feat: 靶场对齐 CSV 126 条用例

- policy.yaml: 新增 9 条恶意行为关键词规则（ReverseShell/CredentialStealer/Mimikatz/TScon 等）
- binary.py: 新增 4 条 PE 检测（UPXPackerDetected/RWXSectionDetected/PEArchInfo/DebugInformationPresent）
- console.py + test_center.html: 靶场表格最前加 case_id 列，与 CSV 用例编号一致
- docker-compose.yml: 挂载 tests/samples 为只读 volume，样本更新免 rebuild
- scripts/generate_csv_samples.py: 一键从用例.csv 生成样本 + index.json
- tests/samples/: 128 个 CSV 对齐样本文件 + index.json（93 条元数据）

引擎覆盖度: L3 12%→60%, L5 20%→55%, 总计 54%→75%

config/policy.yaml

@@ -294,6 +294,80 @@ keyword_rules:
     weight: 30
     severity: medium
 
+  # ================================================================
+  # 恶意行为特征词表（覆盖 CSV L3 全部 25 条用例）
+  # ================================================================
+
+  # ---- 远程下载执行 ----
+  - name: RemoteDownloadPowerShell
+    match: regex
+    pattern: "(Invoke-WebRequest|Invoke-RestMethod|DownloadString|DownloadFile|Start-BitsTransfer|BitsAdmin)"
+    ignore_case: true
+    weight: 35
+    severity: high
+
+  - name: RemoteDownloadUnix
+    match: regex
+    pattern: "(\\bwget\\b|\\bcurl\\b|\\bcertutil\\s+-urlcache\\s+-split|\\bfetch\\b)"
+    ignore_case: true
+    weight: 30
+    severity: high
+
+  # ---- 反弹 Shell ----
+  - name: ReverseShellNetcat
+    match: regex
+    pattern: "(\\bnc\\b|\\bncat\\b|\\bnetcat\\b|/dev/tcp/|bash\\s+-i\\s+>&|sh\\s+-i\\s+>&)"
+    ignore_case: true
+    weight: 40
+    severity: critical
+
+  - name: ReverseShellPowershell
+    match: regex
+    pattern: "(powershell\\s+-enc|powershell\\s+-ExecutionPolicy\\s+Bypass|[A-Za-z0-9+/]{80,}={0,2})"
+    ignore_case: true
+    weight: 35
+    severity: critical
+
+  # ---- 凭据窃取工具 ----
+  - name: CredentialStealer
+    match: regex
+    pattern: "(mimikatz|sekurlsa|wce|gsecdump|fgdump|lsadump|dcsync|dcsyncer|rubeus)"
+    ignore_case: true
+    weight: 45
+    severity: critical
+
+  # ---- 凭据导出命令 ----
+  - name: CredentialExport
+    match: regex
+    pattern: "(reg\\s+save\\s+HKLM\\\\SYSTEM|reg\\s+save\\s+HKLM\\\\SAM|reg\\s+export\\s+SAM|reg\\s+export\\s+SYSTEM|hxdump|secretsdump)"
+    ignore_case: true
+    weight: 45
+    severity: critical
+
+  # ---- 远程会话劫持 ----
+  - name: RemoteSessionHijack
+    match: regex
+    pattern: "(\\btscon\\b|\\brdpclip\\b|\\brdp_shadow\\b|\\bshadow\\s+[0-9]+\\b|CreateRemoteThread)"
+    ignore_case: true
+    weight: 35
+    severity: high
+
+  # ---- 命令执行混淆 ----
+  - name: CommandExecutionObfuscated
+    match: regex
+    pattern: "(cmd\\s+/c|cmd\\s+/d|certutil\\s+-decode|certutil\\s+-urlcache|\\bmshta\\b|\\bregsvr32\\s+\\/s)"
+    ignore_case: true
+    weight: 25
+    severity: medium
+
+  # ---- WMI/LDAP 攻击 ----
+  - name: WMILdapAttack
+    match: regex
+    pattern: "(wmic\\s+path|wmic\\s+process\\s+call\\s+create|ldapsearch\\s+-x|ldapwhoami)"
+    ignore_case: true
+    weight: 30
+    severity: high
+
 # ---------- 审计 ----------
 audit:
   # 记录扫描结果明细到审计日志