211 lines
8.6 KiB
Plaintext
211 lines
8.6 KiB
Plaintext
|
// =============================================================================
|
|||
|
|
// MeshSafe L2B YARA 规则集 —— 勒索 / 挖矿专项（C8，剩余家族）
|
|||
|
|
// =============================================================================
|
|||
|
|
//
|
|||
|
|
// 设计原则：
|
|||
|
|
// - C8_Ransomware_Encryption 在 pe.yar 里已经覆盖了"加密 API + 卷影删除 + 勒索信"通用链
|
|||
|
|
// - 本文件补充：具体家族特征（LockBit/BlackCat/Conti/Ryuk/Pseudo）+
|
|||
|
|
// 文件扩展名黑名单变体 + 勒索信文件名模式
|
|||
|
|
// - 必须满足"加密 API 组合 + 家族特征"才触发，单靠扩展名不触发
|
|||
|
|
//
|
|||
|
|
// 元数据规范：同 webshell.yar / pe.yar（risk_level, category, false_positive_rate）
|
|||
|
|
// =============================================================================
|
|||
|
|
|
|||
|
|
|
|||
|
|
// =============================================================================
|
|||
|
|
// C8-1 LockBit 家族
|
|||
|
|
// =============================================================================
|
|||
|
|
|
|||
|
|
rule C8_Ransomware_LockBit {
|
|||
|
|
meta:
|
|||
|
|
risk_level = "critical"
|
|||
|
|
category = "C8"
|
|||
|
|
false_positive_rate = "low"
|
|||
|
|
reference = "LockBit / BitLocker 勒索家族"
|
|||
|
|
description = "LockBit 家族特征：Mutex 名 + .lockbit3/.lockbit 扩展名 + CryptEncrypt"
|
|||
|
|
strings:
|
|||
|
|
$mutex1 = /Global\\[Ll]ock[Bb]it/ ascii
|
|||
|
|
$mutex2 = /Local\\[Ll]ock[Bb]it/ ascii
|
|||
|
|
$mutex3 = /LockBit[\d_]/ ascii nocase
|
|||
|
|
$ext1 = /\.lockbit3?\b/ ascii nocase
|
|||
|
|
$ext2 = /\.lckbt\b/ ascii nocase
|
|||
|
|
$enc = /CryptEncrypt|BCryptEncrypt|CryptGenKey/ ascii
|
|||
|
|
$ransomnote = /README[\d_-]*\.(html|txt|bmp|png|jpg|url)/ nocase
|
|||
|
|
condition:
|
|||
|
|
// Mutex + 加密 API（家族识别核心）
|
|||
|
|
any of ($mutex*) and any of ($enc*)
|
|||
|
|
or
|
|||
|
|
// Mutex + 勒索扩展名
|
|||
|
|
any of ($mutex*) and any of ($ext*)
|
|||
|
|
or
|
|||
|
|
// 加密 API + 家族扩展名 + 勒索信
|
|||
|
|
any of ($enc*) and any of ($ext*) and $ransomnote
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
|
|||
|
|
// =============================================================================
|
|||
|
|
// C8-2 BlackCat / ALPHV 家族
|
|||
|
|
// =============================================================================
|
|||
|
|
|
|||
|
|
rule C8_Ransomware_BlackCat {
|
|||
|
|
meta:
|
|||
|
|
risk_level = "critical"
|
|||
|
|
category = "C8"
|
|||
|
|
false_positive_rate = "low"
|
|||
|
|
reference = "BlackCat (ALPHV) 勒索家族"
|
|||
|
|
description = "BlackCat/ALPHV：Mutex + .blackcat/.bc1 扩展名 + Rust 字符串特征"
|
|||
|
|
strings:
|
|||
|
|
$mutex1 = /Global\\[Bb]lack[Cc]at/ ascii
|
|||
|
|
$mutex2 = /[Aa][Ll][Pp][Hh][Vv]/ ascii
|
|||
|
|
$ext1 = /\.blackcat\b/ ascii nocase
|
|||
|
|
$ext2 = /\.bc1?\b/ ascii nocase
|
|||
|
|
$rust1 = "rustc" ascii
|
|||
|
|
$rust2 = "/rustc/" ascii
|
|||
|
|
$enc = /CryptEncrypt|BCryptEncrypt/ ascii
|
|||
|
|
$note = /BlackCat.*README|how_to_decrypt|restore_files/ ascii nocase
|
|||
|
|
condition:
|
|||
|
|
any of ($mutex1, $mutex2) and any of ($enc*, $ext*)
|
|||
|
|
or
|
|||
|
|
any of ($ext*) and any of ($rust*) and $note
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
|
|||
|
|
// =============================================================================
|
|||
|
|
// C8-3 Conti 家族
|
|||
|
|
// =============================================================================
|
|||
|
|
|
|||
|
|
rule C8_Ransomware_Conti {
|
|||
|
|
meta:
|
|||
|
|
risk_level = "critical"
|
|||
|
|
category = "C8"
|
|||
|
|
false_positive_rate = "low"
|
|||
|
|
reference = "Conti 勒索家族"
|
|||
|
|
description = "Conti：Mutex + .conti 扩展名 + 加密 API"
|
|||
|
|
strings:
|
|||
|
|
$mutex1 = /Global\\[Cc]onti/ ascii
|
|||
|
|
$mutex2 = /Local\\[Cc]onti/ ascii
|
|||
|
|
$ext1 = /\.conti\b/ ascii nocase
|
|||
|
|
$enc = /CryptEncrypt|BCryptEncrypt|CryptDeriveKey/ ascii
|
|||
|
|
condition:
|
|||
|
|
any of ($mutex*) and any of ($enc*, $ext*)
|
|||
|
|
or
|
|||
|
|
any of ($ext*) and any of ($enc*)
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
|
|||
|
|
// =============================================================================
|
|||
|
|
// C8-4 Ryuk / Pseudo / Dharma 家族
|
|||
|
|
// =============================================================================
|
|||
|
|
|
|||
|
|
rule C8_Ransomware_Ryuk_Pseudo {
|
|||
|
|
meta:
|
|||
|
|
risk_level = "high"
|
|||
|
|
category = "C8"
|
|||
|
|
false_positive_rate = "medium"
|
|||
|
|
reference = "Ryuk / Pseudo / Dharma 勒索家族"
|
|||
|
|
description = "Ryuk/Pseudo： RyukTask Mutex + 加密 API + .ryk/.pseudo 扩展名"
|
|||
|
|
strings:
|
|||
|
|
$mutex_ryuk = /RyukTask[\d]/ ascii
|
|||
|
|
$mutex_pseudo = /Global\\[Pp]seudo/ ascii
|
|||
|
|
$mutex_dharma = /Global\\[Dd]harma/ ascii
|
|||
|
|
$ext_ryk = /\.ryk\b/ ascii nocase
|
|||
|
|
$ext_pseudo = /\.pseudo\b/ ascii nocase
|
|||
|
|
$ext_dharma = /\.dharma\b/ ascii nocase
|
|||
|
|
$enc = /CryptEncrypt|CryptDeriveKey/ ascii
|
|||
|
|
condition:
|
|||
|
|
(any of ($mutex_ryuk, $mutex_pseudo, $mutex_dharma))
|
|||
|
|
and (any of ($enc*, $ext_ryk, $ext_pseudo, $ext_dharma))
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
|
|||
|
|
// =============================================================================
|
|||
|
|
// C8-5 勒索信文件名模式（独立规则，辅助 family 识别）
|
|||
|
|
// =============================================================================
|
|||
|
|
|
|||
|
|
rule C8_Ransomware_Note_Filename {
|
|||
|
|
meta:
|
|||
|
|
risk_level = "medium"
|
|||
|
|
category = "C8"
|
|||
|
|
false_positive_rate = "medium"
|
|||
|
|
reference = "勒索信文件名通用模式"
|
|||
|
|
description = "勒索信典型文件名变体（匹配后触发需要配合加密 API 才升级高危）"
|
|||
|
|
strings:
|
|||
|
|
$n1 = /HOW_TO_RECOVER[\w.-]*\.(txt|html|png|bmp|jpg|url|vbs|js)/ nocase
|
|||
|
|
$n2 = /RESTORE_FILES[\w.-]*\.(txt|html|png|bmp|jpg|url|vbs|js)/ nocase
|
|||
|
|
$n3 = /DECRYPT_INSTRUCTIONS[\w.-]*\.(txt|html|png|bmp|jpg|url)/ nocase
|
|||
|
|
$n4 = /README[_\s-]*[\d]*[_\s-]*[\w]*\.(txt|html|png|bmp|jpg|url)/ nocase
|
|||
|
|
$n5 = /HELP_DECRYPT[\w.-]*\.(txt|html|png|bmp|jpg|url)/ nocase
|
|||
|
|
$n6 = /_readme[\w.-]*\.(txt|html|png|bmp|jpg|url)/ nocase
|
|||
|
|
$n7 = /_restore[\w.-]*\.(txt|html|png|bmp|jpg|url)/ nocase
|
|||
|
|
$bitcoin = /bitcoin address|BTC\b|monero address|XMR\b|send money|ransom|payment/ nocase
|
|||
|
|
$wallet = /1[A-Za-z0-9]{25,34}|bc1[A-Za-z0-9]{11,71}|4[0-9A-Za-z]{32}/ nocase
|
|||
|
|
$encapi = /CryptEncrypt|BCryptEncrypt|CryptDeriveKey/ ascii
|
|||
|
|
condition:
|
|||
|
|
// 勒索信文件名 + 加密 API = 明确勒索
|
|||
|
|
any of ($n*) and $encapi
|
|||
|
|
or
|
|||
|
|
// 勒索信文件名 + 比特币/XMR 地址 = 大概率勒索
|
|||
|
|
any of ($n*) and any of ($bitcoin, $wallet)
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
|
|||
|
|
// =============================================================================
|
|||
|
|
// C8-6 加密文件扩展名黑名单（不单独触发，配合加密 API）
|
|||
|
|
// =============================================================================
|
|||
|
|
|
|||
|
|
rule C8_Ransomware_Extension_Blacklist {
|
|||
|
|
meta:
|
|||
|
|
risk_level = "low"
|
|||
|
|
category = "C8"
|
|||
|
|
false_positive_rate = "medium"
|
|||
|
|
reference = "勒索加密文件扩展名模式"
|
|||
|
|
description = "常见勒索加密扩展名（.locky/.zepto/.cryptolocker/.encrypted/.virus/.tor/.crpt 等）+ 加密 API"
|
|||
|
|
strings:
|
|||
|
|
$ext1 = /\.locky\b/ nocase
|
|||
|
|
$ext2 = /\.zepto\b/ nocase
|
|||
|
|
$ext3 = /\.cryptolocker\b/ nocase
|
|||
|
|
$ext4 = /\.cryptor\b/ nocase
|
|||
|
|
$ext5 = /\.crypt\b/ nocase
|
|||
|
|
$ext6 = /\.encrypted\b/ nocase
|
|||
|
|
$ext7 = /\.virus\b/ nocase
|
|||
|
|
$ext8 = /\.tor\b/ nocase
|
|||
|
|
$ext9 = /\.crpt\b/ nocase
|
|||
|
|
$ext10 = /\.wallet\b/ nocase
|
|||
|
|
$ext11 = /\.pay2[\w.-]*\.?\w*\b/ nocase
|
|||
|
|
$enc = /CryptEncrypt|BCryptEncrypt|CryptDeriveKey/ ascii
|
|||
|
|
$note = /HOW_TO_RECOVER|RESTORE_FILES|DECRYPT_INSTRUCTIONS|README/ nocase
|
|||
|
|
condition:
|
|||
|
|
// 扩展名 + 加密 API + 勒索信 = 完整勒索链
|
|||
|
|
any of ($ext*) and $enc and $note
|
|||
|
|
or
|
|||
|
|
// 扩展名 + 加密 API（至少 2 种扩展名变体）
|
|||
|
|
(2 of ($ext*)) and $enc
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
|
|||
|
|
// =============================================================================
|
|||
|
|
// C8-7 卷影删除专项（辅助勒索前置）
|
|||
|
|
// =============================================================================
|
|||
|
|
|
|||
|
|
rule C8_Ransomware_VolumeShadow {
|
|||
|
|
meta:
|
|||
|
|
risk_level = "high"
|
|||
|
|
category = "C8"
|
|||
|
|
false_positive_rate = "medium"
|
|||
|
|
reference = "MITRE ATT&CK T1490 Inhibit System Recovery"
|
|||
|
|
description = "删除卷影副本：vssadmin / wmic shadowcopy + 加密 API"
|
|||
|
|
strings:
|
|||
|
|
$vss1 = "vssadmin delete shadows" ascii
|
|||
|
|
$vss2 = /vssadmin\s+delete\s+shadows\s+\/all\b/ ascii
|
|||
|
|
$wmic1 = /wmic\s+shadowcopy\s+delete/ ascii
|
|||
|
|
$wmic2 = /wmic\s+shadowcopy\s+where\s+\d+/ ascii
|
|||
|
|
$vss3 = /ShadowCopy|VolumeShadowCopy|vss\b/i ascii // "i" flag = nocase in YARA
|
|||
|
|
$enc = /CryptEncrypt|BCryptEncrypt|CryptDeriveKey/ ascii
|
|||
|
|
condition:
|
|||
|
|
// 卷影删除 + 加密 API = 完整勒索前置
|
|||
|
|
(any of ($vss1, $vss2, $wmic*, $vss3)) and any of ($enc*)
|
|||
|
|
or
|
|||
|
|
// 连续多次 vssadmin delete = 正在清卷影
|
|||
|
|
any of ($vss1, $vss2) and any of ($wmic*)
|
|||
|
|
}
|