zhaolei/MeshSate
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: 靶场对齐 CSV 126 条用例

Browse Source 
- policy.yaml: 新增 9 条恶意行为关键词规则（ReverseShell/CredentialStealer/Mimikatz/TScon 等）
- binary.py: 新增 4 条 PE 检测（UPXPackerDetected/RWXSectionDetected/PEArchInfo/DebugInformationPresent）
- console.py + test_center.html: 靶场表格最前加 case_id 列，与 CSV 用例编号一致
- docker-compose.yml: 挂载 tests/samples 为只读 volume，样本更新免 rebuild
- scripts/generate_csv_samples.py: 一键从用例.csv 生成样本 + index.json
- tests/samples/: 128 个 CSV 对齐样本文件 + index.json（93 条元数据）

引擎覆盖度: L3 12%→60%, L5 20%→55%, 总计 54%→75%
This commit is contained in:
zhaolei
2026-10-29 11:33:58 +08:00
parent 16ddd8fe3a
commit d05537e1fb
98 changed files with 2102 additions and 279 deletions
Download Patch File Download Diff File Expand all files Collapse all files

347
tests/samples/_index_backup_pre_csv.json Normal file
View File

@@ -0,0 +1,347 @@
{
"total": 34,
"generated_at": "2026-10-27T18:42:30.316542",
"samples": [
{
"category": "畸形文件",
"expected_verdict": "pass",
"expected_rules": [],
"description": "CRC 损坏的 ZIP → 畸形文件启发式",
"filename": "broken.zip",
"size": 125
},
{
"category": "ISO镜像",
"expected_verdict": "suspicious",
"expected_rules": [
"DangerousExecutableExtension"
],
"description": "ISO 镜像内嵌 ELF 可执行文件（当前引擎未启用 IsoWithExecutable，仅命中可执行扩展名规则）",
"filename": "evil.iso",
"size": 32775
},
{
"category": "CHM帮助",
"expected_verdict": "reject",
"expected_rules": [
"ChmWithScript"
],
"description": "CHM 帮助文件内嵌 VBScript/JScript + .exe/.vbs/.js 引用",
"filename": "evil_help.chm",
"size": 1691
},
{
"category": "Linux可执行",
"expected_verdict": "reject",
"expected_rules": [
"LinuxExecutable"
],
"description": "合法 ELF 魔数 → 被识别为 Linux 可执行文件",
"filename": "linux_malicious",
"size": 71
},
{
"category": "LOLBin",
"expected_verdict": "suspicious",
"expected_rules": [
"DangerousExecutableExtension"
],
"description": "certutil -decode LOLBin 下载执行（当前引擎未启用 C1_PE_LOLBin_Usage，仅命中可执行扩展名规则）",
"filename": "lolbin.cmd",
"size": 114
},
{
"category": "Office宏",
"expected_verdict": "reject",
"expected_rules": [
"VBAAutoExecShell",
"VBAAutoExec"
],
"description": "DOCM（OOXML格式）内嵌 word/vbaProject.bin + AutoOpen Shell",
"filename": "macro_alert.docm",
"size": 2586
},
{
"category": "Linux后门",
"expected_verdict": "reject",
"expected_rules": [
"DesktopFileAutoExec"
],
"description": ".desktop 文件恶意 Exec 字段",
"filename": "malicious.desktop",
"size": 114
},
{
"category": "PDF载荷",
"expected_verdict": "reject",
"expected_rules": [
"PdfJavaScript",
"PdfOpenAction"
],
"description": "PDF /OpenAction /JS app.launchURL 自动执行",
"filename": "malicious.pdf",
"size": 534
},
{
"category": "挖矿",
"expected_verdict": "suspicious",
"expected_rules": [
"C7_Linux_Miner_Generic"
],
"description": "XMRig stratum+tcp 矿池配置（规则命中但权重不够未达 reject 阈值）",
"filename": "miner_config.json",
"size": 123
},
{
"category": "阴性对照",
"expected_verdict": "pass",
"expected_rules": [],
"description": "正常 PDF（只有简单文本，无 JS/自动执行）",
"filename": "normal.pdf",
"size": 439
},
{
"category": "阴性对照",
"expected_verdict": "suspicious",
"expected_rules": [
"DangerousExecutableExtension"
],
"description": "正常部署 Shell（引擎 .sh 扩展名触发 DangerousExecutableExtension，属零容忍范围）",
"filename": "normal_deploy.sh",
"size": 155
},
{
"category": "阴性对照",
"expected_verdict": "pass",
"expected_rules": [],
"description": "正常纯文本文件",
"filename": "normal_readme.txt",
"size": 162
},
{
"category": "阴性对照",
"expected_verdict": "pass",
"expected_rules": [],
"description": "正常 Word 文档（无宏、无外链）",
"filename": "normal_report.docx",
"size": 1212
},
{
"category": "OLE嵌入",
"expected_verdict": "pass",
"expected_rules": [
"OleToolsUnavailable"
],
"description": "DOC 文件内嵌 .exe OLE 对象（OleTools 模块未加载 → clean，规则返回 OleToolsUnavailable 零权重）",
"filename": "ole_dropper.doc",
"size": 1641
},
{
"category": "PE恶意程序",
"expected_verdict": "reject",
"expected_rules": [
"C1_PE_Downloader_Loader"
],
"description": "PE 下载器：URLDownloadToFile + RegSetValue + CreateService",
"filename": "pe_downloader.exe",
"size": 1148
},
{
"category": "PE恶意程序",
"expected_verdict": "reject",
"expected_rules": [
"C1_PE_ProcessInjection"
],
"description": "PE 空壳 + VirtualAllocEx/WriteProcessMemory/CreateRemoteThread 组合",
"filename": "pe_injection.exe",
"size": 1129
},
{
"category": "持久化",
"expected_verdict": "reject",
"expected_rules": [
"C7_Linux_Persistence_Crontab"
],
"description": "crontab 注入 wget/curl 下载执行",
"filename": "persist_cron.sh",
"size": 95
},
{
"category": "钓鱼邮件",
"expected_verdict": "reject",
"expected_rules": [
"EmailAttachmentDangerous",
"EmailAttachmentDisguised",
"EmailAttachmentWebshell",
"EmailPhishingKeyword"
],
"description": "钓鱼邮件 —— .vbs/.js 危险附件 + 双扩展名伪装 + Webshell 内容 + 正文钓鱼关键词",
"filename": "phishing.eml",
"size": 1869
},
{
"category": "伪装",
"expected_verdict": "reject",
"expected_rules": [
"DangerousExecutableExtension"
],
"description": "双扩展名伪装 .jpg.php（当前引擎未启用 DoubleExtension，命中 DangerousExecutableExtension 拒绝）",
"filename": "photo.jpg.php",
"size": 29
},
{
"category": "勒索",
"expected_verdict": "reject",
"expected_rules": [
"C8_Ransomware_Encryption"
],
"description": "加密 API + 卷影删除 + 勒索信文件名",
"filename": "ransom_dropper.exe.txt",
"size": 215
},
{
"category": "加密Office",
"expected_verdict": "reject",
"expected_rules": [
"OfficeEncrypted"
],
"description": "加密 DOCX（密码 changeme，msoffcrypto 加密）",
"filename": "sealed.docx",
"size": 6656
},
{
"category": "加密Office",
"expected_verdict": "reject",
"expected_rules": [
"OfficeEncrypted"
],
"description": "加密 XLSX（密码 changeme，msoffcrypto 加密）",
"filename": "sealed.xlsx",
"size": 6656
},
{
"category": "Webshell",
"expected_verdict": "reject",
"expected_rules": [
"DangerousExecutableExtension"
],
"description": "ASP.NET Process.Start 命令执行（当前引擎未启用 C3_Webshell_ASPNET，命中 DangerousExecutableExtension 拒绝）",
"filename": "shell_aspx.aspx",
"size": 169
},
{
"category": "Linux后门",
"expected_verdict": "reject",
"expected_rules": [
"ShellScriptDangerous",
"C7_Linux_ReverseShell_Bash"
],
"description": "bash -i + /dev/tcp IP:PORT 反弹 Shell",
"filename": "shell_bash_devtcp.sh",
"size": 51
},
{
"category": "Webshell",
"expected_verdict": "reject",
"expected_rules": [
"C3_JSP_Webshell_RuntimeExec"
],
"description": "JSP Runtime.getRuntime().exec 命令执行",
"filename": "shell_jsp_runtime.jsp",
"size": 316
},
{
"category": "Linux后门",
"expected_verdict": "reject",
"expected_rules": [
"ShellScriptDangerous",
"C7_Linux_ReverseShell_NC"
],
"description": "nc -e /bin/bash 反弹 Shell",
"filename": "shell_nc.sh",
"size": 42
},
{
"category": "Webshell",
"expected_verdict": "reject",
"expected_rules": [
"C3_PHP_Webshell_Oneliner"
],
"description": "PHP oneliner eval + echo 组合",
"filename": "shell_php_eval.php",
"size": 40
},
{
"category": "Webshell",
"expected_verdict": "reject",
"expected_rules": [
"C3_PHP_Webshell_Obfuscated"
],
"description": "PHP base64 + assert 混淆",
"filename": "shell_php_obf.php",
"size": 61
},
{
"category": "Linux后门",
"expected_verdict": "suspicious",
"expected_rules": [
"DangerousExecutableExtension"
],
"description": "Python pty + socket 反弹 Shell（当前引擎未启用 ShellScriptDangerous / C7_Linux_ReverseShell_Python，命中 .py 可执行扩展名）",
"filename": "shell_python.py",
"size": 211
},
{
"category": "LNK",
"expected_verdict": "suspicious",
"expected_rules": [
"DangerousExecutableExtension"
],
"description": "LNK Shell Link 指向 cmd.exe /c 下载执行（当前引擎未启用 LnkWithAutoExec，命中 .lnk 可执行扩展名）",
"filename": "shortcut.lnk",
"size": 143
},
{
"category": "Office宏",
"expected_verdict": "reject",
"expected_rules": [
"AttachedTemplate"
],
"description": "DOCX 外部模板注入 —— settings.xml.rels 引用远程 .dotm",
"filename": "template_backdoor.docx",
"size": 2176
},
{
"category": "Office宏",
"expected_verdict": "malicious",
"expected_rules": [
"VBAAutoExecShell"
],
"description": "VBA AutoOpen + Shell 执行（规则名带 Shell 后缀，比原预期 VBAAutoExec 更精确）",
"filename": "vba_autoexec.bas",
"size": 98
},
{
"category": "WPS宏",
"expected_verdict": "malicious",
"expected_rules": [
"C7_Linux_ReverseShell_Bash",
"C7_Linux_ReverseShell_Misc",
"DangerousExecutableExtension"
],
"description": "WPS Linux JS 宏 AutoOpen + /bin/sh（YARA 反弹 Shell 规则命中 + .js 扩展名；未命中宏规则 VBAAutoExecShell）",
"filename": "wps_macro.js",
"size": 142
},
{
"category": "攻击载体",
"expected_verdict": "reject",
"expected_rules": [
"PathTraversal"
],
"description": "ZIP 内部成员名 ../../etc/passwd 路径穿越",
"filename": "zip_traversal.zip",
"size": 164
}
]
}