303 lines
9.2 KiB
YAML
303 lines
9.2 KiB
YAML
|
# ============================================================
|
|||
|
|
# MeshSafe 全局检测策略
|
|||
|
|
# 说明：所有裁决逻辑集中在此文件，调整策略无需改动代码。
|
|||
|
|
# 修改后调用 POST /api/v1/policies/reload 或重启服务生效。
|
|||
|
|
# ============================================================
|
|||
|
|
|
|||
|
|
version: "2026.10.2"
|
|||
|
|
description: "MeshSafe 默认全局策略（麒麟桌面/UOS x86 + WPS 目标终端）"
|
|||
|
|
|
|||
|
|
# ---------- 全局阈值 ----------
|
|||
|
|
global:
|
|||
|
|
# 风险分 ≥ 该值直接拒绝
|
|||
|
|
block_score: 70
|
|||
|
|
# 风险分落在该区间转人工复核
|
|||
|
|
review_score: [30, 70]
|
|||
|
|
# 引擎不可用时的降级策略：fail_closed（拒绝）/ fail_open（放行）
|
|||
|
|
# 生产环境应为 fail_closed，满足等保"安全优先"要求
|
|||
|
|
engine_failure_mode: fail_closed
|
|||
|
|
# 单文件大小上限（字节）—— 与 ClamAV MaxFileSize=1G 对齐，留余量给其他 5 引擎
|
|||
|
|
max_file_size: 1610612736 # 1.5 GB
|
|||
|
|
# 同步模式的最大文件大小，超过转异步
|
|||
|
|
sync_max_size: 536870912 # 512 MB（超过转异步扫描，避免请求超时）
|
|||
|
|
# 是否允许加密压缩包
|
|||
|
|
allow_encrypted_archive: false
|
|||
|
|
# 是否允许加密文档（Office 加密）
|
|||
|
|
allow_encrypted_document: false
|
|||
|
|
|
|||
|
|
# ================================================================
|
|||
|
|
# 零容忍规则集（独立于评分模型，优先级最高）
|
|||
|
|
# 命中即 reject，不走评分累加。与 §7.2 步骤 0 对应。
|
|||
|
|
# ================================================================
|
|||
|
|
|
|||
|
|
zero_tolerance_rules:
|
|||
|
|
# ---- 跨平台通用载体 ----
|
|||
|
|
- PdfJavaScript # PDF 打开即执行脚本
|
|||
|
|
- PdfLaunchAction # PDF 打开即启动程序
|
|||
|
|
- PdfOpenAction # PDF 打开即执行动作
|
|||
|
|
- PathTraversal # 解包路径穿越
|
|||
|
|
- IsoWithExecutable # ISO 挂载后内部含可执行
|
|||
|
|
- MacroObfuscated # 宏代码混淆/加密（意图不可知）
|
|||
|
|
- AttachedTemplate # Office 外部模板注入
|
|||
|
|
|
|||
|
|
# ---- 宏相关（WPS on Linux 生效）----
|
|||
|
|
- VBAAutoExec # VBA 宏 AutoOpen 自动执行入口
|
|||
|
|
- VBAAutoExecShell # VBA 宏自动执行 + Shell/CreateObject 调用
|
|||
|
|
- MRaptorAutoExec # mraptor 判定为自动执行宏
|
|||
|
|
- MRaptorAutoExecSuspicious # mraptor 判定为可疑自动执行宏
|
|||
|
|
- DDEAutoExecution # DDE/DDEAUTO 自动执行字段
|
|||
|
|
- EmbeddedExecutable # 文档内嵌可执行对象
|
|||
|
|
|
|||
|
|
# ---- Linux 专属载体 ----
|
|||
|
|
- LinuxExecutable # ELF 原生二进制
|
|||
|
|
- DesktopFileAutoExec # .desktop 文件 Exec= 字段含危险命令
|
|||
|
|
- ShellScriptDangerous # Shell/Python/Perl/Ruby 脚本含危险函数
|
|||
|
|
- LinuxPortableExecutable # AppImage/Flatpak/Snap 便携包
|
|||
|
|
- ArchiveContainsLinuxExec # 压缩包内混有 .sh/.deb/.run/.bin
|
|||
|
|
|
|||
|
|
# ---- Windows 专属载体（纵深防御）----
|
|||
|
|
- LnkWithAutoExec # LNK 快捷方式（Linux 不识别，保持检测）
|
|||
|
|
- ChmWithScript # CHM 帮助文件（Linux 默认不自动执行）
|
|||
|
|
|
|||
|
|
# ---------- 文件类型白名单 ----------
|
|||
|
|
# 只允许这些类型通过。空列表表示不限制（不推荐生产使用）。
|
|||
|
|
allowed_extensions:
|
|||
|
|
# --- Office 文档 ---
|
|||
|
|
- .doc
|
|||
|
|
- .docx
|
|||
|
|
- .docm
|
|||
|
|
- .xls
|
|||
|
|
- .xlsx
|
|||
|
|
- .xlsm
|
|||
|
|
- .ppt
|
|||
|
|
- .pptx
|
|||
|
|
- .pptm
|
|||
|
|
- .rtf
|
|||
|
|
- .pdf
|
|||
|
|
- .wps # WPS 文字
|
|||
|
|
- .et # WPS 表格
|
|||
|
|
- .dps # WPS 演示
|
|||
|
|
|
|||
|
|
# --- 文本与图像 ---
|
|||
|
|
- .txt
|
|||
|
|
- .csv
|
|||
|
|
- .json
|
|||
|
|
- .xml
|
|||
|
|
- .yaml
|
|||
|
|
- .yml
|
|||
|
|
- .html
|
|||
|
|
- .htm
|
|||
|
|
- .md # Markdown（飞书/Notion 导出）
|
|||
|
|
- .markdown
|
|||
|
|
- .jpg
|
|||
|
|
- .jpeg
|
|||
|
|
- .png
|
|||
|
|
- .gif
|
|||
|
|
- .bmp
|
|||
|
|
- .tiff
|
|||
|
|
- .svg
|
|||
|
|
- .webp
|
|||
|
|
|
|||
|
|
# --- 音视频 ---
|
|||
|
|
- .mp4
|
|||
|
|
- .mov
|
|||
|
|
- .avi
|
|||
|
|
- .mkv
|
|||
|
|
- .wmv
|
|||
|
|
- .flv
|
|||
|
|
- .webm
|
|||
|
|
- .mp3
|
|||
|
|
- .wav
|
|||
|
|
- .flac
|
|||
|
|
- .m4a
|
|||
|
|
|
|||
|
|
# --- 脑图/设计 ---
|
|||
|
|
- .xmind
|
|||
|
|
- .drawio
|
|||
|
|
- .vsdx
|
|||
|
|
- .bpmn
|
|||
|
|
- .epub
|
|||
|
|
|
|||
|
|
# --- 邮件 ---
|
|||
|
|
- .eml
|
|||
|
|
- .msg
|
|||
|
|
|
|||
|
|
# --- 归档（允许进入后递归扫描）---
|
|||
|
|
- .zip
|
|||
|
|
- .rar
|
|||
|
|
- .7z
|
|||
|
|
- .tar
|
|||
|
|
- .gz
|
|||
|
|
- .bz2
|
|||
|
|
- .xz
|
|||
|
|
- .iso
|
|||
|
|
|
|||
|
|
# --- 可执行与脚本（零容忍规则拦截，此处允许进入裁决流程）---
|
|||
|
|
# 两层防御：零容忍（步骤 0）先拦截，扩展名白名单（步骤 3）作为兜底
|
|||
|
|
# 这样策略中临时禁用某个零容忍规则时，文件仍可进入评分裁决
|
|||
|
|
- .exe
|
|||
|
|
- .dll
|
|||
|
|
- .msi
|
|||
|
|
- .scr
|
|||
|
|
- .com
|
|||
|
|
- .elf
|
|||
|
|
- .so
|
|||
|
|
- .desktop
|
|||
|
|
- .appimage
|
|||
|
|
- .deb
|
|||
|
|
- .rpm
|
|||
|
|
- .run
|
|||
|
|
- .bin
|
|||
|
|
- .snap
|
|||
|
|
- .sh
|
|||
|
|
- .bash
|
|||
|
|
- .zsh
|
|||
|
|
- .py
|
|||
|
|
- .pl
|
|||
|
|
- .rb
|
|||
|
|
- .js
|
|||
|
|
- .vbs
|
|||
|
|
- .bat
|
|||
|
|
- .cmd
|
|||
|
|
- .ps1
|
|||
|
|
- .hta
|
|||
|
|
- .lnk
|
|||
|
|
- .chm
|
|||
|
|
|
|||
|
|
# ---------- 需要强制深检的类型 ----------
|
|||
|
|
# 一期无沙箱，此配置预留。命中这些类型自动转异步。
|
|||
|
|
sandbox_required_extensions:
|
|||
|
|
- .exe
|
|||
|
|
- .msi
|
|||
|
|
- .iso
|
|||
|
|
|
|||
|
|
# ---------- 特定规则的处置覆盖 ----------
|
|||
|
|
# 仅针对未进入零容忍集的规则。零容忍规则已在上方处理，此处不再覆盖。
|
|||
|
|
# rule_name: [action, reason_override]
|
|||
|
|
# action 取值：pass / pass_with_flag / manual_review / reject / reject_and_notify
|
|||
|
|
rule_overrides:
|
|||
|
|
VBAShellInvocation:
|
|||
|
|
action: manual_review
|
|||
|
|
reason: "宏调用 Shell 但无自动执行入口，需人工复核"
|
|||
|
|
ArchiveContainsExecutable:
|
|||
|
|
action: manual_review
|
|||
|
|
reason: "压缩包内含 Windows 可执行文件，转人工确认（Linux 不识别）"
|
|||
|
|
ArchiveBombSuspect:
|
|||
|
|
action: reject
|
|||
|
|
reason: "压缩比异常，疑似压缩炸弹"
|
|||
|
|
ExtensionMismatch:
|
|||
|
|
action: reject
|
|||
|
|
reason: "声明扩展名与真实类型不一致，疑似伪装"
|
|||
|
|
DoubleExtension:
|
|||
|
|
action: reject
|
|||
|
|
reason: "双扩展名伪装，高风险"
|
|||
|
|
# ---- 邮件相关 ----
|
|||
|
|
EmailAttachmentDangerous:
|
|||
|
|
action: manual_review
|
|||
|
|
reason: "邮件附件为高风险类型，需人工确认是否为钓鱼/恶意附件"
|
|||
|
|
EmailAttachmentDisguised:
|
|||
|
|
action: reject
|
|||
|
|
reason: "邮件附件存在双扩展名伪装，高风险钓鱼特征"
|
|||
|
|
EmailPhishingKeyword:
|
|||
|
|
action: manual_review
|
|||
|
|
reason: "邮件正文/Subject 命中钓鱼特征，需人工确认"
|
|||
|
|
# ---- 加密 ----
|
|||
|
|
OfficeEncrypted:
|
|||
|
|
action: reject
|
|||
|
|
reason: "Office 文档已加密，策略禁止加密文档进入内网"
|
|||
|
|
|
|||
|
|
# ---------- 通知设置 ----------
|
|||
|
|
notification:
|
|||
|
|
# 拒绝时是否返回详细原因给调用方（便于摆渡系统向用户提示）
|
|||
|
|
include_reason: true
|
|||
|
|
# 拒绝原因的最大长度
|
|||
|
|
max_reason_length: 500
|
|||
|
|
|
|||
|
|
# ---------- YARA 规则权重映射 ----------
|
|||
|
|
# 按规则名精细设定权重（0-100），覆盖 binary.py 里的默认 weight=50
|
|||
|
|
# 命中但不在下列名单中的规则 weight 保持默认值 50
|
|||
|
|
# 严重度分档由规则内 meta.risk_level 决定（critical/high/medium/low）
|
|||
|
|
yara_rule_weights:
|
|||
|
|
critical: # weight=85
|
|||
|
|
- C3_PHP_Webshell_Oneliner
|
|||
|
|
- C3_JSP_Webshell_RuntimeExec
|
|||
|
|
- C3_Webshell_Behinder
|
|||
|
|
- C1_PE_ProcessInjection
|
|||
|
|
- C8_Ransomware_Encryption
|
|||
|
|
- C8_Ransomware_LockBit
|
|||
|
|
- C8_Ransomware_BlackCat
|
|||
|
|
- C8_Ransomware_Conti
|
|||
|
|
- C7_Linux_ReverseShell_Bash
|
|||
|
|
- C7_Linux_ReverseShell_NC
|
|||
|
|
- C7_Linux_Rootkit_KernelModule
|
|||
|
|
high: # weight=65
|
|||
|
|
- C3_PHP_Webshell_Obfuscated
|
|||
|
|
- C3_PHP_Webshell_VariableDeformation
|
|||
|
|
- C3_Webshell_CommandExecutionEcho
|
|||
|
|
- C3_Webshell_Godzilla
|
|||
|
|
- C1_PE_Downloader_Loader
|
|||
|
|
- C1_PE_RAT_CommandControl
|
|||
|
|
- C1_PE_LOLBin_Usage
|
|||
|
|
- C1_PE_Mutex_Persistence
|
|||
|
|
- C7_Linux_ReverseShell_Python
|
|||
|
|
- C7_Linux_ReverseShell_Perl
|
|||
|
|
- C7_Linux_ReverseShell_Socat
|
|||
|
|
- C7_Linux_Persistence_Crontab
|
|||
|
|
- C7_Linux_Persistence_SystemD
|
|||
|
|
- C7_Linux_Persistence_AuthorizedKeys
|
|||
|
|
- C7_Linux_Persistence_LD_PRELOAD
|
|||
|
|
- C8_Ransomware_VolumeShadow
|
|||
|
|
- C8_Ransomware_Note_Filename
|
|||
|
|
- C8_Ransomware_Ryuk_Pseudo
|
|||
|
|
medium: # weight=45
|
|||
|
|
- C9_Packer_UPX
|
|||
|
|
- C9_Packer_Themida_VMP
|
|||
|
|
- C1_PE_DLLHijacking
|
|||
|
|
- C1_PE_EntropyHighNetwork
|
|||
|
|
- C7_Linux_Miner_Generic
|
|||
|
|
- C7_Misc_Ruby_Lua_ReverseShell
|
|||
|
|
- C7_Network_Tools_Malicious
|
|||
|
|
- C3_Webshell_AntSword
|
|||
|
|
- C3_Webshell_ASPNET
|
|||
|
|
- C3_Webshell_ASP_Classic
|
|||
|
|
- C3_JSP_Webshell_Deserialization
|
|||
|
|
- C3_JSP_Webshell_MemoryShell
|
|||
|
|
- C3_Webshell_CommandExecutionEcho
|
|||
|
|
- C8_Ransomware_Extension_Blacklist
|
|||
|
|
low: # weight=25
|
|||
|
|
- C7_Linux_ReverseShell_Misc
|
|||
|
|
|
|||
|
|
|
|||
|
|
# ---------- 内网特征词表引擎（P1）----------
|
|||
|
|
# 规则为数据驱动：在 policy.yaml 中声明，引擎从 PolicyStore 加载。
|
|||
|
|
# 控制台 P2 可实时修改并热重载。
|
|||
|
|
# 每条规则字段：
|
|||
|
|
# name: 规则名（Finding.rule）
|
|||
|
|
# match: contains | regex | any_of
|
|||
|
|
# pattern: contains/regex 模式的匹配串
|
|||
|
|
# keywords: any_of 模式的关键词列表
|
|||
|
|
# weight: 评分权重（默认 30）
|
|||
|
|
# severity: low | medium | high | critical（默认 medium）
|
|||
|
|
# ignore_case: 正则模式是否忽略大小写
|
|||
|
|
keyword_rules:
|
|||
|
|
# ---- 内网合规特征（辅助判断，不进零容忍）----
|
|||
|
|
- name: ClassifiedLevelMarkers
|
|||
|
|
match: any_of
|
|||
|
|
keywords: ["绝密", "机密", "秘密", "内部文件", "内部资料", "禁止外传"]
|
|||
|
|
weight: 25
|
|||
|
|
severity: low
|
|||
|
|
|
|||
|
|
- name: InternalDocumentPatterns
|
|||
|
|
match: regex
|
|||
|
|
pattern: "(?:国家机密|涉密|密级[：:]\\s*[一二三四五])"
|
|||
|
|
ignore_case: true
|
|||
|
|
weight: 30
|
|||
|
|
severity: medium
|
|||
|
|
|
|||
|
|
# ---------- 审计 ----------
|
|||
|
|
audit:
|
|||
|
|
# 记录扫描结果明细到审计日志
|
|||
|
|
log_findings: true
|
|||
|
|
# 是否记录提取到的子文件路径
|
|||
|
|
log_extracted_paths: true
|