MeshSate/rules/pe.yar

// =============================================================================
// MeshSafe L2B YARA 规则集 —— Windows PE 恶意程序专项（C1 + C8）
// =============================================================================
//
// 设计原则（v0.2.4 起，为消除干净软件误报而重写）：
//   1. 全文搜 API 名 = 必然误报。系统 DLL 会「导出」这些 API（kernel32 里就有
//      VirtualAllocEx/WriteProcessMemory/CreateRemoteThread 的明文字符串），
//      安全 SDK、安装器、调试组件同理。因此 C1 系列一律要求：
//        - 文件是 PE（uint16(0) == 0x5A4D），且
//        - 相关 API 名出现在同一个窗口内（导入名表是连续的，窗口 256~512B）。
//      导出表按字母序排列、跨度通常上 KB，落在窗口外 → 不误报；
//      真注入器/下载器的导入名表三条名字通常挨在一起 → 命中。
//   2. 不单独用「API 组合」定性，必须有硬指标（可疑路径 / 持久化键名 / C2 URL）。
//   3. 不用 3~4 字母裸串（曾经的 $persist5 = "RUN"）和裸工具名。
//   4. binary.py 的 PE 结构分析负责节熵/签名/导入 API 分级；YARA 只做组合特征。
//
// 范围：
//   - C1: Windows PE 恶意程序（注入器 / 下载器 / RAT / Loader）
//   - C8: 勒索 / 挖矿专项（勒索样本常以文本/脚本形态投递，不加 PE 头判定）
//   - C9: 壳特征（识别后建议送沙箱，不作为恶意证据）
//
// 维护：
//   - 新增规则先跑「干净 PE 回归」：C:/Windows/System32 全量 900+ 文件必须 0 命中
//   - meta.risk_level 会被 binary.py 读取用于严重度展示，必须与档位权重一致
// =============================================================================

import "pe"


// =============================================================================
// C1-1 进程注入三件套（VirtualAllocEx + WriteProcessMemory + CreateRemoteThread）
// 判定要点：三个导入名必须在同一张导入名表里（512B 窗口），否则是导出表明文
// =============================================================================

rule C1_PE_ProcessInjection {
    meta:
        risk_level = "critical"
        category = "C1"
        false_positive_rate = "low"
        reference = "MITRE ATT&CK T1055 Process Injection"
        description = "PE 导入表含进程注入三件套（同表紧邻）= 远控/注入器特征"
    strings:
        $alloc = "VirtualAllocEx" ascii
        $write = "WriteProcessMemory" ascii
        $thread = "CreateRemoteThread" ascii
        // 进程镂空（Process Hollowing）
        $unmap1 = "NtUnmapViewOfSection" ascii
        $unmap2 = "ZwUnmapViewOfSection" ascii
        // APC / Hook 注入
        $apc = "QueueUserAPC" ascii
        $hook = "SetWindowsHookEx" ascii
        $open = "OpenProcess" ascii
    condition:
        uint16(0) == 0x5A4D
        and
        (
            // 经典三件套：同表紧邻
            (
                $alloc and $write and $thread
                and for any i in (1..#alloc): (
                    $write in (@alloc[i] - 512..@alloc[i] + 512)
                    and $thread in (@alloc[i] - 512..@alloc[i] + 512)
                )
            )
            or
            // 镂空注入：unmap 必须和 write+thread 同表（kernel32/shell32 只是从
            // ntdll 导入成对的 NtMapView/NtUnmap，没有写入+远线程就不算镂空注入）
            (
                $write and $thread
                and for any i in (1..#unmap1): (
                    $write in (@unmap1[i] - 512..@unmap1[i] + 512)
                    and $thread in (@unmap1[i] - 512..@unmap1[i] + 512)
                )
            )
            or
            (
                $write and $thread
                and for any i in (1..#unmap2): (
                    $write in (@unmap2[i] - 512..@unmap2[i] + 512)
                    and $thread in (@unmap2[i] - 512..@unmap2[i] + 512)
                )
            )
            or
            // APC / Hook 注入：目标进程 API + 注入 API 同表紧邻
            (
                $alloc and $open and ($apc or $hook)
                and for any i in (1..#alloc): (
                    $open in (@alloc[i] - 512..@alloc[i] + 512)
                    and ($apc in (@alloc[i] - 512..@alloc[i] + 512)
                         or $hook in (@alloc[i] - 512..@alloc[i] + 512))
                )
            )
        )
}


// =============================================================================
// C1-2 下载器 / Loader（下载 API + 落地持久化键名，且两者同表紧邻）
// v0.2.3 的写法：任意下载 API + "WriteFile" + "CreateProcess" + 裸串 "RUN"
// → 任何带自动更新的正常软件必中。现在要求持久化硬指标。
// =============================================================================

rule C1_PE_Downloader_Loader {
    meta:
        risk_level = "high"
        category = "C1"
        false_positive_rate = "low"
        reference = "MITRE ATT&CK T1105 Ingress Tool Transfer"
        description = "下载 API 与自启动/服务注册持久化键名同表共存 = Loader"
    strings:
        // 下载类 API（保留专有名词，不用裸串）
        $net1 = "URLDownloadToFile" ascii
        $net2 = "InternetOpenUrl" ascii
        $net3 = "WinHttpOpenRequest" ascii
        $net4 = "WinHttpSendRequest" ascii
        $net5 = "URLDownloadToCacheFile" ascii
        $net6 = "FtpOpenFile" ascii
        $net7 = "WinHttpOpen" ascii
        $net8 = "InternetOpen" ascii

        // 自启动 / 服务注册持久化硬指标（不是裸 "RUN"）
        $p1 = "Software\\Microsoft\\Windows\\CurrentVersion\\Run" ascii nocase
        $p2 = "CurrentVersion\\RunOnce" ascii nocase
        $p3 = "schtasks.exe" ascii nocase
        $p4 = "CreateService" ascii
        $p5 = "Start Menu\\Programs\\StartUp" ascii nocase
        $p6 = "reg add" ascii nocase
        $p7 = "StartupApproved" ascii nocase

        // 临时目录落地（Loader 常先落 %TEMP%）
        $tmp1 = /\\AppData\\Local\\Temp\\[a-z0-9_. -]{3,60}\.(exe|dll|tmp|dat)/ ascii nocase
        $tmp2 = /%TEMP%\\[a-z0-9_. -]{3,60}\.(exe|dll|tmp)/ ascii nocase
        $tmp3 = /\\Windows\\Temp\\[a-z0-9_. -]{3,60}\.(exe|dll|tmp)/ ascii nocase
    condition:
        uint16(0) == 0x5A4D
        and any of ($net*)
        and any of ($p*)
        and
        (
            // 下载 API 与持久化键名同处一个导入/字符串表块
            for any i in (1..#net1): ( any of ($p*) in (@net1[i] - 1024..@net1[i] + 1024) )
            or (any of ($tmp*) and 2 of ($p*))
        )
}


// =============================================================================
// C1-3 RAT / 远控特征
// v0.2.3 的写法用 send( / recv( / system( 这类通用符号，且
// (bot|serv|gate|ops)\.(com|net) 会匹配任意域名字符串 → 正常联网程序必中。
// 现在要求：C2 硬指标（IP:PORT、可执行下载 URL、家族标记）+ 套接字 API 同表。
// =============================================================================

rule C1_PE_RAT_CommandControl {
    meta:
        risk_level = "critical"
        category = "C1"
        false_positive_rate = "low"
        reference = "MITRE ATT&CK T1071 Application Layer Protocol"
        description = "RAT C2 特征：套接字 API + 明确 C2 指标（IP:端口 / .exe 下载 / 家族标记）"
    strings:
        // 套接字 API（不用裸 send/recv/connect）
        $sock1 = "WSASend" ascii
        $sock2 = "WSARecv" ascii
        $sock3 = "WSAConnect" ascii
        $sock4 = "WSASocket" ascii
        $sock5 = "inet_ntoa" ascii
        $sock6 = "getpeername" ascii

        // 命令执行（真实 RAT 才会与 C2 同表出现）
        $cmd1 = "CreateProcess" ascii
        $cmd2 = "ShellExecute" ascii
        $cmd3 = "WinExec" ascii

        // C2 硬指标
        $c2ip = /https?:\/\/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}:[1-5][0-9]{3}/ ascii
        $c2exe = /https?:\/\/[^\s"']{4,}\.(exe|dll|scr|vbs|ps1|bat)\b/ ascii nocase
        $c2uri = /(gate|panel|submit|checkin|beacon|report)\.(php|aspx|html)\b/ ascii nocase
        $c2tld = /\b[a-z0-9-]{4,30}\.(ru|top|xyz|tk|ml|ga|gq|cf|pw|buzz|loan)\b/ ascii nocase
    condition:
        uint16(0) == 0x5A4D
        and 2 of ($sock*)
        and any of ($c2*)
        and
        (
            any of ($cmd*)
            or $c2exe
            or $c2uri
        )
}


// =============================================================================
// C1-4 Mutex 互斥体名（勒索 / RAT / Loader 的持久化标记）
// 需要 CreateMutex 与家族 Mutex 名同表，避免文本文档里提一嘴家族名就命中
// =============================================================================

rule C1_PE_Mutex_Persistence {
    meta:
        risk_level = "medium"
        category = "C1"
        false_positive_rate = "low"
        reference = "MITRE ATT&CK T1057 Process Discovery (mutex as persistence marker)"
        description = "CreateMutex + 已知家族 Mutex 名同表 = 持久化标记"
    strings:
        $createmutex = "CreateMutexA" ascii
        $createmutexw = "CreateMutexW" ascii
        // LockBit
        $lockbit1 = /Global\\[Ll]ock[Bb]it/ ascii
        $lockbit2 = /Local\\[Ll]ock[Bb]it/ ascii
        // BlackCat / ALPHV
        $blackcat = /(Global|Local)\\[Bb]lack[Cc]at|\bALPHV\b/ ascii
        // Ryuk
        $ryuk = /RyukTask[\d]|Global\\Ryuk/ ascii
        // Conti
        $conti = /(Global|Local)\\[Cc]onti/ ascii
        // Pseudo/Dharma
        $dharma = /(Global|Local)\\[Dd]harma/ ascii
        // 通用可疑模式：Mutex 名含 UUID 前缀
        $generic1 = /Global\\Mutex[0-9a-f]{8}/ ascii
        // Kryptik/Qakbot
        $qakbot = /\b[Qq]akbot\b|\b[Kk]ryptik\b/ ascii
        // Cobalt Strike named pipe
        $cs1 = /\\\\\.\\pipe\\msagent_[0-9a-f]+/ ascii
        $cs2 = /\\\\\.\\pipe\\[Bb]eacon_[0-9a-f]+/ ascii
    condition:
        uint16(0) == 0x5A4D
        and
        (
            any of ($cs*)
            or (
                any of ($createmutex*)
                and any of ($lockbit1, $lockbit2, $blackcat, $ryuk, $conti, $dharma, $qakbot, $generic1)
            )
        )
}


// =============================================================================
// C1-5 DLL 劫持 / 侧加载
// 只看「LoadLibrary + GetProcAddress + 临时目录里的 DLL 名」三件套；
// \ProgramData\ 与 \Public\ 是正常安装器路径，不再单独作为可疑路径
// =============================================================================

rule C1_PE_DLLHijacking {
    meta:
        risk_level = "high"
        category = "C1"
        false_positive_rate = "low"
        reference = "MITRE ATT&CK T1574 Hijack Execution Flow"
        description = "动态加载 API + 临时目录 DLL 落地 = DLL 侧加载/劫持"
    strings:
        $loadlib = "LoadLibraryA" ascii
        $loadlibw = "LoadLibraryW" ascii
        $getproc = "GetProcAddress" ascii
        $copy1 = "CopyFileA" ascii
        $copy2 = "CopyFileW" ascii
        $move = "MoveFileEx" ascii
        $temp1 = /\\AppData\\Local\\Temp\\[a-z0-9_. -]{3,40}\.dll/ ascii nocase
        $temp2 = /%TEMP%\\[a-z0-9_. -]{3,40}\.dll/ ascii nocase
        $temp3 = /\\Windows\\Temp\\[a-z0-9_. -]{3,40}\.dll/ ascii nocase
        $sysdir = "SetDllDirectory" ascii
        $searchorder = "LoadLibraryEx" ascii
    condition:
        uint16(0) == 0x5A4D
        and any of ($loadlib*, $searchorder)
        and any of ($temp*)
        and (any of ($getproc, $copy1, $copy2, $move, $sysdir))
}


// =============================================================================
// C1-6 LOLBin（Living Off The Land Binary）调用特征
// 命令行串 + 进程创建 API 必须同表紧邻（正常程序会把两者写进同一个导入/资源块）
// =============================================================================

rule C1_PE_LOLBin_Usage {
    meta:
        risk_level = "high"
        category = "C1"
        false_positive_rate = "low"
        reference = "https://lolbas-project.github.io/"
        description = "PE 中出现 LOLBin 调用命令行 + 进程创建 API（同表）"
    strings:
        $lolbin1 = /certutil(\.exe)?\s+(-urlcache|-decode)\s+-split/ ascii nocase
        $lolbin2 = /mshta(\.exe)?\s+(https?:|javascript:|vbscript:)/ ascii nocase
        $lolbin3 = /regsvr32(\.exe)?\s+\/s\s+\/u:http/ ascii nocase
        $lolbin4 = /bitsadmin(\.exe)?\s+\/transfer\s+\/source:/ ascii nocase
        $lolbin5 = /wmic(\.exe)?\s+process\s+call\s+create/ ascii nocase
        $lolbin6 = /msiexec(\.exe)?\s+\/[ia]\s+https?:/ ascii nocase
        $lolbin7 = /installutil(\.exe)?\s+\/u\s+\/logfile=https?:/ ascii nocase
        $lolbin8 = /psexec(\.exe)?\s+(-accepteula\s+)?-w\s+https?:/ ascii nocase
        $exec1 = "CreateProcess" ascii
        $exec2 = "ShellExecute" ascii
        $exec3 = "WinExec" ascii
    condition:
        uint16(0) == 0x5A4D
        and any of ($lolbin*)
        and any of ($exec*)
}


// =============================================================================
// C1-7 PE 高熵 + 网络 API（疑似加壳下载器）
// 需要「多个网络 API + 明确壳节名」同时成立
// =============================================================================

rule C1_PE_EntropyHighNetwork {
    meta:
        risk_level = "medium"
        category = "C1"
        false_positive_rate = "low"
        reference = "binary.py HighEntropySection 联动"
        description = "PE 加壳节名 + 多个下载 API = 加壳下载器"
    strings:
        $net1 = "InternetOpenUrl" ascii
        $net2 = "URLDownloadToFile" ascii
        $net3 = "WinHttpOpenRequest" ascii
        $net4 = "WSAConnect" ascii
    condition:
        uint16(0) == 0x5A4D
        and 2 of ($net*)
        and (
            for any i in (0..pe.number_of_sections - 1): (
                pe.sections[i].name matches /UPX0/ or pe.sections[i].name == "UPX1"
                or pe.sections[i].name matches /\.vmp[0-9]/ or pe.sections[i].name matches /Themida|\.themida/
            )
        )
}


// =============================================================================
// C8-1 勒索加密链（加密 API + 卷影删除/勒索信，勒索样本常以文本形态投递，不加 PE 头）
// =============================================================================

rule C8_Ransomware_Encryption {
    meta:
        risk_level = "critical"
        category = "C8"
        false_positive_rate = "low"
        reference = "MITRE ATT&CK T1486 Data Encrypted for Impact"
        description = "勒索加密链：加密 API + 卷影删除命令或勒索信文件名"
    strings:
        // 加密 API
        $enc1 = "CryptEncrypt" ascii
        $enc2 = "CryptDeriveKey" ascii
        $enc3 = "BCryptEncrypt" ascii
        $enc4 = "BCryptDeriveKeyPair" ascii
        $enc5 = "CryptGenKey" ascii

        // 文件遍历（全盘加密需要）
        $enum1 = "FindFirstFileA" ascii
        $enum2 = "FindFirstFileW" ascii
        $enum3 = "FindNextFileA" ascii
        $enum4 = "FindNextFileW" ascii

        // 卷影删除（完整命令，不认裸 "wmic"）
        $vss1 = "vssadmin" ascii nocase
        $vss2 = "delete shadows" ascii nocase
        $vss3 = "DeleteShadowCopies" ascii
        $vss4 = "shadow copies" ascii nocase

        // 勒索信文件名 / 加密扩展名
        $note1 = /(HOW_TO_RECOVER|RESTORE_FILES|DECRYPT_INSTRUCTIONS|HELP_DECRYPT)[\w.-]*\.(txt|html|png|jpg|bmp|url)/ nocase
        $note2 = /\.(locky|zepto|cryptolocker|crpt|encrypted|pay2)\b/ nocase
    condition:
        any of ($enc*)
        and
        (
            ($vss1 and ($vss2 or $vss3 or $vss4))
            or (2 of ($enum*) and any of ($note*))
            or (2 of ($enc*) and any of ($enum*) and $vss1)
        )
}


// =============================================================================
// C8-2 挖矿（xmrig / stratum+tcp / 矿池域名）
// =============================================================================

rule C8_Mining_Monero {
    meta:
        risk_level = "high"
        category = "C8"
        false_positive_rate = "low"
        reference = "MITRE ATT&CK T1496 Resource Hijacking"
        description = "挖矿程序特征：xmrig 命令行参数 / stratum+tcp / 矿池域名"
    strings:
        $xmrig1 = "xmrig" ascii nocase
        $xmrig2 = /--donate-level\s+\d+/ ascii
        $xmrig3 = /-o\s+stratum\+tcp/ ascii
        $xmrig4 = /--cpu-priority\s+\d/ ascii
        $xmrig5 = /--max-threads-hint/ ascii
        $pool1 = "pool.xmrig.com" ascii nocase
        $pool2 = "pool.minexmr.com" ascii nocase
        $pool3 = "pool.supportxmr.com" ascii nocase
        $pool4 = "mine.moneropool.com" ascii nocase
        $pool5 = "stratum+tcp://" ascii
        $thread = "CreateThread" ascii
    condition:
        any of ($pool1, $pool2, $pool3, $pool4)
        or ($pool5 and (any of ($xmrig*) or $thread))
        or (2 of ($xmrig*) and any of ($pool*))
}


// =============================================================================
// C9 壳特征（UPX / Themida / VMProtect）
// 加壳本身不是恶意证据（大量开源工具用 UPX），只作沙箱深检触发条件
// =============================================================================

rule C9_Packer_UPX {
    meta:
        risk_level = "low"
        category = "C9"
        false_positive_rate = "low"
        reference = "UPX Packer"
        description = "UPX 加壳 PE：节名 UPX0/UPX1 + UPX 签名"
    strings:
        $upx2 = "UPX!" ascii
    condition:
        uint16(0) == 0x5A4D
        and (
            (
                for any i in (0..pe.number_of_sections - 1): (
                    pe.sections[i].name matches /UPX0/
                )
                and for any j in (0..pe.number_of_sections - 1): (
                    pe.sections[j].name matches /UPX1/
                )
            )
            or ($upx2 and pe.number_of_sections <= 4)
        )
}

rule C9_Packer_Themida_VMP {
    meta:
        risk_level = "medium"
        category = "C9"
        false_positive_rate = "low"
        reference = "Themida / VMProtect"
        description = "商业壳特征：Themida / VMProtect 节名 + 产品标识字符串"
    strings:
        $themida1 = "Themida" ascii wide
        $themida2 = "WinLicense" ascii wide
        $themida3 = "Oreans" ascii wide
        $vmp1 = "VMProtect" ascii wide
    condition:
        uint16(0) == 0x5A4D
        and (
            for any i in (0..pe.number_of_sections - 1): (
                pe.sections[i].name matches /\.themida|\.vmp[0-9]/
            )
            or (any of ($themida*) and any of ($vmp1))
        )
}