// =============================================================================
// MeshSafe L2B YARA 规则集 —— Linux / 跨平台后门专项（C7）
// =============================================================================
//
// 设计原则：
//   - 光闸摆渡场景，所有规则 2-3 特征组合命中，避免单一关键词误伤合法 Shell/Python 代码
//   - 覆盖范围：反弹 Shell、持久化（crontab/authorized_keys/systemd/LD_PRELOAD）、
//               Rootkit 特征、挖矿通用特征
//   - 命中后作为 finding 交给 PolicyEngine 权重累加
//
// 维护：
//   - 新后门工具/家族出现时优先补充 "工具名 + 持久化手段" 组合
// =============================================================================


// =============================================================================
// C7-1 反弹 Shell（多种语言实现）
// =============================================================================

rule C7_Linux_ReverseShell_Bash {
    meta:
        risk_level = "critical"
        category = "C7"
        false_positive_rate = "low"
        reference = "MITRE ATT&CK T1059.004 Bash"
        description = "Bash 反弹 Shell 组合：/dev/tcp + bash -i 或 sh -c"
    strings:
        $devtcp = /\/dev\/tcp\/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{2,5}/ ascii
        $bash_i = "bash -i" ascii
        $sh_c = /sh\s+-c\s+['"]bash -i/ ascii
        $exec3 = "exec 3<>/dev/tcp/" ascii
        $exec4 = "exec 4>&0 0>&1 1>&4" ascii
    condition:
        // /dev/tcp/IP:PORT + bash -i 这两个必须同时出现
        $devtcp and ($bash_i or $sh_c or $exec3)
        or
        // exec fd 重定向链
        $exec3 and $exec4
}

rule C7_Linux_ReverseShell_NC {
    meta:
        risk_level = "critical"
        category = "C7"
        false_positive_rate = "medium"
        reference = "MITRE ATT&CK T1059.004 Netcat"
        description = "nc/ncat 反弹 Shell：-e/-c 参数指定 bash 或 sh"
    strings:
        $nc1 = /nc\s+[\w.-]+\s+\d{2,5}\s+-e\s+(\/bin\/(ba)?sh|bash|sh)/ ascii
        $nc2 = /ncat\s+[\w.-]+\s+\d{2,5}\s+-e\s+(\/bin\/(ba)?sh|bash|sh)/ ascii
        $nc3 = /nc\s+[\w.-]+\s+\d{2,5}\s+-c\s+(\/bin\/(ba)?sh|bash|sh)/ ascii
        $nc4 = /netcat\s+[\w.-]+\s+\d{2,5}\s+-e/ ascii
        $mkfifo = /mkfifo\s+\/tmp\/\w+;\s*(nc|ncat)\s+/ ascii
    condition:
        any of ($*)
}

rule C7_Linux_ReverseShell_Python {
    meta:
        risk_level = "high"
        category = "C7"
        false_positive_rate = "medium"
        reference = "MITRE ATT&CK T1059.006 Python"
        description = "Python 反弹 Shell：socket + exec/bin/sh + pty"
    strings:
        $socket1 = "import socket" ascii
        $socket2 = "socket.socket" ascii
        $pty = "import pty" ascii
        $sub = "import subprocess" ascii
        $sh = /\/bin\/(ba)?sh/ ascii
        $osdup2 = "os.dup2" ascii
        $execv = "os.execv" ascii
    condition:
        // socket + pty + /bin/bash = 完整 Python pty 反弹
        ($socket1 or $socket2) and $pty and $sh
        or
        // socket + subprocess + /bin/sh + dup2 = 经典模式
        ($socket1 or $socket2) and $sub and $sh and $osdup2
        or
        // socket + os.execv + /bin/bash
        ($socket1 or $socket2) and $execv and $sh
}

rule C7_Linux_ReverseShell_Perl {
    meta:
        risk_level = "high"
        category = "C7"
        false_positive_rate = "medium"
        reference = "MITRE ATT&CK T1059.005 Perl"
        description = "Perl 反弹 Shell：IO::Socket + exec + /bin/sh"
    strings:
        $iosocket = "IO::Socket::INET" ascii nocase
        $socketvar = /\$s\s*=\s*IO::Socket/ ascii
        $exec = /exec\s+['"]\/bin\/(ba)?sh['"]/ ascii
        $open = /open\s*\(.*<&\$\{?s\}?/ ascii
        $eval = /eval\s+reverse\s+['"]/ ascii
    condition:
        ($iosocket or $socketvar) and ($exec or $open or $eval)
}

rule C7_Linux_ReverseShell_Socat {
    meta:
        risk_level = "high"
        category = "C7"
        false_positive_rate = "low"
        reference = "MITRE ATT&CK T1059.004 Socat"
        description = "socat 反弹 Shell：TCP-LISTEN + EXEC:/bin/bash"
    strings:
        $socat1 = /socat\s+(TCP-LISTEN:\d{2,5},?\s*(reuseaddr|fork)?|TCP4:\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}:\d{2,5})/ ascii
        $socat2 = /EXEC:\/bin\/(ba)?sh/ ascii
        $socat3 = /EXEC:'\/bin\/(ba)?sh'/ ascii
    condition:
        any of ($socat1*) and any of ($socat2, $socat3)
}

rule C7_Linux_ReverseShell_Misc {
    meta:
        risk_level = "medium"
        category = "C7"
        false_positive_rate = "medium"
        reference = "多种语言反弹 Shell 通用特征"
        description = "通用反弹 Shell 标记：/dev/tcp 或 /dev/udp 或 reverse shell 工具名"
    strings:
        $devudp = /\/dev\/udp\/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{2,5}/ ascii
        $bashc = /bash\s+-c\s+['"].*\/dev\/(tcp|udp)/ ascii
        $dash_e = /\/bin\/bash\s+-e\s+['"]/ ascii
        $hydra = /Hydra|crackmap|weevely|meterpreter|msfconsole|msfvenom/ ascii nocase
        $reverseshell = /reverse[_\s]?shell|shell[_\s]?shock/ ascii nocase
    condition:
        any of ($devudp, $bashc, $dash_e) or any of ($hydra, $reverseshell)
}


// =============================================================================
// C7-2 持久化 —— crontab / authorized_keys / systemd
// =============================================================================

rule C7_Linux_Persistence_Crontab {
    meta:
        risk_level = "high"
        category = "C7"
        false_positive_rate = "medium"
        reference = "MITRE ATT&CK T1053.003 Cron"
        description = "crontab 持久化：下载执行 + .bashrc 注入 + /tmp/.hidden 目录"
    strings:
        $crontab1 = /\*\s+\*\s+\*\s+\*\s+\*\s+(curl|wget)\s+['"]?https?:/ ascii
        $crontab2 = /\*\s+\*\s+\*\s+\*\s+\*\s+(bash|sh)\s+\S+\s+['"]\/dev\/tcp/ ascii
        $crontab3 = /crontab\s+-[lre]?\s+\/tmp\/\w+/ ascii
        $bashrc = /\.bashrc|\.bash_profile|\.profile/ ascii
        $wget = /wget\s+https?:/ ascii
        $curl = /curl\s+.*\|\s*(bash|sh)/ ascii
        $hidden = /\/tmp\/\.?\w+\s+&&/ ascii
    condition:
        any of ($crontab1, $crontab2, $crontab3)
        or
        $bashrc and ($wget or $curl) and $hidden
}

rule C7_Linux_Persistence_AuthorizedKeys {
    meta:
        risk_level = "high"
        category = "C7"
        false_positive_rate = "low"
        reference = "MITRE ATT&CK T1098 SSH Authorized Keys"
        description = "authorized_keys 写入：下载公钥 + 追加到 .ssh/authorized_keys + chmod 600"
    strings:
        $authkeys = /\.ssh\/authorized_keys/ ascii
        $wgetkey = /wget\s+-O\s+.*authorized_keys/ ascii
        $curlkey = /curl\s+.*authorized_keys/ ascii
        $echokey = /echo\s+['"]ssh-(rsa|ecdsa|ed25519)/ ascii
        $chmod = /chmod\s+\d{3,4}\s+\$\{?SSH_DIR\}?authorized_keys/ ascii
    condition:
        any of ($wgetkey, $curlkey, $echokey) or ($authkeys and any of ($wgetkey, $curlkey, $chmod))
}

rule C7_Linux_Persistence_SystemD {
    meta:
        risk_level = "high"
        category = "C7"
        false_positive_rate = "medium"
        reference = "MITRE ATT&CK T1543.002 Systemd Service"
        description = "恶意 systemd unit 文件：ExecStart 指向 /tmp/.hidden + multi-user.target + 反弹命令"
    strings:
        $unit = /\[Unit\]/ ascii
        $service = /\[Service\]/ ascii
        $install = /\[Install\]/ ascii
        $execstart = /ExecStart=/ ascii
        $multiuser = /multi-user\.target/ ascii
        $hiddenpath = /\/tmp\/\.?\w+|\/var\/tmp\/\.?\w+/ ascii
        $bashsh = /\/bin\/(ba)?sh\s+-c/ ascii
    condition:
        // 完整 unit 片段 + 可疑路径
        $unit and $service and $execstart and ($hiddenpath or $bashsh)
        or
        // Install multi-user.target + ExecStart 反弹
        $install and $multiuser and any of ($execstart, $bashsh)
}

rule C7_Linux_Persistence_LD_PRELOAD {
    meta:
        risk_level = "high"
        category = "C7"
        false_positive_rate = "medium"
        reference = "MITRE ATT&CK T1574.006 LD_PRELOAD"
        description = "LD_PRELOAD 劫持：环境变量注入 + .so 文件 + dlopen"
    strings:
        $ldpreload = /LD_PRELOAD=/ ascii
        $sofile = /\.so(\.\d+)?:?/ ascii
        $dlopen = "dlopen" ascii
        $dlsym = "dlsym" ascii
        $exportenv = /export\s+LD_PRELOAD/ ascii
    condition:
        ($ldpreload or $exportenv) and ($sofile or $dlopen or $dlsym)
}


// =============================================================================
// C7-3 Rootkit + 挖矿通用特征
// =============================================================================

rule C7_Linux_Rootkit_KernelModule {
    meta:
        risk_level = "critical"
        category = "C7"
        false_positive_rate = "medium"
        reference = "MITRE ATT&CK T1547.006 Kernel Modules and Extensions"
        description = "内核模块加载：insmod/modprobe + .ko + /proc/kallsyms 隐藏"
    strings:
        $insmod = /insmod\s+.*\.ko/ ascii
        $modprobe = /modprobe\s+.*\.ko/ ascii
        $ko = /\.ko(\.xz|\.gz)?\b/ ascii
        $hiddenproc = /hide_process_from_dcache|hide_module/ ascii
        $proc = /\/proc\/kallsyms|\/proc\/modules/ ascii
        $netstat = /\/proc\/net\/tcp|\/proc\/net\/udp/ ascii
    condition:
        any of ($insmod, $modprobe) and any of ($ko, $hiddenproc)
        or
        any of ($hiddenproc) and any of ($proc, $netstat)
}

rule C7_Linux_Miner_Generic {
    meta:
        risk_level = "medium"
        category = "C7"
        false_positive_rate = "medium"
        reference = "MITRE ATT&CK T1496 Resource Hijacking"
        description = "挖矿通用特征：stratum+tcp 协议 + 非标准端口(3333/5555/8080)"
    strings:
        $stratum = "stratum+tcp://" ascii
        $stratums = "stratum+ssl://" ascii
        $pool = /pool\.(xmr|mine|nanopool|coin|mining)/ ascii nocase
        $port3333 = /:\s*3333\b/ ascii
        $port5555 = /:\s*5555\b/ ascii
        $highcpu = /nice\s+-n\s+[+-]?\d+|cpulimit\s+-l/ ascii
    condition:
        any of ($stratum, $stratums, $pool) and any of ($port3333, $port5555)
        or
        any of ($stratum, $stratums) and $highcpu
}


// =============================================================================
// C7-4 跨平台后门：Ruby + Lua + Node.js
// =============================================================================

rule C7_Misc_Ruby_Lua_ReverseShell {
    meta:
        risk_level = "medium"
        category = "C7"
        false_positive_rate = "medium"
        reference = "多语言反弹 Shell"
        description = "Ruby/Lua 反弹 Shell：TCPSocket + exec/system"
    strings:
        $ruby = "TCPSocket" ascii
        $lua = "loadstring" ascii
        $lua2 = "luasocket" ascii
        $exec = /(exec|system|IO\.popen)\s+.*\/bin\/(ba)?sh/ ascii
    condition:
        any of ($ruby, $lua, $lua2) and ($exec or any of ($ruby, $lua, $lua2))
}


// =============================================================================
// C7-5 网络投毒 / MITM 工具（内网横向移动）
// =============================================================================

rule C7_Network_Tools_Malicious {
    meta:
        risk_level = "medium"
        category = "C7"
        false_positive_rate = "medium"
        reference = "内网攻击工具"
        description = "内网攻击工具：ettercap/responder/nmap 扫描 + SMB/DNS 投毒"
    strings:
        $ettercap = "ettercap" ascii nocase
        $responder = /responder(\.py)?/ ascii nocase
        $nmap = "nmap" ascii nocase
        $smb = /--smb/ ascii
        $ms17 = "ms17-010" ascii nocase
        $smbghost = "SMBGhost" ascii nocase
        $dnsspoof = /dns[-_]spoof|dns[-_]mitm/ ascii nocase
        $arppoison = /arp[-_]poison|arp[-_]spoof/ ascii nocase
    condition:
        any of ($ettercap, $responder, $dnsspoof, $arppoison)
        or
        $nmap and ($smb or $ms17 or $smbghost)
}