zhaolei/MeshSate
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: 六引擎误报根因修复 — 解包递归、YARA 恒真规则、签名分级、real_type 溢出

Browse Source 
检测范围与证据链修复，不改裁决口径（口径改动在下一条提交）。

- extractor：zip/tar 成员在超限分支外漏加回扫描队列，解包后内容永远不参与检测；
  zip 目录条目被当成内嵌对象；tar 超限成员先落盘不删。递归真正生效后深扫耗时可测。
- clamav：_HIGH/_MEDIUM/_UNWANTED 关键词是小写，而签名名是 "Win.Trojan..." 大小写混排，
  分级判定恒不命中全走默认档；改统一大写匹配。超过 clamd MaxFileSize 的裸奔区间
  (1G~1.5G) 新增 ClamAVSkippedSizeLimit(30) — 按"不可扫描不放行"进复核。
- yara：pe.yar C1 系列改用导入表判定，不再靠裸子串命中字符串表；
  linux.yar C7 多条规则条件恒真（裸 nc/fetch 之类）已收紧；C8/C3 相应收窄。
- structure：DangerousExecutableExtension 是载体信号而非恶意行为，critical 权重 45→35，
  不再作为把中低置信度信号一起顶过 block_score 的底座。
- scanner/documents：real_type 拼进 libmagic 对 MSI/OLE 的元数据串实测 334+ 字符，
  超列宽导致整条 scan_tasks INSERT 连 findings 一起丢（被拒文件不留痕）→
  列宽 256→512，migrate.sql 补 ALTER。
This commit is contained in:
zhaolei
2026-11-02 20:26:56 +08:00
parent 64b682319e
commit b6a004bdb7
13 changed files with 636 additions and 311 deletions
Download Patch File Download Diff File Expand all files Collapse all files

91
rules/linux.yar
View File

@@ -117,17 +117,23 @@ rule C7_Linux_ReverseShell_Misc {
meta:
risk_level = "medium"
category = "C7"
false_positive_rate = "medium"
false_positive_rate = "low"
reference = "多种语言反弹 Shell 通用特征"
description = "通用反弹 Shell 标记：/dev/tcp 或 /dev/udp 或 reverse shell 工具名"
description = "通用反弹 Shell 标记：/dev/udp 或 攻击工具名 + shell 参数"
strings:
$devudp = /\/dev\/udp\/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{2,5}/ ascii
$bashc = /bash\s+-c\s+['"].*\/dev\/(tcp|udp)/ ascii
$dash_e = /\/bin\/bash\s+-e\s+['"]/ ascii
$hydra = /Hydra|crackmap|weevely|meterpreter|msfconsole|msfvenom/ ascii nocase
// 裸词 Hydra 会命中 "dehydrated"、crack 会命中 "cracklib"，必须带参数或成组出现
$hydra = /\bhydra\s+(-l|-P|-p|-s|-m|-t)\b/ ascii nocase
$tool = /\b(crackmapexec|weevely|meterpreter|msfconsole|msfvenom)\b/ ascii nocase
$reverseshell = /reverse[_\s]?shell|shell[_\s]?shock/ ascii nocase
$netart = /(nc|ncat)\s+\S+\s+\d{2,5}\s+-[ec]\b|\/dev\/(tcp|udp)\/|socat\s+EXEC:|bash\s+-i\s*>&/ ascii
condition:
any of ($devudp, $bashc, $dash_e) or any of ($hydra, $reverseshell)
any of ($devudp, $bashc, $dash_e)
or $hydra
or ($tool and $netart)
or ($reverseshell and $netart)
}
@@ -177,40 +183,43 @@ rule C7_Linux_Persistence_SystemD {
meta:
risk_level = "high"
category = "C7"
false_positive_rate = "medium"
false_positive_rate = "low"
reference = "MITRE ATT&CK T1543.002 Systemd Service"
description = "恶意 systemd unit 文件：ExecStart 指向 /tmp/.hidden + multi-user.target + 反弹命令"
description = "恶意 systemd unit：ExecStart 指向临时目录隐藏文件 / 管道执行 / 反弹命令"
strings:
$unit = /\[Unit\]/ ascii
$service = /\[Service\]/ ascii
$install = /\[Install\]/ ascii
$execstart = /ExecStart=/ ascii
$multiuser = /multi-user\.target/ ascii
$hiddenpath = /\/tmp\/\.?\w+|\/var\/tmp\/\.?\w+/ ascii
$bashsh = /\/bin\/(ba)?sh\s+-c/ ascii
// 隐藏文件（点开头）落在可写临时目录——正常 unit 只会在 /usr/bin、/opt 等路径
$hiddenpath = /\/(tmp|var\/tmp|dev\/shm)\/\.[a-zA-Z0-9_-]{2,}/ ascii
$pipe = /(curl|wget)\s+\S+\s*\|\s*(ba)?sh/ ascii
$revshell = /((nc|ncat|socat)\s+.*(-e|--exec|EXEC:)\s*\/bin\/(ba)?sh|\/dev\/tcp\/\d{1,3}\.\d{1,3})/ ascii
condition:
// 完整 unit 片段 + 可疑路径
$unit and $service and $execstart and ($hiddenpath or $bashsh)
($unit and $service and $execstart and any of ($hiddenpath, $pipe, $revshell))
or
// Install multi-user.target + ExecStart 反弹
$install and $multiuser and any of ($execstart, $bashsh)
($install and $multiuser and $execstart and any of ($hiddenpath, $pipe, $revshell))
}
rule C7_Linux_Persistence_LD_PRELOAD {
meta:
risk_level = "high"
category = "C7"
false_positive_rate = "medium"
false_positive_rate = "low"
reference = "MITRE ATT&CK T1574.006 LD_PRELOAD"
description = "LD_PRELOAD 劫持：环境变量注入 + .so 文件 + dlopen"
description = "LD_PRELOAD 劫持：写 ld.so.preload 或预加载临时目录里的 .so"
strings:
$ldpreload = /LD_PRELOAD=/ ascii
$sofile = /\.so(\.\d+)?:?/ ascii
$dlopen = "dlopen" ascii
$dlsym = "dlsym" ascii
$exportenv = /export\s+LD_PRELOAD/ ascii
$ldso = /ld\.so\.preload/ ascii
$tmpso = /\/(tmp|var\/tmp|dev\/shm|proc\/\d+\/root)\/[a-zA-Z0-9_.\/-]*\.so(\.[0-9]+)?/ ascii
condition:
($ldpreload or $exportenv) and ($sofile or $dlopen or $dlsym)
// /etc/ld.so.preload 是内核级后门常用落点，单独出现即算证据
$ldso
or
// LD_PRELOAD 指向可写临时目录的 so；README 里 LD_PRELOAD=libasan.so 不算
(any of ($ldpreload, $exportenv) and $tmpso)
}
@@ -267,41 +276,55 @@ rule C7_Misc_Ruby_Lua_ReverseShell {
meta:
risk_level = "medium"
category = "C7"
false_positive_rate = "medium"
false_positive_rate = "low"
reference = "多语言反弹 Shell"
description = "Ruby/Lua 反弹 Shell：TCPSocket + exec/system"
description = "Ruby/Lua 反弹 Shell：Socket 对象 + 紧邻的 shell 执行调用"
strings:
$ruby = "TCPSocket" ascii
$ruby2 = "Socket.tcp" ascii
$lua = "loadstring" ascii
$lua2 = "luasocket" ascii
$exec = /(exec|system|IO\.popen)\s+.*\/bin\/(ba)?sh/ ascii
$exec = /(\bexec|\bsystem|IO\.popen|\bpopen|os\.execute|os\.runtime)\s*\(?\s*['"]((\/bin\/)?(ba)?sh|nc\s+-e|\/dev\/tcp)[^'"]{0,48}/ ascii
condition:
any of ($ruby, $lua, $lua2) and ($exec or any of ($ruby, $lua, $lua2))
// 只要出现 TCPSocket/loadstring 就命中 = 任何内嵌 Lua 的程序（Redis、nginx-lua、
// Wireshark 插件）必中。语言标记与 shell 执行必须挨在一起（256B 内）。
$exec and (
for any i in (1..#exec): (
any of ($ruby, $ruby2, $lua, $lua2) in (@exec[i] - 256..@exec[i] + 256)
)
)
}
// =============================================================================
// C7-5 网络投毒 / MITM 工具（内网横向移动）
// 工具名必须整词匹配，且与攻击参数成组出现
// =============================================================================
rule C7_Network_Tools_Malicious {
meta:
risk_level = "medium"
category = "C7"
false_positive_rate = "medium"
false_positive_rate = "low"
reference = "内网攻击工具"
description = "内网攻击工具：ettercap/responder/nmap 扫描 + SMB/DNS 投毒"
description = "内网攻击工具：ettercap/responder/nmap + 投毒参数成组出现"
strings:
$ettercap = "ettercap" ascii nocase
$responder = /responder(\.py)?/ ascii nocase
$nmap = "nmap" ascii nocase
$smb = /--smb/ ascii
$ms17 = "ms17-010" ascii nocase
$smbghost = "SMBGhost" ascii nocase
$dnsspoof = /dns[-_]spoof|dns[-_]mitm/ ascii nocase
$arppoison = /arp[-_]poison|arp[-_]spoof/ ascii nocase
$tool1 = /\bettercap\b/ ascii nocase
$tool2 = /\bresponder(\.py)?\b/ ascii nocase
$tool3 = /\bnmap\b/ ascii nocase
// 攻击参数 / 漏洞编号（这些才是意图证据）
$art1 = /--smb/ ascii
$art2 = /\bms17-010\b/ ascii nocase
$art3 = /\bSMBGhost\b/ ascii nocase
$art4 = /\bdns[-_]spoof\b|\bdns[-_]mitm\b/ ascii nocase
$art5 = /\barp[-_]poison\b|\barp[-_]spoof\b/ ascii nocase
$art6 = /--Mitm|-T\s+text|\bec_sleep\b|\bntlm_relay\b|\bRunFinger\.py\b/ ascii nocase
condition:
any of ($ettercap, $responder, $dnsspoof, $arppoison)
// 投毒手法名本身就是明确证据
any of ($art4, $art5)
or
$nmap and ($smb or $ms17 or $smbghost)
// 工具名 + 攻击参数
($tool1 and any of ($art1, $art2, $art3, $art6))
or ($tool2 and any of ($art1, $art2, $art3, $art6))
or ($tool3 and any of ($art1, $art2, $art3))
}

445
rules/pe.yar
View File

@@ -2,26 +2,34 @@
// MeshSafe L2B YARA 规则集 —— Windows PE 恶意程序专项（C1 + C8）
// =============================================================================
//
// 设计原则：
// - 所有规则使用 2-3 特征组合命中（API 组合 + C2 URL + Mutex 持久化等）
// - binary.py 的 PE 结构分析负责：节熵 + 签名 + 可疑导入（单 API）
// - YARA 负责：多 API 组合 + 字符串组合 + 壳 + 勒索专项
// - 命中后作为 finding 交给 PolicyEngine 权重累加，不直接零容忍
// 设计原则（v0.2.4 起，为消除干净软件误报而重写）：
// 1. 全文搜 API 名 = 必然误报。系统 DLL 会「导出」这些 API（kernel32 里就有
// VirtualAllocEx/WriteProcessMemory/CreateRemoteThread 的明文字符串），
// 安全 SDK、安装器、调试组件同理。因此 C1 系列一律要求：
// - 文件是 PE（uint16(0) == 0x5A4D），且
// - 相关 API 名出现在同一个窗口内（导入名表是连续的，窗口 256~512B）。
// 导出表按字母序排列、跨度通常上 KB，落在窗口外 → 不误报；
// 真注入器/下载器的导入名表三条名字通常挨在一起 → 命中。
// 2. 不单独用「API 组合」定性，必须有硬指标（可疑路径 / 持久化键名 / C2 URL）。
// 3. 不用 3~4 字母裸串（曾经的 $persist5 = "RUN"）和裸工具名。
// 4. binary.py 的 PE 结构分析负责节熵/签名/导入 API 分级；YARA 只做组合特征。
//
// 范围：
// - C1: Windows PE 恶意程序（注入器 / 下载器 / RAT / Loader）
// - C8: 勒索 / 挖矿专项
// - C9: 壳 / 签名 / 结构异常（binary.py 已覆盖大部分，YARA 补充壳特征）
// - C8: 勒索 / 挖矿专项（勒索样本常以文本/脚本形态投递，不加 PE 头判定）
// - C9: 壳特征（识别后建议送沙箱，不作为恶意证据）
//
// 维护：
// - 新恶意家族出现时，优先补充"API 组合 + Mutex 名 + C2 URL"三件套
// - 壳特征（UPX/Themida/VMP）可识别后自动送沙箱深检
// - 新增规则先跑「干净 PE 回归」：C:/Windows/System32 全量 900+ 文件必须 0 命中
// - meta.risk_level 会被 binary.py 读取用于严重度展示，必须与档位权重一致
// =============================================================================
import "pe"
// =============================================================================
// C1-1 进程注入三件套（VirtualAllocEx + WriteProcessMemory + CreateRemoteThread）
// binary.py 扫了 SuspiciousImports（单个 API），但 3 个同时出现 = 必然是注入器
// 判定要点：三个导入名必须在同一张导入名表里（512B 窗口），否则是导出表明文
// =============================================================================
rule C1_PE_ProcessInjection {
@@ -30,37 +38,66 @@ rule C1_PE_ProcessInjection {
category = "C1"
false_positive_rate = "low"
reference = "MITRE ATT&CK T1055 Process Injection"
description = "PE 文件同时导入 进程注入三件套 API = 远控/注入器特征"
description = "PE 导入表含进程注入三件套（同表紧邻）= 远控/注入器特征"
strings:
$s1 = "VirtualAllocEx" ascii
$s2 = "WriteProcessMemory" ascii
$s3 = "CreateRemoteThread" ascii
// 备选：Nt 系列（NtUnmapViewOfSection + VirtualAllocEx + CreateRemoteThread）
$n1 = "NtUnmapViewOfSection" ascii
$n2 = "NtMapViewOfSection" ascii
$n3 = "ZwUnmapViewOfSection" ascii
// 也可能是 QueueUserAPC 注 APC 注入
$alloc = "VirtualAllocEx" ascii
$write = "WriteProcessMemory" ascii
$thread = "CreateRemoteThread" ascii
// 进程镂空（Process Hollowing）
$unmap1 = "NtUnmapViewOfSection" ascii
$unmap2 = "ZwUnmapViewOfSection" ascii
// APC / Hook 注入
$apc = "QueueUserAPC" ascii
// 或 SetWindowsHookEx DLL 注入
$hook = "SetWindowsHookEx" ascii
$open = "OpenProcess" ascii
condition:
// 经典三件套（必须同时命中）
$s1 and $s2 and $s3
or
// Nt 系列内存注入（至少 2 个 Nt + 1 个注入）
(any of ($n1, $n2, $n3) and any of ($s1, $s3, $apc))
or
// APC 注入 + VirtualAllocEx
$apc and $s1
or
// Hook DLL 注入
$hook and $s1
uint16(0) == 0x5A4D
and
(
// 经典三件套：同表紧邻
(
$alloc and $write and $thread
and for any i in (1..#alloc): (
$write in (@alloc[i] - 512..@alloc[i] + 512)
and $thread in (@alloc[i] - 512..@alloc[i] + 512)
)
)
or
// 镂空注入：unmap 必须和 write+thread 同表（kernel32/shell32 只是从
// ntdll 导入成对的 NtMapView/NtUnmap，没有写入+远线程就不算镂空注入）
(
$write and $thread
and for any i in (1..#unmap1): (
$write in (@unmap1[i] - 512..@unmap1[i] + 512)
and $thread in (@unmap1[i] - 512..@unmap1[i] + 512)
)
)
or
(
$write and $thread
and for any i in (1..#unmap2): (
$write in (@unmap2[i] - 512..@unmap2[i] + 512)
and $thread in (@unmap2[i] - 512..@unmap2[i] + 512)
)
)
or
// APC / Hook 注入：目标进程 API + 注入 API 同表紧邻
(
$alloc and $open and ($apc or $hook)
and for any i in (1..#alloc): (
$open in (@alloc[i] - 512..@alloc[i] + 512)
and ($apc in (@alloc[i] - 512..@alloc[i] + 512)
or $hook in (@alloc[i] - 512..@alloc[i] + 512))
)
)
)
}
// =============================================================================
// C1-2 下载器组合（网络 API + 本地持久化 / 执行）
// 单一 URLDownloadToFile 不致命，但 "下载 + 执行 + 持久化" 三件套 = Loader
// C1-2 下载器 / Loader（下载 API + 落地持久化键名，且两者同表紧邻）
// v0.2.3 的写法：任意下载 API + "WriteFile" + "CreateProcess" + 裸串 "RUN"
// → 任何带自动更新的正常软件必中。现在要求持久化硬指标。
// =============================================================================
rule C1_PE_Downloader_Loader {
@@ -69,157 +106,172 @@ rule C1_PE_Downloader_Loader {
category = "C1"
false_positive_rate = "low"
reference = "MITRE ATT&CK T1105 Ingress Tool Transfer"
description = "下载器组合：HTTP/FTP 下载 + 写入到可疑路径 + 执行"
description = "下载 API 与自启动/服务注册持久化键名同表共存 = Loader"
strings:
// 网络下载 API（任选其一）
// 下载类 API（保留专有名词，不用裸串）
$net1 = "URLDownloadToFile" ascii
$net2 = "InternetOpenUrl" ascii
$net3 = "WinHttpOpen" ascii
$net4 = "WinHttpOpenRequest" ascii
$net5 = "FtpOpenFile" ascii
$net6 = "DownloadFile" ascii
$net7 = "WinHttpSendRequest" ascii
$net3 = "WinHttpOpenRequest" ascii
$net4 = "WinHttpSendRequest" ascii
$net5 = "URLDownloadToCacheFile" ascii
$net6 = "FtpOpenFile" ascii
$net7 = "WinHttpOpen" ascii
$net8 = "InternetOpen" ascii
// 写入/保存到本地
$save1 = "WriteFile" ascii
$save2 = "SaveToFile" ascii
$save3 = "URLDownloadToCacheFile" ascii
// 自启动 / 服务注册持久化硬指标（不是裸 "RUN"）
$p1 = "Software\\Microsoft\\Windows\\CurrentVersion\\Run" ascii nocase
$p2 = "CurrentVersion\\RunOnce" ascii nocase
$p3 = "schtasks.exe" ascii nocase
$p4 = "CreateService" ascii
$p5 = "Start Menu\\Programs\\StartUp" ascii nocase
$p6 = "reg add" ascii nocase
$p7 = "StartupApproved" ascii nocase
// 执行下载的载荷
$exec1 = "WinExec" ascii
$exec2 = "CreateProcess" ascii
$exec3 = "ShellExecute" ascii
$exec4 = "CreateRemoteThread" ascii
// 持久化（注册表/启动项）
$persist1 = "RegSetValueEx" ascii
$persist2 = "SetServiceObjectSecurity" ascii
$persist3 = "CreateService" ascii
$persist4 = "schtasks.exe" ascii
$persist5 = "RUN" ascii // HKCU\Software\Microsoft\Windows\CurrentVersion\Run
// 临时目录落地（Loader 常先落 %TEMP%）
$tmp1 = /\\AppData\\Local\\Temp\\[a-z0-9_. -]{3,60}\.(exe|dll|tmp|dat)/ ascii nocase
$tmp2 = /%TEMP%\\[a-z0-9_. -]{3,60}\.(exe|dll|tmp)/ ascii nocase
$tmp3 = /\\Windows\\Temp\\[a-z0-9_. -]{3,60}\.(exe|dll|tmp)/ ascii nocase
condition:
// 下载 + 保存 + 执行（三件套）
any of ($net*) and any of ($save*) and any of ($exec*)
or
// 下载 + 持久化（即使没执行也是准备投毒）
any of ($net*) and any of ($persist*)
or
// 执行 + 持久化（下载可能在运行时动态完成）
any of ($exec1, $exec2, $exec3) and any of ($persist*)
uint16(0) == 0x5A4D
and any of ($net*)
and any of ($p*)
and
(
// 下载 API 与持久化键名同处一个导入/字符串表块
for any i in (1..#net1): ( any of ($p*) in (@net1[i] - 1024..@net1[i] + 1024) )
or (any of ($tmp*) and 2 of ($p*))
)
}
// =============================================================================
// C1-3 RAT / 远控特征（C2 通信 + 命令执行 + 持久化）
// C1-3 RAT / 远控特征
// v0.2.3 的写法用 send( / recv( / system( 这类通用符号，且
// (bot|serv|gate|ops)\.(com|net) 会匹配任意域名字符串 → 正常联网程序必中。
// 现在要求：C2 硬指标（IP:PORT、可执行下载 URL、家族标记）+ 套接字 API 同表。
// =============================================================================
rule C1_PE_RAT_CommandControl {
meta:
risk_level = "critical"
category = "C1"
false_positive_rate = "medium"
false_positive_rate = "low"
reference = "MITRE ATT&CK T1071 Application Layer Protocol"
description = "RAT C2 通信特征：WinHTTP/WSASend + 命令执行 API + 可疑 URL/域名"
description = "RAT C2 特征：套接字 API + 明确 C2 指标（IP:端口 / .exe 下载 / 家族标记）"
strings:
// C2 网络通道
$c2_send = /WSASend|send\s*\(|sendto|WinHttpSendRequest|InternetWriteFile/ ascii
$c2_recv = /WSARecv|recv\s*\(|recvfrom|WinHttpReadData|InternetReadFile/ ascii
$c2_connect = /WSAConnect|connect\s*\(|WinHttpConnect|InternetConnect/ ascii
// 套接字 API（不用裸 send/recv/connect）
$sock1 = "WSASend" ascii
$sock2 = "WSARecv" ascii
$sock3 = "WSAConnect" ascii
$sock4 = "WSASocket" ascii
$sock5 = "inet_ntoa" ascii
$sock6 = "getpeername" ascii
// 命令执行
$cmd = /CreateProcess|ShellExecute|WinExec|system\s*\(|popen/ ascii
// 命令执行（真实 RAT 才会与 C2 同表出现）
$cmd1 = "CreateProcess" ascii
$cmd2 = "ShellExecute" ascii
$cmd3 = "WinExec" ascii
// 可疑 C2 URL（可执行文件里出现 http://...exe 或常见 C2 域名）
$c2url1 = /http:\/\/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}:\d{2,5}/ ascii
$c2url2 = /https?:\/\/[^\"\s'\)]+\.(ru|top|xyz|tk|ml|ga|gq|cf|pw|click|stream|xyz|buzz|loan)\/[^\"\s'\)]*\.exe/ ascii
$c2url3 = /(c2|panel|gate|bot|ops|serv|beacon|stage|stager)\.(ru|top|xyz|cc|io|com|net)/ ascii
// C2 硬指标
$c2ip = /https?:\/\/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}:[1-5][0-9]{3}/ ascii
$c2exe = /https?:\/\/[^\s"']{4,}\.(exe|dll|scr|vbs|ps1|bat)\b/ ascii nocase
$c2uri = /(gate|panel|submit|checkin|beacon|report)\.(php|aspx|html)\b/ ascii nocase
$c2tld = /\b[a-z0-9-]{4,30}\.(ru|top|xyz|tk|ml|ga|gq|cf|pw|buzz|loan)\b/ ascii nocase
condition:
// C2 通信 + 命令执行（至少两个网络 + 一个命令）
any of ($c2_send, $c2_recv, $c2_connect) and any of ($cmd*) and any of ($c2url*)
or
// C2 URL 模式 + 网络 API
any of ($c2url*) and any of ($c2_connect, $c2_send)
uint16(0) == 0x5A4D
and 2 of ($sock*)
and any of ($c2*)
and
(
any of ($cmd*)
or $c2exe
or $c2uri
)
}
// =============================================================================
// C1-4 Mutex 互斥体名（勒索 / RAT / Loader 的持久化标记）
// 单一 Mutex 名有一定价值，但必须配合其他特征才触发
// 需要 CreateMutex 与家族 Mutex 名同表，避免文本文档里提一嘴家族名就命中
// =============================================================================
rule C1_PE_Mutex_Persistence {
meta:
risk_level = "medium"
category = "C1"
false_positive_rate = "medium"
false_positive_rate = "low"
reference = "MITRE ATT&CK T1057 Process Discovery (mutex as persistence marker)"
description = "可疑 Mutex 名称 + CreateMutex API = 持久化标记"
description = "CreateMutex + 已知家族 Mutex 名同表 = 持久化标记"
strings:
$createmutex = "CreateMutexA" ascii
$createmutexw = "CreateMutexW" ascii
// 常见勒索/RAT Mutex 名（大小写不敏感，含 Unicode 变体用 wide）
// LockBit
$lockbit1 = /Global\\[Ll]ock[Bb]it/ ascii
$lockbit2 = /Local\\[Ll]ock[Bb]it/ ascii
// BlackCat / ALPHV
$blackcat = /Global\\[Bb]lack[Cc]at|[Aa][Ll][Pp][Hh][Vv]/ ascii
$blackcat = /(Global|Local)\\[Bb]lack[Cc]at|\bALPHV\b/ ascii
// Ryuk
$ryuk = /RyukTask[\d]|Global\\Ryuk/ ascii
// Conti
$conti = /Global\\[Cc]onti|Local\\[Cc]onti/ ascii
$conti = /(Global|Local)\\[Cc]onti/ ascii
// Pseudo/Dharma
$dharma = /Global\\[Dd]harma|Local\\[Dd]harma/ ascii
// 通用可疑模式：Mutex 名包含 "Mutex" + UUID 变体
$dharma = /(Global|Local)\\[Dd]harma/ ascii
// 通用可疑模式：Mutex 名含 UUID 前缀
$generic1 = /Global\\Mutex[0-9a-f]{8}/ ascii
// Kryptik/Qakbot
$qakbot = /[Qq]akbot|[Kk]ryptik/ ascii
$qakbot = /\b[Qq]akbot\b|\b[Kk]ryptik\b/ ascii
// Cobalt Strike named pipe
$cs1 = /\\\\\.\\pipe\\msagent_[0-9a-f]+/ ascii
$cs2 = /\\\\\.\\pipe\\[Bb]eacon_[0-9a-f]+/ ascii
condition:
// CreateMutex + 已知家族 Mutex 名
(any of ($createmutex*)) and any of ($lockbit1, $lockbit2, $blackcat, $ryuk, $conti, $dharma, $qakbot)
or
// Cobalt Strike 命名管道特征（不需要 CreateMutex）
any of ($cs*)
or
// CreateMutex + 通用可疑 UUID Mutex
(any of ($createmutex*)) and $generic1
uint16(0) == 0x5A4D
and
(
any of ($cs*)
or (
any of ($createmutex*)
and any of ($lockbit1, $lockbit2, $blackcat, $ryuk, $conti, $dharma, $qakbot, $generic1)
)
)
}
// =============================================================================
// C1-5 DLL 劫持 / LoadLibrary 动态加载
// C1-5 DLL 劫持 / 侧加载
// 只看「LoadLibrary + GetProcAddress + 临时目录里的 DLL 名」三件套；
// \ProgramData\ 与 \Public\ 是正常安装器路径，不再单独作为可疑路径
// =============================================================================
rule C1_PE_DLLHijacking {
meta:
risk_level = "high"
category = "C1"
false_positive_rate = "medium"
false_positive_rate = "low"
reference = "MITRE ATT&CK T1574 Hijack Execution Flow"
description = "PE 动态加载多个系统 DLL + 非系统路径 = DLL 劫持迹象"
description = "动态加载 API + 临时目录 DLL 落地 = DLL 侧加载/劫持"
strings:
$loadlib = "LoadLibraryA" ascii
$loadlibw = "LoadLibraryW" ascii
$getproc = "GetProcAddress" ascii
// 可疑加载路径（非 System32）
$path1 = /\\Users\\[^\\]+\\AppData\\Local\\Temp/ ascii
$path2 = /\\AppData\\Local\\Temp/ ascii
$path3 = /\\ProgramData\\/ ascii
$path4 = /\\Public\\Documents\\/ ascii
$copy1 = "CopyFileA" ascii
$copy2 = "CopyFileW" ascii
$move = "MoveFileEx" ascii
$temp1 = /\\AppData\\Local\\Temp\\[a-z0-9_. -]{3,40}\.dll/ ascii nocase
$temp2 = /%TEMP%\\[a-z0-9_. -]{3,40}\.dll/ ascii nocase
$temp3 = /\\Windows\\Temp\\[a-z0-9_. -]{3,40}\.dll/ ascii nocase
$sysdir = "SetDllDirectory" ascii
$searchorder = "LoadLibraryEx" ascii
condition:
// LoadLibrary + 可疑路径 + GetProcAddress = 完整劫持链
(any of ($loadlib*)) and any of ($path*) and $getproc
or
// LoadLibrary + 多个可疑路径
(any of ($loadlib*)) and 2 of ($path*)
uint16(0) == 0x5A4D
and any of ($loadlib*, $searchorder)
and any of ($temp*)
and (any of ($getproc, $copy1, $copy2, $move, $sysdir))
}
// =============================================================================
// C1-6 LOLBin（Living Off The Land Binary）调用特征
// 已知合法 Windows 二进制被恶意利用来执行命令
// 命令行串 + 进程创建 API 必须同表紧邻（正常程序会把两者写进同一个导入/资源块）
// =============================================================================
rule C1_PE_LOLBin_Usage {
@@ -228,31 +280,57 @@ rule C1_PE_LOLBin_Usage {
category = "C1"
false_positive_rate = "low"
reference = "https://lolbas-project.github.io/"
description = "PE 文件中出现 LOLBin 调用：certutil / mshta / rundll32 / regsvr32 / bitsadmin / wmic / msiexec"
description = "PE 中出现 LOLBin 调用命令行 + 进程创建 API（同表）"
strings:
$certutil = /certutil(\.exe)?\s+(-urlcache|-decode|-encode|-hashfile)/ ascii
$mshta = /mshta(\.exe)?\s+(https?:|javascript:|vbscript:)/ ascii
$rundll32 = /rundll32(\.exe)?\s+[A-Za-z0-9_.]+,/ ascii
$regsvr32 = /regsvr32(\.exe)?\s+\/s\s+\/u/ ascii
$bitsadmin = /bitsadmin(\.exe)?\s+(\/transfer|\/create)/ ascii
$wmic = /wmic(\.exe)?\s+(process\s+call\s+create|product\s+call)/ ascii
$msiexec = /msiexec(\.exe)?\s+\/[ia]\s+https?:/ ascii
$installutil = /installutil(\.exe)?\s+\/u\s+\/logfile=/ ascii
$syncapp = /syncapp(\.exe)?\s+\/compattrack/ ascii
$psexec = /psexec(\.exe)?\s+(-accepteula|-i\s+\d+|-w\s+https?:)/ ascii
// 命令执行 API（用于组合条件）
$lolbin1 = /certutil(\.exe)?\s+(-urlcache|-decode)\s+-split/ ascii nocase
$lolbin2 = /mshta(\.exe)?\s+(https?:|javascript:|vbscript:)/ ascii nocase
$lolbin3 = /regsvr32(\.exe)?\s+\/s\s+\/u:http/ ascii nocase
$lolbin4 = /bitsadmin(\.exe)?\s+\/transfer\s+\/source:/ ascii nocase
$lolbin5 = /wmic(\.exe)?\s+process\s+call\s+create/ ascii nocase
$lolbin6 = /msiexec(\.exe)?\s+\/[ia]\s+https?:/ ascii nocase
$lolbin7 = /installutil(\.exe)?\s+\/u\s+\/logfile=https?:/ ascii nocase
$lolbin8 = /psexec(\.exe)?\s+(-accepteula\s+)?-w\s+https?:/ ascii nocase
$exec1 = "CreateProcess" ascii
$exec2 = "ShellExecute" ascii
$exec3 = "WinExec" ascii
condition:
// 至少 1 个 LOLBin 调用 + 命令执行 API
any of ($certutil*, $mshta*, $rundll32*, $regsvr32*, $bitsadmin*, $wmic*, $msiexec*, $installutil*, $syncapp*, $psexec*)
uint16(0) == 0x5A4D
and any of ($lolbin*)
and any of ($exec*)
}
// =============================================================================
// C8-1 勒索加密 API 组合（CryptEncrypt + BCrypt* + 文件遍历 + 删除卷影）
// C1-7 PE 高熵 + 网络 API（疑似加壳下载器）
// 需要「多个网络 API + 明确壳节名」同时成立
// =============================================================================
rule C1_PE_EntropyHighNetwork {
meta:
risk_level = "medium"
category = "C1"
false_positive_rate = "low"
reference = "binary.py HighEntropySection 联动"
description = "PE 加壳节名 + 多个下载 API = 加壳下载器"
strings:
$net1 = "InternetOpenUrl" ascii
$net2 = "URLDownloadToFile" ascii
$net3 = "WinHttpOpenRequest" ascii
$net4 = "WSAConnect" ascii
condition:
uint16(0) == 0x5A4D
and 2 of ($net*)
and (
for any i in (0..pe.number_of_sections - 1): (
pe.sections[i].name matches /UPX0/ or pe.sections[i].name == "UPX1"
or pe.sections[i].name matches /\.vmp[0-9]/ or pe.sections[i].name matches /Themida|\.themida/
)
)
}
// =============================================================================
// C8-1 勒索加密链（加密 API + 卷影删除/勒索信，勒索样本常以文本形态投递，不加 PE 头）
// =============================================================================
rule C8_Ransomware_Encryption {
@@ -261,9 +339,9 @@ rule C8_Ransomware_Encryption {
category = "C8"
false_positive_rate = "low"
reference = "MITRE ATT&CK T1486 Data Encrypted for Impact"
description = "勒索加密链：CryptEncrypt/BCryptEncrypt + 大量文件遍历 + 卷影删除 = 勒索"
description = "勒索加密链：加密 API + 卷影删除命令或勒索信文件名"
strings:
// 加密 API（至少出现两个）
// 加密 API
$enc1 = "CryptEncrypt" ascii
$enc2 = "CryptDeriveKey" ascii
$enc3 = "BCryptEncrypt" ascii
@@ -276,25 +354,23 @@ rule C8_Ransomware_Encryption {
$enum3 = "FindNextFileA" ascii
$enum4 = "FindNextFileW" ascii
// 卷影删除（勒索前置）
$vss1 = "vssadmin" ascii
$vss2 = "delete shadows" ascii
// 卷影删除（完整命令，不认裸 "wmic"）
$vss1 = "vssadmin" ascii nocase
$vss2 = "delete shadows" ascii nocase
$vss3 = "DeleteShadowCopies" ascii
$vss4 = "wmic" ascii
$vss4 = "shadow copies" ascii nocase
// 勒索信文件名变体（出现在二进制里）
$ransomnote1 = /(HOW_TO_RECOVER|RESTORE_FILES|DECRYPT_INSTRUCTIONS|README|HELP_DECRYPT|_readme|_restore)[\w.-]*\.(txt|html|png|jpg|bmp|url)/ nocase
$ransomnote2 = /\.(locky|zepto|cryptolocker|tor|crpt|encrypted|virus|wallet|pay2)/ nocase
$ransomnote3 = /bitcoin|bitcash|monero|ltc|BTC\b/ ascii
// 勒索信文件名 / 加密扩展名
$note1 = /(HOW_TO_RECOVER|RESTORE_FILES|DECRYPT_INSTRUCTIONS|HELP_DECRYPT)[\w.-]*\.(txt|html|png|jpg|bmp|url)/ nocase
$note2 = /\.(locky|zepto|cryptolocker|crpt|encrypted|pay2)\b/ nocase
condition:
// 加密 API + 文件遍历 = 加密工具（必须至少 2 个加密 API）
(2 of ($enc*)) and any of ($enum*)
or
// 加密 API + 卷影删除 = 完整勒索
(any of ($enc*)) and any of ($vss*)
or
// 加密 API + 勒索信 + 加密文件扩展名 = 明确勒索
(any of ($enc*)) and (any of ($ransomnote1, $ransomnote2)) and $ransomnote3
any of ($enc*)
and
(
($vss1 and ($vss2 or $vss3 or $vss4))
or (2 of ($enum*) and any of ($note*))
or (2 of ($enc*) and any of ($enum*) and $vss1)
)
}
@@ -310,53 +386,51 @@ rule C8_Mining_Monero {
reference = "MITRE ATT&CK T1496 Resource Hijacking"
description = "挖矿程序特征：xmrig 命令行参数 / stratum+tcp / 矿池域名"
strings:
// xmrig 命令行特征
$xmrig1 = "xmrig" ascii nocase
$xmrig2 = /--donate-level\s+\d+/ ascii
$xmrig3 = /-o\s+stratum\+tcp/ ascii
$xmrig4 = /--cpu-priority\s+\d/ ascii
$xmrig5 = /--max-threads-hint/ ascii
// 矿池域名（Monero）
$pool1 = "pool.xmrig.com" ascii nocase
$pool2 = "pool.minexmr.com" ascii nocase
$pool3 = "pool.supportxmr.com" ascii nocase
$pool4 = "mine.moneropool.com" ascii nocase
$pool5 = "stratum+tcp://" ascii
// CPU 高占用循环特征
$loop = /(while|for)\s*\(\s*\d+\s*[<>=]/ ascii
$thread = "CreateThread" ascii
condition:
// 至少 2 个 xmrig 特征
(any of ($xmrig1, $xmrig2, $xmrig3, $xmrig4, $xmrig5)) and 2 of ($*)
or
// stratum+tcp 矿池协议 + 多个线程创建
$pool5 and ($thread or 2 of ($xmrig*))
any of ($pool1, $pool2, $pool3, $pool4)
or ($pool5 and (any of ($xmrig*) or $thread))
or (2 of ($xmrig*) and any of ($pool*))
}
// =============================================================================
// C9 壳特征（UPX / Themida / VMProtect / Enigma）
// 壳识别后建议升级到 L3 沙箱深检，不单独阻断
// C9 壳特征（UPX / Themida / VMProtect）
// 加壳本身不是恶意证据（大量开源工具用 UPX），只作沙箱深检触发条件
// =============================================================================
rule C9_Packer_UPX {
meta:
risk_level = "medium"
risk_level = "low"
category = "C9"
false_positive_rate = "low"
reference = "UPX Packer"
description = "UPX 加壳 PE：节名 UPX0 / UPX1 + UPX 签名"
description = "UPX 加壳 PE：节名 UPX0/UPX1 + UPX 签名"
strings:
$upx0 = "UPX0" ascii
$upx1 = "UPX1" ascii
$upx2 = "UPX!" ascii
$upx3 = /UPX\s+\d+\.\d+/ ascii // "UPX 3.96" 这类版本字符串
$upx4 = /UPX\b/ ascii
condition:
// 节名（两个）+ 签名
($upx0 and $upx1) or ($upx2 and any of ($upx3, $upx4))
uint16(0) == 0x5A4D
and (
(
for any i in (0..pe.number_of_sections - 1): (
pe.sections[i].name matches /UPX0/
)
and for any j in (0..pe.number_of_sections - 1): (
pe.sections[j].name matches /UPX1/
)
)
or ($upx2 and pe.number_of_sections <= 4)
)
}
rule C9_Packer_Themida_VMP {
@@ -365,39 +439,18 @@ rule C9_Packer_Themida_VMP {
category = "C9"
false_positive_rate = "low"
reference = "Themida / VMProtect"
description = "商业壳特征：Themida / VMProtect 产品标识字符串"
description = "商业壳特征：Themida / VMProtect 节名 + 产品标识字符串"
strings:
$themida1 = "Themida" ascii wide
$themida2 = "WinLicense" ascii wide
$themida3 = "Oreans" ascii wide
$vmp1 = "VMProtect" ascii wide
$vmp3 = "VMProtect SDK" ascii wide
condition:
any of ($themida*) or any of ($vmp*)
}
// =============================================================================
// C1-7 PE 高熵 + 大量网络 API（疑似加壳下载器）
// binary.py 的 HighEntropySection 已单独扫描，但 YARA 看"熵 + 网络"组合
// =============================================================================
rule C1_PE_EntropyHighNetwork {
meta:
risk_level = "medium"
category = "C1"
false_positive_rate = "medium"
reference = "binary.py HighEntropySection 联动"
description = "PE 同时出现：多个网络 API + 加壳特征（熵高） + 无签名"
strings:
$net1 = "InternetOpenUrl" ascii
$net2 = "WinHttpOpen" ascii
$net3 = "URLDownloadToFile" ascii
$net4 = "WSAConnect" ascii
// 壳特征
$upx = "UPX0" ascii
$themida = "Themida" ascii
condition:
// 网络 API + 壳特征 = 加壳下载器
any of ($net*) and ($upx or $themida)
uint16(0) == 0x5A4D
and (
for any i in (0..pe.number_of_sections - 1): (
pe.sections[i].name matches /\.themida|\.vmp[0-9]/
)
or (any of ($themida*) and any of ($vmp1))
)
}

45
rules/ransom.yar
View File

@@ -126,26 +126,41 @@ rule C8_Ransomware_Note_Filename {
meta:
risk_level = "medium"
category = "C8"
false_positive_rate = "medium"
false_positive_rate = "low"
reference = "勒索信文件名通用模式"
description = "勒索信典型文件名变体（匹配后触发需要配合加密 API 才升级高危）"
description = "勒索信文件名 + （加密 API + 赎金语言）或（赎金语言 + 钱包地址）"
strings:
// 只保留"文件名形态"的勒索信特征：家族专有名 + 扩展名。
// 不再用裸 README.txt / _readme.txt：任何安装包都带这两个字面量，
// 在二进制内容上做全文匹配时必然命中（Go 官方 MSI 即被这样判成恶意）。
$n1 = /HOW_TO_RECOVER[\w.-]*\.(txt|html|png|bmp|jpg|url|vbs|js)/ nocase
$n2 = /RESTORE_FILES[\w.-]*\.(txt|html|png|bmp|jpg|url|vbs|js)/ nocase
$n3 = /DECRYPT_INSTRUCTIONS[\w.-]*\.(txt|html|png|bmp|jpg|url)/ nocase
$n4 = /README[_\s-]*[\d]*[_\s-]*[\w]*\.(txt|html|png|bmp|jpg|url)/ nocase
$n4 = /README[._-]*(FOR[._-]*DECRYPT|TO[._-]*RESTORE)[\w.-]*\.(txt|html|png|bmp|jpg|url)/ nocase
$n5 = /HELP_DECRYPT[\w.-]*\.(txt|html|png|bmp|jpg|url)/ nocase
$n6 = /_readme[\w.-]*\.(txt|html|png|bmp|jpg|url)/ nocase
$n7 = /_restore[\w.-]*\.(txt|html|png|bmp|jpg|url)/ nocase
$bitcoin = /bitcoin address|BTC\b|monero address|XMR\b|send money|ransom|payment/ nocase
$wallet = /1[A-Za-z0-9]{25,34}|bc1[A-Za-z0-9]{11,71}|4[0-9A-Za-z]{32}/ nocase
$n6 = /\b_(readme|restore)[\w.-]*\.(txt|html|png|bmp|jpg|url)/ nocase
$n7 = /(how_to_decrypt|restore_my_files|decrypt_your_files)[\w.-]*\.(txt|html)/ nocase
// 赎金语言：必须是完整词组。裸 "BTC"/"XMR"/"payment"/"ransom" 在压缩流里
// 会以随机字节出现，"ransom" 还会被 "Ransomware" 子串命中。
$payment = /(bitcoin|monero|xmr|btc)\s+(address|wallet)|send\s+(the\s+)?money|pay\s+(the\s+)?(ransom|fee)|\bransom\b\s+(note|payment|demand)|your\s+files\s+(are\s+)?encrypted|decrypt\s+your\s+files/ nocase
// 钱包地址：锚定到整个 token，并用真实地址字符集/长度。
// 原写法 1[A-Za-z0-9]{25,34} 无边界，单个 56MB 安装包命中 7.6 万次。
$btc_addr = /\b[13][a-km-zA-HJ-NP-Z1-9]{25,34}\b/
$bech32 = /\bbc1q[a-z0-9]{38}\b|\bbc1q[a-z0-9]{58}\b/
$xmr_addr = /\b[48][0-9A-Za-z]{94}\b/
$encapi = /CryptEncrypt|BCryptEncrypt|CryptDeriveKey/ ascii
condition:
// 勒索信文件名 + 加密 API = 明确勒索
any of ($n*) and $encapi
or
// 勒索信文件名 + 比特币/XMR 地址 = 大概率勒索
any of ($n*) and any of ($bitcoin, $wallet)
any of ($n*)
and (
// 投递器：真加密 API + 赎金语言
($encapi and $payment)
or
// 纯文本勒索信：赎金语言 + 具体钱包地址
($payment and any of ($btc_addr, $bech32, $xmr_addr))
)
}
@@ -199,11 +214,13 @@ rule C8_Ransomware_VolumeShadow {
$vss2 = /vssadmin\s+delete\s+shadows\s+\/all\b/ ascii
$wmic1 = /wmic\s+shadowcopy\s+delete/ ascii
$wmic2 = /wmic\s+shadowcopy\s+where\s+\d+/ ascii
$vss3 = /ShadowCopy|VolumeShadowCopy|vss\b/i ascii // "i" flag = nocase in YARA
$vss4 = /vssadmin[^\n]{0,48}delete[^\n]{0,48}(shadows|shadow\s+copies)/ ascii
$enc = /CryptEncrypt|BCryptEncrypt|CryptDeriveKey/ ascii
condition:
// 卷影删除 + 加密 API = 完整勒索前置
(any of ($vss1, $vss2, $wmic*, $vss3)) and any of ($enc*)
// 不用裸 "vss"/"ShadowCopy" 子串：任何备份/卷影库的符号表都有它们，
// 和 CryptEncrypt 同框就报勒索，是典型误报来源。
(any of ($vss1, $vss2, $wmic*, $vss4)) and any of ($enc*)
or
// 连续多次 vssadmin delete = 正在清卷影
any of ($vss1, $vss2) and any of ($wmic*)

17
rules/webshell.yar
View File

@@ -57,12 +57,19 @@ rule C3_PHP_Webshell_Obfuscated {
$rot13 = "str_rot13" ascii wide
$assert = "assert(" ascii wide
$createfn = "create_function" ascii wide
// PHP 上下文证据：没有 <?php / 超全局变量，就不要凭函数名定罪（vim、git 等
// 二进制里同样存在 base64_decode / eval( 字样）
$php1 = "<?php" ascii
$php2 = /\$_(GET|POST|REQUEST|COOKIE|FILES|SESSION)\b/ ascii
condition:
// base64_decode + (eval|assert|create_function) = 解码后动态执行
$b64 and ($eval or $assert or $createfn)
or
// 解码链：base64 + gzinflate / str_rot13 + 执行
$b64 and ($gzinflate or $rot13) and ($eval or $assert)
any of ($php*)
and (
// base64_decode + (eval|assert|create_function) = 解码后动态执行
($b64 and ($eval or $assert or $createfn))
or
// 解码链：base64 + gzinflate / str_rot13 + 执行
($b64 and ($gzinflate or $rot13) and ($eval or $assert))
)
}
// PHP Webshell —— 变量变形（$$a = $_POST['cmd']；$$a($_POST['arg'])）