zhaolei/MeshSate
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
d05537e1fb763f8277dcf862071bac56aad86721
MeshSate/tests/samples/index.json
zhaolei d05537e1fb feat: 靶场对齐 CSV 126 条用例 
- policy.yaml: 新增 9 条恶意行为关键词规则（ReverseShell/CredentialStealer/Mimikatz/TScon 等）
- binary.py: 新增 4 条 PE 检测（UPXPackerDetected/RWXSectionDetected/PEArchInfo/DebugInformationPresent）
- console.py + test_center.html: 靶场表格最前加 case_id 列，与 CSV 用例编号一致
- docker-compose.yml: 挂载 tests/samples 为只读 volume，样本更新免 rebuild
- scripts/generate_csv_samples.py: 一键从用例.csv 生成样本 + index.json
- tests/samples/: 128 个 CSV 对齐样本文件 + index.json（93 条元数据）

引擎覆盖度: L3 12%→60%, L5 20%→55%, 总计 54%→75%
2026-10-29 11:33:58 +08:00

868 lines
23 KiB
JSON
Raw Blame History

This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
{
"meshsafe_target_version": "v0.2.1",
"generated_at": "2026-10-29T11:32:38.543046",
"csv_source": "用例.csv",
"samples": [
{
"filename": "L0-001_jpg_normal.jpg",
"case_id": "L0-001",
"category": "L0",
"expected_verdict": "pass",
"expected_rules": [
"identify_type"
],
"description": "正常文件幻数识别-JPG"
},
{
"filename": "L0-002_png_normal.png",
"case_id": "L0-002",
"category": "L0",
"expected_verdict": "pass",
"expected_rules": [
"identify_type"
],
"description": "正常文件幻数识别-PNG"
},
{
"filename": "L0-003_docx_normal.docx",
"case_id": "L0-003",
"category": "L0",
"expected_verdict": "pass",
"expected_rules": [
"identify_type"
],
"description": "正常文件幻数识别-DOCX"
},
{
"filename": "L0-004_pdf_normal.pdf",
"case_id": "L0-004",
"category": "L0",
"expected_verdict": "pass",
"expected_rules": [
"identify_type"
],
"description": "正常文件幻数识别-PDF"
},
{
"filename": "L0-005_pe_clean.exe",
"case_id": "L0-005",
"category": "L0",
"expected_verdict": "review",
"expected_rules": [
"DangerousExtension",
"UnsignedExecutable"
],
"description": "正常文件幻数识别-干净PE"
},
{
"filename": "L0-006_disguise_jpg_pe.jpg",
"case_id": "L0-006",
"category": "L0",
"expected_verdict": "reject",
"expected_rules": [
"ExtensionMismatch"
],
"description": "jpg 后缀 + 实际 PE MZ 头"
},
{
"filename": "L0-007_disguise_txt_pdf.txt",
"case_id": "L0-007",
"category": "L0",
"expected_verdict": "reject",
"expected_rules": [
"ExtensionMismatch"
],
"description": "后缀伪装：txt后缀，实际PDF幻数"
},
{
"filename": "L0-008_disguise_png_zip.png",
"case_id": "L0-008",
"category": "L0",
"expected_verdict": "reject",
"expected_rules": [
"ExtensionMismatch"
],
"description": "后缀伪装：png后缀，实际ZIP幻数"
},
{
"filename": "L0-009_double_ext_pdf_exe.pdf.exe",
"case_id": "L0-009",
"category": "L0",
"expected_verdict": "reject",
"expected_rules": [
"DoubleExtension",
"DangerousExtension"
],
"description": "双扩展名伪装：report.pdf.exe"
},
{
"filename": "L0-010_double_ext_txt_ps1.txt.ps1",
"case_id": "L0-010",
"category": "L0",
"expected_verdict": "reject",
"expected_rules": [
"DoubleExtension",
"DangerousExtension"
],
"description": "双扩展名伪装：data.txt.ps1"
},
{
"filename": "L0-011_double_ext_docx_js.docx.js",
"case_id": "L0-011",
"category": "L0",
"expected_verdict": "reject",
"expected_rules": [
"DoubleExtension",
"DangerousExtension"
],
"description": "双扩展名伪装：note.docx.js"
},
{
"filename": "L0-012_double_ext_xlsx_bat.xlsx.bat",
"case_id": "L0-012",
"category": "L0",
"expected_verdict": "reject",
"expected_rules": [
"DoubleExtension",
"DangerousExtension"
],
"description": "双扩展名伪装：log.xlsx.bat"
},
{
"filename": "L0-013_clean.ps1",
"case_id": "L0-013",
"category": "L0",
"expected_verdict": "review",
"expected_rules": [
"DangerousExtension"
],
"description": "干净 ps1 文件"
},
{
"filename": "L0-014_clean.bat",
"case_id": "L0-014",
"category": "L0",
"expected_verdict": "review",
"expected_rules": [
"DangerousExtension"
],
"description": "干净 bat 文件"
},
{
"filename": "L0-015_clean.cmd",
"case_id": "L0-015",
"category": "L0",
"expected_verdict": "review",
"expected_rules": [
"DangerousExtension"
],
"description": "干净 cmd 文件"
},
{
"filename": "L0-016_clean.vbs",
"case_id": "L0-016",
"category": "L0",
"expected_verdict": "review",
"expected_rules": [
"DangerousExtension"
],
"description": "干净 vbs 文件"
},
{
"filename": "L0-017_clean.js",
"case_id": "L0-017",
"category": "L0",
"expected_verdict": "review",
"expected_rules": [
"DangerousExtension"
],
"description": "干净 js 文件"
},
{
"filename": "L0-018_zip_traversal.zip",
"case_id": "L0-018",
"category": "L0",
"expected_verdict": "reject",
"expected_rules": [
"PathTraversal"
],
"description": "ZIP单级路径穿越：../test.txt"
},
{
"filename": "L0-019_zip_deep_traversal.zip",
"case_id": "L0-019",
"category": "L0",
"expected_verdict": "reject",
"expected_rules": [
"PathTraversal"
],
"description": "ZIP多级路径穿越：../../a.txt"
},
{
"filename": "L0-020_zip_bomb.zip",
"case_id": "L0-020",
"category": "L0",
"expected_verdict": "reject",
"expected_rules": [
"ArchiveBombSuspect"
],
"description": "ZIP炸弹42.zip"
},
{
"filename": "L0-022_3layer_nested.zip",
"case_id": "L0-022",
"category": "L0",
"expected_verdict": "pass",
"expected_rules": [
"recursive_ok"
],
"description": "3层无害嵌套ZIP"
},
{
"filename": "L0-024_encrypted.zip",
"case_id": "L0-024",
"category": "L0",
"expected_verdict": "review",
"expected_rules": [
"EncryptedArchive"
],
"description": "加密 ZIP（标记待验证）"
},
{
"filename": "L0-025_corrupt_zip.zip",
"case_id": "L0-025",
"category": "L0",
"expected_verdict": "review",
"expected_rules": [
"ArchiveBroken"
],
"description": "截断损坏 ZIP 头"
},
{
"filename": "L0-026_corrupt_direntry.zip",
"case_id": "L0-026",
"category": "L0",
"expected_verdict": "review",
"expected_rules": [
"ArchiveBroken"
],
"description": "损坏ZIP目录项"
},
{
"filename": "L0-029_zero_byte_exe.exe",
"case_id": "L0-029",
"category": "L0",
"expected_verdict": "review",
"expected_rules": [
"ZeroByteFile",
"DangerousExtension"
],
"description": "空文件（0字节）后缀exe"
},
{
"filename": "L1-001_eicar.txt",
"case_id": "L1-001",
"category": "L1",
"expected_verdict": "reject",
"expected_rules": [
"ClamAV:EICAR"
],
"description": "EICAR标准测试串文本"
},
{
"filename": "L1-002_eicar_in_zip.zip",
"case_id": "L1-002",
"category": "L1",
"expected_verdict": "reject",
"expected_rules": [
"ClamAV:EICAR"
],
"description": "EICAR放入zip压缩包"
},
{
"filename": "L1-004_eicar_in_docx.docx",
"case_id": "L1-004",
"category": "L1",
"expected_verdict": "reject",
"expected_rules": [
"ClamAV:EICAR"
],
"description": "EICAR放入docx内嵌（OLE）"
},
{
"filename": "L1-005_eicar_modified.txt",
"case_id": "L1-005",
"category": "L1",
"expected_verdict": "pass",
"expected_rules": [],
"description": "修改 1 字节 EICAR，ClamAV 不应命中"
},
{
"filename": "L0-001_jpg_normal.jpg",
"case_id": "L1-006",
"category": "L1",
"expected_verdict": "pass",
"expected_rules": [],
"description": "干净jpg图片（对照负样本）"
},
{
"filename": "L0-003_docx_normal.docx",
"case_id": "L1-007",
"category": "L1",
"expected_verdict": "pass",
"expected_rules": [],
"description": "干净docx文档（对照负样本）"
},
{
"filename": "L0-005_pe_clean.exe",
"case_id": "L1-008",
"category": "L1",
"expected_verdict": "pass",
"expected_rules": [],
"description": "干净hello PE（对照负样本）"
},
{
"filename": "L1-011_eicar_in_3layer.zip",
"case_id": "L1-011",
"category": "L1",
"expected_verdict": "reject",
"expected_rules": [
"ClamAV:EICAR"
],
"description": "EICAR放在多层嵌套zip"
},
{
"filename": "L1-012_eicar_base64.txt",
"case_id": "L1-012",
"category": "L1",
"expected_verdict": "pass",
"expected_rules": [],
"description": "base64 编码 EICAR，ClamAV 不解码"
},
{
"filename": "L3-001_001_sample.ps1",
"case_id": "L3-001",
"category": "L3",
"expected_verdict": "reject",
"expected_rules": [
"RemoteDownloadPowerShell"
],
"description": "PS1明文：Invoke-WebRequest下载"
},
{
"filename": "L3-002_002_sample.ps1",
"case_id": "L3-002",
"category": "L3",
"expected_verdict": "reject",
"expected_rules": [
"ReverseShellNetcat"
],
"description": "PS1明文：反弹shell nc"
},
{
"filename": "L3-003_003_sample.bat",
"case_id": "L3-003",
"category": "L3",
"expected_verdict": "reject",
"expected_rules": [
"RemoteDownloadUnix"
],
"description": "bat明文：curl下载payload"
},
{
"filename": "L3-004_004_sample.txt",
"case_id": "L3-004",
"category": "L3",
"expected_verdict": "reject",
"expected_rules": [
"CredentialStealer"
],
"description": "文本包含mimikatz关键字"
},
{
"filename": "L3-005_005_sample.txt",
"case_id": "L3-005",
"category": "L3",
"expected_verdict": "reject",
"expected_rules": [
"CredentialExport"
],
"description": "文本包含reg save导出注册表"
},
{
"filename": "L3-006_006_sample.txt",
"case_id": "L3-006",
"category": "L3",
"expected_verdict": "reject",
"expected_rules": [
"RemoteSessionHijack"
],
"description": "文本包含rdp、tscon劫持关键字"
},
{
"filename": "L3-007_007_sample.txt",
"case_id": "L3-007",
"category": "L3",
"expected_verdict": "pass",
"expected_rules": [],
"description": "高危串base64编码放在txt"
},
{
"filename": "L3-008_008_sample.ps1",
"case_id": "L3-008",
"category": "L3",
"expected_verdict": "pass",
"expected_rules": [],
"description": "Powershell字符串拆分拼接绕过"
},
{
"filename": "L3-010_010_sample.ps1",
"case_id": "L3-010",
"category": "L3",
"expected_verdict": "pass",
"expected_rules": [],
"description": "高危串插入注释分割（powershell #注释）"
},
{
"filename": "L3-011_011_sample.js",
"case_id": "L3-011",
"category": "L3",
"expected_verdict": "reject",
"expected_rules": [
"RemoteDownloadUnix"
],
"description": "高危串放js脚本内"
},
{
"filename": "L3-012_012_sample.bat",
"case_id": "L3-012",
"category": "L3",
"expected_verdict": "reject",
"expected_rules": [
"pass（内网白名单对照）"
],
"description": "正常内网运维curl（白名单对照）"
},
{
"filename": "L3-016_016_sample.ps1",
"case_id": "L3-016",
"category": "L3",
"expected_verdict": "pass",
"expected_rules": [],
"description": "空脚本文件（负样本）"
},
{
"filename": "L3-017_017_sample.txt",
"case_id": "L3-017",
"category": "L3",
"expected_verdict": "reject",
"expected_rules": [
"ReverseShellNetcat",
"CredentialStealer"
],
"description": "多条高危特征同文件复合"
},
{
"filename": "L3-018_018_sample.txt",
"case_id": "L3-018",
"category": "L3",
"expected_verdict": "reject",
"expected_rules": [
"RemoteDownloadPowerShell"
],
"description": "高危字符串大小写混写"
},
{
"filename": "L3-021_021_sample.eml",
"case_id": "L3-021",
"category": "L3",
"expected_verdict": "reject",
"expected_rules": [
"RemoteDownloadPowerShell"
],
"description": "高危字符串放在eml邮件正文"
},
{
"filename": "L3-024_024_sample.txt",
"case_id": "L3-024",
"category": "L3",
"expected_verdict": "reject",
"expected_rules": [
"RemoteDownloadPowerShell"
],
"description": "超长单行文本（10万字符）包含高危串"
},
{
"filename": "L3-014_l3001_in_zip.zip",
"case_id": "L3-014",
"category": "L3",
"expected_verdict": "reject",
"expected_rules": [
"RemoteDownloadPowerShell"
],
"description": "高危字符串放在zip内部txt"
},
{
"filename": "L3-015_keyword_in_docx.docx",
"case_id": "L3-015",
"category": "L3",
"expected_verdict": "reject",
"expected_rules": [
"RemoteDownloadPowerShell"
],
"description": "高危字符串放在docx文本正文"
},
{
"filename": "L3-019_unicode_obfuscated.txt",
"case_id": "L3-019",
"category": "L3",
"expected_verdict": "pass",
"expected_rules": [],
"description": "同形字混淆，L3 默认不命中"
},
{
"filename": "L3-020_log_with_keyword.log",
"case_id": "L3-020",
"category": "L3",
"expected_verdict": "reject",
"expected_rules": [
"ReverseShellNetcat"
],
"description": "日志文件混杂正常日志+高危串"
},
{
"filename": "L3-023_keyword_in_encrypted.zip",
"case_id": "L3-023",
"category": "L3",
"expected_verdict": "review",
"expected_rules": [],
"description": "加密 zip 内容无法扫描（标记）"
},
{
"filename": "L4-001_001_sample.txt",
"case_id": "L4-001",
"category": "L4",
"expected_verdict": "reject",
"expected_rules": [],
"description": "YARA正向命中占位（需对应规则）"
},
{
"filename": "L4-002_002_sample.txt",
"case_id": "L4-002",
"category": "L4",
"expected_verdict": "pass",
"expected_rules": [],
"description": "干净对照"
},
{
"filename": "L4-005_005_sample.txt",
"case_id": "L4-005",
"category": "L4",
"expected_verdict": "unknown",
"expected_rules": [],
"description": "热加载测试占位"
},
{
"filename": "L4-008_in_zip.zip",
"case_id": "L4-008",
"category": "L4",
"expected_verdict": null,
"expected_rules": [],
"description": "压缩包内文件匹配YARA规则"
},
{
"filename": "L4-010_010_sample.txt",
"case_id": "L4-010",
"category": "L4",
"expected_verdict": "unknown",
"expected_rules": [],
"description": "正则 YARA 测试占位"
},
{
"filename": "L5-001_clean_hello.exe",
"case_id": "L5-001",
"category": "L5",
"expected_verdict": "pass",
"expected_rules": [],
"description": "原生干净HelloWorld PE（无壳）"
},
{
"filename": "L5-002_upx_shell.exe",
"case_id": "L5-002",
"category": "L5",
"expected_verdict": "review",
"expected_rules": [
"UPXPackerDetected",
"HighEntropySection"
],
"description": "UPX0/UPX1 节名"
},
{
"filename": "L5-003_double_upx.exe",
"case_id": "L5-003",
"category": "L5",
"expected_verdict": "review",
"expected_rules": [
"UPXPackerDetected"
],
"description": "UPX加壳PE，二次压缩"
},
{
"filename": "L5-004_rwx_section.exe",
"case_id": "L5-004",
"category": "L5",
"expected_verdict": "reject",
"expected_rules": [
"RWXSectionDetected"
],
"description": "节属性 RWX"
},
{
"filename": "L5-007_garbage_section.exe",
"case_id": "L5-007",
"category": "L5",
"expected_verdict": "review",
"expected_rules": [
"AbnormalSectionName"
],
"description": "节名乱码"
},
{
"filename": "L5-010_bad_mz.exe",
"case_id": "L5-010",
"category": "L5",
"expected_verdict": "review",
"expected_rules": [
"PeParseFailed"
],
"description": "PE 头非法"
},
{
"filename": "L5-011_truncated.exe",
"case_id": "L5-011",
"category": "L5",
"expected_verdict": "review",
"expected_rules": [
"PeParseFailed"
],
"description": "截断 PE"
},
{
"filename": "L5-012_pe32.exe",
"case_id": "L5-012",
"category": "L5",
"expected_verdict": "pass",
"expected_rules": [
"PEArchInfo"
],
"description": "32 位识别"
},
{
"filename": "L5-013_pe64.exe",
"case_id": "L5-013",
"category": "L5",
"expected_verdict": "pass",
"expected_rules": [
"PEArchInfo"
],
"description": "64 位识别占位"
},
{
"filename": "L5-014_clean_tool.exe",
"case_id": "L5-014",
"category": "L5",
"expected_verdict": "pass",
"expected_rules": [],
"description": "PE导入表大量系统API（正常工具）"
},
{
"filename": "L5-016_zero_section.exe",
"case_id": "L5-016",
"category": "L5",
"expected_verdict": "review",
"expected_rules": [],
"description": "零节 PE 占位"
},
{
"filename": "L5-017_upx_rwx.exe",
"case_id": "L5-017",
"category": "L5",
"expected_verdict": "review",
"expected_rules": [
"UPXPackerDetected",
"RWXSectionDetected"
],
"description": "UPX壳 + RWX节复合特征"
},
{
"filename": "L5-018_debug_info.exe",
"case_id": "L5-018",
"category": "L5",
"expected_verdict": "review",
"expected_rules": [
"DebugInformationPresent"
],
"description": "调试信息占位"
},
{
"filename": "NEG-001_clean.jpg",
"case_id": "NEG-001",
"category": "NEG",
"expected_verdict": "pass",
"expected_rules": [],
"description": "业务标准JPG图片"
},
{
"filename": "NEG-002_clean.png",
"case_id": "NEG-002",
"category": "NEG",
"expected_verdict": "pass",
"expected_rules": [],
"description": "业务PNG图片"
},
{
"filename": "NEG-003_clean.mp4",
"case_id": "NEG-003",
"category": "NEG",
"expected_verdict": "pass",
"expected_rules": [],
"description": "业务MP4视频"
},
{
"filename": "NEG-004_clean.docx",
"case_id": "NEG-004",
"category": "NEG",
"expected_verdict": "pass",
"expected_rules": [],
"description": "业务正常docx报表"
},
{
"filename": "NEG-005_clean.xlsx",
"case_id": "NEG-005",
"category": "NEG",
"expected_verdict": "pass",
"expected_rules": [],
"description": "业务正常xlsx表格"
},
{
"filename": "NEG-006_clean.pdf",
"case_id": "NEG-006",
"category": "NEG",
"expected_verdict": "pass",
"expected_rules": [],
"description": "业务正常PDF报告"
},
{
"filename": "NEG-007_clean.java",
"case_id": "NEG-007",
"category": "NEG",
"expected_verdict": "pass",
"expected_rules": [],
"description": "业务源码java文件"
},
{
"filename": "NEG-008_clean.py",
"case_id": "NEG-008",
"category": "NEG",
"expected_verdict": "pass",
"expected_rules": [],
"description": "业务源码python脚本"
},
{
"filename": "NEG-009_clean.zip",
"case_id": "NEG-009",
"category": "NEG",
"expected_verdict": "pass",
"expected_rules": [],
"description": "正常业务压缩包zip"
},
{
"filename": "NEG-010_clean.exe",
"case_id": "NEG-010",
"category": "NEG",
"expected_verdict": "pass",
"expected_rules": [],
"description": "正常业务安装包（干净开源）"
},
{
"filename": "NEG-011_clean.log",
"case_id": "NEG-011",
"category": "NEG",
"expected_verdict": "pass",
"expected_rules": [],
"description": "正常日志文件"
},
{
"filename": "NEG-012_clean.csv",
"case_id": "NEG-012",
"category": "NEG",
"expected_verdict": "pass",
"expected_rules": [],
"description": "正常csv业务数据文件"
},
{
"filename": "NEG-013_clean.eml",
"case_id": "NEG-013",
"category": "NEG",
"expected_verdict": "pass",
"expected_rules": [],
"description": "正常eml业务邮件（无附件、无外联恶意）"
},
{
"filename": "NEG-014_clean.dll",
"case_id": "NEG-014",
"category": "NEG",
"expected_verdict": "pass",
"expected_rules": [],
"description": "正常dll（系统干净dll）"
},
{
"filename": "NEG-015_clean.ttf",
"case_id": "NEG-015",
"category": "NEG",
"expected_verdict": "pass",
"expected_rules": [],
"description": "正常字体文件ttf"
},
{
"filename": "NEG-016_clean.dwg",
"case_id": "NEG-016",
"category": "NEG",
"expected_verdict": "pass",
"expected_rules": [],
"description": "正常CAD图纸"
},
{
"filename": "NEG-017_4layer_nested.zip",
"case_id": "NEG-017",
"category": "NEG",
"expected_verdict": "pass",
"expected_rules": [],
"description": "多层嵌套干净zip（无风险）"
},
{
"filename": "NEG-018_clean.bat",
"case_id": "NEG-018",
"category": "NEG",
"expected_verdict": "pass",
"expected_rules": [],
"description": "正常bat运维脚本（内网备份）"
},
{
"filename": "NEG-019_clean.ps1",
"case_id": "NEG-019",
"category": "NEG",
"expected_verdict": "pass",
"expected_rules": [],
"description": "正常ps1运维脚本（内网查询）"
},
{
"filename": "NEG-020_clean.odt",
"case_id": "NEG-020",
"category": "NEG",
"expected_verdict": "pass",
"expected_rules": [],
"description": "正常odt文档"
}
]
}
Reference in New Issue View Git Blame Copy Permalink