zhaolei
6e3c1a40e5
rules/test_rules.yar (7 条规则): - Test_ReverseShell_Basic: nc 反弹 shell - Test_PowerShell_Download: Invoke-WebRequest - Newly_Added_Rule_Test: 热加载验证 - Meta_Label_Test: metadata 输出验证 - Regex_Shell_Pattern: powershell -enc 正则 - Count_Condition_Test: count >= 3 条件 - Size_Condition_Test: filesize <= 10KB 条件 YARA 命中验证: 7/7 ✅ L4-001 → Test_ReverseShell_Basic + keywords.ReverseShellNetcat 复合命中 L4-004 → Test_ReverseShell_Basic + Test_PowerShell_Download + 3 条关键词 L4-005/007/010/011/012 → 全部命中 ✅ 边界记录验证: 4/4 ✅ 全 clean L1-005 EICAR 1 字节修改 → ClamAV 不命中 ✅ L1-012 EICAR base64 → ClamAV 不解码 ✅ L3-007 高危串 base64 → 关键词不解码 ✅ L3-019 unicode 同形字 → 关键词不还原 ✅
143 lines
4.6 KiB
Python
143 lines
4.6 KiB
Python
"""自动生成 CSV L4 段需要的 YARA 规则文件。
|
||
|
||
输出: rules/test_rules.yar — 9 条规则覆盖 L4-001~L4-012
|
||
引擎会自动加载 rules/*.yar 文件。
|
||
"""
|
||
from pathlib import Path
|
||
|
||
OUT = Path(r'd:\project\MeshSafe\rules\test_rules.yar')
|
||
|
||
RULES = """/* MeshSafe 测试靶场 YARA 规则
|
||
* 自动生成，覆盖 CSV L4-001 ~ L4-012
|
||
* 引擎自动扫描 rules/*.yar，热加载
|
||
*/
|
||
|
||
// L4-001: 基础规则 —— 正向命中 shell 反弹特征
|
||
rule Test_ReverseShell_Basic {
|
||
meta:
|
||
family = "TestRules"
|
||
author = "MeshSafe Test Suite"
|
||
version = "1.0"
|
||
description = "L4-001 基础规则: 匹配 nc 反弹 shell 特征"
|
||
strings:
|
||
$a = /nc\\s+[0-9.]+\\s+[0-9]+\\s+-e/
|
||
$b = /bash\\s+-i\\s+>&\\s+\\/dev\\/tcp\\//
|
||
condition:
|
||
$a or $b
|
||
}
|
||
|
||
// L4-004: 第二条规则 —— 同时命中验证
|
||
rule Test_PowerShell_Download {
|
||
meta:
|
||
family = "TestRules"
|
||
author = "MeshSafe Test Suite"
|
||
description = "L4-004 多规则同时命中: 匹配 PowerShell 下载"
|
||
strings:
|
||
$c = /Invoke-WebRequest\\s+-Uri/
|
||
$d = /powershell\\s+-w\\s+hidden/
|
||
condition:
|
||
$c or $d
|
||
}
|
||
|
||
// L4-005: 新增规则（热加载验证）
|
||
rule Newly_Added_Rule_Test {
|
||
meta:
|
||
family = "TestRules"
|
||
author = "MeshSafe Test Suite"
|
||
description = "L4-005 热加载验证: 运行时新增此规则后应能命中"
|
||
strings:
|
||
$e = "meshsafe-hot-reload-test-string"
|
||
condition:
|
||
$e
|
||
}
|
||
|
||
// L4-007: metadata 标签测试
|
||
rule Meta_Label_Test {
|
||
meta:
|
||
family = "Trojan.Generic"
|
||
author = "Security Researcher"
|
||
description = "L4-007 metadata 输出验证: 规则带完整 meta 字段"
|
||
severity = "high"
|
||
strings:
|
||
$f = "trojan-metadata-test"
|
||
condition:
|
||
$f
|
||
}
|
||
|
||
// L4-010: 正则型规则
|
||
rule Regex_Shell_Pattern {
|
||
meta:
|
||
family = "TestRules"
|
||
author = "MeshSafe Test Suite"
|
||
description = "L4-010 正则匹配: powershell -enc 编码执行"
|
||
strings:
|
||
$g = /powershell\\s+-e[nN][cC]\\s+[A-Za-z0-9+\/]{20,}/
|
||
condition:
|
||
$g
|
||
}
|
||
|
||
// L4-011: count 条件（出现 ≥3 次才触发）
|
||
rule Count_Condition_Test {
|
||
meta:
|
||
family = "TestRules"
|
||
author = "MeshSafe Test Suite"
|
||
description = "L4-011 count 条件: 文件内匹配串 ≥3 次命中"
|
||
strings:
|
||
$h = "malicious_token_count_test"
|
||
condition:
|
||
#h >= 3
|
||
}
|
||
|
||
// L4-012: size 条件（仅匹配 ≤10KB 的文件）
|
||
rule Size_Condition_Test {
|
||
meta:
|
||
family = "TestRules"
|
||
author = "MeshSafe Test Suite"
|
||
description = "L4-012 size 条件: 仅匹配 size <= 10KB 的文件"
|
||
strings:
|
||
$i = "size_condition_test_payload"
|
||
condition:
|
||
$i and filesize <= 10KB
|
||
}
|
||
|
||
// L4-003: PE 内字符串（实际是 Test_PowerShell_Download 的 strings 也在 PE 里）
|
||
// 已由 Test_PowerShell_Download 覆盖，因为 PE 里的 strings() 也会被 YARA 扫描
|
||
|
||
// L4-009: 加密包内无法扫描（不是规则缺失，是 zipfile 跳过加密内容）
|
||
// L4-013: 大文件 YARA —— 由 Test_ReverseShell_Basic 自动覆盖大文件扫描
|
||
// L4-014: 开关测试 —— 由引擎 is_enabled() 控制
|
||
// L4-015: 哈希白名单 —— 需在 policy.yaml 配置，不是 .yar 文件
|
||
"""
|
||
|
||
OUT.write_text(RULES, encoding='utf-8')
|
||
print(f'✅ 生成 {OUT}')
|
||
print(f' 规则数: 7 条')
|
||
print(f' 覆盖 CSV: L4-001/004/005/007/010/011/012')
|
||
|
||
# 也需要对应的样本文件（已经有了，在 tests/samples/L4-*.txt 系列）
|
||
import os
|
||
SAMPLES = Path(r'd:\project\MeshSafe\tests\samples')
|
||
|
||
# L4-005 热加载样本
|
||
(SAMPLES / 'L4-005_hotreload.txt').write_text('meshsafe-hot-reload-test-string present here', encoding='utf-8')
|
||
print(f'✅ L4-005_hotreload.txt 已生成')
|
||
|
||
# L4-007 meta 标签样本
|
||
(SAMPLES / 'L4-007_meta_rule.txt').write_text('trojan-metadata-test payload here', encoding='utf-8')
|
||
print(f'✅ L4-007_meta_rule.txt 已生成')
|
||
|
||
# L4-010 正则样本
|
||
(SAMPLES / 'L4-010_regex_pattern.txt').write_text('powershell -enc ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwx+/==', encoding='utf-8')
|
||
print(f'✅ L4-010_regex_pattern.txt 已生成')
|
||
|
||
# L4-011 count 条件样本（同一串出现 5 次）
|
||
payload = 'malicious_token_count_test\n' * 5
|
||
(SAMPLES / 'L4-011_count_condition.txt').write_text(payload, encoding='utf-8')
|
||
print(f'✅ L4-011_count_condition.txt 已生成 (5 次)')
|
||
|
||
# L4-012 size 条件样本
|
||
(SAMPLES / 'L4-012_size_condition.txt').write_text('size_condition_test_payload small file', encoding='utf-8')
|
||
print(f'✅ L4-012_size_condition.txt 已生成')
|
||
|
||
print('\n=== 完成。下一步: docker compose up -d --build api 后靶场就能命中 ===')
|