MeshSate/rules/webshell.yar

// =============================================================================
// MeshSafe L2B YARA 规则集 — Webshell 专项（C3）
// =============================================================================
//
// 设计原则：
//   - 所有规则使用 2-3 个特征组合命中，避免单一关键词导致误杀
//   - 光闸场景误报代价极高（阻断合法文件传输），宁可漏报不轻易阻断
//   - 命中后作为 finding 交给 PolicyEngine 权重累加，不直接零容忍
//
// 元数据规范：
//   risk_level     = critical | high | medium | low
//   category       = "C3"
//   false_positive_rate = low | medium | high
//
// 维护：
//   - 新 Webshell 工具/变体出现时，优先新增"工具特征"组合规则
//   - 纯 PHP/JSP 反序列化 payload 单特征也可能有价值，但组合原则仍适用
// =============================================================================


// =============================================================================
// PHP Webshell —— 一行马 / 变形马
// =============================================================================

// PHP 一行 eval($_POST) 组合（常见的菜刀/蚁剑/冰蝎基础形态）
// 单一 eval + $_GET/$_POST 误伤太大，必须"动态执行入口 + 用户输入 + 输出回显"三点组合
rule C3_PHP_Webshell_Oneliner {
    meta:
        risk_level = "critical"
        category = "C3"
        false_positive_rate = "low"
        reference = "OWASP Web Shell Cheat Sheet"
        description = "PHP 一行 Webshell：eval + 超全局变量 + 输出回显 组合命中"
    strings:
        $entrypoint = /eval\s*\(\s*\$\s*_(GET|POST|REQUEST|COOKIE)\s*\[.+\]\s*\)/ ascii
        // 备选入口：assert / create_function / preg_replace / system
        $entryp2 = /assert\s*\(\s*\$\s*_(GET|POST|REQUEST)/ ascii
        $entryp3 = /create_function\s*\(\s*['"]['"]\s*,\s*\$\s*_(GET|POST|REQUEST)/ ascii
        // 回显手段：print / echo / var_dump / die
        $echo = /print|echo|var_dump|die/ ascii
    condition:
        ($entrypoint or $entryp2 or $entryp3) and $echo
}

// PHP Webshell —— 多层解码（base64 + gzinflate + str_rot13）
rule C3_PHP_Webshell_Obfuscated {
    meta:
        risk_level = "high"
        category = "C3"
        false_positive_rate = "medium"
        reference = "典型 Webshell 变形手段"
        description = "PHP 解码链组合（base64_decode + gzinflate / str_rot13 + eval）"
    strings:
        $b64 = "base64_decode" ascii wide
        $eval = "eval(" ascii wide
        $gzinflate = "gzinflate" ascii wide
        $rot13 = "str_rot13" ascii wide
        $assert = "assert(" ascii wide
        $createfn = "create_function" ascii wide
    condition:
        // base64_decode + (eval|assert|create_function) = 解码后动态执行
        $b64 and ($eval or $assert or $createfn)
        or
        // 解码链：base64 + gzinflate / str_rot13 + 执行
        $b64 and ($gzinflate or $rot13) and ($eval or $assert)
}

// PHP Webshell —— 变量变形（$$a = $_POST['cmd']；$$a($_POST['arg'])）
rule C3_PHP_Webshell_VariableDeformation {
    meta:
        risk_level = "high"
        category = "C3"
        false_positive_rate = "medium"
        reference = "PHP 变量变形 Webshell 特征"
        description = "PHP 可变变量组合：$$ 或 ${$ 配合超全局变量"
    strings:
        $doubledollar = /\$\$\w+\s*=\s*\$\s*_(GET|POST|REQUEST)/ ascii
        $curlyvar = /\$\{\$\w+\}\s*\(/ ascii
        $superglobal = /\$_/ ascii
        $invoke = /\$\$\w+\s*\(/ ascii
    condition:
        ($doubledollar or ($curlyvar and $invoke)) and $superglobal
}


// =============================================================================
// JSP / Java Webshell —— 反射执行 + 反序列化
// =============================================================================

// JSP Runtime.exec + ProcessBuilder 反射执行链
rule C3_JSP_Webshell_RuntimeExec {
    meta:
        risk_level = "critical"
        category = "C3"
        false_positive_rate = "low"
        reference = "https://blog.csdn.net/JavaWebshell"
        description = "JSP 通过 Runtime.exec / ProcessBuilder 执行命令，配合反射 / 密码变量（cmd/pass/pwd）"
    strings:
        $runtime = "Runtime.getRuntime()" ascii
        $exec = ".exec(" ascii
        $processbuilder = "ProcessBuilder" ascii
        $cmdparam = /(cmd|pass|pwd|exec|shell)\s*=/ ascii
        $reflection = /Class\.forName|getMethod|getDeclaredMethod|Method\.invoke/ ascii
        $requestparam = /request\.getParameter\s*\(\s*['"](cmd|pass|pwd|exec|shell)['"]/ ascii
        $printwriter = /PrintWriter|getWriter|out\.println/ ascii
    condition:
        // Runtime.exec + 命令参数名 + 回显 = 完整 Webshell
        $runtime and $exec and ($requestparam or $printwriter)
        or
        // ProcessBuilder + 命令参数名
        $processbuilder and ($cmdparam or $requestparam)
        or
        // 反射链 + getRuntime().exec
        $runtime and $exec and any of ($reflection*)
}

// JSP 反序列化 CommonsCollections / ysoerial
rule C3_JSP_Webshell_Deserialization {
    meta:
        risk_level = "critical"
        category = "C3"
        false_positive_rate = "low"
        reference = "https://github.com/frohoff/ysoserial"
        description = "Java 反序列化利用链：CommonsCollections / Gadgets / InvokerTransformer"
    strings:
        $icc = "InvokerTransformer" ascii wide
        $lzy = "LazyMap" ascii wide
        $trn = "TransformerFactory" ascii wide
        $ccimpl = "TemplatesImpl" ascii wide
        $gadget = "CommonsCollections" ascii wide
        $readobj = /readObject\s*\(/ ascii wide
        $objectinputstream = "ObjectInputStream" ascii wide
        $execchain = /getRuntime\(\)\.exec|ProcessBuilder/ ascii wide
    condition:
        // 反序列化链：readObject + InvokerTransformer / LazyMap / TemplatesImpl + Runtime.exec
        $readobj and ($icc or $lzy or $trn or $ccimpl or $gadget) and any of ($execchain*)
        or
        // 直接 ObjectInputStream + 已知 Gadget
        $objectinputstream and ($icc or $ccimpl or $gadget)
}

// JSP Servlet Filter / Listener 注入型内存马
rule C3_JSP_Webshell_MemoryShell {
    meta:
        risk_level = "high"
        category = "C3"
        false_positive_rate = "medium"
        reference = "Tomcat / JBoss 内存马分析"
        description = "JSP 动态注册 Filter / Listener / Valve 实现内存 Webshell"
    strings:
        $filterdef = "FilterDef" ascii
        $applicationfilter = "ApplicationFilterConfig" ascii
        $addfilter = /addFilterDef|addFilterMap|addListener/ ascii
        $servletcontext = /ServletContext|getServletContext/ ascii
        $filter = "implements Filter" ascii
        $listener = /implements\s+(HttpSession|Servlet|Request)Listener/ ascii
        $standardctx = "StandardContext" ascii
        // 命令执行特征
        $runtime = "Runtime.getRuntime()" ascii
        $execchain = /getRuntime\(\)\.exec|ProcessBuilder/ ascii wide
    condition:
        // 动态 Filter 注册链：StandardContext + addFilterDef + FilterDef + ApplicationFilterConfig
        $standardctx and $addfilter and $filterdef and $applicationfilter
        or
        // Listener 注册链：ServletContext + Listener interface + addListener
        $servletcontext and $listener and any of ($addfilter)
        or
        // Filter 接口 + 命令执行（反射/内联）
        $filter and ($runtime or $execchain)
}


// =============================================================================
// 冰蝎 / 哥斯拉 / 蚁剑 —— 工具专属特征
// =============================================================================

// 冰蝎（Behinder）—— AES 加密通道 + 固定类名特征
rule C3_Webshell_Behinder {
    meta:
        risk_level = "critical"
        category = "C3"
        false_positive_rate = "low"
        reference = "https://github.com/rebeyond/Behinder"
        description = "冰蝎 Webshell 特征：AES/CBC/PKCS5Padding 或反射解密"
    strings:
        $aes = /AES\s*\/?\s*CBC\s*\/?\s*PKCS5Padding|AES\/CBC\/PKCS5Padding/ ascii wide
        $cipherget = "Cipher.getInstance" ascii wide
        $doFinal = /\.doFinal\s*\(/ ascii wide
        $secret = /secretKey|SecretKeySpec|PasswordKey/ ascii wide
        $toolname = /Behinder|behinder|冰蝎/ ascii wide nocase
        // JSP 命令执行特征
        $execchain1 = /getRuntime\(\)\.exec/ ascii wide
        $execchain2 = "ProcessBuilder" ascii wide
        // PHP 执行特征
        $phpdecrypt = "openssl_decrypt" ascii
        $phpb64 = "base64_decode" ascii
        $phpeval = "eval(" ascii
        $phpassert = "assert(" ascii
    condition:
        // 冰蝎 JSP：AES 加密解密 + secretKey + Runtime.exec
        $cipherget and $aes and $doFinal and $secret and any of ($execchain*)
        or
        // 冰蝎 PHP：openssl_encrypt + base64 + eval/assert
        $phpdecrypt and $phpb64 and ($phpeval or $phpassert)
        or
        // 直接工具名（极低概率误报）
        $toolname
}

// 哥斯拉（Godzilla）—— 加密通信 + 动态字节码加载
rule C3_Webshell_Godzilla {
    meta:
        risk_level = "critical"
        category = "C3"
        false_positive_rate = "low"
        reference = "https://github.com/whale1017/godzilla"
        description = "哥斯拉 Webshell 特征：ASM 字节码生成 + ClassLoader 动态加载"
    strings:
        $asm = "org.objectweb.asm" ascii wide
        $classloader = /defineClass|ClassLoader|loadClass/ ascii wide
        $bytes = /toByteArray|writeByteArray/ ascii wide
        $reflect = /setAccessible|getDeclaredMethod/ ascii wide
        $deserialize = "deserialize" ascii wide
        $toolname = /Godzilla|godzilla|哥斯拉/ ascii wide nocase
    condition:
        // ASM 字节码 + ClassLoader.defineClass = 动态加载
        $asm and ($classloader or $bytes) and any of ($reflect*)
        or
        // 反序列化 + ClassLoader
        $deserialize and $classloader
        or
        $toolname
}

// 蚁剑（AntSword）—— 基础 eval + 加密通信 + 自定义 Header
rule C3_Webshell_AntSword {
    meta:
        risk_level = "high"
        category = "C3"
        false_positive_rate = "medium"
        reference = "https://github.com/AntSwordProject/AntSword-Labs"
        description = "蚁剑 Webshell 特征：assert + 特定请求参数加密 + 自定义 HTTP 头"
    strings:
        $phpassert = /assert\s*\(\s*\$\s*_(GET|POST|REQUEST)/ ascii
        $phpcipher = /openssl_(encrypt|decrypt)|mcrypt_(encrypt|decrypt)/ ascii
        $header = /X-Request-Id|AntSword|antsword/ ascii
        $jspcipher = /AES|DES|RSA|Cipher/ ascii wide
    condition:
        // PHP：assert + openssl/mcrypt + 蚁剑特征 header
        $phpassert and $phpcipher and $header
        or
        // JSP：加密算法 + 特征 header（可能是蚁剑 JSP 变体）
        any of ($jspcipher) and $header
}


// =============================================================================
// ASP / ASP.NET Webshell
// =============================================================================

// ASP.NET Eval / Execute + Server.CreateObject("Wscript.Shell")
rule C3_Webshell_ASPNET {
    meta:
        risk_level = "high"
        category = "C3"
        false_positive_rate = "low"
        reference = "ASP.NET Webshell 常见手法"
        description = "ASP.NET Webshell：Eval/Execute + Server.CreateObject/Wscript.Shell + Process.Start"
    strings:
        $eval = /\bEval\s*\(\s*Request\s*\(/ ascii wide
        $execute = /\bExecute\s*\(\s*Request\s*\(/ ascii wide
        $wscript = /Server\.CreateObject\s*\(\s*["']Wscript\.Shell["']\s*\)/ ascii wide
        $processstart = /Process\.Start|Diagnostics\.Process/ ascii wide
        $reflect = /Activator\.CreateInstance|Assembly\.Load|BinaryFormatter/ ascii wide
    condition:
        // Eval + 动态执行
        ($eval or $execute) and ($wscript or $processstart or any of ($reflect*))
        or
        // Wscript.Shell + Process.Start
        $wscript and $processstart
        or
        // BinaryFormatter 反序列化 + 命令执行
        any of ($reflect*) and $processstart
}


// =============================================================================
// ASP Classic (VBScript)
// =============================================================================

rule C3_Webshell_ASP_Classic {
    meta:
        risk_level = "high"
        category = "C3"
        false_positive_rate = "medium"
        reference = "ASP Classic Webshell"
        description = "ASP Classic (VBScript) Webshell：Execute + Wscript.Shell + Request"
    strings:
        $execute = /\bExecute\s*\(\s*Request\s*\(/ ascii
        $wscript = "WScript.Shell" ascii
        $shellrun = /\.Run\s*\(\s*["']cmd/ ascii
        $servercreate = "Server.CreateObject" ascii
        $request = "Request(" ascii
    condition:
        // Execute + Request 取参
        $execute and $request
        or
        // Server.CreateObject(WScript.Shell) + cmd Run
        $servercreate and $wscript and $shellrun
}


// =============================================================================
// 通用：所有 Webshell 类（PHP/JSP/ASP）的 ProcessBuilder + 输出回显
// =============================================================================

rule C3_Webshell_CommandExecutionEcho {
    meta:
        risk_level = "critical"
        category = "C3"
        false_positive_rate = "low"
        reference = "综合 Webshell 命令执行链"
        description = "任何语言的 Webshell：命令执行 + 输出回显（三特征同时命中）"
    strings:
        $exec_php = /(system|exec|passthru|shell_exec|popen|proc_open)\s*\(\s*\$\s*_(GET|POST|REQUEST)/ ascii
        $exec_java = /Runtime\.getRuntime\(\)\.exec|ProcessBuilder/ ascii
        $exec_asp = /\.Run\s*\(\s*["']cmd|Process\.Start/ ascii
        // 回显通道
        $echo_php = /echo|print|passthru/ ascii
        $echo_java = /getWriter|getOutputStream|PrintWriter|out\.println|response\.getWriter/ ascii
        $echo_asp = /Response\.Write|output\.Write/ ascii
        // 参数来源（外部可控）
        $param_java = /request\.getParameter|HttpServletRequest|getParameter/ ascii wide
        $param_php = /\$_(GET|POST|REQUEST)\s*\[/ ascii
        $param_asp = /Request\("|\bRequest\(/ ascii
    condition:
        // PHP 路径
        $exec_php and $echo_php and $param_php
        or
        // Java/JSP 路径
        $exec_java and any of ($echo_java*) and any of ($param_java*)
        or
        // ASP 路径
        $exec_asp and $echo_asp and ($param_php or $param_asp)
}