zhaolei/MeshSate
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

sample: 补齐 L1-014/L4-007/008/013 四样本内容 → 对账 168/168 100%

Browse Source 
- L1-014: 加入 EICAR 字节串（触发 EmbeddedEICAR w=35 → suspicious=review tier）
- L4-007: 加入 'trojan-metadata-test'（YARA Meta_Label_Test → suspicious=review）
- L4-008: 重建成 ZIP_STORED 不压缩 zip，内含 nc reverse shell 明文
  （YARA Test_ReverseShell_Basic + keywords ReverseShellNetcat 零容忍）
- L4-013: 尾部追加 nc + bash -i >& /dev/tcp/ 特征
  （YARA Test_ReverseShell_Basic → malicious，≥review tier 匹配通过）

对账: 164/168 → 168/168 (100.0%) 🎉
This commit is contained in:
zhaolei
2026-10-29 16:19:58 +08:00
parent 43cfb0fe69
commit a372ee5a08
4 changed files with 11 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
tests/samples/L4-007_meta_rule_match.txt
View File

@@ -1 +1 @@
yara match string placeholder
trojan-metadata-test