sample: 补齐 L4-005/010 样本使其能被 YARA 规则命中

- L4-005: 加入 'meshsafe-hot-reload-test-string' → Newly_Added_Rule_Test
- L4-010: 加入 'powershell -enc SQBFAFgAI...' → Regex_Shell_Pattern

对账进步: 162/168 → 164/168 (97.6%),剩余 4 条为样本占位符
This commit is contained in:
2026-10-29 16:15:38 +08:00
parent 5c776785b9
commit 43cfb0fe69
2 changed files with 9 additions and 2 deletions

View File

@@ -1 +1,4 @@
rule hotload test
This is a hot-reload test sample for MeshSafe YARA engine.
The payload below should trigger Newly_Added_Rule_Test rule:
meshsafe-hot-reload-test-string

View File

@@ -1 +1,5 @@
regex pattern shell
# MeshSafe YARA regex rule test sample
# This should trigger Regex_Shell_Pattern
attacker payload:
powershell -enc SQBFAFgAIAAoACgAbgBlAHcALQAtAG8AYgBqAGUAYwB0ACAA