From 43cfb0fe69e6a42e6d0a4912025f003c10416408 Mon Sep 17 00:00:00 2001
From: zhaolei <12153398@qq.com>
Date: Thu, 29 Oct 2026 16:15:38 +0800
Subject: [PATCH] =?UTF-8?q?sample:=20=E8=A1=A5=E9=BD=90=20L4-005/010=20?=
 =?UTF-8?q?=E6=A0=B7=E6=9C=AC=E4=BD=BF=E5=85=B6=E8=83=BD=E8=A2=AB=20YARA?=
 =?UTF-8?q?=20=E8=A7=84=E5=88=99=E5=91=BD=E4=B8=AD?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- L4-005: 加入 'meshsafe-hot-reload-test-string' → Newly_Added_Rule_Test
- L4-010: 加入 'powershell -enc SQBFAFgAI...' → Regex_Shell_Pattern

对账进步: 162/168 → 164/168 (97.6%)，剩余 4 条为样本占位符
---
 tests/samples/L4-005_005_sample.txt | 5 ++++-
 tests/samples/L4-010_010_sample.txt | 6 +++++-
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/tests/samples/L4-005_005_sample.txt b/tests/samples/L4-005_005_sample.txt
index 45e7f9d..3e1e009 100644
--- a/tests/samples/L4-005_005_sample.txt
+++ b/tests/samples/L4-005_005_sample.txt
@@ -1 +1,4 @@
-rule hotload test
\ No newline at end of file
+This is a hot-reload test sample for MeshSafe YARA engine.
+The payload below should trigger Newly_Added_Rule_Test rule:
+
+meshsafe-hot-reload-test-string
diff --git a/tests/samples/L4-010_010_sample.txt b/tests/samples/L4-010_010_sample.txt
index b134165..ecbcfcf 100644
--- a/tests/samples/L4-010_010_sample.txt
+++ b/tests/samples/L4-010_010_sample.txt
@@ -1 +1,5 @@
-regex pattern shell
\ No newline at end of file
+# MeshSafe YARA regex rule test sample
+# This should trigger Regex_Shell_Pattern
+
+attacker payload:
+powershell -enc SQBFAFgAIAAoACgAbgBlAHcALQAtAG8AYgBqAGUAYwB0ACAA