// =============================================================================
// MeshSafe L2B YARA 规则集 —— 勒索 / 挖矿专项（C8，剩余家族）
// =============================================================================
//
// 设计原则：
//   - C8_Ransomware_Encryption 在 pe.yar 里已经覆盖了"加密 API + 卷影删除 + 勒索信"通用链
//   - 本文件补充：具体家族特征（LockBit/BlackCat/Conti/Ryuk/Pseudo）+
//                 文件扩展名黑名单变体 + 勒索信文件名模式
//   - 必须满足"加密 API 组合 + 家族特征"才触发，单靠扩展名不触发
//
// 元数据规范：同 webshell.yar / pe.yar（risk_level, category, false_positive_rate）
// =============================================================================


// =============================================================================
// C8-1 LockBit 家族
// =============================================================================

rule C8_Ransomware_LockBit {
    meta:
        risk_level = "critical"
        category = "C8"
        false_positive_rate = "low"
        reference = "LockBit / BitLocker 勒索家族"
        description = "LockBit 家族特征：Mutex 名 + .lockbit3/.lockbit 扩展名 + CryptEncrypt"
    strings:
        $mutex1 = /Global\\[Ll]ock[Bb]it/ ascii
        $mutex2 = /Local\\[Ll]ock[Bb]it/ ascii
        $mutex3 = /LockBit[\d_]/ ascii nocase
        $ext1 = /\.lockbit3?\b/ ascii nocase
        $ext2 = /\.lckbt\b/ ascii nocase
        $enc = /CryptEncrypt|BCryptEncrypt|CryptGenKey/ ascii
        $ransomnote = /README[\d_-]*\.(html|txt|bmp|png|jpg|url)/ nocase
    condition:
        // Mutex + 加密 API（家族识别核心）
        any of ($mutex*) and any of ($enc*)
        or
        // Mutex + 勒索扩展名
        any of ($mutex*) and any of ($ext*)
        or
        // 加密 API + 家族扩展名 + 勒索信
        any of ($enc*) and any of ($ext*) and $ransomnote
}


// =============================================================================
// C8-2 BlackCat / ALPHV 家族
// =============================================================================

rule C8_Ransomware_BlackCat {
    meta:
        risk_level = "critical"
        category = "C8"
        false_positive_rate = "low"
        reference = "BlackCat (ALPHV) 勒索家族"
        description = "BlackCat/ALPHV：Mutex + .blackcat/.bc1 扩展名 + Rust 字符串特征"
    strings:
        $mutex1 = /Global\\[Bb]lack[Cc]at/ ascii
        $mutex2 = /[Aa][Ll][Pp][Hh][Vv]/ ascii
        $ext1 = /\.blackcat\b/ ascii nocase
        $ext2 = /\.bc1?\b/ ascii nocase
        $rust1 = "rustc" ascii
        $rust2 = "/rustc/" ascii
        $enc = /CryptEncrypt|BCryptEncrypt/ ascii
        $note = /BlackCat.*README|how_to_decrypt|restore_files/ ascii nocase
    condition:
        any of ($mutex1, $mutex2) and any of ($enc*, $ext*)
        or
        any of ($ext*) and any of ($rust*) and $note
}


// =============================================================================
// C8-3 Conti 家族
// =============================================================================

rule C8_Ransomware_Conti {
    meta:
        risk_level = "critical"
        category = "C8"
        false_positive_rate = "low"
        reference = "Conti 勒索家族"
        description = "Conti：Mutex + .conti 扩展名 + 加密 API"
    strings:
        $mutex1 = /Global\\[Cc]onti/ ascii
        $mutex2 = /Local\\[Cc]onti/ ascii
        $ext1 = /\.conti\b/ ascii nocase
        $enc = /CryptEncrypt|BCryptEncrypt|CryptDeriveKey/ ascii
    condition:
        any of ($mutex*) and any of ($enc*, $ext*)
        or
        any of ($ext*) and any of ($enc*)
}


// =============================================================================
// C8-4 Ryuk / Pseudo / Dharma 家族
// =============================================================================

rule C8_Ransomware_Ryuk_Pseudo {
    meta:
        risk_level = "high"
        category = "C8"
        false_positive_rate = "medium"
        reference = "Ryuk / Pseudo / Dharma 勒索家族"
        description = "Ryuk/Pseudo： RyukTask Mutex + 加密 API + .ryk/.pseudo 扩展名"
    strings:
        $mutex_ryuk = /RyukTask[\d]/ ascii
        $mutex_pseudo = /Global\\[Pp]seudo/ ascii
        $mutex_dharma = /Global\\[Dd]harma/ ascii
        $ext_ryk = /\.ryk\b/ ascii nocase
        $ext_pseudo = /\.pseudo\b/ ascii nocase
        $ext_dharma = /\.dharma\b/ ascii nocase
        $enc = /CryptEncrypt|CryptDeriveKey/ ascii
    condition:
        (any of ($mutex_ryuk, $mutex_pseudo, $mutex_dharma))
        and (any of ($enc*, $ext_ryk, $ext_pseudo, $ext_dharma))
}


// =============================================================================
// C8-5 勒索信文件名模式（独立规则，辅助 family 识别）
// =============================================================================

rule C8_Ransomware_Note_Filename {
    meta:
        risk_level = "medium"
        category = "C8"
        false_positive_rate = "medium"
        reference = "勒索信文件名通用模式"
        description = "勒索信典型文件名变体（匹配后触发需要配合加密 API 才升级高危）"
    strings:
        $n1 = /HOW_TO_RECOVER[\w.-]*\.(txt|html|png|bmp|jpg|url|vbs|js)/ nocase
        $n2 = /RESTORE_FILES[\w.-]*\.(txt|html|png|bmp|jpg|url|vbs|js)/ nocase
        $n3 = /DECRYPT_INSTRUCTIONS[\w.-]*\.(txt|html|png|bmp|jpg|url)/ nocase
        $n4 = /README[_\s-]*[\d]*[_\s-]*[\w]*\.(txt|html|png|bmp|jpg|url)/ nocase
        $n5 = /HELP_DECRYPT[\w.-]*\.(txt|html|png|bmp|jpg|url)/ nocase
        $n6 = /_readme[\w.-]*\.(txt|html|png|bmp|jpg|url)/ nocase
        $n7 = /_restore[\w.-]*\.(txt|html|png|bmp|jpg|url)/ nocase
        $bitcoin = /bitcoin address|BTC\b|monero address|XMR\b|send money|ransom|payment/ nocase
        $wallet = /1[A-Za-z0-9]{25,34}|bc1[A-Za-z0-9]{11,71}|4[0-9A-Za-z]{32}/ nocase
        $encapi = /CryptEncrypt|BCryptEncrypt|CryptDeriveKey/ ascii
    condition:
        // 勒索信文件名 + 加密 API = 明确勒索
        any of ($n*) and $encapi
        or
        // 勒索信文件名 + 比特币/XMR 地址 = 大概率勒索
        any of ($n*) and any of ($bitcoin, $wallet)
}


// =============================================================================
// C8-6 加密文件扩展名黑名单（不单独触发，配合加密 API）
// =============================================================================

rule C8_Ransomware_Extension_Blacklist {
    meta:
        risk_level = "low"
        category = "C8"
        false_positive_rate = "medium"
        reference = "勒索加密文件扩展名模式"
        description = "常见勒索加密扩展名（.locky/.zepto/.cryptolocker/.encrypted/.virus/.tor/.crpt 等）+ 加密 API"
    strings:
        $ext1 = /\.locky\b/ nocase
        $ext2 = /\.zepto\b/ nocase
        $ext3 = /\.cryptolocker\b/ nocase
        $ext4 = /\.cryptor\b/ nocase
        $ext5 = /\.crypt\b/ nocase
        $ext6 = /\.encrypted\b/ nocase
        $ext7 = /\.virus\b/ nocase
        $ext8 = /\.tor\b/ nocase
        $ext9 = /\.crpt\b/ nocase
        $ext10 = /\.wallet\b/ nocase
        $ext11 = /\.pay2[\w.-]*\.?\w*\b/ nocase
        $enc = /CryptEncrypt|BCryptEncrypt|CryptDeriveKey/ ascii
        $note = /HOW_TO_RECOVER|RESTORE_FILES|DECRYPT_INSTRUCTIONS|README/ nocase
    condition:
        // 扩展名 + 加密 API + 勒索信 = 完整勒索链
        any of ($ext*) and $enc and $note
        or
        // 扩展名 + 加密 API（至少 2 种扩展名变体）
        (2 of ($ext*)) and $enc
}


// =============================================================================
// C8-7 卷影删除专项（辅助勒索前置）
// =============================================================================

rule C8_Ransomware_VolumeShadow {
    meta:
        risk_level = "high"
        category = "C8"
        false_positive_rate = "medium"
        reference = "MITRE ATT&CK T1490 Inhibit System Recovery"
        description = "删除卷影副本：vssadmin / wmic shadowcopy + 加密 API"
    strings:
        $vss1 = "vssadmin delete shadows" ascii
        $vss2 = /vssadmin\s+delete\s+shadows\s+\/all\b/ ascii
        $wmic1 = /wmic\s+shadowcopy\s+delete/ ascii
        $wmic2 = /wmic\s+shadowcopy\s+where\s+\d+/ ascii
        $vss3 = /ShadowCopy|VolumeShadowCopy|vss\b/i ascii  // "i" flag = nocase in YARA
        $enc = /CryptEncrypt|BCryptEncrypt|CryptDeriveKey/ ascii
    condition:
        // 卷影删除 + 加密 API = 完整勒索前置
        (any of ($vss1, $vss2, $wmic*, $vss3)) and any of ($enc*)
        or
        // 连续多次 vssadmin delete = 正在清卷影
        any of ($vss1, $vss2) and any of ($wmic*)
}