reference = "MITRE ATT&CK T1543.002 Systemd Service"
|
|||
|
|
description = "恶意 systemd unit 文件：ExecStart 指向 /tmp/.hidden + multi-user.target + 反弹命令"
|
|||
|
|
strings:
|
|||
|
|
$unit = /\[Unit\]/ ascii
|
|||
|
|
$service = /\[Service\]/ ascii
|
|||
|
|
$install = /\[Install\]/ ascii
|
|||
|
|
$execstart = /ExecStart=/ ascii
|
|||
|
|
$multiuser = /multi-user\.target/ ascii
|
|||
|
|
$hiddenpath = /\/tmp\/\.?\w+|\/var\/tmp\/\.?\w+/ ascii
|
|||
|
|
$bashsh = /\/bin\/(ba)?sh\s+-c/ ascii
|
|||
|
|
condition:
|
|||
|
|
// 完整 unit 片段 + 可疑路径
|
|||
|
|
$unit and $service and $execstart and ($hiddenpath or $bashsh)
|
|||
|
|
or
|
|||
|
|
// Install multi-user.target + ExecStart 反弹
|
|||
|
|
$install and $multiuser and any of ($execstart, $bashsh)
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
rule C7_Linux_Persistence_LD_PRELOAD {
|
|||
|
|
meta:
|
|||
|
|
risk_level = "high"
|
|||
|
|
category = "C7"
|
|||
|
|
false_positive_rate = "medium"
|
|||
|
|
reference = "MITRE ATT&CK T1574.006 LD_PRELOAD"
|
|||
|
|
description = "LD_PRELOAD 劫持：环境变量注入 + .so 文件 + dlopen"
|
|||
|
|
strings:
|
|||
|
|
$ldpreload = /LD_PRELOAD=/ ascii
|
|||
|
|
$sofile = /\.so(\.\d+)?:?/ ascii
|
|||
|
|
$dlopen = "dlopen" ascii
|
|||
|
|
$dlsym = "dlsym" ascii
|
|||
|
|
$exportenv = /export\s+LD_PRELOAD/ ascii
|
|||
|
|
condition:
|
|||
|
|
($ldpreload or $exportenv) and ($sofile or $dlopen or $dlsym)
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
|
|||
|
|
// =============================================================================
|
|||
|
|
// C7-3 Rootkit + 挖矿通用特征
|
|||
|
|
// =============================================================================
|
|||
|
|
|
|||
|
|
rule C7_Linux_Rootkit_KernelModule {
|
|||
|
|
meta:
|
|||
|
|
risk_level = "critical"
|
|||
|
|
category = "C7"
|
|||
|
|
false_positive_rate = "medium"
|
|||
|
|
reference = "MITRE ATT&CK T1547.006 Kernel Modules and Extensions"
|
|||
|
|
description = "内核模块加载：insmod/modprobe + .ko + /proc/kallsyms 隐藏"
|
|||
|
|
strings:
|
|||
|
|
$insmod = /insmod\s+.*\.ko/ ascii
|
|||
|
|
$modprobe = /modprobe\s+.*\.ko/ ascii
|
|||
|
|
$ko = /\.ko(\.xz|\.gz)?\b/ ascii
|
|||
|
|
$hiddenproc = /hide_process_from_dcache|hide_module/ ascii
|
|||
|
|
$proc = /\/proc\/kallsyms|\/proc\/modules/ ascii
|
|||
|
|
$netstat = /\/proc\/net\/tcp|\/proc\/net\/udp/ ascii
|
|||
|
|
condition:
|
|||
|
|
any of ($insmod, $modprobe) and any of ($ko, $hiddenproc)
|
|||
|
|
or
|
|||
|
|
any of ($hiddenproc) and any of ($proc, $netstat)
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
rule C7_Linux_Miner_Generic {
|
|||
|
|
meta:
|
|||
|
|
risk_level = "medium"
|
|||
|
|
category = "C7"
|
|||
|
|
false_positive_rate = "medium"
|
|||
|
|
reference = "MITRE ATT&CK T1496 Resource Hijacking"
|
|||
|
|
description = "挖矿通用特征：stratum+tcp 协议 + 非标准端口(3333/5555/8080)"
|
|||
|
|
strings:
|
|||
|
|
$stratum = "stratum+tcp://" ascii
|
|||
|
|
$stratums = "stratum+ssl://" ascii
|
|||
|
|
$pool = /pool\.(xmr|mine|nanopool|coin|mining)/ ascii nocase
|
|||
|
|
$port3333 = /:\s*3333\b/ ascii
|
|||
|
|
$port5555 = /:\s*5555\b/ ascii
|
|||
|
|
$highcpu = /nice\s+-n\s+[+-]?\d+|cpulimit\s+-l/ ascii
|
|||
|
|
condition:
|
|||
|
|
any of ($stratum, $stratums, $pool) and any of ($port3333, $port5555)
|
|||
|
|
or
|
|||
|
|
any of ($stratum, $stratums) and $highcpu
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
|
|||
|
|
// =============================================================================
|
|||
|
|
// C7-4 跨平台后门：Ruby + Lua + Node.js
|
|||
|
|
// =============================================================================
|
|||
|
|
|
|||
|
|
rule C7_Misc_Ruby_Lua_ReverseShell {
|
|||
|
|
meta:
|
|||
|
|
risk_level = "medium"
|
|||
|
|
category = "C7"
|
|||
|
|
false_positive_rate = "medium"
|
|||
|
|
reference = "多语言反弹 Shell"
|
|||
|
|
description = "Ruby/Lua 反弹 Shell：TCPSocket + exec/system"
|
|||
|
|
strings:
|
|||
|
|
$ruby = "TCPSocket" ascii
|
|||
|
|
$lua = "loadstring" ascii
|
|||
|
|
$lua2 = "luasocket" ascii
|
|||
|
|
$exec = /(exec|system|IO\.popen)\s+.*\/bin\/(ba)?sh/ ascii
|
|||
|
|
condition:
|
|||
|
|
any of ($ruby, $lua, $lua2) and ($exec or any of ($ruby, $lua, $lua2))
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
|
|||
|
|
// =============================================================================
|
|||
|
|
// C7-5 网络投毒 / MITM 工具（内网横向移动）
|
|||
|
|
// =============================================================================
|
|||
|
|
|
|||
|
|
rule C7_Network_Tools_Malicious {
|
|||
|
|
meta:
|
|||
|
|
risk_level = "medium"
|
|||
|
|
category = "C7"
|
|||
|
|
false_positive_rate = "medium"
|
|||
|
|
reference = "内网攻击工具"
|
|||
|
|
description = "内网攻击工具：ettercap/responder/nmap 扫描 + SMB/DNS 投毒"
|
|||
|
|
strings:
|
|||
|
|
$ettercap = "ettercap" ascii nocase
|
|||
|
|
$responder = /responder(\.py)?/ ascii nocase
|
|||
|
|
$nmap = "nmap" ascii nocase
|
|||
|
|
$smb = /--smb/ ascii
|
|||
|
|
$ms17 = "ms17-010" ascii nocase
|
|||
|
|
$smbghost = "SMBGhost" ascii nocase
|
|||
|
|
$dnsspoof = /dns[-_]spoof|dns[-_]mitm/ ascii nocase
|
|||
|
|
$arppoison = /arp[-_]poison|arp[-_]spoof/ ascii nocase
|
|||
|
|
condition:
|
|||
|
|
any of ($ettercap, $responder, $dnsspoof, $arppoison)
|
|||
|
|
or
|
|||
|
|
$nmap and ($smb or $ms17 or $smbghost)
|
|||
|
|
}
|