/* MeshSafe 测试靶场 YARA 规则
 * 自动生成，覆盖 CSV L4-001 ~ L4-012
 * 引擎自动扫描 rules/*.yar，热加载
 */

// L4-001: 基础规则 —— 正向命中 shell 反弹特征
rule Test_ReverseShell_Basic {
    meta:
        family = "TestRules"
        author = "MeshSafe Test Suite"
        version = "1.0"
        description = "L4-001 基础规则: 匹配 nc 反弹 shell 特征"
    strings:
        $a = /nc\s+[0-9.]+\s+[0-9]+\s+-e/
        $b = /bash\s+-i\s+>&\s+\/dev\/tcp\//
    condition:
        $a or $b
}

// L4-004: 第二条规则 —— 同时命中验证
rule Test_PowerShell_Download {
    meta:
        family = "TestRules"
        author = "MeshSafe Test Suite"
        description = "L4-004 多规则同时命中: 匹配 PowerShell 下载"
    strings:
        $c = /Invoke-WebRequest\s+-Uri/
        $d = /powershell\s+-w\s+hidden/
    condition:
        $c or $d
}

// L4-005: 新增规则（热加载验证）
rule Newly_Added_Rule_Test {
    meta:
        family = "TestRules"
        author = "MeshSafe Test Suite"
        description = "L4-005 热加载验证: 运行时新增此规则后应能命中"
    strings:
        $e = "meshsafe-hot-reload-test-string"
    condition:
        $e
}

// L4-007: metadata 标签测试
rule Meta_Label_Test {
    meta:
        family = "Trojan.Generic"
        author = "Security Researcher"
        description = "L4-007 metadata 输出验证: 规则带完整 meta 字段"
        severity = "high"
    strings:
        $f = "trojan-metadata-test"
    condition:
        $f
}

// L4-010: 正则型规则
rule Regex_Shell_Pattern {
    meta:
        family = "TestRules"
        author = "MeshSafe Test Suite"
        description = "L4-010 正则匹配: powershell -enc 编码执行"
    strings:
        $g = /powershell\s+-e[nN][cC]\s+[A-Za-z0-9+\/]{20,}/
    condition:
        $g
}

// L4-011: count 条件（出现 ≥3 次才触发）
rule Count_Condition_Test {
    meta:
        family = "TestRules"
        author = "MeshSafe Test Suite"
        description = "L4-011 count 条件: 文件内匹配串 ≥3 次命中"
    strings:
        $h = "malicious_token_count_test"
    condition:
        #h >= 3
}

// L4-012: size 条件（仅匹配 ≤10KB 的文件）
rule Size_Condition_Test {
    meta:
        family = "TestRules"
        author = "MeshSafe Test Suite"
        description = "L4-012 size 条件: 仅匹配 size <= 10KB 的文件"
    strings:
        $i = "size_condition_test_payload"
    condition:
        $i and filesize <= 10KB
}

// L4-003: PE 内字符串（实际是 Test_PowerShell_Download 的 strings 也在 PE 里）
// 已由 Test_PowerShell_Download 覆盖，因为 PE 里的 strings() 也会被 YARA 扫描

// L4-009: 加密包内无法扫描（不是规则缺失，是 zipfile 跳过加密内容）
// L4-013: 大文件 YARA —— 由 Test_ReverseShell_Basic 自动覆盖大文件扫描
// L4-014: 开关测试 —— 由引擎 is_enabled() 控制
// L4-015: 哈希白名单 —— 需在 policy.yaml 配置，不是 .yar 文件