MeshSate/rules/rule_labels.yaml

# MeshSafe 规则名中文标签映射
# 前端显示时用中文名代替引擎内部的英文 rule_name
# 层级分组对应 CSV 里的 L0-L5 + NEG + L7

# ===== L0 结构分析 =====
ArchiveBroken:
  label: "压缩包损坏"
  desc: "ZIP/7z 结构异常，目录项或文件头损坏"

ArchiveContainsExecutable:
  label: "压缩包内含可执行文件"
  desc: "归档内包含 .exe/.dll/.sys/.scr 等 PE 文件"

ExtensionMismatch:
  label: "后缀伪装"
  desc: "文件声明扩展名与真实幻数不符（如 jpg 后缀实际 MZ 头）"

DoubleExtension:
  label: "双扩展名伪装"
  desc: "文件名含两个扩展名，隐藏真实后缀（如 report.pdf.exe）"

DangerousExecutableExtension:
  label: "危险可执行扩展名"
  desc: "文件后缀属于可执行/脚本类型（exe/ps1/bat/cmd/js/vbs 等）"

ShellScriptDangerous:
  label: "危险脚本扩展名"
  desc: "shell/bash/powershell 等脚本类扩展名"

PathTraversal:
  label: "压缩包路径穿越"
  desc: "ZIP 内文件名包含 ../ 或绝对路径，可能覆盖系统文件"

PathTraversalBlocked:
  label: "路径穿越已拦截"
  desc: "扫描器已阻止路径穿越文件落地"

ArchiveBombSuspect:
  label: "ZIP 炸弹"
  desc: "压缩比异常高（如 42.zip），解压膨胀可能耗尽磁盘/内存"

EncryptedArchive:
  label: "加密压缩包"
  desc: "ZIP 设置了打开密码，无法扫描内部内容"

MalformedStructure:
  label: "文件结构畸形"
  desc: "文件能识别但内部结构不符合该格式规范"

ZeroByteFile:
  label: "零字节文件"
  desc: "空文件（0 字节）"

# ===== L1 ClamAV =====
"ClamAV:EICAR":
  label: "ClamAV EICAR 测试病毒"
  desc: "命中 ClamAV EICAR-STANDARD-ANTIVIRUS-TEST-FILE 签名"

Eicar-Test-Signature:
  label: "EICAR 测试签名"
  desc: "ClamAV 识别到 EICAR 标准测试串（行业无害测试）"

# ===== L2 文档深度 =====
OfficeEncrypted:
  label: "Office 加密文档"
  desc: "DOCX/XLSX/PPTX 设置了打开密码"

OleToolsUnavailable:
  label: "OLE 工具不可用"
  desc: "olefile 未安装，无法扫描 OLE 结构"

OoxmlParseFailed:
  label: "OOXML 解析失败"
  desc: "DOCX/XLSX/PPTX ZIP 内部 XML 损坏"

AttachedTemplate:
  label: "模板注入风险"
  desc: "Word 文档关联了外部模板（可能触发模板后门）"

VBAAutoExecShell:
  label: "VBA 宏自动执行 Shell"
  desc: "检测到 AutoOpen/Workbook_Open 等自动执行入口 + Shell/CreateObject 等危险调用"

PdfJavaScript:
  label: "PDF 内含 JavaScript"
  desc: "PDF 文档嵌入可执行 JavaScript"

PdfOpenAction:
  label: "PDF OpenAction 跳转"
  desc: "PDF 启动时有自动跳转/打开外部链接动作"

PdfParseFailed:
  label: "PDF 解析失败"
  desc: "PDF 结构异常或为占位文件，无法正常解析"

ChmWithScript:
  label: "CHM 内含脚本"
  desc: "CHM 帮助文档包含 ActiveScript/JScript"

DesktopFileAutoExec:
  label: "Linux .desktop 自动执行"
  desc: ".desktop 文件设置了自动执行属性"

# ===== L3 关键词匹配 =====
ReverseShellNetcat:
  label: "NC 反弹 Shell"
  desc: "包含 nc/ncat/netcat /bin/bash -i >& /dev/tcp/ 等反弹 shell 特征"

ReverseShellPowershell:
  label: "PowerShell EncodedCommand"
  desc: "包含 powershell -enc / -w hidden 等混淆执行"

CredentialStealer:
  label: "凭据窃取工具"
  desc: "包含 mimikatz/sekurlsa/gsecdump/DCSync/Rubeus 等"

CredentialExport:
  label: "凭据导出命令"
  desc: "包含 reg save HKLM\\SAM/SYSTEM/secretsdump 等"

RemoteDownloadPowerShell:
  label: "PowerShell 远程下载"
  desc: "Invoke-WebRequest/Invoke-RestMethod/DownloadString/BitsAdmin 等"

RemoteDownloadUnix:
  label: "Unix 远程下载"
  desc: "wget/curl/certutil -urlcache -split 等"

RemoteSessionHijack:
  label: "远程会话劫持"
  desc: "tscon/rdpclip/shadow/CreateRemoteThread 等"

CommandExecutionObfuscated:
  label: "命令执行混淆"
  desc: "certutil -decode/mshta/regsvr32 /s 等混淆执行"

WMILdapAttack:
  label: "WMI/LDAP 攻击"
  desc: "wmic path/wmic process call create/ldapsearch 等"

ClassifiedLevelMarkers:
  label: "涉密密级标记"
  desc: "包含绝密/机密/秘密/内部文件/禁止外传等密级标识"

InternalDocumentPatterns:
  label: "国家机密标识"
  desc: "包含国家机密|涉密|密级：等关键词"

# ===== L4 YARA =====
# 留空 → YARA 规则文件自己的 rule name 就是中文或 meta 里有描述

# ===== L5 PE 二进制 =====
UPXPackerDetected:
  label: "UPX 加壳"
  desc: "PE 节名包含 UPX0/UPX1/UPX!，检测到 UPX 加壳"

RWXSectionDetected:
  label: "RWX 可写可执行节"
  desc: "PE 节同时设置了 MEM_EXECUTE + MEM_WRITE，典型绕过 DEP 手法"

HighEntropySection:
  label: "节区熵值异常"
  desc: "PE 节熵 ≥ 7.2，可能经过加密或加壳"

SuspiciousImports:
  label: "可疑导入表"
  desc: "PE 导入表包含 VirtualAllocEx/WriteProcessMemory/CreateRemoteThread 等高危注入 API"

UnsignedExecutable:
  label: "未签名可执行文件"
  desc: "PE 未携带 Authenticode 数字签名"

SuspiciousTimestamp:
  label: "编译时间戳异常"
  desc: "PE 编译时间戳为 0 或指向未来时间，可能被伪造"

PEArchInfo:
  label: "PE 架构信息"
  desc: "PE 架构识别（x86/x64/ARM 等），辅助判断"

DebugInformationPresent:
  label: "含调试信息"
  desc: "PE 包含 PDB 调试路径或 .debug 节"

PeParseFailed:
  label: "PE 结构解析失败"
  desc: "pefile 无法解析 PE，可能是畸形文件"

LinuxExecutable:
  label: "Linux ELF 可执行"
  desc: "ELF 格式 Linux 可执行文件"

# ===== C1/C3/C7/C8 自动命名规则 =====
"C1_PE_Downloader_Loader":
  label: "YARA: PE 下载木马"
  desc: "YARA C1_PE_Downloader_Loader 规则命中"

"C1_PE_ProcessInjection":
  label: "YARA: PE 进程注入"
  desc: "YARA C1_PE_ProcessInjection 规则命中"

"C3_PHP_Webshell_Oneliner":
  label: "YARA: PHP 一句话木马"
  desc: "YARA C3_PHP_Webshell_Oneliner 规则命中"

"C3_PHP_Webshell_Obfuscated":
  label: "YARA: PHP 混淆木马"
  desc: "YARA C3_PHP_Webshell_Obfuscated 规则命中"

"C3_JSP_Webshell_RuntimeExec":
  label: "YARA: JSP Runtime exec 木马"
  desc: "YARA C3_JSP_Webshell_RuntimeExec 规则命中"

"C7_Linux_ReverseShell_Bash":
  label: "YARA: Bash 反弹 Shell"
  desc: "YARA C7_Linux_ReverseShell_Bash 规则命中"

"C7_Linux_ReverseShell_NC":
  label: "YARA: NC 反弹 Shell"
  desc: "YARA C7_Linux_ReverseShell_NC 规则命中"

"C7_Linux_ReverseShell_Misc":
  label: "YARA: Linux 反弹 Shell（其他）"
  desc: "YARA C7_Linux_ReverseShell_Misc 规则命中"

"C7_Linux_Persistence_Crontab":
  label: "YARA: Crontab 持久化"
  desc: "YARA C7_Linux_Persistence_Crontab 规则命中"

"C7_Linux_Miner_Generic":
  label: "YARA: 挖矿程序"
  desc: "YARA C7_Linux_Miner_Generic 规则命中"

"C8_Ransomware_Encryption":
  label: "YARA: 勒索加密特征"
  desc: "YARA C8_Ransomware_Encryption 规则命中"

"C8_Ransomware_Note_Filename":
  label: "YARA: 勒索赎金文件名"
  desc: "YARA C8_Ransomware_Note_Filename 规则命中"

"C8_Ransomware_VolumeShadow":
  label: "YARA: VSS 卷影副本删除"
  desc: "YARA C8_Ransomware_VolumeShadow 规则命中"

# ===== 邮件 =====
EmailAttachmentDangerous:
  label: "邮件附件危险"
  desc: "EML 包含 .exe/.dll/.ps1 等危险附件"

EmailAttachmentDisguised:
  label: "邮件附件伪装"
  desc: "EML 附件扩展名与真实类型不符"

EmailAttachmentWebshell:
  label: "邮件附件 Webshell"
  desc: "EML 附件为 PHP/ASP/JSP 一句话木马"

EmailPhishingKeyword:
  label: "钓鱼邮件关键词"
  desc: "EML 正文包含钓鱼诈骗关键词"

# ===== 其他 =====
SuspiciousScript:
  label: "可疑脚本"
  desc: "脚本内容触发通用恶意特征"

"Txt.Malware.Sustes-6779550-1":
  label: "ClamAV: Sustes 木马变体"
  desc: "ClamAV 识别到 Sustes 木马家族签名"

# ===== verdict → 中文 =====
# （前端直接写死在 template 里，这里留文档）
verdict_labels:
  clean: "干净（放行）"
  suspicious: "可疑（人工审核）"
  reject: "拦截（零容忍）"
  malicious: "恶意（零容忍）"
  pending: "待测"
  unknown: "未知"