sample: 补齐 L4-005/010 样本使其能被 YARA 规则命中
- L4-005: 加入 'meshsafe-hot-reload-test-string' → Newly_Added_Rule_Test - L4-010: 加入 'powershell -enc SQBFAFgAI...' → Regex_Shell_Pattern 对账进步: 162/168 → 164/168 (97.6%),剩余 4 条为样本占位符
This commit is contained in:
@@ -1 +1,4 @@
|
|||||||
rule hotload test
|
This is a hot-reload test sample for MeshSafe YARA engine.
|
||||||
|
The payload below should trigger Newly_Added_Rule_Test rule:
|
||||||
|
|
||||||
|
meshsafe-hot-reload-test-string
|
||||||
|
|||||||
@@ -1 +1,5 @@
|
|||||||
regex pattern shell
|
# MeshSafe YARA regex rule test sample
|
||||||
|
# This should trigger Regex_Shell_Pattern
|
||||||
|
|
||||||
|
attacker payload:
|
||||||
|
powershell -enc SQBFAFgAIAAoACgAbgBlAHcALQAtAG8AYgBqAGUAYwB0ACAA
|
||||||
|
|||||||
Reference in New Issue
Block a user