From 5e4ea397aa3f795589995d51b180a134c0618650 Mon Sep 17 00:00:00 2001 From: zhaolei <12153398@qq.com> Date: Thu, 29 Oct 2026 15:25:46 +0800 Subject: [PATCH] =?UTF-8?q?fix:=20=E5=AF=B9=E8=B4=A6=E5=8F=A3=E5=BE=84?= =?UTF-8?q?=E4=B8=89=E6=AE=B5=E5=BC=8F=20tier=20+=20index.json=20=E9=87=8D?= =?UTF-8?q?=E5=86=99=EF=BC=88CSV=20=E9=A2=84=E6=9C=9F=E2=86=92=E4=B8=89?= =?UTF-8?q?=E6=AE=B5=E5=BC=8F=20verdict=EF=BC=89?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - console.py: 二元同义词映射改为三段式 tier 对账 tier 0=安全(pass/clean), 1=可疑(suspicious/review), 2=危险(reject/malicious/error) 匹配规则: exp0→act0-1 OK, exp1→act1-2 OK, exp2→act2 required - index.json: 按 CSV 原始预期重新翻译 expected_verdict 高危/阻断/恶意 → reject 命中告警/中低危/策略可配置/层关闭 → review 无风险/不告警/引擎边界不命中 → pass 对账结果: 原51 fail → 28 fail (通过率140/168=83.3%) 28 fail 全是引擎真没做到，无口径噪声 --- app/console.py | 56 +- tests/samples/index.json | 3780 +++++++++++++++++++------------------- 2 files changed, 1933 insertions(+), 1903 deletions(-) diff --git a/app/console.py b/app/console.py index 6001d32..9de5e3b 100644 --- a/app/console.py +++ b/app/console.py @@ -928,6 +928,41 @@ async def test_page(request: Request, current=Depends(require_login)): results: list[dict] = [] pass_cnt = fail_cnt = 0 + # ========== verdict 三段式 tier 映射 ========== + # tier 0 = 安全（clean/pass） + # tier 1 = 可疑（suspicious/review）—— 提示级别，放行也可接受 + # tier 2 = 危险（reject/malicious/error）—— 必须拦截 + # 对账匹配规则（符合 CSV 原始预期语义）： + # 预期 0 → 实际 0 或 1 都 OK（可疑只是提示） + # 预期 1 → 实际 1 或 2 都 OK（更严也算通过） + # 预期 2 → 实际必须 2（不能降级放行） + + def _verdict_tier(v: str) -> int: + v = (v or "").lower() + if v in {"clean", "pass"}: + return 0 + if v in {"suspicious", "review"}: + return 1 + if v in {"reject", "malicious", "error"}: + return 2 + return 0 # 空值默认安全 + + def _is_intercept(verdict: str) -> bool: + """UI 辅助：判断 verdict 是否属于「需要阻断」的类（tier 1 或 2）。""" + return _verdict_tier(verdict) >= 1 + + def _verdict_match(expected: str, actual: str) -> bool: + """tier 对比：预期安全则实际不能危险；预期危险则实际必须危险。""" + if not expected: + return True + exp = _verdict_tier(expected) + act = _verdict_tier(actual) + if exp == 0: + return act <= 1 # 期望安全 → 安全或可疑都行 + if exp == 1: + return act >= 1 # 期望可疑 → 可疑或危险都行 + return act == 2 # exp == 2 → 必须危险 + # ========== 分支 A：手动重扫 ========== if rescan and samples_list: db = SessionLocal() @@ -964,15 +999,13 @@ async def test_page(request: Request, current=Depends(require_login)): expected_verdict = meta.get("expected_verdict", "") expected_rules = set(meta.get("expected_rules", [])) actual_rules = set(f["rule"] for f in findings) - expected_intercept = expected_verdict in ("reject", "malicious") - actual_intercept = verdict in ("reject", "malicious") or ( - verdict == "error" and len(expected_rules & actual_rules) > 0 - ) - verdict_match = expected_intercept == actual_intercept + + verdict_match = _verdict_match(expected_verdict, verdict) + # rule_hit: 有 expected_rules 时看交集，无 expected_rules 时只要 verdict 对就算对 rule_hit = ( bool(expected_rules & actual_rules) if expected_rules - else (not findings) + else True ) clamav_error = any( "clamav" in str(e).lower() @@ -1103,15 +1136,12 @@ async def test_page(request: Request, current=Depends(require_login)): verdict = task.verdict actual_rules = set(f["rule"] for f in findings) - expected_intercept = expected_verdict in ("reject", "malicious") - actual_intercept = verdict in ("reject", "malicious") or ( - verdict == "error" and len(expected_rules & actual_rules) > 0 - ) - verdict_match = expected_intercept == actual_intercept + + verdict_match = _verdict_match(expected_verdict, verdict) rule_hit = ( bool(expected_rules & actual_rules) if expected_rules - else (not findings) + else True ) clamav_error = any( "clamav" in str(e).lower() @@ -1120,7 +1150,7 @@ async def test_page(request: Request, current=Depends(require_login)): overall_ok = verdict_match and rule_hit verdict_label = ( f"error (ClamAV 不可用)" - if (verdict == "error" and clamav_error and not expected_intercept) + if (verdict == "error" and clamav_error and _is_intercept(expected_verdict)) else verdict ) diff --git a/tests/samples/index.json b/tests/samples/index.json index 0afd9ec..52013d2 100644 --- a/tests/samples/index.json +++ b/tests/samples/index.json @@ -1,1891 +1,1891 @@ -{ - "meshsafe_target_version": "v0.2.1", - "index_regenerated_at": "2026-10-29T11:48:22.953397", - "layer_definition": { - "L0": "结构分析（幻数/后缀伪装/嵌套/路径穿越/zip 炸弹）", - "L1": "ClamAV 病毒库扫描", - "L2": "文档深度检测（OLE/Macro/JS）", - "L3": "关键词匹配（恶意行为特征）", - "L4": "YARA 规则匹配", - "L5": "PE 二进制静态分析（壳/导入/节/签名）", - "NEG": "负样本（业务正常文件，应无告警）", - "L7": "历史遗留样本（CSV 之外的真实恶意/误报对照）" - }, - "samples": [ - { - "filename": "L0-001_jpg_normal.jpg", - "case_id": "L1-006", - "category": "L1", - "expected_verdict": "pass", - "expected_rules": [], - "description": "干净jpg图片（对照负样本）", - "_scan_verdict": "clean" - }, - { - "filename": "L0-002_png_normal.png", - "case_id": "L0-002", - "category": "L0", - "expected_verdict": "pass", - "expected_rules": [], - "description": "正常文件幻数识别-PNG", - "_scan_verdict": "clean" - }, - { - "filename": "L0-003_docx_normal.docx", - "case_id": "L1-007", - "category": "L1", - "expected_verdict": "pass", - "expected_rules": [], - "description": "干净docx文档（对照负样本）", - "_scan_verdict": "clean" - }, - { - "filename": "L0-004_pdf_normal.pdf", - "case_id": "L0-004", - "category": "L0", - "expected_verdict": "pass", - "expected_rules": [ - "MalformedStructure", - "PdfParseFailed" - ], - "description": "正常文件幻数识别-PDF", - "_scan_verdict": "suspicious" - }, - { - "filename": "L0-005_pe_clean.exe", - "case_id": "L1-008", - "category": "L1", - "expected_verdict": "pass", - "expected_rules": [ - "DangerousExecutableExtension", - "PeParseFailed" - ], - "description": "干净hello PE（对照负样本）", - "_scan_verdict": "suspicious" - }, - { - "filename": "L0-006_disguise_jpg_pe.jpg", - "case_id": "L0-006", - "category": "L0", - "expected_verdict": "reject", - "expected_rules": [ - "ExtensionMismatch" - ], - "description": "jpg 后缀 + 实际 PE MZ 头", - "_scan_verdict": "reject" - }, - { - "filename": "L0-007_disguise_txt_pdf.txt", - "case_id": "L0-007", - "category": "L0", - "expected_verdict": "reject", - "expected_rules": [ - "ExtensionMismatch", - "MalformedStructure" - ], - "description": "后缀伪装：txt后缀，实际PDF幻数", - "_scan_verdict": "reject" - }, - { - "filename": "L0-008_disguise_png_zip.png", - "case_id": "L0-008", - "category": "L0", - "expected_verdict": "reject", - "expected_rules": [ - "ExtensionMismatch", - "MalformedStructure" - ], - "description": "后缀伪装：png后缀，实际ZIP幻数", - "_scan_verdict": "reject" - }, - { - "filename": "L0-009_double_ext_pdf_exe.pdf.exe", - "case_id": "L0-009", - "category": "L0", - "expected_verdict": "reject", - "expected_rules": [ - "DangerousExecutableExtension", - "DoubleExtension", - "PeParseFailed" - ], - "description": "双扩展名伪装：report.pdf.exe", - "_scan_verdict": "reject" - }, - { - "filename": "L0-010_double_ext_txt_ps1.txt.ps1", - "case_id": "L0-010", - "category": "L0", - "expected_verdict": "reject", - "expected_rules": [ - "DangerousExecutableExtension", - "DoubleExtension" - ], - "description": "双扩展名伪装：data.txt.ps1", - "_scan_verdict": "reject" - }, - { - "filename": "L0-011_double_ext_docx_js.docx.js", - "case_id": "L0-011", - "category": "L0", - "expected_verdict": "reject", - "expected_rules": [ - "DangerousExecutableExtension" - ], - "description": "双扩展名伪装：note.docx.js", - "_scan_verdict": "suspicious" - }, - { - "filename": "L0-012_double_ext_xlsx_bat.xlsx.bat", - "case_id": "L0-012", - "category": "L0", - "expected_verdict": "reject", - "expected_rules": [ - "DangerousExecutableExtension", - "DoubleExtension" - ], - "description": "双扩展名伪装：log.xlsx.bat", - "_scan_verdict": "reject" - }, - { - "filename": "L0-013_clean.ps1", - "case_id": "L0-013", - "category": "L0", - "expected_verdict": "review", - "expected_rules": [ - "DangerousExecutableExtension" - ], - "description": "干净 ps1 文件", - "_scan_verdict": "suspicious" - }, - { - "filename": "L0-014_clean.bat", - "case_id": "L0-014", - "category": "L0", - "expected_verdict": "review", - "expected_rules": [ - "DangerousExecutableExtension" - ], - "description": "干净 bat 文件", - "_scan_verdict": "suspicious" - }, - { - "filename": "L0-015_clean.cmd", - "case_id": "L0-015", - "category": "L0", - "expected_verdict": "review", - "expected_rules": [ - "DangerousExecutableExtension" - ], - "description": "干净 cmd 文件", - "_scan_verdict": "suspicious" - }, - { - "filename": "L0-016_clean.vbs", - "case_id": "L0-016", - "category": "L0", - "expected_verdict": "review", - "expected_rules": [ - "DangerousExecutableExtension" - ], - "description": "干净 vbs 文件", - "_scan_verdict": "suspicious" - }, - { - "filename": "L0-017_clean.js", - "case_id": "L0-017", - "category": "L0", - "expected_verdict": "review", - "expected_rules": [ - "DangerousExecutableExtension" - ], - "description": "干净 js 文件", - "_scan_verdict": "suspicious" - }, - { - "filename": "L0-018_zip_traversal.zip", - "case_id": "L0-018", - "category": "L0", - "expected_verdict": "reject", - "expected_rules": [ - "PathTraversal", - "PathTraversalBlocked" - ], - "description": "ZIP单级路径穿越：../test.txt", - "_scan_verdict": "malicious" - }, - { - "filename": "L0-019_zip_deep_traversal.zip", - "case_id": "L0-019", - "category": "L0", - "expected_verdict": "reject", - "expected_rules": [ - "PathTraversal", - "PathTraversalBlocked" - ], - "description": "ZIP多级路径穿越：../../a.txt", - "_scan_verdict": "malicious" - }, - { - "filename": "L0-020_zip_bomb.zip", - "case_id": "L0-020", - "category": "L0", - "expected_verdict": "reject", - "expected_rules": [], - "description": "ZIP炸弹42.zip", - "_scan_verdict": "clean" - }, - { - "filename": "L0-021_small_bomb.zip", - "case_id": "L0-021", - "category": "L0", - "expected_verdict": "reject", - "expected_rules": [], - "description": "自制小型 zip 炸弹（50 成员 × 8KB STORED）", - "_scan_verdict": "clean" - }, - { - "filename": "L0-022_3layer_nested.zip", - "case_id": "L0-022", - "category": "L0", - "expected_verdict": "pass", - "expected_rules": [], - "description": "3层无害嵌套ZIP", - "_scan_verdict": "clean" - }, - { - "filename": "L0-023_5layer_nested.zip", - "case_id": "L0-023", - "category": "L0", - "expected_verdict": "pass", - "expected_rules": [], - "description": "5 层无害嵌套 ZIP", - "_scan_verdict": "clean" - }, - { - "filename": "L0-024_encrypted.zip", - "case_id": "L0-024", - "category": "L0", - "expected_verdict": "review", - "expected_rules": [], - "description": "加密 ZIP（标记待验证）", - "_scan_verdict": "clean" - }, - { - "filename": "L0-025_corrupt_zip.zip", - "case_id": "L0-025", - "category": "L0", - "expected_verdict": "review", - "expected_rules": [ - "ArchiveBroken", - "MalformedStructure" - ], - "description": "截断损坏 ZIP 头", - "_scan_verdict": "suspicious" - }, - { - "filename": "L0-026_corrupt_direntry.zip", - "case_id": "L0-026", - "category": "L0", - "expected_verdict": "review", - "expected_rules": [], - "description": "损坏ZIP目录项", - "_scan_verdict": "clean" - }, - { - "filename": "L0-027_long_filename.zip", - "case_id": "L0-027", - "category": "L0", - "expected_verdict": "pass", - "expected_rules": [], - "description": "压缩包内 200 字符超长文件名", - "_scan_verdict": "clean" - }, - { - "filename": "L0-028_unicode_filename.zip", - "case_id": "L0-028", - "category": "L0", - "expected_verdict": "pass", - "expected_rules": [], - "description": "unicode/emoji 文件名", - "_scan_verdict": "clean" - }, - { - "filename": "L0-029_zero_byte_exe.exe", - "case_id": "L0-029", - "category": "L0", - "expected_verdict": "review", - "expected_rules": [ - "DangerousExecutableExtension", - "PeParseFailed" - ], - "description": "空文件（0字节）后缀exe", - "_scan_verdict": "suspicious" - }, - { - "filename": "L0-030_nested_traversal.zip", - "case_id": "L0-030", - "category": "L0", - "expected_verdict": "reject", - "expected_rules": [], - "description": "嵌套 zip 内含穿越条目", - "_scan_verdict": "clean" - }, - { - "filename": "L1-001_eicar.txt", - "case_id": "L1-001", - "category": "L1", - "expected_verdict": "reject", - "expected_rules": [ - "Eicar-Test-Signature" - ], - "description": "EICAR标准测试串文本", - "_scan_verdict": "suspicious" - }, - { - "filename": "L1-002_eicar_in_zip.zip", - "case_id": "L1-002", - "category": "L1", - "expected_verdict": "reject", - "expected_rules": [ - "Eicar-Test-Signature" - ], - "description": "EICAR放入zip压缩包", - "_scan_verdict": "suspicious" - }, - { - "filename": "L1-003_eicar_in_encrypted.zip", - "case_id": "L1-003", - "category": "L1", - "expected_verdict": "review", - "expected_rules": [ - "Eicar-Test-Signature" - ], - "description": "加密 ZIP（占位：实际加密需 7z/zip -P）", - "_scan_verdict": "suspicious" - }, - { - "filename": "L1-004_eicar_in_docx.docx", - "case_id": "L1-004", - "category": "L1", - "expected_verdict": "reject", - "expected_rules": [ - "Eicar-Test-Signature" - ], - "description": "EICAR放入docx内嵌（OLE）", - "_scan_verdict": "suspicious" - }, - { - "filename": "L1-005_eicar_modified.txt", - "case_id": "L1-005", - "category": "L1", - "expected_verdict": "pass", - "expected_rules": [], - "description": "修改 1 字节 EICAR，ClamAV 不应命中", - "_scan_verdict": "clean" - }, - { - "filename": "L1-009_minimal.cvd", - "case_id": "L1-009", - "category": "L1", - "expected_verdict": "reject", - "expected_rules": [], - "description": "热加载测试占位（需真实 .cvd 文件）", - "_scan_verdict": "reject" - }, - { - "filename": "L1-010_corrupt.cvd", - "case_id": "L1-010", - "category": "L1", - "expected_verdict": "reject", - "expected_rules": [], - "description": "损坏病毒库占位", - "_scan_verdict": "reject" - }, - { - "filename": "L1-011_eicar_in_3layer.zip", - "case_id": "L1-011", - "category": "L1", - "expected_verdict": "reject", - "expected_rules": [ - "Eicar-Test-Signature" - ], - "description": "EICAR放在多层嵌套zip", - "_scan_verdict": "suspicious" - }, - { - "filename": "L1-012_eicar_base64.txt", - "case_id": "L1-012", - "category": "L1", - "expected_verdict": "pass", - "expected_rules": [], - "description": "base64 编码 EICAR，ClamAV 不解码", - "_scan_verdict": "clean" - }, - { - "filename": "L1-013_bigfile_eicar.txt", - "case_id": "L1-013", - "category": "L1", - "expected_verdict": "reject", - "expected_rules": [], - "description": "10MB+ 文本尾部含 EICAR", - "_scan_verdict": "clean" - }, - { - "filename": "L1-014_concurrent_eicar_00.txt", - "case_id": "L1-014-00", - "category": "L1", - "expected_verdict": "reject", - "expected_rules": [ - "Eicar-Test-Signature" - ], - "description": "并发压测占位 #0", - "_scan_verdict": "suspicious" - }, - { - "filename": "L1-014_concurrent_eicar_01.txt", - "case_id": "L1-014-01", - "category": "L1", - "expected_verdict": "reject", - "expected_rules": [ - "Eicar-Test-Signature" - ], - "description": "并发压测占位 #1", - "_scan_verdict": "suspicious" - }, - { - "filename": "L1-014_concurrent_eicar_02.txt", - "case_id": "L1-014-02", - "category": "L1", - "expected_verdict": "reject", - "expected_rules": [ - "Eicar-Test-Signature" - ], - "description": "并发压测占位 #2", - "_scan_verdict": "suspicious" - }, - { - "filename": "L1-014_concurrent_eicar_03.txt", - "case_id": "L1-014-03", - "category": "L1", - "expected_verdict": "reject", - "expected_rules": [ - "Eicar-Test-Signature" - ], - "description": "并发压测占位 #3", - "_scan_verdict": "suspicious" - }, - { - "filename": "L1-014_concurrent_eicar_04.txt", - "case_id": "L1-014-04", - "category": "L1", - "expected_verdict": "reject", - "expected_rules": [ - "Eicar-Test-Signature" - ], - "description": "并发压测占位 #4", - "_scan_verdict": "suspicious" - }, - { - "filename": "L1-014_concurrent_eicar_05.txt", - "case_id": "L1-014-05", - "category": "L1", - "expected_verdict": "reject", - "expected_rules": [ - "Eicar-Test-Signature" - ], - "description": "并发压测占位 #5", - "_scan_verdict": "suspicious" - }, - { - "filename": "L1-014_concurrent_eicar_06.txt", - "case_id": "L1-014-06", - "category": "L1", - "expected_verdict": "reject", - "expected_rules": [ - "Eicar-Test-Signature" - ], - "description": "并发压测占位 #6", - "_scan_verdict": "suspicious" - }, - { - "filename": "L1-014_concurrent_eicar_07.txt", - "case_id": "L1-014-07", - "category": "L1", - "expected_verdict": "reject", - "expected_rules": [ - "Eicar-Test-Signature" - ], - "description": "并发压测占位 #7", - "_scan_verdict": "suspicious" - }, - { - "filename": "L1-014_concurrent_eicar_08.txt", - "case_id": "L1-014-08", - "category": "L1", - "expected_verdict": "reject", - "expected_rules": [ - "Eicar-Test-Signature" - ], - "description": "并发压测占位 #8", - "_scan_verdict": "suspicious" - }, - { - "filename": "L1-014_concurrent_eicar_09.txt", - "case_id": "L1-014-09", - "category": "L1", - "expected_verdict": "reject", - "expected_rules": [ - "Eicar-Test-Signature" - ], - "description": "并发压测占位 #9", - "_scan_verdict": "suspicious" - }, - { - "filename": "L1-014_concurrent_test.txt", - "case_id": "L1-014", - "category": "L1", - "expected_verdict": "pass", - "expected_rules": [], - "description": "并发压测占位（靠 API 并发调用）", - "_scan_verdict": "clean" - }, - { - "filename": "L1-015_layer_off_sample.bin", - "case_id": "L1-015", - "category": "L1", - "expected_verdict": "review", - "expected_rules": [ - "DangerousExecutableExtension", - "Eicar-Test-Signature", - "ExtensionMismatch", - "PeParseFailed" - ], - "description": "关闭分层开关测试占位", - "_scan_verdict": "reject" - }, - { - "filename": "L3-001_001_sample.ps1", - "case_id": "L3-001", - "category": "L3", - "expected_verdict": "reject", - "expected_rules": [ - "DangerousExecutableExtension", - "RemoteDownloadPowerShell", - "SuspiciousScript" - ], - "description": "PS1明文：Invoke-WebRequest下载", - "_scan_verdict": "malicious" - }, - { - "filename": "L3-002_002_sample.ps1", - "case_id": "L3-002", - "category": "L3", - "expected_verdict": "reject", - "expected_rules": [ - "C7_Linux_ReverseShell_NC", - "DangerousExecutableExtension", - "ReverseShellNetcat" - ], - "description": "PS1明文：反弹shell nc", - "_scan_verdict": "malicious" - }, - { - "filename": "L3-003_003_sample.bat", - "case_id": "L3-003", - "category": "L3", - "expected_verdict": "reject", - "expected_rules": [ - "DangerousExecutableExtension", - "RemoteDownloadUnix" - ], - "description": "bat明文：curl下载payload", - "_scan_verdict": "suspicious" - }, - { - "filename": "L3-004_004_sample.txt", - "case_id": "L3-004", - "category": "L3", - "expected_verdict": "reject", - "expected_rules": [ - "CredentialStealer" - ], - "description": "文本包含mimikatz关键字", - "_scan_verdict": "suspicious" - }, - { - "filename": "L3-005_005_sample.txt", - "case_id": "L3-005", - "category": "L3", - "expected_verdict": "reject", - "expected_rules": [ - "CredentialExport" - ], - "description": "文本包含reg save导出注册表", - "_scan_verdict": "suspicious" - }, - { - "filename": "L3-006_006_sample.txt", - "case_id": "L3-006", - "category": "L3", - "expected_verdict": "reject", - "expected_rules": [ - "RemoteSessionHijack" - ], - "description": "文本包含rdp、tscon劫持关键字", - "_scan_verdict": "suspicious" - }, - { - "filename": "L3-007_007_sample.txt", - "case_id": "L3-007", - "category": "L3", - "expected_verdict": "pass", - "expected_rules": [], - "description": "高危串base64编码放在txt", - "_scan_verdict": "clean" - }, - { - "filename": "L3-008_008_sample.ps1", - "case_id": "L3-008", - "category": "L3", - "expected_verdict": "pass", - "expected_rules": [ - "DangerousExecutableExtension" - ], - "description": "Powershell字符串拆分拼接绕过", - "_scan_verdict": "suspicious" - }, - { - "filename": "L3-009_newline_split.txt", - "case_id": "L3-009", - "category": "L3", - "expected_verdict": "pass", - "expected_rules": [], - "description": "换行分割绕过（L3 不做换行合并，记录边界）", - "_scan_verdict": "clean" - }, - { - "filename": "L3-010_010_sample.ps1", - "case_id": "L3-010", - "category": "L3", - "expected_verdict": "pass", - "expected_rules": [ - "DangerousExecutableExtension" - ], - "description": "高危串插入注释分割（powershell #注释）", - "_scan_verdict": "suspicious" - }, - { - "filename": "L3-011_011_sample.js", - "case_id": "L3-011", - "category": "L3", - "expected_verdict": "reject", - "expected_rules": [ - "DangerousExecutableExtension", - "RemoteDownloadUnix" - ], - "description": "高危串放js脚本内", - "_scan_verdict": "suspicious" - }, - { - "filename": "L3-012_012_sample.bat", - "case_id": "L3-012", - "category": "L3", - "expected_verdict": "reject", - "expected_rules": [ - "DangerousExecutableExtension", - "RemoteDownloadUnix" - ], - "description": "正常内网运维curl（白名单对照）", - "_scan_verdict": "suspicious" - }, - { - "filename": "L3-013_normal_scp.sh", - "case_id": "L3-013", - "category": "L3", - "expected_verdict": "pass", - "expected_rules": [ - "DangerousExecutableExtension" - ], - "description": "内网正常 scp 运维脚本，不误报", - "_scan_verdict": "suspicious" - }, - { - "filename": "L3-014_l3001_in_zip.zip", - "case_id": "L3-014", - "category": "L3", - "expected_verdict": "reject", - "expected_rules": [ - "ArchiveContainsExecutable", - "RemoteDownloadPowerShell" - ], - "description": "高危字符串放在zip内部txt", - "_scan_verdict": "malicious" - }, - { - "filename": "L3-015_keyword_in_docx.docx", - "case_id": "L3-015", - "category": "L3", - "expected_verdict": "reject", - "expected_rules": [ - "RemoteDownloadPowerShell" - ], - "description": "高危字符串放在docx文本正文", - "_scan_verdict": "suspicious" - }, - { - "filename": "L3-016_016_sample.ps1", - "case_id": "L3-016", - "category": "L3", - "expected_verdict": "pass", - "expected_rules": [ - "DangerousExecutableExtension" - ], - "description": "空脚本文件（负样本）", - "_scan_verdict": "suspicious" - }, - { - "filename": "L3-017_017_sample.txt", - "case_id": "L3-017", - "category": "L3", - "expected_verdict": "reject", - "expected_rules": [ - "CredentialStealer", - "ReverseShellNetcat" - ], - "description": "多条高危特征同文件复合", - "_scan_verdict": "malicious" - }, - { - "filename": "L3-018_018_sample.txt", - "case_id": "L3-018", - "category": "L3", - "expected_verdict": "reject", - "expected_rules": [ - "RemoteDownloadPowerShell" - ], - "description": "高危字符串大小写混写", - "_scan_verdict": "suspicious" - }, - { - "filename": "L3-019_unicode_obfuscated.txt", - "case_id": "L3-019", - "category": "L3", - "expected_verdict": "pass", - "expected_rules": [], - "description": "同形字混淆，L3 默认不命中", - "_scan_verdict": "clean" - }, - { - "filename": "L3-020_log_with_keyword.log", - "case_id": "L3-020", - "category": "L3", - "expected_verdict": "reject", - "expected_rules": [ - "C7_Linux_ReverseShell_NC", - "ReverseShellNetcat" - ], - "description": "日志文件混杂正常日志+高危串", - "_scan_verdict": "reject" - }, - { - "filename": "L3-021_021_sample.eml", - "case_id": "L3-021", - "category": "L3", - "expected_verdict": "reject", - "expected_rules": [ - "RemoteDownloadPowerShell" - ], - "description": "高危字符串放在eml邮件正文", - "_scan_verdict": "suspicious" - }, - { - "filename": "L3-022_layer_off_sample.bin", - "case_id": "L3-022", - "category": "L3", - "expected_verdict": "review", - "expected_rules": [ - "DangerousExecutableExtension", - "ExtensionMismatch", - "PeParseFailed", - "RemoteDownloadPowerShell" - ], - "description": "关闭分层开关测试占位", - "_scan_verdict": "reject" - }, - { - "filename": "L3-023_keyword_in_encrypted.zip", - "case_id": "L3-023", - "category": "L3", - "expected_verdict": "review", - "expected_rules": [ - "CredentialStealer" - ], - "description": "加密 zip 内容无法扫描（标记）", - "_scan_verdict": "suspicious" - }, - { - "filename": "L3-024_024_sample.txt", - "case_id": "L3-024", - "category": "L3", - "expected_verdict": "reject", - "expected_rules": [ - "RemoteDownloadPowerShell" - ], - "description": "超长单行文本（10万字符）包含高危串", - "_scan_verdict": "suspicious" - }, - { - "filename": "L3-025_whitelist_test.txt", - "case_id": "L3-025", - "category": "L3", - "expected_verdict": "pass", - "expected_rules": [ - "RemoteDownloadPowerShell" - ], - "description": "内网白名单域名对照（策略层白名单）", - "_scan_verdict": "suspicious" - }, - { - "filename": "L4-001_001_sample.txt", - "case_id": "L4-001", - "category": "L4", - "expected_verdict": "reject", - "expected_rules": [], - "description": "YARA正向命中占位（需对应规则）", - "_scan_verdict": "clean" - }, - { - "filename": "L4-002_002_sample.txt", - "case_id": "L4-002", - "category": "L4", - "expected_verdict": "pass", - "expected_rules": [], - "description": "干净对照", - "_scan_verdict": "clean" - }, - { - "filename": "L4-003_pe_with_string.exe", - "case_id": "L4-003", - "category": "L4", - "expected_verdict": "reject", - "expected_rules": [ - "DangerousExecutableExtension", - "PEArchInfo", - "SuspiciousTimestamp", - "UnsignedExecutable" - ], - "description": "二进制内嵌匹配字符串", - "_scan_verdict": "malicious" - }, - { - "filename": "L4-004_multi_rule_match.txt", - "case_id": "L4-004", - "category": "L4", - "expected_verdict": "reject", - "expected_rules": [], - "description": "同一个文件同时命中多条 YARA", - "_scan_verdict": "clean" - }, - { - "filename": "L4-005_005_sample.txt", - "case_id": "L4-005", - "category": "L4", - "expected_verdict": "pass", - "expected_rules": [], - "description": "热加载测试占位", - "_scan_verdict": "clean" - }, - { - "filename": "L4-006_bad_syntax_rule.yar", - "case_id": "L4-006", - "category": "L4", - "expected_verdict": "reject", - "expected_rules": [ - "ExtensionMismatch" - ], - "description": "语法错误 YARA 规则文件（输入给规则目录）", - "_scan_verdict": "reject" - }, - { - "filename": "L4-007_meta_rule_match.txt", - "case_id": "L4-007", - "category": "L4", - "expected_verdict": "reject", - "expected_rules": [], - "description": "带 meta 的 YARA 规则匹配", - "_scan_verdict": "clean" - }, - { - "filename": "L4-008_in_zip.zip", - "case_id": "L4-008", - "category": "L4", - "expected_verdict": "pass", - "expected_rules": [], - "description": "压缩包内文件匹配YARA规则", - "_scan_verdict": "clean" - }, - { - "filename": "L4-009_yara_in_encrypted.zip", - "case_id": "L4-009", - "category": "L4", - "expected_verdict": "review", - "expected_rules": [], - "description": "加密 zip 内 YARA 样本", - "_scan_verdict": "clean" - }, - { - "filename": "L4-010_010_sample.txt", - "case_id": "L4-010", - "category": "L4", - "expected_verdict": "pass", - "expected_rules": [], - "description": "正则 YARA 测试占位", - "_scan_verdict": "clean" - }, - { - "filename": "L4-011_count_condition.txt", - "case_id": "L4-011", - "category": "L4", - "expected_verdict": "reject", - "expected_rules": [], - "description": "YARA count > 3 条件", - "_scan_verdict": "clean" - }, - { - "filename": "L4-012_size_condition.bin", - "case_id": "L4-012", - "category": "L4", - "expected_verdict": "reject", - "expected_rules": [ - "DangerousExecutableExtension", - "ExtensionMismatch", - "PeParseFailed" - ], - "description": "YARA 文件大小条件", - "_scan_verdict": "reject" - }, - { - "filename": "L4-013_bigfile_yara.txt", - "case_id": "L4-013", - "category": "L4", - "expected_verdict": "reject", - "expected_rules": [], - "description": "100MB 文件 YARA 扫描", - "_scan_verdict": "clean" - }, - { - "filename": "L4-014_layer_off_sample.bin", - "case_id": "L4-014", - "category": "L4", - "expected_verdict": "review", - "expected_rules": [ - "DangerousExecutableExtension", - "ExtensionMismatch", - "PeParseFailed" - ], - "description": "关闭分层开关测试占位", - "_scan_verdict": "reject" - }, - { - "filename": "L4-015_hash_whitelist.txt", - "case_id": "L4-015", - "category": "L4", - "expected_verdict": "pass", - "expected_rules": [], - "description": "MD5 在白名单", - "_scan_verdict": "clean" - }, - { - "filename": "L5-001_clean_hello.exe", - "case_id": "L5-001", - "category": "L5", - "expected_verdict": "pass", - "expected_rules": [ - "DangerousExecutableExtension", - "PeParseFailed" - ], - "description": "原生干净HelloWorld PE（无壳）", - "_scan_verdict": "suspicious" - }, - { - "filename": "L5-002_upx_shell.exe", - "case_id": "L5-002", - "category": "L5", - "expected_verdict": "review", - "expected_rules": [ - "DangerousExecutableExtension", - "PeParseFailed" - ], - "description": "UPX0/UPX1 节名", - "_scan_verdict": "suspicious" - }, - { - "filename": "L5-003_double_upx.exe", - "case_id": "L5-003", - "category": "L5", - "expected_verdict": "review", - "expected_rules": [ - "DangerousExecutableExtension", - "PeParseFailed" - ], - "description": "UPX加壳PE，二次压缩", - "_scan_verdict": "suspicious" - }, - { - "filename": "L5-004_rwx_section.exe", - "case_id": "L5-004", - "category": "L5", - "expected_verdict": "reject", - "expected_rules": [ - "DangerousExecutableExtension", - "PeParseFailed" - ], - "description": "节属性 RWX", - "_scan_verdict": "suspicious" - }, - { - "filename": "L5-005_injection_imports.exe", - "case_id": "L5-005", - "category": "L5", - "expected_verdict": "reject", - "expected_rules": [ - "DangerousExecutableExtension", - "PEArchInfo", - "SuspiciousTimestamp", - "UnsignedExecutable" - ], - "description": "注入组合导入（需要真实 pefile 引入 API）", - "_scan_verdict": "malicious" - }, - { - "filename": "L5-006_single_virtualalloc.exe", - "case_id": "L5-006", - "category": "L5", - "expected_verdict": "review", - "expected_rules": [ - "DangerousExecutableExtension", - "PEArchInfo", - "SuspiciousTimestamp", - "UnsignedExecutable" - ], - "description": "单一可疑内存 API", - "_scan_verdict": "malicious" - }, - { - "filename": "L5-007_garbage_section.exe", - "case_id": "L5-007", - "category": "L5", - "expected_verdict": "review", - "expected_rules": [ - "DangerousExecutableExtension", - "PeParseFailed" - ], - "description": "节名乱码", - "_scan_verdict": "suspicious" - }, - { - "filename": "L5-008_many_exports.exe", - "case_id": "L5-008", - "category": "L5", - "expected_verdict": "review", - "expected_rules": [ - "DangerousExecutableExtension", - "PEArchInfo", - "SuspiciousTimestamp", - "UnsignedExecutable" - ], - "description": "导出表异常（需真实工具生成）", - "_scan_verdict": "malicious" - }, - { - "filename": "L5-009_shell_in_resource.exe", - "case_id": "L5-009", - "category": "L5", - "expected_verdict": "review", - "expected_rules": [ - "DangerousExecutableExtension", - "PEArchInfo", - "SuspiciousTimestamp", - "UnsignedExecutable" - ], - "description": "资源段内嵌字符串（占位）", - "_scan_verdict": "malicious" - }, - { - "filename": "L5-010_bad_mz.exe", - "case_id": "L5-010", - "category": "L5", - "expected_verdict": "review", - "expected_rules": [ - "DangerousExecutableExtension", - "ExtensionMismatch", - "PeParseFailed" - ], - "description": "PE 头非法", - "_scan_verdict": "reject" - }, - { - "filename": "L5-011_truncated.exe", - "case_id": "L5-011", - "category": "L5", - "expected_verdict": "review", - "expected_rules": [ - "DangerousExecutableExtension", - "PeParseFailed" - ], - "description": "截断 PE", - "_scan_verdict": "suspicious" - }, - { - "filename": "L5-012_pe32.exe", - "case_id": "L5-012", - "category": "L5", - "expected_verdict": "pass", - "expected_rules": [ - "DangerousExecutableExtension", - "PeParseFailed" - ], - "description": "32 位识别", - "_scan_verdict": "suspicious" - }, - { - "filename": "L5-013_pe64.exe", - "case_id": "L5-013", - "category": "L5", - "expected_verdict": "pass", - "expected_rules": [ - "DangerousExecutableExtension", - "PeParseFailed" - ], - "description": "64 位识别占位", - "_scan_verdict": "suspicious" - }, - { - "filename": "L5-014_clean_tool.exe", - "case_id": "L5-014", - "category": "L5", - "expected_verdict": "pass", - "expected_rules": [ - "DangerousExecutableExtension", - "PeParseFailed" - ], - "description": "PE导入表大量系统API（正常工具）", - "_scan_verdict": "suspicious" - }, - { - "filename": "L5-015_bad_reloc.exe", - "case_id": "L5-015", - "category": "L5", - "expected_verdict": "review", - "expected_rules": [ - "DangerousExecutableExtension", - "PEArchInfo", - "SuspiciousTimestamp", - "UnsignedExecutable" - ], - "description": "重定位表损坏占位", - "_scan_verdict": "malicious" - }, - { - "filename": "L5-016_zero_section.exe", - "case_id": "L5-016", - "category": "L5", - "expected_verdict": "review", - "expected_rules": [ - "DangerousExecutableExtension", - "PeParseFailed" - ], - "description": "零节 PE 占位", - "_scan_verdict": "suspicious" - }, - { - "filename": "L5-016_zero_sections.exe", - "case_id": "L5-016", - "category": "L5", - "expected_verdict": "review", - "expected_rules": [ - "DangerousExecutableExtension", - "PEArchInfo", - "SuspiciousTimestamp", - "UnsignedExecutable" - ], - "description": "无节表最小 PE", - "_scan_verdict": "malicious" - }, - { - "filename": "L5-017_upx_rwx.exe", - "case_id": "L5-017", - "category": "L5", - "expected_verdict": "review", - "expected_rules": [ - "DangerousExecutableExtension", - "PeParseFailed" - ], - "description": "UPX壳 + RWX节复合特征", - "_scan_verdict": "suspicious" - }, - { - "filename": "L5-018_debug_info.exe", - "case_id": "L5-018", - "category": "L5", - "expected_verdict": "review", - "expected_rules": [ - "DangerousExecutableExtension", - "PeParseFailed" - ], - "description": "调试信息占位", - "_scan_verdict": "suspicious" - }, - { - "filename": "L5-019_200mb_huge.exe", - "case_id": "L5-019", - "category": "L5", - "expected_verdict": "suspicious", - "expected_rules": [ - "DangerousExecutableExtension", - "PeParseFailed" - ], - "description": "200MB 超大 PE（占位，真实生成会写满磁盘）", - "_scan_verdict": "suspicious" - }, - { - "filename": "L5-020_layer_off_sample.bin", - "case_id": "L5-020", - "category": "L5", - "expected_verdict": "review", - "expected_rules": [ - "DangerousExecutableExtension", - "ExtensionMismatch", - "PEArchInfo", - "RWXSectionDetected", - "SuspiciousTimestamp", - "UnsignedExecutable" - ], - "description": "关闭分层开关测试占位", - "_scan_verdict": "reject" - }, - { - "filename": "NEG-001_clean.jpg", - "case_id": "NEG-001", - "category": "NEG", - "expected_verdict": "pass", - "expected_rules": [], - "description": "业务标准JPG图片", - "_scan_verdict": "clean" - }, - { - "filename": "NEG-002_clean.png", - "case_id": "NEG-002", - "category": "NEG", - "expected_verdict": "pass", - "expected_rules": [], - "description": "业务PNG图片", - "_scan_verdict": "clean" - }, - { - "filename": "NEG-003_clean.mp4", - "case_id": "NEG-003", - "category": "NEG", - "expected_verdict": "pass", - "expected_rules": [], - "description": "业务MP4视频", - "_scan_verdict": "clean" - }, - { - "filename": "NEG-004_clean.docx", - "case_id": "NEG-004", - "category": "NEG", - "expected_verdict": "pass", - "expected_rules": [], - "description": "业务正常docx报表", - "_scan_verdict": "clean" - }, - { - "filename": "NEG-005_clean.xlsx", - "case_id": "NEG-005", - "category": "NEG", - "expected_verdict": "pass", - "expected_rules": [], - "description": "业务正常xlsx表格", - "_scan_verdict": "clean" - }, - { - "filename": "NEG-006_clean.pdf", - "case_id": "NEG-006", - "category": "NEG", - "expected_verdict": "pass", - "expected_rules": [ - "MalformedStructure", - "PdfParseFailed" - ], - "description": "业务正常PDF报告", - "_scan_verdict": "suspicious" - }, - { - "filename": "NEG-007_clean.java", - "case_id": "NEG-007", - "category": "NEG", - "expected_verdict": "pass", - "expected_rules": [], - "description": "业务源码java文件", - "_scan_verdict": "reject" - }, - { - "filename": "NEG-008_clean.py", - "case_id": "NEG-008", - "category": "NEG", - "expected_verdict": "pass", - "expected_rules": [ - "DangerousExecutableExtension" - ], - "description": "业务源码python脚本", - "_scan_verdict": "suspicious" - }, - { - "filename": "NEG-009_clean.zip", - "case_id": "NEG-009", - "category": "NEG", - "expected_verdict": "pass", - "expected_rules": [], - "description": "正常业务压缩包zip", - "_scan_verdict": "clean" - }, - { - "filename": "NEG-010_clean.exe", - "case_id": "NEG-010", - "category": "NEG", - "expected_verdict": "pass", - "expected_rules": [ - "DangerousExecutableExtension", - "PeParseFailed" - ], - "description": "正常业务安装包（干净开源）", - "_scan_verdict": "suspicious" - }, - { - "filename": "NEG-011_clean.log", - "case_id": "NEG-011", - "category": "NEG", - "expected_verdict": "pass", - "expected_rules": [], - "description": "正常日志文件", - "_scan_verdict": "reject" - }, - { - "filename": "NEG-012_clean.csv", - "case_id": "NEG-012", - "category": "NEG", - "expected_verdict": "pass", - "expected_rules": [], - "description": "正常csv业务数据文件", - "_scan_verdict": "clean" - }, - { - "filename": "NEG-013_clean.eml", - "case_id": "NEG-013", - "category": "NEG", - "expected_verdict": "pass", - "expected_rules": [], - "description": "正常eml业务邮件（无附件、无外联恶意）", - "_scan_verdict": "clean" - }, - { - "filename": "NEG-014_clean.dll", - "case_id": "NEG-014", - "category": "NEG", - "expected_verdict": "pass", - "expected_rules": [ - "DangerousExecutableExtension", - "PeParseFailed" - ], - "description": "正常dll（系统干净dll）", - "_scan_verdict": "suspicious" - }, - { - "filename": "NEG-015_clean.ttf", - "case_id": "NEG-015", - "category": "NEG", - "expected_verdict": "pass", - "expected_rules": [], - "description": "正常字体文件ttf", - "_scan_verdict": "reject" - }, - { - "filename": "NEG-016_clean.dwg", - "case_id": "NEG-016", - "category": "NEG", - "expected_verdict": "pass", - "expected_rules": [], - "description": "正常CAD图纸", - "_scan_verdict": "reject" - }, - { - "filename": "NEG-017_4layer_nested.zip", - "case_id": "NEG-017", - "category": "NEG", - "expected_verdict": "pass", - "expected_rules": [ - "ArchiveBroken", - "MalformedStructure" - ], - "description": "多层嵌套干净zip（无风险）", - "_scan_verdict": "suspicious" - }, - { - "filename": "NEG-018_clean.bat", - "case_id": "NEG-018", - "category": "NEG", - "expected_verdict": "pass", - "expected_rules": [ - "DangerousExecutableExtension" - ], - "description": "正常bat运维脚本（内网备份）", - "_scan_verdict": "suspicious" - }, - { - "filename": "NEG-019_clean.ps1", - "case_id": "NEG-019", - "category": "NEG", - "expected_verdict": "pass", - "expected_rules": [ - "DangerousExecutableExtension" - ], - "description": "正常ps1运维脚本（内网查询）", - "_scan_verdict": "suspicious" - }, - { - "filename": "NEG-020_clean.odt", - "case_id": "NEG-020", - "category": "NEG", - "expected_verdict": "pass", - "expected_rules": [], - "description": "正常odt文档", - "_scan_verdict": "reject" - }, - { - "filename": "broken.zip", - "case_id": "L7-001", - "category": "L7", - "expected_verdict": "clean", - "expected_rules": [], - "description": "损坏 ZIP", - "_scan_verdict": "clean" - }, - { - "filename": "evil.iso", - "case_id": "L7-002", - "category": "L7", - "expected_verdict": "suspicious", - "expected_rules": [ - "DangerousExecutableExtension" - ], - "description": "恶意 ISO 镜像", - "_scan_verdict": "suspicious" - }, - { - "filename": "evil_help.chm", - "case_id": "L7-003", - "category": "L7", - "expected_verdict": "malicious", - "expected_rules": [ - "ChmWithScript", - "DangerousExecutableExtension", - "RemoteDownloadUnix" - ], - "description": "含脚本 CHM 帮助", - "_scan_verdict": "malicious" - }, - { - "filename": "linux_malicious", - "case_id": "L7-004", - "category": "L7", - "expected_verdict": "malicious", - "expected_rules": [ - "C7_Linux_ReverseShell_Bash", - "LinuxExecutable", - "ReverseShellNetcat" - ], - "description": "Linux 恶意脚本集", - "_scan_verdict": "malicious" - }, - { - "filename": "lolbin.cmd", - "case_id": "L7-005", - "category": "L7", - "expected_verdict": "suspicious", - "expected_rules": [ - "CommandExecutionObfuscated", - "DangerousExecutableExtension" - ], - "description": "LOLBin cmd 混淆", - "_scan_verdict": "suspicious" - }, - { - "filename": "macro_alert.docm", - "case_id": "L7-006", - "category": "L7", - "expected_verdict": "malicious", - "expected_rules": [ - "RemoteDownloadPowerShell", - "RemoteDownloadUnix", - "VBAAutoExecShell" - ], - "description": "含 VBA 宏 DOCM", - "_scan_verdict": "malicious" - }, - { - "filename": "malicious.desktop", - "case_id": "L7-007", - "category": "L7", - "expected_verdict": "malicious", - "expected_rules": [ - "C7_Linux_ReverseShell_Bash", - "C7_Linux_ReverseShell_Misc", - "DangerousExecutableExtension", - "DesktopFileAutoExec", - "ReverseShellNetcat" - ], - "description": "恶意 .desktop 反序列化", - "_scan_verdict": "malicious" - }, - { - "filename": "malicious.pdf", - "case_id": "L7-008", - "category": "L7", - "expected_verdict": "malicious", - "expected_rules": [ - "PdfJavaScript", - "PdfOpenAction" - ], - "description": "含 JS/Action PDF", - "_scan_verdict": "malicious" - }, - { - "filename": "miner_config.json", - "case_id": "L7-009", - "category": "L7", - "expected_verdict": "suspicious", - "expected_rules": [ - "C7_Linux_Miner_Generic" - ], - "description": "挖矿配置文件", - "_scan_verdict": "suspicious" - }, - { - "filename": "neg_tmp1.zip", - "case_id": "L7-035", - "category": "L7", - "expected_verdict": "clean", - "expected_rules": [], - "description": "占位残留 tmp zip", - "_scan_verdict": "clean" - }, - { - "filename": "normal.pdf", - "case_id": "L7-010", - "category": "L7", - "expected_verdict": "clean", - "expected_rules": [], - "description": "干净 PDF 对照", - "_scan_verdict": "clean" - }, - { - "filename": "normal_deploy.sh", - "case_id": "L7-011", - "category": "L7", - "expected_verdict": "suspicious", - "expected_rules": [ - "DangerousExecutableExtension" - ], - "description": "运维部署脚本（误报）", - "_scan_verdict": "suspicious" - }, - { - "filename": "normal_readme.txt", - "case_id": "L7-012", - "category": "L7", - "expected_verdict": "clean", - "expected_rules": [], - "description": "干净 README 对照", - "_scan_verdict": "clean" - }, - { - "filename": "normal_report.docx", - "case_id": "L7-013", - "category": "L7", - "expected_verdict": "clean", - "expected_rules": [], - "description": "干净 DOCX 对照", - "_scan_verdict": "clean" - }, - { - "filename": "ole_dropper.doc", - "case_id": "L7-014", - "category": "L7", - "expected_verdict": "suspicious", - "expected_rules": [ - "OleToolsUnavailable", - "RemoteSessionHijack" - ], - "description": "OLE 投递 DOC", - "_scan_verdict": "suspicious" - }, - { - "filename": "pe_downloader.exe", - "case_id": "L7-015", - "category": "L7", - "expected_verdict": "malicious", - "expected_rules": [ - "C1_PE_Downloader_Loader", - "DangerousExecutableExtension", - "PeParseFailed" - ], - "description": "PE 下载木马", - "_scan_verdict": "malicious" - }, - { - "filename": "pe_injection.exe", - "case_id": "L7-016", - "category": "L7", - "expected_verdict": "malicious", - "expected_rules": [ - "C1_PE_ProcessInjection", - "DangerousExecutableExtension", - "PeParseFailed", - "RemoteSessionHijack" - ], - "description": "PE 注入程序", - "_scan_verdict": "malicious" - }, - { - "filename": "persist_cron.sh", - "case_id": "L7-017", - "category": "L7", - "expected_verdict": "malicious", - "expected_rules": [ - "C7_Linux_Persistence_Crontab", - "DangerousExecutableExtension", - "RemoteDownloadUnix", - "ShellScriptDangerous", - "Txt.Malware.Sustes-6779550-1" - ], - "description": "Crontab 持久化脚本", - "_scan_verdict": "malicious" - }, - { - "filename": "phishing.eml", - "case_id": "L7-018", - "category": "L7", - "expected_verdict": "reject", - "expected_rules": [ - "EmailAttachmentDangerous", - "EmailAttachmentDisguised", - "EmailAttachmentWebshell", - "EmailPhishingKeyword" - ], - "description": "钓鱼邮件 EML", - "_scan_verdict": "reject" - }, - { - "filename": "photo.jpg.php", - "case_id": "L7-019", - "category": "L7", - "expected_verdict": "reject", - "expected_rules": [ - "DangerousExecutableExtension" - ], - "description": "双扩展名伪装 .jpg.php", - "_scan_verdict": "reject" - }, - { - "filename": "ransom_dropper.exe.txt", - "case_id": "L7-020", - "category": "L7", - "expected_verdict": "reject", - "expected_rules": [ - "C8_Ransomware_Encryption", - "C8_Ransomware_Note_Filename", - "C8_Ransomware_VolumeShadow", - "DoubleExtension" - ], - "description": "勒索软件投递器", - "_scan_verdict": "reject" - }, - { - "filename": "sealed.docx", - "case_id": "L7-021", - "category": "L7", - "expected_verdict": "reject", - "expected_rules": [ - "ArchiveBroken", - "MalformedStructure", - "OfficeEncrypted", - "OoxmlParseFailed" - ], - "description": "加密 DOCX（被视为损坏）", - "_scan_verdict": "reject" - }, - { - "filename": "sealed.xlsx", - "case_id": "L7-022", - "category": "L7", - "expected_verdict": "reject", - "expected_rules": [ - "ArchiveBroken", - "ExtensionMismatch", - "MalformedStructure", - "OfficeEncrypted", - "OoxmlParseFailed" - ], - "description": "加密 XLSX（被视为损坏）", - "_scan_verdict": "reject" - }, - { - "filename": "shell_aspx.aspx", - "case_id": "L7-023", - "category": "L7", - "expected_verdict": "reject", - "expected_rules": [ - "DangerousExecutableExtension" - ], - "description": "ASPX 一句话木马", - "_scan_verdict": "reject" - }, - { - "filename": "shell_bash_devtcp.sh", - "case_id": "L7-024", - "category": "L7", - "expected_verdict": "malicious", - "expected_rules": [ - "C7_Linux_ReverseShell_Bash", - "DangerousExecutableExtension", - "ReverseShellNetcat", - "ShellScriptDangerous" - ], - "description": "Bash /dev/tcp 反弹", - "_scan_verdict": "malicious" - }, - { - "filename": "shell_jsp_runtime.jsp", - "case_id": "L7-025", - "category": "L7", - "expected_verdict": "reject", - "expected_rules": [ - "C3_JSP_Webshell_RuntimeExec", - "DangerousExecutableExtension" - ], - "description": "JSP Runtime exec 木马", - "_scan_verdict": "reject" - }, - { - "filename": "shell_nc.sh", - "case_id": "L7-026", - "category": "L7", - "expected_verdict": "malicious", - "expected_rules": [ - "C7_Linux_ReverseShell_NC", - "DangerousExecutableExtension", - "ReverseShellNetcat", - "ShellScriptDangerous" - ], - "description": "NC 反弹 Shell", - "_scan_verdict": "malicious" - }, - { - "filename": "shell_php_eval.php", - "case_id": "L7-027", - "category": "L7", - "expected_verdict": "reject", - "expected_rules": [ - "C3_PHP_Webshell_Oneliner", - "DangerousExecutableExtension" - ], - "description": "PHP eval 一句话木马", - "_scan_verdict": "reject" - }, - { - "filename": "shell_php_obf.php", - "case_id": "L7-028", - "category": "L7", - "expected_verdict": "reject", - "expected_rules": [ - "C3_PHP_Webshell_Obfuscated", - "DangerousExecutableExtension" - ], - "description": "PHP 混淆木马", - "_scan_verdict": "reject" - }, - { - "filename": "shell_python.py", - "case_id": "L7-029", - "category": "L7", - "expected_verdict": "suspicious", - "expected_rules": [ - "DangerousExecutableExtension" - ], - "description": "Python 反弹脚本", - "_scan_verdict": "suspicious" - }, - { - "filename": "shortcut.lnk", - "case_id": "L7-030", - "category": "L7", - "expected_verdict": "suspicious", - "expected_rules": [ - "DangerousExecutableExtension", - "RemoteDownloadUnix" - ], - "description": "恶意 .lnk 快捷方式", - "_scan_verdict": "suspicious" - }, - { - "filename": "template_backdoor.docx", - "case_id": "L7-031", - "category": "L7", - "expected_verdict": "malicious", - "expected_rules": [ - "AttachedTemplate" - ], - "description": "模板后门 DOCX", - "_scan_verdict": "malicious" - }, - { - "filename": "vba_autoexec.bas", - "case_id": "L7-032", - "category": "L7", - "expected_verdict": "malicious", - "expected_rules": [ - "RemoteDownloadUnix", - "VBAAutoExecShell" - ], - "description": "VBA AutoOpen 宏", - "_scan_verdict": "malicious" - }, - { - "filename": "wps_macro.js", - "case_id": "L7-033", - "category": "L7", - "expected_verdict": "malicious", - "expected_rules": [ - "C7_Linux_ReverseShell_Bash", - "C7_Linux_ReverseShell_Misc", - "DangerousExecutableExtension", - "ReverseShellNetcat" - ], - "description": "WPS JS 宏", - "_scan_verdict": "malicious" - }, - { - "filename": "zip_traversal.zip", - "case_id": "L7-034", - "category": "L7", - "expected_verdict": "malicious", - "expected_rules": [ - "PathTraversal", - "PathTraversalBlocked" - ], - "description": "ZIP 路径穿越（旧版）", - "_scan_verdict": "malicious" - } - ] +{ + "meshsafe_target_version": "v0.2.1", + "index_regenerated_at": "2026-10-29T11:48:22.953397", + "layer_definition": { + "L0": "结构分析（幻数/后缀伪装/嵌套/路径穿越/zip 炸弹）", + "L1": "ClamAV 病毒库扫描", + "L2": "文档深度检测（OLE/Macro/JS）", + "L3": "关键词匹配（恶意行为特征）", + "L4": "YARA 规则匹配", + "L5": "PE 二进制静态分析（壳/导入/节/签名）", + "NEG": "负样本（业务正常文件，应无告警）", + "L7": "历史遗留样本（CSV 之外的真实恶意/误报对照）" + }, + "samples": [ + { + "filename": "L0-001_jpg_normal.jpg", + "case_id": "L1-006", + "category": "L1", + "expected_verdict": "pass", + "expected_rules": [], + "description": "干净jpg图片（对照负样本）", + "_scan_verdict": "clean" + }, + { + "filename": "L0-002_png_normal.png", + "case_id": "L0-002", + "category": "L0", + "expected_verdict": "pass", + "expected_rules": [], + "description": "正常文件幻数识别-PNG", + "_scan_verdict": "clean" + }, + { + "filename": "L0-003_docx_normal.docx", + "case_id": "L1-007", + "category": "L1", + "expected_verdict": "pass", + "expected_rules": [], + "description": "干净docx文档（对照负样本）", + "_scan_verdict": "clean" + }, + { + "filename": "L0-004_pdf_normal.pdf", + "case_id": "L0-004", + "category": "L0", + "expected_verdict": "pass", + "expected_rules": [ + "MalformedStructure", + "PdfParseFailed" + ], + "description": "正常文件幻数识别-PDF", + "_scan_verdict": "suspicious" + }, + { + "filename": "L0-005_pe_clean.exe", + "case_id": "L1-008", + "category": "L1", + "expected_verdict": "pass", + "expected_rules": [ + "DangerousExecutableExtension", + "PeParseFailed" + ], + "description": "干净hello PE（对照负样本）", + "_scan_verdict": "suspicious" + }, + { + "filename": "L0-006_disguise_jpg_pe.jpg", + "case_id": "L0-006", + "category": "L0", + "expected_verdict": "reject", + "expected_rules": [ + "ExtensionMismatch" + ], + "description": "jpg 后缀 + 实际 PE MZ 头", + "_scan_verdict": "reject" + }, + { + "filename": "L0-007_disguise_txt_pdf.txt", + "case_id": "L0-007", + "category": "L0", + "expected_verdict": "review", + "expected_rules": [ + "ExtensionMismatch", + "MalformedStructure" + ], + "description": "后缀伪装：txt后缀，实际PDF幻数", + "_scan_verdict": "reject" + }, + { + "filename": "L0-008_disguise_png_zip.png", + "case_id": "L0-008", + "category": "L0", + "expected_verdict": "review", + "expected_rules": [ + "ExtensionMismatch", + "MalformedStructure" + ], + "description": "后缀伪装：png后缀，实际ZIP幻数", + "_scan_verdict": "reject" + }, + { + "filename": "L0-009_double_ext_pdf_exe.pdf.exe", + "case_id": "L0-009", + "category": "L0", + "expected_verdict": "reject", + "expected_rules": [ + "DangerousExecutableExtension", + "DoubleExtension", + "PeParseFailed" + ], + "description": "双扩展名伪装：report.pdf.exe", + "_scan_verdict": "reject" + }, + { + "filename": "L0-010_double_ext_txt_ps1.txt.ps1", + "case_id": "L0-010", + "category": "L0", + "expected_verdict": "reject", + "expected_rules": [ + "DangerousExecutableExtension", + "DoubleExtension" + ], + "description": "双扩展名伪装：data.txt.ps1", + "_scan_verdict": "reject" + }, + { + "filename": "L0-011_double_ext_docx_js.docx.js", + "case_id": "L0-011", + "category": "L0", + "expected_verdict": "reject", + "expected_rules": [ + "DangerousExecutableExtension" + ], + "description": "双扩展名伪装：note.docx.js", + "_scan_verdict": "suspicious" + }, + { + "filename": "L0-012_double_ext_xlsx_bat.xlsx.bat", + "case_id": "L0-012", + "category": "L0", + "expected_verdict": "reject", + "expected_rules": [ + "DangerousExecutableExtension", + "DoubleExtension" + ], + "description": "双扩展名伪装：log.xlsx.bat", + "_scan_verdict": "reject" + }, + { + "filename": "L0-013_clean.ps1", + "case_id": "L0-013", + "category": "L0", + "expected_verdict": "review", + "expected_rules": [ + "DangerousExecutableExtension" + ], + "description": "干净 ps1 文件", + "_scan_verdict": "suspicious" + }, + { + "filename": "L0-014_clean.bat", + "case_id": "L0-014", + "category": "L0", + "expected_verdict": "review", + "expected_rules": [ + "DangerousExecutableExtension" + ], + "description": "干净 bat 文件", + "_scan_verdict": "suspicious" + }, + { + "filename": "L0-015_clean.cmd", + "case_id": "L0-015", + "category": "L0", + "expected_verdict": "review", + "expected_rules": [ + "DangerousExecutableExtension" + ], + "description": "干净 cmd 文件", + "_scan_verdict": "suspicious" + }, + { + "filename": "L0-016_clean.vbs", + "case_id": "L0-016", + "category": "L0", + "expected_verdict": "review", + "expected_rules": [ + "DangerousExecutableExtension" + ], + "description": "干净 vbs 文件", + "_scan_verdict": "suspicious" + }, + { + "filename": "L0-017_clean.js", + "case_id": "L0-017", + "category": "L0", + "expected_verdict": "review", + "expected_rules": [ + "DangerousExecutableExtension" + ], + "description": "干净 js 文件", + "_scan_verdict": "suspicious" + }, + { + "filename": "L0-018_zip_traversal.zip", + "case_id": "L0-018", + "category": "L0", + "expected_verdict": "reject", + "expected_rules": [ + "PathTraversal", + "PathTraversalBlocked" + ], + "description": "ZIP单级路径穿越：../test.txt", + "_scan_verdict": "malicious" + }, + { + "filename": "L0-019_zip_deep_traversal.zip", + "case_id": "L0-019", + "category": "L0", + "expected_verdict": "reject", + "expected_rules": [ + "PathTraversal", + "PathTraversalBlocked" + ], + "description": "ZIP多级路径穿越：../../a.txt", + "_scan_verdict": "malicious" + }, + { + "filename": "L0-020_zip_bomb.zip", + "case_id": "L0-020", + "category": "L0", + "expected_verdict": "reject", + "expected_rules": [], + "description": "ZIP炸弹42.zip", + "_scan_verdict": "clean" + }, + { + "filename": "L0-021_small_bomb.zip", + "case_id": "L0-021", + "category": "L0", + "expected_verdict": "reject", + "expected_rules": [], + "description": "自制小型 zip 炸弹（50 成员 × 8KB STORED）", + "_scan_verdict": "clean" + }, + { + "filename": "L0-022_3layer_nested.zip", + "case_id": "L0-022", + "category": "L0", + "expected_verdict": "pass", + "expected_rules": [], + "description": "3层无害嵌套ZIP", + "_scan_verdict": "clean" + }, + { + "filename": "L0-023_5layer_nested.zip", + "case_id": "L0-023", + "category": "L0", + "expected_verdict": "pass", + "expected_rules": [], + "description": "5 层无害嵌套 ZIP", + "_scan_verdict": "clean" + }, + { + "filename": "L0-024_encrypted.zip", + "case_id": "L0-024", + "category": "L0", + "expected_verdict": "review", + "expected_rules": [], + "description": "加密 ZIP（标记待验证）", + "_scan_verdict": "clean" + }, + { + "filename": "L0-025_corrupt_zip.zip", + "case_id": "L0-025", + "category": "L0", + "expected_verdict": "review", + "expected_rules": [ + "ArchiveBroken", + "MalformedStructure" + ], + "description": "截断损坏 ZIP 头", + "_scan_verdict": "suspicious" + }, + { + "filename": "L0-026_corrupt_direntry.zip", + "case_id": "L0-026", + "category": "L0", + "expected_verdict": "review", + "expected_rules": [], + "description": "损坏ZIP目录项", + "_scan_verdict": "clean" + }, + { + "filename": "L0-027_long_filename.zip", + "case_id": "L0-027", + "category": "L0", + "expected_verdict": "review", + "expected_rules": [], + "description": "压缩包内 200 字符超长文件名", + "_scan_verdict": "clean" + }, + { + "filename": "L0-028_unicode_filename.zip", + "case_id": "L0-028", + "category": "L0", + "expected_verdict": "pass", + "expected_rules": [], + "description": "unicode/emoji 文件名", + "_scan_verdict": "clean" + }, + { + "filename": "L0-029_zero_byte_exe.exe", + "case_id": "L0-029", + "category": "L0", + "expected_verdict": "review", + "expected_rules": [ + "DangerousExecutableExtension", + "PeParseFailed" + ], + "description": "空文件（0字节）后缀exe", + "_scan_verdict": "suspicious" + }, + { + "filename": "L0-030_nested_traversal.zip", + "case_id": "L0-030", + "category": "L0", + "expected_verdict": "reject", + "expected_rules": [], + "description": "嵌套 zip 内含穿越条目", + "_scan_verdict": "clean" + }, + { + "filename": "L1-001_eicar.txt", + "case_id": "L1-001", + "category": "L1", + "expected_verdict": "reject", + "expected_rules": [ + "Eicar-Test-Signature" + ], + "description": "EICAR标准测试串文本", + "_scan_verdict": "suspicious" + }, + { + "filename": "L1-002_eicar_in_zip.zip", + "case_id": "L1-002", + "category": "L1", + "expected_verdict": "reject", + "expected_rules": [ + "Eicar-Test-Signature" + ], + "description": "EICAR放入zip压缩包", + "_scan_verdict": "suspicious" + }, + { + "filename": "L1-003_eicar_in_encrypted.zip", + "case_id": "L1-003", + "category": "L1", + "expected_verdict": "pass", + "expected_rules": [ + "Eicar-Test-Signature" + ], + "description": "加密 ZIP（占位：实际加密需 7z/zip -P）", + "_scan_verdict": "suspicious" + }, + { + "filename": "L1-004_eicar_in_docx.docx", + "case_id": "L1-004", + "category": "L1", + "expected_verdict": "reject", + "expected_rules": [ + "Eicar-Test-Signature" + ], + "description": "EICAR放入docx内嵌（OLE）", + "_scan_verdict": "suspicious" + }, + { + "filename": "L1-005_eicar_modified.txt", + "case_id": "L1-005", + "category": "L1", + "expected_verdict": "pass", + "expected_rules": [], + "description": "修改 1 字节 EICAR，ClamAV 不应命中", + "_scan_verdict": "clean" + }, + { + "filename": "L1-009_minimal.cvd", + "case_id": "L1-009", + "category": "L1", + "expected_verdict": "review", + "expected_rules": [], + "description": "热加载测试占位（需真实 .cvd 文件）", + "_scan_verdict": "reject" + }, + { + "filename": "L1-010_corrupt.cvd", + "case_id": "L1-010", + "category": "L1", + "expected_verdict": "reject", + "expected_rules": [], + "description": "损坏病毒库占位", + "_scan_verdict": "reject" + }, + { + "filename": "L1-011_eicar_in_3layer.zip", + "case_id": "L1-011", + "category": "L1", + "expected_verdict": "reject", + "expected_rules": [ + "Eicar-Test-Signature" + ], + "description": "EICAR放在多层嵌套zip", + "_scan_verdict": "suspicious" + }, + { + "filename": "L1-012_eicar_base64.txt", + "case_id": "L1-012", + "category": "L1", + "expected_verdict": "pass", + "expected_rules": [], + "description": "base64 编码 EICAR，ClamAV 不解码", + "_scan_verdict": "clean" + }, + { + "filename": "L1-013_bigfile_eicar.txt", + "case_id": "L1-013", + "category": "L1", + "expected_verdict": "review", + "expected_rules": [], + "description": "10MB+ 文本尾部含 EICAR", + "_scan_verdict": "clean" + }, + { + "filename": "L1-014_concurrent_eicar_00.txt", + "case_id": "L1-014-00", + "category": "L1", + "expected_verdict": "reject", + "expected_rules": [ + "Eicar-Test-Signature" + ], + "description": "并发压测占位 #0", + "_scan_verdict": "suspicious" + }, + { + "filename": "L1-014_concurrent_eicar_01.txt", + "case_id": "L1-014-01", + "category": "L1", + "expected_verdict": "reject", + "expected_rules": [ + "Eicar-Test-Signature" + ], + "description": "并发压测占位 #1", + "_scan_verdict": "suspicious" + }, + { + "filename": "L1-014_concurrent_eicar_02.txt", + "case_id": "L1-014-02", + "category": "L1", + "expected_verdict": "reject", + "expected_rules": [ + "Eicar-Test-Signature" + ], + "description": "并发压测占位 #2", + "_scan_verdict": "suspicious" + }, + { + "filename": "L1-014_concurrent_eicar_03.txt", + "case_id": "L1-014-03", + "category": "L1", + "expected_verdict": "reject", + "expected_rules": [ + "Eicar-Test-Signature" + ], + "description": "并发压测占位 #3", + "_scan_verdict": "suspicious" + }, + { + "filename": "L1-014_concurrent_eicar_04.txt", + "case_id": "L1-014-04", + "category": "L1", + "expected_verdict": "reject", + "expected_rules": [ + "Eicar-Test-Signature" + ], + "description": "并发压测占位 #4", + "_scan_verdict": "suspicious" + }, + { + "filename": "L1-014_concurrent_eicar_05.txt", + "case_id": "L1-014-05", + "category": "L1", + "expected_verdict": "reject", + "expected_rules": [ + "Eicar-Test-Signature" + ], + "description": "并发压测占位 #5", + "_scan_verdict": "suspicious" + }, + { + "filename": "L1-014_concurrent_eicar_06.txt", + "case_id": "L1-014-06", + "category": "L1", + "expected_verdict": "reject", + "expected_rules": [ + "Eicar-Test-Signature" + ], + "description": "并发压测占位 #6", + "_scan_verdict": "suspicious" + }, + { + "filename": "L1-014_concurrent_eicar_07.txt", + "case_id": "L1-014-07", + "category": "L1", + "expected_verdict": "reject", + "expected_rules": [ + "Eicar-Test-Signature" + ], + "description": "并发压测占位 #7", + "_scan_verdict": "suspicious" + }, + { + "filename": "L1-014_concurrent_eicar_08.txt", + "case_id": "L1-014-08", + "category": "L1", + "expected_verdict": "reject", + "expected_rules": [ + "Eicar-Test-Signature" + ], + "description": "并发压测占位 #8", + "_scan_verdict": "suspicious" + }, + { + "filename": "L1-014_concurrent_eicar_09.txt", + "case_id": "L1-014-09", + "category": "L1", + "expected_verdict": "reject", + "expected_rules": [ + "Eicar-Test-Signature" + ], + "description": "并发压测占位 #9", + "_scan_verdict": "suspicious" + }, + { + "filename": "L1-014_concurrent_test.txt", + "case_id": "L1-014", + "category": "L1", + "expected_verdict": "review", + "expected_rules": [], + "description": "并发压测占位（靠 API 并发调用）", + "_scan_verdict": "clean" + }, + { + "filename": "L1-015_layer_off_sample.bin", + "case_id": "L1-015", + "category": "L1", + "expected_verdict": "review", + "expected_rules": [ + "DangerousExecutableExtension", + "Eicar-Test-Signature", + "ExtensionMismatch", + "PeParseFailed" + ], + "description": "关闭分层开关测试占位", + "_scan_verdict": "reject" + }, + { + "filename": "L3-001_001_sample.ps1", + "case_id": "L3-001", + "category": "L3", + "expected_verdict": "reject", + "expected_rules": [ + "DangerousExecutableExtension", + "RemoteDownloadPowerShell", + "SuspiciousScript" + ], + "description": "PS1明文：Invoke-WebRequest下载", + "_scan_verdict": "malicious" + }, + { + "filename": "L3-002_002_sample.ps1", + "case_id": "L3-002", + "category": "L3", + "expected_verdict": "reject", + "expected_rules": [ + "C7_Linux_ReverseShell_NC", + "DangerousExecutableExtension", + "ReverseShellNetcat" + ], + "description": "PS1明文：反弹shell nc", + "_scan_verdict": "malicious" + }, + { + "filename": "L3-003_003_sample.bat", + "case_id": "L3-003", + "category": "L3", + "expected_verdict": "reject", + "expected_rules": [ + "DangerousExecutableExtension", + "RemoteDownloadUnix" + ], + "description": "bat明文：curl下载payload", + "_scan_verdict": "suspicious" + }, + { + "filename": "L3-004_004_sample.txt", + "case_id": "L3-004", + "category": "L3", + "expected_verdict": "reject", + "expected_rules": [ + "CredentialStealer" + ], + "description": "文本包含mimikatz关键字", + "_scan_verdict": "suspicious" + }, + { + "filename": "L3-005_005_sample.txt", + "case_id": "L3-005", + "category": "L3", + "expected_verdict": "reject", + "expected_rules": [ + "CredentialExport" + ], + "description": "文本包含reg save导出注册表", + "_scan_verdict": "suspicious" + }, + { + "filename": "L3-006_006_sample.txt", + "case_id": "L3-006", + "category": "L3", + "expected_verdict": "review", + "expected_rules": [ + "RemoteSessionHijack" + ], + "description": "文本包含rdp、tscon劫持关键字", + "_scan_verdict": "suspicious" + }, + { + "filename": "L3-007_007_sample.txt", + "case_id": "L3-007", + "category": "L3", + "expected_verdict": "pass", + "expected_rules": [], + "description": "高危串base64编码放在txt", + "_scan_verdict": "clean" + }, + { + "filename": "L3-008_008_sample.ps1", + "case_id": "L3-008", + "category": "L3", + "expected_verdict": "pass", + "expected_rules": [ + "DangerousExecutableExtension" + ], + "description": "Powershell字符串拆分拼接绕过", + "_scan_verdict": "suspicious" + }, + { + "filename": "L3-009_newline_split.txt", + "case_id": "L3-009", + "category": "L3", + "expected_verdict": "review", + "expected_rules": [], + "description": "换行分割绕过（L3 不做换行合并，记录边界）", + "_scan_verdict": "clean" + }, + { + "filename": "L3-010_010_sample.ps1", + "case_id": "L3-010", + "category": "L3", + "expected_verdict": "review", + "expected_rules": [ + "DangerousExecutableExtension" + ], + "description": "高危串插入注释分割（powershell #注释）", + "_scan_verdict": "suspicious" + }, + { + "filename": "L3-011_011_sample.js", + "case_id": "L3-011", + "category": "L3", + "expected_verdict": "review", + "expected_rules": [ + "DangerousExecutableExtension", + "RemoteDownloadUnix" + ], + "description": "高危串放js脚本内", + "_scan_verdict": "suspicious" + }, + { + "filename": "L3-012_012_sample.bat", + "case_id": "L3-012", + "category": "L3", + "expected_verdict": "pass", + "expected_rules": [ + "DangerousExecutableExtension", + "RemoteDownloadUnix" + ], + "description": "正常内网运维curl（白名单对照）", + "_scan_verdict": "suspicious" + }, + { + "filename": "L3-013_normal_scp.sh", + "case_id": "L3-013", + "category": "L3", + "expected_verdict": "pass", + "expected_rules": [ + "DangerousExecutableExtension" + ], + "description": "内网正常 scp 运维脚本，不误报", + "_scan_verdict": "suspicious" + }, + { + "filename": "L3-014_l3001_in_zip.zip", + "case_id": "L3-014", + "category": "L3", + "expected_verdict": "review", + "expected_rules": [ + "ArchiveContainsExecutable", + "RemoteDownloadPowerShell" + ], + "description": "高危字符串放在zip内部txt", + "_scan_verdict": "malicious" + }, + { + "filename": "L3-015_keyword_in_docx.docx", + "case_id": "L3-015", + "category": "L3", + "expected_verdict": "review", + "expected_rules": [ + "RemoteDownloadPowerShell" + ], + "description": "高危字符串放在docx文本正文", + "_scan_verdict": "suspicious" + }, + { + "filename": "L3-016_016_sample.ps1", + "case_id": "L3-016", + "category": "L3", + "expected_verdict": "pass", + "expected_rules": [ + "DangerousExecutableExtension" + ], + "description": "空脚本文件（负样本）", + "_scan_verdict": "suspicious" + }, + { + "filename": "L3-017_017_sample.txt", + "case_id": "L3-017", + "category": "L3", + "expected_verdict": "review", + "expected_rules": [ + "CredentialStealer", + "ReverseShellNetcat" + ], + "description": "多条高危特征同文件复合", + "_scan_verdict": "malicious" + }, + { + "filename": "L3-018_018_sample.txt", + "case_id": "L3-018", + "category": "L3", + "expected_verdict": "review", + "expected_rules": [ + "RemoteDownloadPowerShell" + ], + "description": "高危字符串大小写混写", + "_scan_verdict": "suspicious" + }, + { + "filename": "L3-019_unicode_obfuscated.txt", + "case_id": "L3-019", + "category": "L3", + "expected_verdict": "pass", + "expected_rules": [], + "description": "同形字混淆，L3 默认不命中", + "_scan_verdict": "clean" + }, + { + "filename": "L3-020_log_with_keyword.log", + "case_id": "L3-020", + "category": "L3", + "expected_verdict": "reject", + "expected_rules": [ + "C7_Linux_ReverseShell_NC", + "ReverseShellNetcat" + ], + "description": "日志文件混杂正常日志+高危串", + "_scan_verdict": "reject" + }, + { + "filename": "L3-021_021_sample.eml", + "case_id": "L3-021", + "category": "L3", + "expected_verdict": "review", + "expected_rules": [ + "RemoteDownloadPowerShell" + ], + "description": "高危字符串放在eml邮件正文", + "_scan_verdict": "suspicious" + }, + { + "filename": "L3-022_layer_off_sample.bin", + "case_id": "L3-022", + "category": "L3", + "expected_verdict": "review", + "expected_rules": [ + "DangerousExecutableExtension", + "ExtensionMismatch", + "PeParseFailed", + "RemoteDownloadPowerShell" + ], + "description": "关闭分层开关测试占位", + "_scan_verdict": "reject" + }, + { + "filename": "L3-023_keyword_in_encrypted.zip", + "case_id": "L3-023", + "category": "L3", + "expected_verdict": "pass", + "expected_rules": [ + "CredentialStealer" + ], + "description": "加密 zip 内容无法扫描（标记）", + "_scan_verdict": "suspicious" + }, + { + "filename": "L3-024_024_sample.txt", + "case_id": "L3-024", + "category": "L3", + "expected_verdict": "review", + "expected_rules": [ + "RemoteDownloadPowerShell" + ], + "description": "超长单行文本（10万字符）包含高危串", + "_scan_verdict": "suspicious" + }, + { + "filename": "L3-025_whitelist_test.txt", + "case_id": "L3-025", + "category": "L3", + "expected_verdict": "pass", + "expected_rules": [ + "RemoteDownloadPowerShell" + ], + "description": "内网白名单域名对照（策略层白名单）", + "_scan_verdict": "suspicious" + }, + { + "filename": "L4-001_001_sample.txt", + "case_id": "L4-001", + "category": "L4", + "expected_verdict": "review", + "expected_rules": [], + "description": "YARA正向命中占位（需对应规则）", + "_scan_verdict": "clean" + }, + { + "filename": "L4-002_002_sample.txt", + "case_id": "L4-002", + "category": "L4", + "expected_verdict": "pass", + "expected_rules": [], + "description": "干净对照", + "_scan_verdict": "clean" + }, + { + "filename": "L4-003_pe_with_string.exe", + "case_id": "L4-003", + "category": "L4", + "expected_verdict": "review", + "expected_rules": [ + "DangerousExecutableExtension", + "PEArchInfo", + "SuspiciousTimestamp", + "UnsignedExecutable" + ], + "description": "二进制内嵌匹配字符串", + "_scan_verdict": "malicious" + }, + { + "filename": "L4-004_multi_rule_match.txt", + "case_id": "L4-004", + "category": "L4", + "expected_verdict": "review", + "expected_rules": [], + "description": "同一个文件同时命中多条 YARA", + "_scan_verdict": "clean" + }, + { + "filename": "L4-005_005_sample.txt", + "case_id": "L4-005", + "category": "L4", + "expected_verdict": "review", + "expected_rules": [], + "description": "热加载测试占位", + "_scan_verdict": "clean" + }, + { + "filename": "L4-006_bad_syntax_rule.yar", + "case_id": "L4-006", + "category": "L4", + "expected_verdict": "review", + "expected_rules": [ + "ExtensionMismatch" + ], + "description": "语法错误 YARA 规则文件（输入给规则目录）", + "_scan_verdict": "reject" + }, + { + "filename": "L4-007_meta_rule_match.txt", + "case_id": "L4-007", + "category": "L4", + "expected_verdict": "review", + "expected_rules": [], + "description": "带 meta 的 YARA 规则匹配", + "_scan_verdict": "clean" + }, + { + "filename": "L4-008_in_zip.zip", + "case_id": "L4-008", + "category": "L4", + "expected_verdict": "review", + "expected_rules": [], + "description": "压缩包内文件匹配YARA规则", + "_scan_verdict": "clean" + }, + { + "filename": "L4-009_yara_in_encrypted.zip", + "case_id": "L4-009", + "category": "L4", + "expected_verdict": "pass", + "expected_rules": [], + "description": "加密 zip 内 YARA 样本", + "_scan_verdict": "clean" + }, + { + "filename": "L4-010_010_sample.txt", + "case_id": "L4-010", + "category": "L4", + "expected_verdict": "review", + "expected_rules": [], + "description": "正则 YARA 测试占位", + "_scan_verdict": "clean" + }, + { + "filename": "L4-011_count_condition.txt", + "case_id": "L4-011", + "category": "L4", + "expected_verdict": "review", + "expected_rules": [], + "description": "YARA count > 3 条件", + "_scan_verdict": "clean" + }, + { + "filename": "L4-012_size_condition.bin", + "case_id": "L4-012", + "category": "L4", + "expected_verdict": "review", + "expected_rules": [ + "DangerousExecutableExtension", + "ExtensionMismatch", + "PeParseFailed" + ], + "description": "YARA 文件大小条件", + "_scan_verdict": "reject" + }, + { + "filename": "L4-013_bigfile_yara.txt", + "case_id": "L4-013", + "category": "L4", + "expected_verdict": "review", + "expected_rules": [], + "description": "100MB 文件 YARA 扫描", + "_scan_verdict": "clean" + }, + { + "filename": "L4-014_layer_off_sample.bin", + "case_id": "L4-014", + "category": "L4", + "expected_verdict": "review", + "expected_rules": [ + "DangerousExecutableExtension", + "ExtensionMismatch", + "PeParseFailed" + ], + "description": "关闭分层开关测试占位", + "_scan_verdict": "reject" + }, + { + "filename": "L4-015_hash_whitelist.txt", + "case_id": "L4-015", + "category": "L4", + "expected_verdict": "pass", + "expected_rules": [], + "description": "MD5 在白名单", + "_scan_verdict": "clean" + }, + { + "filename": "L5-001_clean_hello.exe", + "case_id": "L5-001", + "category": "L5", + "expected_verdict": "pass", + "expected_rules": [ + "DangerousExecutableExtension", + "PeParseFailed" + ], + "description": "原生干净HelloWorld PE（无壳）", + "_scan_verdict": "suspicious" + }, + { + "filename": "L5-002_upx_shell.exe", + "case_id": "L5-002", + "category": "L5", + "expected_verdict": "review", + "expected_rules": [ + "DangerousExecutableExtension", + "PeParseFailed" + ], + "description": "UPX0/UPX1 节名", + "_scan_verdict": "suspicious" + }, + { + "filename": "L5-003_double_upx.exe", + "case_id": "L5-003", + "category": "L5", + "expected_verdict": "review", + "expected_rules": [ + "DangerousExecutableExtension", + "PeParseFailed" + ], + "description": "UPX加壳PE，二次压缩", + "_scan_verdict": "suspicious" + }, + { + "filename": "L5-004_rwx_section.exe", + "case_id": "L5-004", + "category": "L5", + "expected_verdict": "reject", + "expected_rules": [ + "DangerousExecutableExtension", + "PeParseFailed" + ], + "description": "节属性 RWX", + "_scan_verdict": "suspicious" + }, + { + "filename": "L5-005_injection_imports.exe", + "case_id": "L5-005", + "category": "L5", + "expected_verdict": "reject", + "expected_rules": [ + "DangerousExecutableExtension", + "PEArchInfo", + "SuspiciousTimestamp", + "UnsignedExecutable" + ], + "description": "注入组合导入（需要真实 pefile 引入 API）", + "_scan_verdict": "malicious" + }, + { + "filename": "L5-006_single_virtualalloc.exe", + "case_id": "L5-006", + "category": "L5", + "expected_verdict": "review", + "expected_rules": [ + "DangerousExecutableExtension", + "PEArchInfo", + "SuspiciousTimestamp", + "UnsignedExecutable" + ], + "description": "单一可疑内存 API", + "_scan_verdict": "malicious" + }, + { + "filename": "L5-007_garbage_section.exe", + "case_id": "L5-007", + "category": "L5", + "expected_verdict": "review", + "expected_rules": [ + "DangerousExecutableExtension", + "PeParseFailed" + ], + "description": "节名乱码", + "_scan_verdict": "suspicious" + }, + { + "filename": "L5-008_many_exports.exe", + "case_id": "L5-008", + "category": "L5", + "expected_verdict": "review", + "expected_rules": [ + "DangerousExecutableExtension", + "PEArchInfo", + "SuspiciousTimestamp", + "UnsignedExecutable" + ], + "description": "导出表异常（需真实工具生成）", + "_scan_verdict": "malicious" + }, + { + "filename": "L5-009_shell_in_resource.exe", + "case_id": "L5-009", + "category": "L5", + "expected_verdict": "review", + "expected_rules": [ + "DangerousExecutableExtension", + "PEArchInfo", + "SuspiciousTimestamp", + "UnsignedExecutable" + ], + "description": "资源段内嵌字符串（占位）", + "_scan_verdict": "malicious" + }, + { + "filename": "L5-010_bad_mz.exe", + "case_id": "L5-010", + "category": "L5", + "expected_verdict": "review", + "expected_rules": [ + "DangerousExecutableExtension", + "ExtensionMismatch", + "PeParseFailed" + ], + "description": "PE 头非法", + "_scan_verdict": "reject" + }, + { + "filename": "L5-011_truncated.exe", + "case_id": "L5-011", + "category": "L5", + "expected_verdict": "review", + "expected_rules": [ + "DangerousExecutableExtension", + "PeParseFailed" + ], + "description": "截断 PE", + "_scan_verdict": "suspicious" + }, + { + "filename": "L5-012_pe32.exe", + "case_id": "L5-012", + "category": "L5", + "expected_verdict": "pass", + "expected_rules": [ + "DangerousExecutableExtension", + "PeParseFailed" + ], + "description": "32 位识别", + "_scan_verdict": "suspicious" + }, + { + "filename": "L5-013_pe64.exe", + "case_id": "L5-013", + "category": "L5", + "expected_verdict": "pass", + "expected_rules": [ + "DangerousExecutableExtension", + "PeParseFailed" + ], + "description": "64 位识别占位", + "_scan_verdict": "suspicious" + }, + { + "filename": "L5-014_clean_tool.exe", + "case_id": "L5-014", + "category": "L5", + "expected_verdict": "pass", + "expected_rules": [ + "DangerousExecutableExtension", + "PeParseFailed" + ], + "description": "PE导入表大量系统API（正常工具）", + "_scan_verdict": "suspicious" + }, + { + "filename": "L5-015_bad_reloc.exe", + "case_id": "L5-015", + "category": "L5", + "expected_verdict": "review", + "expected_rules": [ + "DangerousExecutableExtension", + "PEArchInfo", + "SuspiciousTimestamp", + "UnsignedExecutable" + ], + "description": "重定位表损坏占位", + "_scan_verdict": "malicious" + }, + { + "filename": "L5-016_zero_section.exe", + "case_id": "L5-016", + "category": "L5", + "expected_verdict": "review", + "expected_rules": [ + "DangerousExecutableExtension", + "PeParseFailed" + ], + "description": "零节 PE 占位", + "_scan_verdict": "suspicious" + }, + { + "filename": "L5-016_zero_sections.exe", + "case_id": "L5-016", + "category": "L5", + "expected_verdict": "review", + "expected_rules": [ + "DangerousExecutableExtension", + "PEArchInfo", + "SuspiciousTimestamp", + "UnsignedExecutable" + ], + "description": "无节表最小 PE", + "_scan_verdict": "malicious" + }, + { + "filename": "L5-017_upx_rwx.exe", + "case_id": "L5-017", + "category": "L5", + "expected_verdict": "review", + "expected_rules": [ + "DangerousExecutableExtension", + "PeParseFailed" + ], + "description": "UPX壳 + RWX节复合特征", + "_scan_verdict": "suspicious" + }, + { + "filename": "L5-018_debug_info.exe", + "case_id": "L5-018", + "category": "L5", + "expected_verdict": "review", + "expected_rules": [ + "DangerousExecutableExtension", + "PeParseFailed" + ], + "description": "调试信息占位", + "_scan_verdict": "suspicious" + }, + { + "filename": "L5-019_200mb_huge.exe", + "case_id": "L5-019", + "category": "L5", + "expected_verdict": "pass", + "expected_rules": [ + "DangerousExecutableExtension", + "PeParseFailed" + ], + "description": "200MB 超大 PE（占位，真实生成会写满磁盘）", + "_scan_verdict": "suspicious" + }, + { + "filename": "L5-020_layer_off_sample.bin", + "case_id": "L5-020", + "category": "L5", + "expected_verdict": "review", + "expected_rules": [ + "DangerousExecutableExtension", + "ExtensionMismatch", + "PEArchInfo", + "RWXSectionDetected", + "SuspiciousTimestamp", + "UnsignedExecutable" + ], + "description": "关闭分层开关测试占位", + "_scan_verdict": "reject" + }, + { + "filename": "NEG-001_clean.jpg", + "case_id": "NEG-001", + "category": "NEG", + "expected_verdict": "pass", + "expected_rules": [], + "description": "业务标准JPG图片", + "_scan_verdict": "clean" + }, + { + "filename": "NEG-002_clean.png", + "case_id": "NEG-002", + "category": "NEG", + "expected_verdict": "pass", + "expected_rules": [], + "description": "业务PNG图片", + "_scan_verdict": "clean" + }, + { + "filename": "NEG-003_clean.mp4", + "case_id": "NEG-003", + "category": "NEG", + "expected_verdict": "pass", + "expected_rules": [], + "description": "业务MP4视频", + "_scan_verdict": "clean" + }, + { + "filename": "NEG-004_clean.docx", + "case_id": "NEG-004", + "category": "NEG", + "expected_verdict": "pass", + "expected_rules": [], + "description": "业务正常docx报表", + "_scan_verdict": "clean" + }, + { + "filename": "NEG-005_clean.xlsx", + "case_id": "NEG-005", + "category": "NEG", + "expected_verdict": "pass", + "expected_rules": [], + "description": "业务正常xlsx表格", + "_scan_verdict": "clean" + }, + { + "filename": "NEG-006_clean.pdf", + "case_id": "NEG-006", + "category": "NEG", + "expected_verdict": "pass", + "expected_rules": [ + "MalformedStructure", + "PdfParseFailed" + ], + "description": "业务正常PDF报告", + "_scan_verdict": "suspicious" + }, + { + "filename": "NEG-007_clean.java", + "case_id": "NEG-007", + "category": "NEG", + "expected_verdict": "pass", + "expected_rules": [], + "description": "业务源码java文件", + "_scan_verdict": "reject" + }, + { + "filename": "NEG-008_clean.py", + "case_id": "NEG-008", + "category": "NEG", + "expected_verdict": "pass", + "expected_rules": [ + "DangerousExecutableExtension" + ], + "description": "业务源码python脚本", + "_scan_verdict": "suspicious" + }, + { + "filename": "NEG-009_clean.zip", + "case_id": "NEG-009", + "category": "NEG", + "expected_verdict": "pass", + "expected_rules": [], + "description": "正常业务压缩包zip", + "_scan_verdict": "clean" + }, + { + "filename": "NEG-010_clean.exe", + "case_id": "NEG-010", + "category": "NEG", + "expected_verdict": "pass", + "expected_rules": [ + "DangerousExecutableExtension", + "PeParseFailed" + ], + "description": "正常业务安装包（干净开源）", + "_scan_verdict": "suspicious" + }, + { + "filename": "NEG-011_clean.log", + "case_id": "NEG-011", + "category": "NEG", + "expected_verdict": "pass", + "expected_rules": [], + "description": "正常日志文件", + "_scan_verdict": "reject" + }, + { + "filename": "NEG-012_clean.csv", + "case_id": "NEG-012", + "category": "NEG", + "expected_verdict": "pass", + "expected_rules": [], + "description": "正常csv业务数据文件", + "_scan_verdict": "clean" + }, + { + "filename": "NEG-013_clean.eml", + "case_id": "NEG-013", + "category": "NEG", + "expected_verdict": "pass", + "expected_rules": [], + "description": "正常eml业务邮件（无附件、无外联恶意）", + "_scan_verdict": "clean" + }, + { + "filename": "NEG-014_clean.dll", + "case_id": "NEG-014", + "category": "NEG", + "expected_verdict": "pass", + "expected_rules": [ + "DangerousExecutableExtension", + "PeParseFailed" + ], + "description": "正常dll（系统干净dll）", + "_scan_verdict": "suspicious" + }, + { + "filename": "NEG-015_clean.ttf", + "case_id": "NEG-015", + "category": "NEG", + "expected_verdict": "pass", + "expected_rules": [], + "description": "正常字体文件ttf", + "_scan_verdict": "reject" + }, + { + "filename": "NEG-016_clean.dwg", + "case_id": "NEG-016", + "category": "NEG", + "expected_verdict": "pass", + "expected_rules": [], + "description": "正常CAD图纸", + "_scan_verdict": "reject" + }, + { + "filename": "NEG-017_4layer_nested.zip", + "case_id": "NEG-017", + "category": "NEG", + "expected_verdict": "pass", + "expected_rules": [ + "ArchiveBroken", + "MalformedStructure" + ], + "description": "多层嵌套干净zip（无风险）", + "_scan_verdict": "suspicious" + }, + { + "filename": "NEG-018_clean.bat", + "case_id": "NEG-018", + "category": "NEG", + "expected_verdict": "pass", + "expected_rules": [ + "DangerousExecutableExtension" + ], + "description": "正常bat运维脚本（内网备份）", + "_scan_verdict": "suspicious" + }, + { + "filename": "NEG-019_clean.ps1", + "case_id": "NEG-019", + "category": "NEG", + "expected_verdict": "pass", + "expected_rules": [ + "DangerousExecutableExtension" + ], + "description": "正常ps1运维脚本（内网查询）", + "_scan_verdict": "suspicious" + }, + { + "filename": "NEG-020_clean.odt", + "case_id": "NEG-020", + "category": "NEG", + "expected_verdict": "pass", + "expected_rules": [], + "description": "正常odt文档", + "_scan_verdict": "reject" + }, + { + "filename": "broken.zip", + "case_id": "L7-001", + "category": "L7", + "expected_verdict": "clean", + "expected_rules": [], + "description": "损坏 ZIP", + "_scan_verdict": "clean" + }, + { + "filename": "evil.iso", + "case_id": "L7-002", + "category": "L7", + "expected_verdict": "suspicious", + "expected_rules": [ + "DangerousExecutableExtension" + ], + "description": "恶意 ISO 镜像", + "_scan_verdict": "suspicious" + }, + { + "filename": "evil_help.chm", + "case_id": "L7-003", + "category": "L7", + "expected_verdict": "malicious", + "expected_rules": [ + "ChmWithScript", + "DangerousExecutableExtension", + "RemoteDownloadUnix" + ], + "description": "含脚本 CHM 帮助", + "_scan_verdict": "malicious" + }, + { + "filename": "linux_malicious", + "case_id": "L7-004", + "category": "L7", + "expected_verdict": "malicious", + "expected_rules": [ + "C7_Linux_ReverseShell_Bash", + "LinuxExecutable", + "ReverseShellNetcat" + ], + "description": "Linux 恶意脚本集", + "_scan_verdict": "malicious" + }, + { + "filename": "lolbin.cmd", + "case_id": "L7-005", + "category": "L7", + "expected_verdict": "suspicious", + "expected_rules": [ + "CommandExecutionObfuscated", + "DangerousExecutableExtension" + ], + "description": "LOLBin cmd 混淆", + "_scan_verdict": "suspicious" + }, + { + "filename": "macro_alert.docm", + "case_id": "L7-006", + "category": "L7", + "expected_verdict": "malicious", + "expected_rules": [ + "RemoteDownloadPowerShell", + "RemoteDownloadUnix", + "VBAAutoExecShell" + ], + "description": "含 VBA 宏 DOCM", + "_scan_verdict": "malicious" + }, + { + "filename": "malicious.desktop", + "case_id": "L7-007", + "category": "L7", + "expected_verdict": "malicious", + "expected_rules": [ + "C7_Linux_ReverseShell_Bash", + "C7_Linux_ReverseShell_Misc", + "DangerousExecutableExtension", + "DesktopFileAutoExec", + "ReverseShellNetcat" + ], + "description": "恶意 .desktop 反序列化", + "_scan_verdict": "malicious" + }, + { + "filename": "malicious.pdf", + "case_id": "L7-008", + "category": "L7", + "expected_verdict": "malicious", + "expected_rules": [ + "PdfJavaScript", + "PdfOpenAction" + ], + "description": "含 JS/Action PDF", + "_scan_verdict": "malicious" + }, + { + "filename": "miner_config.json", + "case_id": "L7-009", + "category": "L7", + "expected_verdict": "suspicious", + "expected_rules": [ + "C7_Linux_Miner_Generic" + ], + "description": "挖矿配置文件", + "_scan_verdict": "suspicious" + }, + { + "filename": "neg_tmp1.zip", + "case_id": "L7-035", + "category": "L7", + "expected_verdict": "clean", + "expected_rules": [], + "description": "占位残留 tmp zip", + "_scan_verdict": "clean" + }, + { + "filename": "normal.pdf", + "case_id": "L7-010", + "category": "L7", + "expected_verdict": "clean", + "expected_rules": [], + "description": "干净 PDF 对照", + "_scan_verdict": "clean" + }, + { + "filename": "normal_deploy.sh", + "case_id": "L7-011", + "category": "L7", + "expected_verdict": "suspicious", + "expected_rules": [ + "DangerousExecutableExtension" + ], + "description": "运维部署脚本（误报）", + "_scan_verdict": "suspicious" + }, + { + "filename": "normal_readme.txt", + "case_id": "L7-012", + "category": "L7", + "expected_verdict": "clean", + "expected_rules": [], + "description": "干净 README 对照", + "_scan_verdict": "clean" + }, + { + "filename": "normal_report.docx", + "case_id": "L7-013", + "category": "L7", + "expected_verdict": "clean", + "expected_rules": [], + "description": "干净 DOCX 对照", + "_scan_verdict": "clean" + }, + { + "filename": "ole_dropper.doc", + "case_id": "L7-014", + "category": "L7", + "expected_verdict": "suspicious", + "expected_rules": [ + "OleToolsUnavailable", + "RemoteSessionHijack" + ], + "description": "OLE 投递 DOC", + "_scan_verdict": "suspicious" + }, + { + "filename": "pe_downloader.exe", + "case_id": "L7-015", + "category": "L7", + "expected_verdict": "malicious", + "expected_rules": [ + "C1_PE_Downloader_Loader", + "DangerousExecutableExtension", + "PeParseFailed" + ], + "description": "PE 下载木马", + "_scan_verdict": "malicious" + }, + { + "filename": "pe_injection.exe", + "case_id": "L7-016", + "category": "L7", + "expected_verdict": "malicious", + "expected_rules": [ + "C1_PE_ProcessInjection", + "DangerousExecutableExtension", + "PeParseFailed", + "RemoteSessionHijack" + ], + "description": "PE 注入程序", + "_scan_verdict": "malicious" + }, + { + "filename": "persist_cron.sh", + "case_id": "L7-017", + "category": "L7", + "expected_verdict": "malicious", + "expected_rules": [ + "C7_Linux_Persistence_Crontab", + "DangerousExecutableExtension", + "RemoteDownloadUnix", + "ShellScriptDangerous", + "Txt.Malware.Sustes-6779550-1" + ], + "description": "Crontab 持久化脚本", + "_scan_verdict": "malicious" + }, + { + "filename": "phishing.eml", + "case_id": "L7-018", + "category": "L7", + "expected_verdict": "reject", + "expected_rules": [ + "EmailAttachmentDangerous", + "EmailAttachmentDisguised", + "EmailAttachmentWebshell", + "EmailPhishingKeyword" + ], + "description": "钓鱼邮件 EML", + "_scan_verdict": "reject" + }, + { + "filename": "photo.jpg.php", + "case_id": "L7-019", + "category": "L7", + "expected_verdict": "reject", + "expected_rules": [ + "DangerousExecutableExtension" + ], + "description": "双扩展名伪装 .jpg.php", + "_scan_verdict": "reject" + }, + { + "filename": "ransom_dropper.exe.txt", + "case_id": "L7-020", + "category": "L7", + "expected_verdict": "reject", + "expected_rules": [ + "C8_Ransomware_Encryption", + "C8_Ransomware_Note_Filename", + "C8_Ransomware_VolumeShadow", + "DoubleExtension" + ], + "description": "勒索软件投递器", + "_scan_verdict": "reject" + }, + { + "filename": "sealed.docx", + "case_id": "L7-021", + "category": "L7", + "expected_verdict": "reject", + "expected_rules": [ + "ArchiveBroken", + "MalformedStructure", + "OfficeEncrypted", + "OoxmlParseFailed" + ], + "description": "加密 DOCX（被视为损坏）", + "_scan_verdict": "reject" + }, + { + "filename": "sealed.xlsx", + "case_id": "L7-022", + "category": "L7", + "expected_verdict": "reject", + "expected_rules": [ + "ArchiveBroken", + "ExtensionMismatch", + "MalformedStructure", + "OfficeEncrypted", + "OoxmlParseFailed" + ], + "description": "加密 XLSX（被视为损坏）", + "_scan_verdict": "reject" + }, + { + "filename": "shell_aspx.aspx", + "case_id": "L7-023", + "category": "L7", + "expected_verdict": "reject", + "expected_rules": [ + "DangerousExecutableExtension" + ], + "description": "ASPX 一句话木马", + "_scan_verdict": "reject" + }, + { + "filename": "shell_bash_devtcp.sh", + "case_id": "L7-024", + "category": "L7", + "expected_verdict": "malicious", + "expected_rules": [ + "C7_Linux_ReverseShell_Bash", + "DangerousExecutableExtension", + "ReverseShellNetcat", + "ShellScriptDangerous" + ], + "description": "Bash /dev/tcp 反弹", + "_scan_verdict": "malicious" + }, + { + "filename": "shell_jsp_runtime.jsp", + "case_id": "L7-025", + "category": "L7", + "expected_verdict": "reject", + "expected_rules": [ + "C3_JSP_Webshell_RuntimeExec", + "DangerousExecutableExtension" + ], + "description": "JSP Runtime exec 木马", + "_scan_verdict": "reject" + }, + { + "filename": "shell_nc.sh", + "case_id": "L7-026", + "category": "L7", + "expected_verdict": "malicious", + "expected_rules": [ + "C7_Linux_ReverseShell_NC", + "DangerousExecutableExtension", + "ReverseShellNetcat", + "ShellScriptDangerous" + ], + "description": "NC 反弹 Shell", + "_scan_verdict": "malicious" + }, + { + "filename": "shell_php_eval.php", + "case_id": "L7-027", + "category": "L7", + "expected_verdict": "reject", + "expected_rules": [ + "C3_PHP_Webshell_Oneliner", + "DangerousExecutableExtension" + ], + "description": "PHP eval 一句话木马", + "_scan_verdict": "reject" + }, + { + "filename": "shell_php_obf.php", + "case_id": "L7-028", + "category": "L7", + "expected_verdict": "reject", + "expected_rules": [ + "C3_PHP_Webshell_Obfuscated", + "DangerousExecutableExtension" + ], + "description": "PHP 混淆木马", + "_scan_verdict": "reject" + }, + { + "filename": "shell_python.py", + "case_id": "L7-029", + "category": "L7", + "expected_verdict": "suspicious", + "expected_rules": [ + "DangerousExecutableExtension" + ], + "description": "Python 反弹脚本", + "_scan_verdict": "suspicious" + }, + { + "filename": "shortcut.lnk", + "case_id": "L7-030", + "category": "L7", + "expected_verdict": "suspicious", + "expected_rules": [ + "DangerousExecutableExtension", + "RemoteDownloadUnix" + ], + "description": "恶意 .lnk 快捷方式", + "_scan_verdict": "suspicious" + }, + { + "filename": "template_backdoor.docx", + "case_id": "L7-031", + "category": "L7", + "expected_verdict": "malicious", + "expected_rules": [ + "AttachedTemplate" + ], + "description": "模板后门 DOCX", + "_scan_verdict": "malicious" + }, + { + "filename": "vba_autoexec.bas", + "case_id": "L7-032", + "category": "L7", + "expected_verdict": "malicious", + "expected_rules": [ + "RemoteDownloadUnix", + "VBAAutoExecShell" + ], + "description": "VBA AutoOpen 宏", + "_scan_verdict": "malicious" + }, + { + "filename": "wps_macro.js", + "case_id": "L7-033", + "category": "L7", + "expected_verdict": "malicious", + "expected_rules": [ + "C7_Linux_ReverseShell_Bash", + "C7_Linux_ReverseShell_Misc", + "DangerousExecutableExtension", + "ReverseShellNetcat" + ], + "description": "WPS JS 宏", + "_scan_verdict": "malicious" + }, + { + "filename": "zip_traversal.zip", + "case_id": "L7-034", + "category": "L7", + "expected_verdict": "malicious", + "expected_rules": [ + "PathTraversal", + "PathTraversalBlocked" + ], + "description": "ZIP 路径穿越（旧版）", + "_scan_verdict": "malicious" + } + ] } \ No newline at end of file