From b6a004bdb766c64b4ff814862c7fb7a02c95c1f1 Mon Sep 17 00:00:00 2001 From: zhaolei <12153398@qq.com> Date: Mon, 2 Nov 2026 20:26:56 +0800 Subject: [PATCH] =?UTF-8?q?fix:=20=E5=85=AD=E5=BC=95=E6=93=8E=E8=AF=AF?= =?UTF-8?q?=E6=8A=A5=E6=A0=B9=E5=9B=A0=E4=BF=AE=E5=A4=8D=20=E2=80=94=20?= =?UTF-8?q?=E8=A7=A3=E5=8C=85=E9=80=92=E5=BD=92=E3=80=81YARA=20=E6=81=92?= =?UTF-8?q?=E7=9C=9F=E8=A7=84=E5=88=99=E3=80=81=E7=AD=BE=E5=90=8D=E5=88=86?= =?UTF-8?q?=E7=BA=A7=E3=80=81real=5Ftype=20=E6=BA=A2=E5=87=BA?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 检测范围与证据链修复，不改裁决口径（口径改动在下一条提交）。 - extractor：zip/tar 成员在超限分支外漏加回扫描队列，解包后内容永远不参与检测； zip 目录条目被当成内嵌对象；tar 超限成员先落盘不删。递归真正生效后深扫耗时可测。 - clamav：_HIGH/_MEDIUM/_UNWANTED 关键词是小写，而签名名是 "Win.Trojan..." 大小写混排， 分级判定恒不命中全走默认档；改统一大写匹配。超过 clamd MaxFileSize 的裸奔区间 (1G~1.5G) 新增 ClamAVSkippedSizeLimit(30) — 按"不可扫描不放行"进复核。 - yara：pe.yar C1 系列改用导入表判定，不再靠裸子串命中字符串表； linux.yar C7 多条规则条件恒真（裸 nc/fetch 之类）已收紧；C8/C3 相应收窄。 - structure：DangerousExecutableExtension 是载体信号而非恶意行为，critical 权重 45→35， 不再作为把中低置信度信号一起顶过 block_score 的底座。 - scanner/documents：real_type 拼进 libmagic 对 MSI/OLE 的元数据串实测 334+ 字符， 超列宽导致整条 scan_tasks INSERT 连 findings 一起丢（被拒文件不留痕）→ 列宽 256→512，migrate.sql 补 ALTER。 --- app/engines/binary.py | 174 ++++++++++++--- app/engines/clamav.py | 18 +- app/engines/documents.py | 54 ++++- app/engines/extractor.py | 39 ++-- app/engines/keywords.py | 32 ++- app/engines/structure.py | 5 +- app/models.py | 2 +- app/services/scanner.py | 19 +- rules/linux.yar | 91 +++++--- rules/pe.yar | 445 ++++++++++++++++++++++----------------- rules/ransom.yar | 45 ++-- rules/webshell.yar | 17 +- scripts/migrate.sql | 6 + 13 files changed, 636 insertions(+), 311 deletions(-) diff --git a/app/engines/binary.py b/app/engines/binary.py index 4b75efc..906e7cc 100644 --- a/app/engines/binary.py +++ b/app/engines/binary.py @@ -23,6 +23,32 @@ BINARY_EXTS = {".exe", ".dll", ".sys", ".scr", ".com", ".cpl", ".ocx", ".msi", " _PE_SCN_MEM_EXECUTE = 0x20000000 _PE_SCN_MEM_WRITE = 0x80000000 +# 声明扩展名 → 该格式自己的魔数。这些容器本就不是 PE，用 pefile 解析必然抛错； +# 把"格式完全正常的安装包/共享库"记成 PeParseFailed 会给每个 .msi/.jar/.so 白送 10 分。 +_NATIVE_MAGIC: Dict[str, Any] = { + ".msi": (b"\xd0\xcf\x11\xe0",), + ".msp": (b"\xd0\xcf\x11\xe0",), + ".mst": (b"\xd0\xcf\x11\xe0",), + ".jar": (b"PK\x03\x04", b"PK\x05\x06"), + ".war": (b"PK\x03\x04", b"PK\x05\x06"), + ".apk": (b"PK\x03\x04", b"PK\x05\x06"), + ".so": (b"\x7fELF",), + ".elf": (b"\x7fELF",), +} + + +def _is_native_container(path: str, ext: str) -> bool: + """文件内容是否就是其声明格式（非 PE）。""" + expected = _NATIVE_MAGIC.get(ext) + if not expected: + return False + try: + with open(path, "rb") as fh: + head = fh.read(4) + except OSError: + return False + return any(head.startswith(m) for m in expected) + def _manual_pe_analysis(path: str) -> List[Finding]: """pefile 解析失败时，手工搜索 PE\\0\\0 签名并解析节表。 @@ -172,6 +198,8 @@ class YaraEngine(Engine): return result try: + # 本环境的 yara-python 4.5.4 在 Match 对象上默认就带 meta， + # 且 rules.match() 不接受 with_meta 关键字（传了会整引擎报错）。 matches = rules.match(target.path) except Exception as exc: # noqa: BLE001 result.ok = False @@ -179,7 +207,8 @@ class YaraEngine(Engine): return result for match in matches: - severity, weight = _judge_yara_rule(match.rule, match.tags) + meta = getattr(match, "meta", None) or {} + severity, weight = _judge_yara_rule(match.rule, match.tags, meta) # 覆盖：如果 ctx 里的策略为该 YARA 规则定义了精细权重，用它 try: policy = ctx.policy_engine.policy @@ -188,13 +217,18 @@ class YaraEngine(Engine): weight = float(yara_weights[match.rule]) except Exception: pass # ctx 没有 policy 字段时保持默认 weight + desc = str(meta.get("description", "")).strip() + tags_text = ", ".join(match.tags) result.findings.append( Finding( engine=self.name, layer=self.layer, severity=severity, rule=match.rule, - detail=f"YARA 规则 {match.rule} 命中（标签：{', '.join(match.tags) or '无'}）", + detail=( + f"YARA 规则 {match.rule} 命中" + + (f"（{desc}）" if desc else f"（标签：{tags_text or '无'}）") + ), weight=weight, meta={"tags": list(match.tags)}, ) @@ -232,6 +266,10 @@ class BinaryEngine(Engine): if ext not in BINARY_EXTS: return result + # 内容确实是声明的那个非 PE 容器（MSI=CFB、JAR/APK=ZIP、SO/ELF=ELF）→ 不做 PE 分析 + if _is_native_container(target.path, ext): + return result + try: import pefile except Exception: # noqa: BLE001 @@ -290,17 +328,54 @@ class BinaryEngine(Engine): ) ) - # 2) 可疑导入表 - suspicious_imports = self._suspicious_imports(pe) - if suspicious_imports: + # 2) 导入表能力信号：只做佐证，不做独立定罪 + # Windows 自身的内核/外壳组件（kernel32、shell32、wer）必然导入 + # VirtualAllocEx/WriteProcessMemory 这类 API——它们就是这些 API 的实现方。 + # 真正的注入判定由 YARA C1_PE_ProcessInjection（导入名邻接窗口）负责， + # 这里按「命中个数」而不是「命中即高危」计分，避免正常软件被判恶意。 + tier1, tier2, tier3 = self._suspicious_imports(pe) + if len(tier1) >= 2: findings.append( Finding( engine=self.name, layer=self.layer, severity=Severity.HIGH.value, rule="SuspiciousImports", - detail=f"导入表包含高危 API：{', '.join(suspicious_imports[:8])}", - weight=25.0, + detail=f"导入表同时包含多个注入/后门级 API：{', '.join(tier1[:8])}", + weight=20.0, + ) + ) + elif len(tier1) == 1: + findings.append( + Finding( + engine=self.name, + layer=self.layer, + severity=Severity.LOW.value, + rule="SuspiciousImports", + detail=f"导入表含单个注入/后门级 API（系统组件常态，需其他信号佐证）：{tier1[0]}", + weight=5.0, + ) + ) + if len(tier2) >= 3: + findings.append( + Finding( + engine=self.name, + layer=self.layer, + severity=Severity.LOW.value, + rule="CapabilityImports", + detail=f"导入表同时具备多项危险能力：{', '.join(tier2[:8])}", + weight=10.0, + ) + ) + elif tier3: + findings.append( + Finding( + engine=self.name, + layer=self.layer, + severity=Severity.INFO.value, + rule="AntiDebugImports", + detail=f"导入表含反调试/环境探测 API（正常软件普遍使用）：{', '.join(tier3[:8])}", + weight=0.0, ) ) @@ -312,8 +387,8 @@ class BinaryEngine(Engine): layer=self.layer, severity=Severity.MEDIUM.value, rule="UnsignedExecutable", - detail="可执行文件未携带数字签名", - weight=20.0, + detail="可执行文件未携带数字签名（内网自研工具常态，仅辅助人工判断）", + weight=10.0, ) ) @@ -330,7 +405,7 @@ class BinaryEngine(Engine): severity=Severity.LOW.value, rule="SuspiciousTimestamp", detail="PE 编译时间戳异常，可能被伪造", - weight=10.0, + weight=0.0, ) ) except Exception: # noqa: BLE001 @@ -433,32 +508,62 @@ class BinaryEngine(Engine): severity=Severity.LOW.value, rule="DebugInformationPresent", detail="PE 包含调试信息（PDB 路径或 .debug 节），可用于逆向定位", - weight=10.0, + weight=0.0, ) ) return findings - def _suspicious_imports(self, pe: Any) -> List[str]: - """检测高危 API 导入。""" - suspicious = { + def _suspicious_imports(self, pe: Any) -> "tuple[List[str], List[str], List[str]]": + """导入 API 按恶意指向分档。 + + 返回 (tier1, tier2, tier3)： + tier1 注入/后门级 API —— 单独出现即可疑 + tier2 危险能力 API —— 正常软件也常用，需多项共存才计分 + tier3 反调试/探测 API —— 信息项，不计分（大量合法商业软件带加壳自保会用） + """ + tier1_set = { "VirtualAllocEx", "WriteProcessMemory", "CreateRemoteThread", - "NtUnmapViewOfSection", "SetWindowsHookEx", "OpenProcess", - "WinHttpOpen", "InternetOpenUrl", "URLDownloadToFile", - "CryptEncrypt", "AdjustTokenPrivileges", "CreateService", - "ShellExecute", "WinExec", "IsDebuggerPresent", "CheckRemoteDebuggerPresent", + "NtUnmapViewOfSection", "SetWindowsHookEx", "SetWindowsHookExA", + "SetWindowsHookExW", "URLDownloadToFileA", "URLDownloadToFileW", + "QueueUserAPC", "NtQueueApcThread", "RtlCreateUserThread", } - found: List[str] = [] + tier2_set = { + "OpenProcess", "WinHttpOpen", "WinHttpOpenRequest", "WinHttpSendRequest", + "CryptEncrypt", "CryptDeriveKey", "AdjustTokenPrivileges", + "LookupPrivilegeValueA", "LookupPrivilegeValueW", "OpenProcessToken", + "VirtualProtectEx", "ReadProcessMemory", "SuspendThread", "GetAsyncKeyState", + "SetWinEventHook", "HttpSendRequestA", "InternetWriteFile", + "RegSetValueExA", "RegSetValueExW", + # 以下 API 恶意软件常用，但任何"要装服务/要启动进程/要联网"的正常 + # 软件都必然导入它们，不足以单独定罪 + "WinExec", "ShellExecuteExA", "ShellExecuteExW", "CreateServiceA", + "CreateServiceW", "InternetOpenUrlA", "InternetOpenUrlW", + "CreateNamedPipeA", "DefineDosDeviceW", + } + tier3_set = { + "IsDebuggerPresent", "CheckRemoteDebuggerPresent", "OutputDebugStringA", + "GetTickCount", "GetTickCount64", "QueryPerformanceCounter", + "GetProcessHeap", "FindWindowA", "FindWindowW", + } + found1: List[str] = [] + found2: List[str] = [] + found3: List[str] = [] try: for entry in getattr(pe, "DIRECTORY_ENTRY_IMPORT", []) or []: for imp in entry.imports: - if imp.name: - name = imp.name.decode("utf-8", errors="replace") - if name in suspicious: - found.append(name) + if not imp.name: + continue + name = imp.name.decode("utf-8", errors="replace") + if name in tier1_set: + found1.append(name) + elif name in tier2_set: + found2.append(name) + elif name in tier3_set: + found3.append(name) except Exception: # noqa: BLE001 pass - return sorted(set(found)) + return sorted(set(found1)), sorted(set(found2)), sorted(set(found3)) def _has_signature(self, pe: Any) -> bool: """检查 PE 是否包含 Authenticode 签名目录。""" @@ -469,8 +574,25 @@ class BinaryEngine(Engine): return False -def _judge_yara_rule(rule: str, tags: List[str]) -> tuple[str, float]: - """依据 YARA 规则名与标签判定严重度。""" +_YARA_RISK_SEVERITY = { + "critical": Severity.CRITICAL.value, + "high": Severity.HIGH.value, + "medium": Severity.MEDIUM.value, + "low": Severity.LOW.value, +} +_YARA_RISK_WEIGHT = {"critical": 85.0, "high": 60.0, "medium": 30.0, "low": 10.0} + + +def _judge_yara_rule(rule: str, tags: List[str], meta: Dict[str, Any] | None = None) -> tuple[str, float]: + """依据规则 meta.risk_level 判定严重度（其次才是标签/规则名启发式）。 + + v0.2.3 只看标签与规则名，规则库里的 risk_level 被完全忽略， + 结果 65 分的 C1_PE_RAT 显示成"低危"，权重与严重度两套口径。 + """ + risk = str((meta or {}).get("risk_level", "")).strip().lower() + if risk in _YARA_RISK_SEVERITY: + return _YARA_RISK_SEVERITY[risk], _YARA_RISK_WEIGHT[risk] + tag_set = {t.lower() for t in tags} text = f"{rule} {' '.join(tags)}".lower() diff --git a/app/engines/clamav.py b/app/engines/clamav.py index ff535e1..921aa4d 100644 --- a/app/engines/clamav.py +++ b/app/engines/clamav.py @@ -45,9 +45,21 @@ class ClamAVEngine(Engine): except _ClamdSizeLimit: # 文件超过 ClamAV MaxFileSize（clamd.conf 可调，默认 1G） # → 引擎只是拒扫这个大文件，不当成引擎故障 + # 但"没查过"必须留下信号：策略里 max_file_size 是 1.5G，1G~1.5G 的文件 + # 原本在 L1 完全裸奔却仍可能 clean/pass。按"不可扫描不放行"落人工复核。 result.ok = True result.meta["skipped"] = "size_limit" result.meta["reason"] = "文件超过 ClamAV 大小限制已跳过" + result.findings.append( + Finding( + engine=self.name, + layer=self.layer, + severity=Severity.MEDIUM.value, + rule="ClamAVSkippedSizeLimit", + detail="文件超过 clamd MaxFileSize，L1 签名查杀未执行，按不可扫描内容处置", + weight=30.0, + ) + ) return result except Exception as exc: # noqa: BLE001 # 真·引擎不可用：连不上 / PING 超时 / daemon 挂了 @@ -267,9 +279,9 @@ def _parse_clamd_response(text: str) -> Dict[str, Any]: # 签名名中的可信度关键词映射到严重度 -_HIGH_KEYWORDS = ("ransom", "crypt", "trojan", "backdoor", "rootkit", "stealer", "keylog", "worm", "dropper", "ransomware") -_MEDIUM_KEYWORDS = ("generic", "heur", "packed", "obfusc", "suspect", "malware", "riskware", "virus") -_UNWANTED_KEYWORDS = ("PUA", "unwanted", "toolkit", "pup", "adware") +_HIGH_KEYWORDS = ("RANSOM", "CRYPT", "TROJAN", "BACKDOOR", "ROOTKIT", "STEALER", "KEYLOG", "WORM", "DROPPER") +_MEDIUM_KEYWORDS = ("GENERIC", "HEUR", "PACKED", "OBFUSC", "SUSPECT", "MALWARE", "RISKWARE", "VIRUS") +_UNWANTED_KEYWORDS = ("PUA", "UNWANTED", "TOOLKIT", "PUP", "ADWARE") # EICAR 测试病毒签名 —— 明确标为 critical（等保要求：检测到即阻断） _EICAR_SIGNATURES = ("Eicar-Test-Signature", "EICAR-AV-Test", "Eicar-Test-Signature.UNOFFICIAL") diff --git a/app/engines/documents.py b/app/engines/documents.py index 557df1e..5960cb7 100644 --- a/app/engines/documents.py +++ b/app/engines/documents.py @@ -56,6 +56,19 @@ EML_EXTS = {".eml", ".msg"} # 带 VBA 宏的 Office 扩展名（用于 VBA 纯文本扫描触发） VBA_MACRO_OFFICE_EXTS = OLE_EXTS | OOXML_EXTS | {".bas", ".vba", ".cls", ".frm"} +# OOXML 包内的内嵌 OLE 部件目录 +EMBED_PREFIX_RE = re.compile(r"^(?:word|xl|ppt)/embeddings/.+") + +# 内嵌对象中的办公载体：文档互嵌（子表格/图表/PDF）是正常用法，不等于藏可执行 +OFFICE_PART_EXTS = { + ".docx", ".docm", ".xlsx", ".xlsm", ".pptx", ".pptm", + ".doc", ".xls", ".ppt", ".pdf", ".rtf", ".xml", ".txt", ".csv", + ".htm", ".html", ".wmf", ".emf", ".bin", +} + +# 内嵌部件里直接判定为可执行对象的扩展名 +EXEC_PART_EXTS = {".exe", ".dll", ".scr", ".js", ".jse", ".vbs", ".vbe", ".bat", ".cmd", ".ps1", ".hta", ".com", ".msi"} + # VBA 自动执行入口关键词 VBA_AUTOEXEC_PATTERNS = [ r"Sub\s+AutoOpen\s*\(", r"Sub\s+AutoExec\s*\(", r"Sub\s+AutoNew\s*\(", @@ -211,14 +224,16 @@ class DocumentEngine(Engine): else: parser.close() except Exception as exc: # noqa: BLE001 + # 宏流解析不了 = 内容不可判定。这类畸形 OLE 常被用来探测解析器异常， + # 给 0 分等于"看不懂就放行"，落人工复核。 findings.append( Finding( engine=self.name, layer=self.layer, - severity=Severity.LOW.value, + severity=Severity.MEDIUM.value, rule="OleToolsUnavailable", detail=f"VBA 宏解析失败：{exc}", - weight=0.0, + weight=30.0, ) ) @@ -407,6 +422,24 @@ class DocumentEngine(Engine): "excerpt": excerpt, } + def _looks_like_executable(self, zf: Any, name: str) -> bool: + """判断内嵌部件是否为可执行载荷（扩展名 + 文件头魔数）。 + + oleObject1.bin 之类的外壳里可能装着真正的 PE，光看扩展名会漏； + 反之把每个 .bin 都判成可执行又会拦掉正常的图表/子文档。 + """ + if os.path.splitext(name)[1].lower() in EXEC_PART_EXTS: + return True + try: + with zf.open(name) as fp: + head = fp.read(1 << 20) + except Exception: # noqa: BLE001 + return False + if head[:2] == b"MZ" or head[:4] in (b"\x7fELF", b"\xca\xfe\xba\xbe"): + return True + # OLE 复合容器（Package/Ole10Native）内嵌 PE：找 MZ..PE 头 + return bool(re.search(rb"MZ[\x00-\xff]{0,64}PE\x00\x00", head)) + def _scan_ooxml(self, target: ScanTarget) -> List[Finding]: """检测 OOXML（docx/xlsx/pptx）中的外部引用与外部链接。""" findings: List[Finding] = [] @@ -429,9 +462,11 @@ class DocumentEngine(Engine): weight=45.0, ) ) - if name.startswith("word/embeddings/") or name.startswith("xl/embeddings/") or name.startswith("ppt/embeddings/"): + # 内嵌 OLE 部件。zip 目录条目（以 / 结尾、长度为 0）不是部件—— + # PowerPoint 导出的包常带空的 ppt/embeddings/ 目录，按文件处理会凭空报内嵌对象。 + if EMBED_PREFIX_RE.match(name) and not name.endswith("/"): embedded_ext = os.path.splitext(name)[1].lower() - if embedded_ext in {".exe", ".dll", ".scr", ".js", ".vbs", ".bat", ".bin"}: + if self._looks_like_executable(zf, name): findings.append( Finding( engine=self.name, @@ -442,6 +477,17 @@ class DocumentEngine(Engine): weight=75.0, ) ) + elif embedded_ext in OFFICE_PART_EXTS: + findings.append( + Finding( + engine=self.name, + layer=self.layer, + severity=Severity.LOW.value, + rule="EmbeddedObject", + detail=f"文档内嵌办公对象：{name}", + weight=5.0, + ) + ) else: findings.append( Finding( diff --git a/app/engines/extractor.py b/app/engines/extractor.py index cfacf3e..c36ad77 100644 --- a/app/engines/extractor.py +++ b/app/engines/extractor.py @@ -205,8 +205,9 @@ class SafeExtractor: safe_name = self._sanitize_name(name) dest = os.path.join(out_dir, safe_name) try: + written = 0 + overflow = False with zf.open(info) as src, open(dest, "wb") as out: - written = 0 while True: chunk = src.read(1024 * 1024) if not chunk: @@ -222,20 +223,22 @@ class SafeExtractor: f"成员 {name} 实际解压超限，已丢弃", 10.0, ) + overflow = True break out.write(chunk) - else: - report.total_bytes += written - report.files.append( - ScanTarget( - path=dest, - filename=safe_name, - declared_ext=os.path.splitext(safe_name)[1].lower(), - logical_path=f"{target.logical_path}!/{name}", - depth=target.depth + 1, - is_extracted=True, - ) + # 成员必须回到扫描队列，否则压缩包/OOXML 里的内容永远不参与检测 + if not overflow: + report.total_bytes += written + report.files.append( + ScanTarget( + path=dest, + filename=safe_name, + declared_ext=os.path.splitext(safe_name)[1].lower(), + logical_path=f"{target.logical_path}!/{name}", + depth=target.depth + 1, + is_extracted=True, ) + ) except Exception as exc: # noqa: BLE001 self._add_finding( report, @@ -323,14 +326,26 @@ class SafeExtractor: continue with src, open(dest, "wb") as out: written = 0 + overflow = False while True: chunk = src.read(1024 * 1024) if not chunk: break written += len(chunk) if written > self.settings.max_upload_bytes: + out.close() + os.remove(dest) + self._add_finding( + report, + Severity.MEDIUM.value, + "MemberTooLarge", + f"成员 {name} 实际解压超限，已丢弃", + 10.0, + ) + overflow = True break out.write(chunk) + if not overflow: report.total_bytes += written report.files.append( ScanTarget( diff --git a/app/engines/keywords.py b/app/engines/keywords.py index bfd8028..320b848 100644 --- a/app/engines/keywords.py +++ b/app/engines/keywords.py @@ -21,6 +21,9 @@ from app.engines.base import Engine, EngineResult, Finding, ScanTarget, Severity logger = logging.getLogger(__name__) +# cross_line 规则用的续行归一：换行（及其两侧空白）压成一个空格 +NEWLINE_RUN_RE = re.compile(r"\s*[\r\n]+\s*") + class KeywordEngine(Engine): """内网特征词表匹配引擎。""" @@ -94,12 +97,13 @@ class KeywordEngine(Engine): if not text: return result - # ---- 预处理：合并换行符以支持跨行关键词 ---- - # 攻击者会把 Invoke-WebRequest 这种关键字用 CRLF 拆成 - # "Invoke-Web\r\nRequest" 来绕过基于单行的匹配。 - # 这里把所有 \r\n / \r / \n 替换为空，让跨行关键词重新拼接。 - # 注意：不影响纯文本/多行语义，我们匹配的都是单行关键词或跨行命令。 - text = text.replace("\r\n", "").replace("\r", "").replace("\n", "") + # ---- 预处理 ---- + # 默认按原始行匹配：把整篇文本的换行全部删除会让上一行行尾和下一行行首 + # 黏成一句话（Ruby 源码 "…breed\n+fetch()…" 曾被当成 curl 特征命中）。 + # cross_line: true 的规则再跑一遍"换行压成空格"的文本，用于兜住 + # wget \ + 换行 + -O payload 这类续行绕过；保留分隔符，不产生黏连。 + text_norm = text.replace("\r\n", "\n").replace("\r", "\n") + text_joined = NEWLINE_RUN_RE.sub(" ", text_norm) for rule in self._compiled: match_mode = rule.get("match", "contains") @@ -113,23 +117,29 @@ class KeywordEngine(Engine): if match_mode == "regex": compiled = rule.get("_re") if compiled: - for m in compiled.finditer(text): - snippet = text[max(0, m.start() - 10): m.end() + 10] - hits.append(snippet.strip()) + scan_targets = [text_norm] + if rule.get("cross_line"): + scan_targets.append(text_joined) + for body in scan_targets: + for m in compiled.finditer(body): + snippet = body[max(0, m.start() - 10): m.end() + 10] + hits.append(" ".join(snippet.split())) + if len(hits) >= 3: + break if len(hits) >= 3: break elif match_mode == "any_of": keywords = rule.get("keywords", []) for kw in keywords: - if kw.lower() in text.lower(): + if kw.lower() in text_norm.lower(): hits.append(kw) if len(hits) >= 3: break elif match_mode == "contains": pattern = rule.get("pattern", "") - if pattern and (pattern.lower() in text.lower()): + if pattern and (pattern.lower() in text_norm.lower()): hits.append(pattern) if hits: diff --git a/app/engines/structure.py b/app/engines/structure.py index 1b77ee2..b1ddbcb 100644 --- a/app/engines/structure.py +++ b/app/engines/structure.py @@ -108,6 +108,9 @@ class StructureEngine(Engine): ) # 3) 危险可执行扩展名（顶层文件） + # 这是「载体」信号而不是恶意行为：单独命中应当进人工复核（≥review_score）， + # 但不能成为把后续中/低置信度检测一起顶过 block_score 的底座， + # 否则正常签名的 exe/dll 会被判恶意。 if ext in DANGEROUS_EXTS and not target.is_extracted: severity = Severity.CRITICAL.value if ext in {".exe", ".scr", ".dll", ".com", ".pif"} else Severity.HIGH.value findings.append( @@ -117,7 +120,7 @@ class StructureEngine(Engine): severity=severity, rule="DangerousExecutableExtension", detail=f"文件类型为可执行/脚本格式：{ext}", - weight=45.0 if severity == Severity.CRITICAL.value else 30.0, + weight=35.0 if severity == Severity.CRITICAL.value else 30.0, ) ) diff --git a/app/models.py b/app/models.py index 7ca7b89..1933fb3 100644 --- a/app/models.py +++ b/app/models.py @@ -52,7 +52,7 @@ class ScanTask(Base): size: Mapped[int] = mapped_column(Integer, default=0) sha256: Mapped[str] = mapped_column(String(64), index=True) md5: Mapped[str] = mapped_column(String(32), default="") - real_type: Mapped[str] = mapped_column(String(256), default="") + real_type: Mapped[str] = mapped_column(String(512), default="") status: Mapped[str] = mapped_column(String(16), default="pending", index=True) mode: Mapped[str] = mapped_column(String(16), default="sync") diff --git a/app/services/scanner.py b/app/services/scanner.py index 915994a..16b2810 100644 --- a/app/services/scanner.py +++ b/app/services/scanner.py @@ -34,6 +34,17 @@ _settings = get_settings() TEMP_ROOT = os.environ.get("MESHSAFE_TEMP_ROOT", "/tmp/meshsafe") +def _clip(value: Any, limit: int) -> str: + """按列宽截断字符串。 + + 外部可控的长度（libmagic 描述串、归档成员路径、用户文件名）一旦超出列宽， + PostgreSQL 会拒绝整条 INSERT，连带同事务里的 scan_findings 一起丢失—— + 被拒绝的文件反而查不到记录。宁可截断，也不能整条不落库。 + """ + text = str(value or "") + return text[:limit] + + @dataclass class ScanContext: """一次扫描任务的上下文。""" @@ -95,12 +106,12 @@ class ScanOutcome: id=self.task_id, channel=self.channel, client_id=self.client_id, - filename=self.file_info.get("filename", ""), - declared_ext=self.file_info.get("declared_ext", ""), + filename=_clip(self.file_info.get("filename", ""), 512), + declared_ext=_clip(self.file_info.get("declared_ext", ""), 32), size=self.file_info.get("size", 0), sha256=self.file_info.get("sha256", ""), md5=self.file_info.get("md5", ""), - real_type=self.file_info.get("real_type", ""), + real_type=_clip(self.file_info.get("real_type", ""), 512), status="completed", mode=self.mode, verdict=self.verdict, @@ -122,7 +133,7 @@ class ScanOutcome: severity=f.severity, rule=f.rule, detail=f.detail, - extracted_path=f.extracted_path, + extracted_path=_clip(f.extracted_path, 1024), weight=f.weight, )) diff --git a/rules/linux.yar b/rules/linux.yar index 59374a0..f99ae02 100644 --- a/rules/linux.yar +++ b/rules/linux.yar @@ -117,17 +117,23 @@ rule C7_Linux_ReverseShell_Misc { meta: risk_level = "medium" category = "C7" - false_positive_rate = "medium" + false_positive_rate = "low" reference = "多种语言反弹 Shell 通用特征" - description = "通用反弹 Shell 标记：/dev/tcp 或 /dev/udp 或 reverse shell 工具名" + description = "通用反弹 Shell 标记：/dev/udp 或 攻击工具名 + shell 参数" strings: $devudp = /\/dev\/udp\/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{2,5}/ ascii $bashc = /bash\s+-c\s+['"].*\/dev\/(tcp|udp)/ ascii $dash_e = /\/bin\/bash\s+-e\s+['"]/ ascii - $hydra = /Hydra|crackmap|weevely|meterpreter|msfconsole|msfvenom/ ascii nocase + // 裸词 Hydra 会命中 "dehydrated"、crack 会命中 "cracklib"，必须带参数或成组出现 + $hydra = /\bhydra\s+(-l|-P|-p|-s|-m|-t)\b/ ascii nocase + $tool = /\b(crackmapexec|weevely|meterpreter|msfconsole|msfvenom)\b/ ascii nocase $reverseshell = /reverse[_\s]?shell|shell[_\s]?shock/ ascii nocase + $netart = /(nc|ncat)\s+\S+\s+\d{2,5}\s+-[ec]\b|\/dev\/(tcp|udp)\/|socat\s+EXEC:|bash\s+-i\s*>&/ ascii condition: - any of ($devudp, $bashc, $dash_e) or any of ($hydra, $reverseshell) + any of ($devudp, $bashc, $dash_e) + or $hydra + or ($tool and $netart) + or ($reverseshell and $netart) } @@ -177,40 +183,43 @@ rule C7_Linux_Persistence_SystemD { meta: risk_level = "high" category = "C7" - false_positive_rate = "medium" + false_positive_rate = "low" reference = "MITRE ATT&CK T1543.002 Systemd Service" - description = "恶意 systemd unit 文件：ExecStart 指向 /tmp/.hidden + multi-user.target + 反弹命令" + description = "恶意 systemd unit：ExecStart 指向临时目录隐藏文件 / 管道执行 / 反弹命令" strings: $unit = /\[Unit\]/ ascii $service = /\[Service\]/ ascii $install = /\[Install\]/ ascii $execstart = /ExecStart=/ ascii $multiuser = /multi-user\.target/ ascii - $hiddenpath = /\/tmp\/\.?\w+|\/var\/tmp\/\.?\w+/ ascii - $bashsh = /\/bin\/(ba)?sh\s+-c/ ascii + // 隐藏文件（点开头）落在可写临时目录——正常 unit 只会在 /usr/bin、/opt 等路径 + $hiddenpath = /\/(tmp|var\/tmp|dev\/shm)\/\.[a-zA-Z0-9_-]{2,}/ ascii + $pipe = /(curl|wget)\s+\S+\s*\|\s*(ba)?sh/ ascii + $revshell = /((nc|ncat|socat)\s+.*(-e|--exec|EXEC:)\s*\/bin\/(ba)?sh|\/dev\/tcp\/\d{1,3}\.\d{1,3})/ ascii condition: - // 完整 unit 片段 + 可疑路径 - $unit and $service and $execstart and ($hiddenpath or $bashsh) + ($unit and $service and $execstart and any of ($hiddenpath, $pipe, $revshell)) or - // Install multi-user.target + ExecStart 反弹 - $install and $multiuser and any of ($execstart, $bashsh) + ($install and $multiuser and $execstart and any of ($hiddenpath, $pipe, $revshell)) } rule C7_Linux_Persistence_LD_PRELOAD { meta: risk_level = "high" category = "C7" - false_positive_rate = "medium" + false_positive_rate = "low" reference = "MITRE ATT&CK T1574.006 LD_PRELOAD" - description = "LD_PRELOAD 劫持：环境变量注入 + .so 文件 + dlopen" + description = "LD_PRELOAD 劫持：写 ld.so.preload 或预加载临时目录里的 .so" strings: $ldpreload = /LD_PRELOAD=/ ascii - $sofile = /\.so(\.\d+)?:?/ ascii - $dlopen = "dlopen" ascii - $dlsym = "dlsym" ascii $exportenv = /export\s+LD_PRELOAD/ ascii + $ldso = /ld\.so\.preload/ ascii + $tmpso = /\/(tmp|var\/tmp|dev\/shm|proc\/\d+\/root)\/[a-zA-Z0-9_.\/-]*\.so(\.[0-9]+)?/ ascii condition: - ($ldpreload or $exportenv) and ($sofile or $dlopen or $dlsym) + // /etc/ld.so.preload 是内核级后门常用落点，单独出现即算证据 + $ldso + or + // LD_PRELOAD 指向可写临时目录的 so；README 里 LD_PRELOAD=libasan.so 不算 + (any of ($ldpreload, $exportenv) and $tmpso) } @@ -267,41 +276,55 @@ rule C7_Misc_Ruby_Lua_ReverseShell { meta: risk_level = "medium" category = "C7" - false_positive_rate = "medium" + false_positive_rate = "low" reference = "多语言反弹 Shell" - description = "Ruby/Lua 反弹 Shell：TCPSocket + exec/system" + description = "Ruby/Lua 反弹 Shell：Socket 对象 + 紧邻的 shell 执行调用" strings: $ruby = "TCPSocket" ascii + $ruby2 = "Socket.tcp" ascii $lua = "loadstring" ascii $lua2 = "luasocket" ascii - $exec = /(exec|system|IO\.popen)\s+.*\/bin\/(ba)?sh/ ascii + $exec = /(\bexec|\bsystem|IO\.popen|\bpopen|os\.execute|os\.runtime)\s*\(?\s*['"]((\/bin\/)?(ba)?sh|nc\s+-e|\/dev\/tcp)[^'"]{0,48}/ ascii condition: - any of ($ruby, $lua, $lua2) and ($exec or any of ($ruby, $lua, $lua2)) + // 只要出现 TCPSocket/loadstring 就命中 = 任何内嵌 Lua 的程序（Redis、nginx-lua、 + // Wireshark 插件）必中。语言标记与 shell 执行必须挨在一起（256B 内）。 + $exec and ( + for any i in (1..#exec): ( + any of ($ruby, $ruby2, $lua, $lua2) in (@exec[i] - 256..@exec[i] + 256) + ) + ) } // ============================================================================= // C7-5 网络投毒 / MITM 工具（内网横向移动） +// 工具名必须整词匹配，且与攻击参数成组出现 // ============================================================================= rule C7_Network_Tools_Malicious { meta: risk_level = "medium" category = "C7" - false_positive_rate = "medium" + false_positive_rate = "low" reference = "内网攻击工具" - description = "内网攻击工具：ettercap/responder/nmap 扫描 + SMB/DNS 投毒" + description = "内网攻击工具：ettercap/responder/nmap + 投毒参数成组出现" strings: - $ettercap = "ettercap" ascii nocase - $responder = /responder(\.py)?/ ascii nocase - $nmap = "nmap" ascii nocase - $smb = /--smb/ ascii - $ms17 = "ms17-010" ascii nocase - $smbghost = "SMBGhost" ascii nocase - $dnsspoof = /dns[-_]spoof|dns[-_]mitm/ ascii nocase - $arppoison = /arp[-_]poison|arp[-_]spoof/ ascii nocase + $tool1 = /\bettercap\b/ ascii nocase + $tool2 = /\bresponder(\.py)?\b/ ascii nocase + $tool3 = /\bnmap\b/ ascii nocase + // 攻击参数 / 漏洞编号（这些才是意图证据） + $art1 = /--smb/ ascii + $art2 = /\bms17-010\b/ ascii nocase + $art3 = /\bSMBGhost\b/ ascii nocase + $art4 = /\bdns[-_]spoof\b|\bdns[-_]mitm\b/ ascii nocase + $art5 = /\barp[-_]poison\b|\barp[-_]spoof\b/ ascii nocase + $art6 = /--Mitm|-T\s+text|\bec_sleep\b|\bntlm_relay\b|\bRunFinger\.py\b/ ascii nocase condition: - any of ($ettercap, $responder, $dnsspoof, $arppoison) + // 投毒手法名本身就是明确证据 + any of ($art4, $art5) or - $nmap and ($smb or $ms17 or $smbghost) + // 工具名 + 攻击参数 + ($tool1 and any of ($art1, $art2, $art3, $art6)) + or ($tool2 and any of ($art1, $art2, $art3, $art6)) + or ($tool3 and any of ($art1, $art2, $art3)) } diff --git a/rules/pe.yar b/rules/pe.yar index d0145c2..1bbccbb 100644 --- a/rules/pe.yar +++ b/rules/pe.yar @@ -2,26 +2,34 @@ // MeshSafe L2B YARA 规则集 —— Windows PE 恶意程序专项（C1 + C8） // ============================================================================= // -// 设计原则： -// - 所有规则使用 2-3 特征组合命中（API 组合 + C2 URL + Mutex 持久化等） -// - binary.py 的 PE 结构分析负责：节熵 + 签名 + 可疑导入（单 API） -// - YARA 负责：多 API 组合 + 字符串组合 + 壳 + 勒索专项 -// - 命中后作为 finding 交给 PolicyEngine 权重累加，不直接零容忍 +// 设计原则（v0.2.4 起，为消除干净软件误报而重写）： +// 1. 全文搜 API 名 = 必然误报。系统 DLL 会「导出」这些 API（kernel32 里就有 +// VirtualAllocEx/WriteProcessMemory/CreateRemoteThread 的明文字符串）， +// 安全 SDK、安装器、调试组件同理。因此 C1 系列一律要求： +// - 文件是 PE（uint16(0) == 0x5A4D），且 +// - 相关 API 名出现在同一个窗口内（导入名表是连续的，窗口 256~512B）。 +// 导出表按字母序排列、跨度通常上 KB，落在窗口外 → 不误报； +// 真注入器/下载器的导入名表三条名字通常挨在一起 → 命中。 +// 2. 不单独用「API 组合」定性，必须有硬指标（可疑路径 / 持久化键名 / C2 URL）。 +// 3. 不用 3~4 字母裸串（曾经的 $persist5 = "RUN"）和裸工具名。 +// 4. binary.py 的 PE 结构分析负责节熵/签名/导入 API 分级；YARA 只做组合特征。 // // 范围： // - C1: Windows PE 恶意程序（注入器 / 下载器 / RAT / Loader） -// - C8: 勒索 / 挖矿专项 -// - C9: 壳 / 签名 / 结构异常（binary.py 已覆盖大部分，YARA 补充壳特征） +// - C8: 勒索 / 挖矿专项（勒索样本常以文本/脚本形态投递，不加 PE 头判定） +// - C9: 壳特征（识别后建议送沙箱，不作为恶意证据） // // 维护： -// - 新恶意家族出现时，优先补充"API 组合 + Mutex 名 + C2 URL"三件套 -// - 壳特征（UPX/Themida/VMP）可识别后自动送沙箱深检 +// - 新增规则先跑「干净 PE 回归」：C:/Windows/System32 全量 900+ 文件必须 0 命中 +// - meta.risk_level 会被 binary.py 读取用于严重度展示，必须与档位权重一致 // ============================================================================= +import "pe" + // ============================================================================= // C1-1 进程注入三件套（VirtualAllocEx + WriteProcessMemory + CreateRemoteThread） -// binary.py 扫了 SuspiciousImports（单个 API），但 3 个同时出现 = 必然是注入器 +// 判定要点：三个导入名必须在同一张导入名表里（512B 窗口），否则是导出表明文 // ============================================================================= rule C1_PE_ProcessInjection { @@ -30,37 +38,66 @@ rule C1_PE_ProcessInjection { category = "C1" false_positive_rate = "low" reference = "MITRE ATT&CK T1055 Process Injection" - description = "PE 文件同时导入 进程注入三件套 API = 远控/注入器特征" + description = "PE 导入表含进程注入三件套（同表紧邻）= 远控/注入器特征" strings: - $s1 = "VirtualAllocEx" ascii - $s2 = "WriteProcessMemory" ascii - $s3 = "CreateRemoteThread" ascii - // 备选：Nt 系列（NtUnmapViewOfSection + VirtualAllocEx + CreateRemoteThread） - $n1 = "NtUnmapViewOfSection" ascii - $n2 = "NtMapViewOfSection" ascii - $n3 = "ZwUnmapViewOfSection" ascii - // 也可能是 QueueUserAPC 注 APC 注入 + $alloc = "VirtualAllocEx" ascii + $write = "WriteProcessMemory" ascii + $thread = "CreateRemoteThread" ascii + // 进程镂空（Process Hollowing） + $unmap1 = "NtUnmapViewOfSection" ascii + $unmap2 = "ZwUnmapViewOfSection" ascii + // APC / Hook 注入 $apc = "QueueUserAPC" ascii - // 或 SetWindowsHookEx DLL 注入 $hook = "SetWindowsHookEx" ascii + $open = "OpenProcess" ascii condition: - // 经典三件套（必须同时命中） - $s1 and $s2 and $s3 - or - // Nt 系列内存注入（至少 2 个 Nt + 1 个注入） - (any of ($n1, $n2, $n3) and any of ($s1, $s3, $apc)) - or - // APC 注入 + VirtualAllocEx - $apc and $s1 - or - // Hook DLL 注入 - $hook and $s1 + uint16(0) == 0x5A4D + and + ( + // 经典三件套：同表紧邻 + ( + $alloc and $write and $thread + and for any i in (1..#alloc): ( + $write in (@alloc[i] - 512..@alloc[i] + 512) + and $thread in (@alloc[i] - 512..@alloc[i] + 512) + ) + ) + or + // 镂空注入：unmap 必须和 write+thread 同表（kernel32/shell32 只是从 + // ntdll 导入成对的 NtMapView/NtUnmap，没有写入+远线程就不算镂空注入） + ( + $write and $thread + and for any i in (1..#unmap1): ( + $write in (@unmap1[i] - 512..@unmap1[i] + 512) + and $thread in (@unmap1[i] - 512..@unmap1[i] + 512) + ) + ) + or + ( + $write and $thread + and for any i in (1..#unmap2): ( + $write in (@unmap2[i] - 512..@unmap2[i] + 512) + and $thread in (@unmap2[i] - 512..@unmap2[i] + 512) + ) + ) + or + // APC / Hook 注入：目标进程 API + 注入 API 同表紧邻 + ( + $alloc and $open and ($apc or $hook) + and for any i in (1..#alloc): ( + $open in (@alloc[i] - 512..@alloc[i] + 512) + and ($apc in (@alloc[i] - 512..@alloc[i] + 512) + or $hook in (@alloc[i] - 512..@alloc[i] + 512)) + ) + ) + ) } // ============================================================================= -// C1-2 下载器组合（网络 API + 本地持久化 / 执行） -// 单一 URLDownloadToFile 不致命，但 "下载 + 执行 + 持久化" 三件套 = Loader +// C1-2 下载器 / Loader（下载 API + 落地持久化键名，且两者同表紧邻） +// v0.2.3 的写法：任意下载 API + "WriteFile" + "CreateProcess" + 裸串 "RUN" +// → 任何带自动更新的正常软件必中。现在要求持久化硬指标。 // ============================================================================= rule C1_PE_Downloader_Loader { @@ -69,157 +106,172 @@ rule C1_PE_Downloader_Loader { category = "C1" false_positive_rate = "low" reference = "MITRE ATT&CK T1105 Ingress Tool Transfer" - description = "下载器组合：HTTP/FTP 下载 + 写入到可疑路径 + 执行" + description = "下载 API 与自启动/服务注册持久化键名同表共存 = Loader" strings: - // 网络下载 API（任选其一） + // 下载类 API（保留专有名词，不用裸串） $net1 = "URLDownloadToFile" ascii $net2 = "InternetOpenUrl" ascii - $net3 = "WinHttpOpen" ascii - $net4 = "WinHttpOpenRequest" ascii - $net5 = "FtpOpenFile" ascii - $net6 = "DownloadFile" ascii - $net7 = "WinHttpSendRequest" ascii + $net3 = "WinHttpOpenRequest" ascii + $net4 = "WinHttpSendRequest" ascii + $net5 = "URLDownloadToCacheFile" ascii + $net6 = "FtpOpenFile" ascii + $net7 = "WinHttpOpen" ascii + $net8 = "InternetOpen" ascii - // 写入/保存到本地 - $save1 = "WriteFile" ascii - $save2 = "SaveToFile" ascii - $save3 = "URLDownloadToCacheFile" ascii + // 自启动 / 服务注册持久化硬指标（不是裸 "RUN"） + $p1 = "Software\\Microsoft\\Windows\\CurrentVersion\\Run" ascii nocase + $p2 = "CurrentVersion\\RunOnce" ascii nocase + $p3 = "schtasks.exe" ascii nocase + $p4 = "CreateService" ascii + $p5 = "Start Menu\\Programs\\StartUp" ascii nocase + $p6 = "reg add" ascii nocase + $p7 = "StartupApproved" ascii nocase - // 执行下载的载荷 - $exec1 = "WinExec" ascii - $exec2 = "CreateProcess" ascii - $exec3 = "ShellExecute" ascii - $exec4 = "CreateRemoteThread" ascii - - // 持久化（注册表/启动项） - $persist1 = "RegSetValueEx" ascii - $persist2 = "SetServiceObjectSecurity" ascii - $persist3 = "CreateService" ascii - $persist4 = "schtasks.exe" ascii - $persist5 = "RUN" ascii // HKCU\Software\Microsoft\Windows\CurrentVersion\Run + // 临时目录落地（Loader 常先落 %TEMP%） + $tmp1 = /\\AppData\\Local\\Temp\\[a-z0-9_. -]{3,60}\.(exe|dll|tmp|dat)/ ascii nocase + $tmp2 = /%TEMP%\\[a-z0-9_. -]{3,60}\.(exe|dll|tmp)/ ascii nocase + $tmp3 = /\\Windows\\Temp\\[a-z0-9_. -]{3,60}\.(exe|dll|tmp)/ ascii nocase condition: - // 下载 + 保存 + 执行（三件套） - any of ($net*) and any of ($save*) and any of ($exec*) - or - // 下载 + 持久化（即使没执行也是准备投毒） - any of ($net*) and any of ($persist*) - or - // 执行 + 持久化（下载可能在运行时动态完成） - any of ($exec1, $exec2, $exec3) and any of ($persist*) + uint16(0) == 0x5A4D + and any of ($net*) + and any of ($p*) + and + ( + // 下载 API 与持久化键名同处一个导入/字符串表块 + for any i in (1..#net1): ( any of ($p*) in (@net1[i] - 1024..@net1[i] + 1024) ) + or (any of ($tmp*) and 2 of ($p*)) + ) } // ============================================================================= -// C1-3 RAT / 远控特征（C2 通信 + 命令执行 + 持久化） +// C1-3 RAT / 远控特征 +// v0.2.3 的写法用 send( / recv( / system( 这类通用符号，且 +// (bot|serv|gate|ops)\.(com|net) 会匹配任意域名字符串 → 正常联网程序必中。 +// 现在要求：C2 硬指标（IP:PORT、可执行下载 URL、家族标记）+ 套接字 API 同表。 // ============================================================================= rule C1_PE_RAT_CommandControl { meta: risk_level = "critical" category = "C1" - false_positive_rate = "medium" + false_positive_rate = "low" reference = "MITRE ATT&CK T1071 Application Layer Protocol" - description = "RAT C2 通信特征：WinHTTP/WSASend + 命令执行 API + 可疑 URL/域名" + description = "RAT C2 特征：套接字 API + 明确 C2 指标（IP:端口 / .exe 下载 / 家族标记）" strings: - // C2 网络通道 - $c2_send = /WSASend|send\s*\(|sendto|WinHttpSendRequest|InternetWriteFile/ ascii - $c2_recv = /WSARecv|recv\s*\(|recvfrom|WinHttpReadData|InternetReadFile/ ascii - $c2_connect = /WSAConnect|connect\s*\(|WinHttpConnect|InternetConnect/ ascii + // 套接字 API（不用裸 send/recv/connect） + $sock1 = "WSASend" ascii + $sock2 = "WSARecv" ascii + $sock3 = "WSAConnect" ascii + $sock4 = "WSASocket" ascii + $sock5 = "inet_ntoa" ascii + $sock6 = "getpeername" ascii - // 命令执行 - $cmd = /CreateProcess|ShellExecute|WinExec|system\s*\(|popen/ ascii + // 命令执行（真实 RAT 才会与 C2 同表出现） + $cmd1 = "CreateProcess" ascii + $cmd2 = "ShellExecute" ascii + $cmd3 = "WinExec" ascii - // 可疑 C2 URL（可执行文件里出现 http://...exe 或常见 C2 域名） - $c2url1 = /http:\/\/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}:\d{2,5}/ ascii - $c2url2 = /https?:\/\/[^\"\s'\)]+\.(ru|top|xyz|tk|ml|ga|gq|cf|pw|click|stream|xyz|buzz|loan)\/[^\"\s'\)]*\.exe/ ascii - $c2url3 = /(c2|panel|gate|bot|ops|serv|beacon|stage|stager)\.(ru|top|xyz|cc|io|com|net)/ ascii + // C2 硬指标 + $c2ip = /https?:\/\/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}:[1-5][0-9]{3}/ ascii + $c2exe = /https?:\/\/[^\s"']{4,}\.(exe|dll|scr|vbs|ps1|bat)\b/ ascii nocase + $c2uri = /(gate|panel|submit|checkin|beacon|report)\.(php|aspx|html)\b/ ascii nocase + $c2tld = /\b[a-z0-9-]{4,30}\.(ru|top|xyz|tk|ml|ga|gq|cf|pw|buzz|loan)\b/ ascii nocase condition: - // C2 通信 + 命令执行（至少两个网络 + 一个命令） - any of ($c2_send, $c2_recv, $c2_connect) and any of ($cmd*) and any of ($c2url*) - or - // C2 URL 模式 + 网络 API - any of ($c2url*) and any of ($c2_connect, $c2_send) + uint16(0) == 0x5A4D + and 2 of ($sock*) + and any of ($c2*) + and + ( + any of ($cmd*) + or $c2exe + or $c2uri + ) } // ============================================================================= // C1-4 Mutex 互斥体名（勒索 / RAT / Loader 的持久化标记） -// 单一 Mutex 名有一定价值，但必须配合其他特征才触发 +// 需要 CreateMutex 与家族 Mutex 名同表，避免文本文档里提一嘴家族名就命中 // ============================================================================= rule C1_PE_Mutex_Persistence { meta: risk_level = "medium" category = "C1" - false_positive_rate = "medium" + false_positive_rate = "low" reference = "MITRE ATT&CK T1057 Process Discovery (mutex as persistence marker)" - description = "可疑 Mutex 名称 + CreateMutex API = 持久化标记" + description = "CreateMutex + 已知家族 Mutex 名同表 = 持久化标记" strings: $createmutex = "CreateMutexA" ascii $createmutexw = "CreateMutexW" ascii - // 常见勒索/RAT Mutex 名（大小写不敏感，含 Unicode 变体用 wide） // LockBit $lockbit1 = /Global\\[Ll]ock[Bb]it/ ascii $lockbit2 = /Local\\[Ll]ock[Bb]it/ ascii // BlackCat / ALPHV - $blackcat = /Global\\[Bb]lack[Cc]at|[Aa][Ll][Pp][Hh][Vv]/ ascii + $blackcat = /(Global|Local)\\[Bb]lack[Cc]at|\bALPHV\b/ ascii // Ryuk $ryuk = /RyukTask[\d]|Global\\Ryuk/ ascii // Conti - $conti = /Global\\[Cc]onti|Local\\[Cc]onti/ ascii + $conti = /(Global|Local)\\[Cc]onti/ ascii // Pseudo/Dharma - $dharma = /Global\\[Dd]harma|Local\\[Dd]harma/ ascii - // 通用可疑模式：Mutex 名包含 "Mutex" + UUID 变体 + $dharma = /(Global|Local)\\[Dd]harma/ ascii + // 通用可疑模式：Mutex 名含 UUID 前缀 $generic1 = /Global\\Mutex[0-9a-f]{8}/ ascii // Kryptik/Qakbot - $qakbot = /[Qq]akbot|[Kk]ryptik/ ascii + $qakbot = /\b[Qq]akbot\b|\b[Kk]ryptik\b/ ascii // Cobalt Strike named pipe $cs1 = /\\\\\.\\pipe\\msagent_[0-9a-f]+/ ascii $cs2 = /\\\\\.\\pipe\\[Bb]eacon_[0-9a-f]+/ ascii condition: - // CreateMutex + 已知家族 Mutex 名 - (any of ($createmutex*)) and any of ($lockbit1, $lockbit2, $blackcat, $ryuk, $conti, $dharma, $qakbot) - or - // Cobalt Strike 命名管道特征（不需要 CreateMutex） - any of ($cs*) - or - // CreateMutex + 通用可疑 UUID Mutex - (any of ($createmutex*)) and $generic1 + uint16(0) == 0x5A4D + and + ( + any of ($cs*) + or ( + any of ($createmutex*) + and any of ($lockbit1, $lockbit2, $blackcat, $ryuk, $conti, $dharma, $qakbot, $generic1) + ) + ) } // ============================================================================= -// C1-5 DLL 劫持 / LoadLibrary 动态加载 +// C1-5 DLL 劫持 / 侧加载 +// 只看「LoadLibrary + GetProcAddress + 临时目录里的 DLL 名」三件套； +// \ProgramData\ 与 \Public\ 是正常安装器路径，不再单独作为可疑路径 // ============================================================================= rule C1_PE_DLLHijacking { meta: risk_level = "high" category = "C1" - false_positive_rate = "medium" + false_positive_rate = "low" reference = "MITRE ATT&CK T1574 Hijack Execution Flow" - description = "PE 动态加载多个系统 DLL + 非系统路径 = DLL 劫持迹象" + description = "动态加载 API + 临时目录 DLL 落地 = DLL 侧加载/劫持" strings: $loadlib = "LoadLibraryA" ascii $loadlibw = "LoadLibraryW" ascii $getproc = "GetProcAddress" ascii - // 可疑加载路径（非 System32） - $path1 = /\\Users\\[^\\]+\\AppData\\Local\\Temp/ ascii - $path2 = /\\AppData\\Local\\Temp/ ascii - $path3 = /\\ProgramData\\/ ascii - $path4 = /\\Public\\Documents\\/ ascii + $copy1 = "CopyFileA" ascii + $copy2 = "CopyFileW" ascii + $move = "MoveFileEx" ascii + $temp1 = /\\AppData\\Local\\Temp\\[a-z0-9_. -]{3,40}\.dll/ ascii nocase + $temp2 = /%TEMP%\\[a-z0-9_. -]{3,40}\.dll/ ascii nocase + $temp3 = /\\Windows\\Temp\\[a-z0-9_. -]{3,40}\.dll/ ascii nocase + $sysdir = "SetDllDirectory" ascii + $searchorder = "LoadLibraryEx" ascii condition: - // LoadLibrary + 可疑路径 + GetProcAddress = 完整劫持链 - (any of ($loadlib*)) and any of ($path*) and $getproc - or - // LoadLibrary + 多个可疑路径 - (any of ($loadlib*)) and 2 of ($path*) + uint16(0) == 0x5A4D + and any of ($loadlib*, $searchorder) + and any of ($temp*) + and (any of ($getproc, $copy1, $copy2, $move, $sysdir)) } // ============================================================================= // C1-6 LOLBin（Living Off The Land Binary）调用特征 -// 已知合法 Windows 二进制被恶意利用来执行命令 +// 命令行串 + 进程创建 API 必须同表紧邻（正常程序会把两者写进同一个导入/资源块） // ============================================================================= rule C1_PE_LOLBin_Usage { @@ -228,31 +280,57 @@ rule C1_PE_LOLBin_Usage { category = "C1" false_positive_rate = "low" reference = "https://lolbas-project.github.io/" - description = "PE 文件中出现 LOLBin 调用：certutil / mshta / rundll32 / regsvr32 / bitsadmin / wmic / msiexec" + description = "PE 中出现 LOLBin 调用命令行 + 进程创建 API（同表）" strings: - $certutil = /certutil(\.exe)?\s+(-urlcache|-decode|-encode|-hashfile)/ ascii - $mshta = /mshta(\.exe)?\s+(https?:|javascript:|vbscript:)/ ascii - $rundll32 = /rundll32(\.exe)?\s+[A-Za-z0-9_.]+,/ ascii - $regsvr32 = /regsvr32(\.exe)?\s+\/s\s+\/u/ ascii - $bitsadmin = /bitsadmin(\.exe)?\s+(\/transfer|\/create)/ ascii - $wmic = /wmic(\.exe)?\s+(process\s+call\s+create|product\s+call)/ ascii - $msiexec = /msiexec(\.exe)?\s+\/[ia]\s+https?:/ ascii - $installutil = /installutil(\.exe)?\s+\/u\s+\/logfile=/ ascii - $syncapp = /syncapp(\.exe)?\s+\/compattrack/ ascii - $psexec = /psexec(\.exe)?\s+(-accepteula|-i\s+\d+|-w\s+https?:)/ ascii - // 命令执行 API（用于组合条件） + $lolbin1 = /certutil(\.exe)?\s+(-urlcache|-decode)\s+-split/ ascii nocase + $lolbin2 = /mshta(\.exe)?\s+(https?:|javascript:|vbscript:)/ ascii nocase + $lolbin3 = /regsvr32(\.exe)?\s+\/s\s+\/u:http/ ascii nocase + $lolbin4 = /bitsadmin(\.exe)?\s+\/transfer\s+\/source:/ ascii nocase + $lolbin5 = /wmic(\.exe)?\s+process\s+call\s+create/ ascii nocase + $lolbin6 = /msiexec(\.exe)?\s+\/[ia]\s+https?:/ ascii nocase + $lolbin7 = /installutil(\.exe)?\s+\/u\s+\/logfile=https?:/ ascii nocase + $lolbin8 = /psexec(\.exe)?\s+(-accepteula\s+)?-w\s+https?:/ ascii nocase $exec1 = "CreateProcess" ascii $exec2 = "ShellExecute" ascii $exec3 = "WinExec" ascii condition: - // 至少 1 个 LOLBin 调用 + 命令执行 API - any of ($certutil*, $mshta*, $rundll32*, $regsvr32*, $bitsadmin*, $wmic*, $msiexec*, $installutil*, $syncapp*, $psexec*) + uint16(0) == 0x5A4D + and any of ($lolbin*) and any of ($exec*) } // ============================================================================= -// C8-1 勒索加密 API 组合（CryptEncrypt + BCrypt* + 文件遍历 + 删除卷影） +// C1-7 PE 高熵 + 网络 API（疑似加壳下载器） +// 需要「多个网络 API + 明确壳节名」同时成立 +// ============================================================================= + +rule C1_PE_EntropyHighNetwork { + meta: + risk_level = "medium" + category = "C1" + false_positive_rate = "low" + reference = "binary.py HighEntropySection 联动" + description = "PE 加壳节名 + 多个下载 API = 加壳下载器" + strings: + $net1 = "InternetOpenUrl" ascii + $net2 = "URLDownloadToFile" ascii + $net3 = "WinHttpOpenRequest" ascii + $net4 = "WSAConnect" ascii + condition: + uint16(0) == 0x5A4D + and 2 of ($net*) + and ( + for any i in (0..pe.number_of_sections - 1): ( + pe.sections[i].name matches /UPX0/ or pe.sections[i].name == "UPX1" + or pe.sections[i].name matches /\.vmp[0-9]/ or pe.sections[i].name matches /Themida|\.themida/ + ) + ) +} + + +// ============================================================================= +// C8-1 勒索加密链（加密 API + 卷影删除/勒索信，勒索样本常以文本形态投递，不加 PE 头） // ============================================================================= rule C8_Ransomware_Encryption { @@ -261,9 +339,9 @@ rule C8_Ransomware_Encryption { category = "C8" false_positive_rate = "low" reference = "MITRE ATT&CK T1486 Data Encrypted for Impact" - description = "勒索加密链：CryptEncrypt/BCryptEncrypt + 大量文件遍历 + 卷影删除 = 勒索" + description = "勒索加密链：加密 API + 卷影删除命令或勒索信文件名" strings: - // 加密 API（至少出现两个） + // 加密 API $enc1 = "CryptEncrypt" ascii $enc2 = "CryptDeriveKey" ascii $enc3 = "BCryptEncrypt" ascii @@ -276,25 +354,23 @@ rule C8_Ransomware_Encryption { $enum3 = "FindNextFileA" ascii $enum4 = "FindNextFileW" ascii - // 卷影删除（勒索前置） - $vss1 = "vssadmin" ascii - $vss2 = "delete shadows" ascii + // 卷影删除（完整命令，不认裸 "wmic"） + $vss1 = "vssadmin" ascii nocase + $vss2 = "delete shadows" ascii nocase $vss3 = "DeleteShadowCopies" ascii - $vss4 = "wmic" ascii + $vss4 = "shadow copies" ascii nocase - // 勒索信文件名变体（出现在二进制里） - $ransomnote1 = /(HOW_TO_RECOVER|RESTORE_FILES|DECRYPT_INSTRUCTIONS|README|HELP_DECRYPT|_readme|_restore)[\w.-]*\.(txt|html|png|jpg|bmp|url)/ nocase - $ransomnote2 = /\.(locky|zepto|cryptolocker|tor|crpt|encrypted|virus|wallet|pay2)/ nocase - $ransomnote3 = /bitcoin|bitcash|monero|ltc|BTC\b/ ascii + // 勒索信文件名 / 加密扩展名 + $note1 = /(HOW_TO_RECOVER|RESTORE_FILES|DECRYPT_INSTRUCTIONS|HELP_DECRYPT)[\w.-]*\.(txt|html|png|jpg|bmp|url)/ nocase + $note2 = /\.(locky|zepto|cryptolocker|crpt|encrypted|pay2)\b/ nocase condition: - // 加密 API + 文件遍历 = 加密工具（必须至少 2 个加密 API） - (2 of ($enc*)) and any of ($enum*) - or - // 加密 API + 卷影删除 = 完整勒索 - (any of ($enc*)) and any of ($vss*) - or - // 加密 API + 勒索信 + 加密文件扩展名 = 明确勒索 - (any of ($enc*)) and (any of ($ransomnote1, $ransomnote2)) and $ransomnote3 + any of ($enc*) + and + ( + ($vss1 and ($vss2 or $vss3 or $vss4)) + or (2 of ($enum*) and any of ($note*)) + or (2 of ($enc*) and any of ($enum*) and $vss1) + ) } @@ -310,53 +386,51 @@ rule C8_Mining_Monero { reference = "MITRE ATT&CK T1496 Resource Hijacking" description = "挖矿程序特征：xmrig 命令行参数 / stratum+tcp / 矿池域名" strings: - // xmrig 命令行特征 $xmrig1 = "xmrig" ascii nocase $xmrig2 = /--donate-level\s+\d+/ ascii $xmrig3 = /-o\s+stratum\+tcp/ ascii $xmrig4 = /--cpu-priority\s+\d/ ascii $xmrig5 = /--max-threads-hint/ ascii - - // 矿池域名（Monero） $pool1 = "pool.xmrig.com" ascii nocase $pool2 = "pool.minexmr.com" ascii nocase $pool3 = "pool.supportxmr.com" ascii nocase $pool4 = "mine.moneropool.com" ascii nocase $pool5 = "stratum+tcp://" ascii - - // CPU 高占用循环特征 - $loop = /(while|for)\s*\(\s*\d+\s*[<>=]/ ascii $thread = "CreateThread" ascii condition: - // 至少 2 个 xmrig 特征 - (any of ($xmrig1, $xmrig2, $xmrig3, $xmrig4, $xmrig5)) and 2 of ($*) - or - // stratum+tcp 矿池协议 + 多个线程创建 - $pool5 and ($thread or 2 of ($xmrig*)) + any of ($pool1, $pool2, $pool3, $pool4) + or ($pool5 and (any of ($xmrig*) or $thread)) + or (2 of ($xmrig*) and any of ($pool*)) } // ============================================================================= -// C9 壳特征（UPX / Themida / VMProtect / Enigma） -// 壳识别后建议升级到 L3 沙箱深检，不单独阻断 +// C9 壳特征（UPX / Themida / VMProtect） +// 加壳本身不是恶意证据（大量开源工具用 UPX），只作沙箱深检触发条件 // ============================================================================= rule C9_Packer_UPX { meta: - risk_level = "medium" + risk_level = "low" category = "C9" false_positive_rate = "low" reference = "UPX Packer" - description = "UPX 加壳 PE：节名 UPX0 / UPX1 + UPX 签名" + description = "UPX 加壳 PE：节名 UPX0/UPX1 + UPX 签名" strings: - $upx0 = "UPX0" ascii - $upx1 = "UPX1" ascii $upx2 = "UPX!" ascii - $upx3 = /UPX\s+\d+\.\d+/ ascii // "UPX 3.96" 这类版本字符串 - $upx4 = /UPX\b/ ascii condition: - // 节名（两个）+ 签名 - ($upx0 and $upx1) or ($upx2 and any of ($upx3, $upx4)) + uint16(0) == 0x5A4D + and ( + ( + for any i in (0..pe.number_of_sections - 1): ( + pe.sections[i].name matches /UPX0/ + ) + and for any j in (0..pe.number_of_sections - 1): ( + pe.sections[j].name matches /UPX1/ + ) + ) + or ($upx2 and pe.number_of_sections <= 4) + ) } rule C9_Packer_Themida_VMP { @@ -365,39 +439,18 @@ rule C9_Packer_Themida_VMP { category = "C9" false_positive_rate = "low" reference = "Themida / VMProtect" - description = "商业壳特征：Themida / VMProtect 产品标识字符串" + description = "商业壳特征：Themida / VMProtect 节名 + 产品标识字符串" strings: $themida1 = "Themida" ascii wide $themida2 = "WinLicense" ascii wide $themida3 = "Oreans" ascii wide $vmp1 = "VMProtect" ascii wide - $vmp3 = "VMProtect SDK" ascii wide condition: - any of ($themida*) or any of ($vmp*) -} - - -// ============================================================================= -// C1-7 PE 高熵 + 大量网络 API（疑似加壳下载器） -// binary.py 的 HighEntropySection 已单独扫描，但 YARA 看"熵 + 网络"组合 -// ============================================================================= - -rule C1_PE_EntropyHighNetwork { - meta: - risk_level = "medium" - category = "C1" - false_positive_rate = "medium" - reference = "binary.py HighEntropySection 联动" - description = "PE 同时出现：多个网络 API + 加壳特征（熵高） + 无签名" - strings: - $net1 = "InternetOpenUrl" ascii - $net2 = "WinHttpOpen" ascii - $net3 = "URLDownloadToFile" ascii - $net4 = "WSAConnect" ascii - // 壳特征 - $upx = "UPX0" ascii - $themida = "Themida" ascii - condition: - // 网络 API + 壳特征 = 加壳下载器 - any of ($net*) and ($upx or $themida) + uint16(0) == 0x5A4D + and ( + for any i in (0..pe.number_of_sections - 1): ( + pe.sections[i].name matches /\.themida|\.vmp[0-9]/ + ) + or (any of ($themida*) and any of ($vmp1)) + ) } diff --git a/rules/ransom.yar b/rules/ransom.yar index ae9c6da..0ec65d7 100644 --- a/rules/ransom.yar +++ b/rules/ransom.yar @@ -126,26 +126,41 @@ rule C8_Ransomware_Note_Filename { meta: risk_level = "medium" category = "C8" - false_positive_rate = "medium" + false_positive_rate = "low" reference = "勒索信文件名通用模式" - description = "勒索信典型文件名变体（匹配后触发需要配合加密 API 才升级高危）" + description = "勒索信文件名 + （加密 API + 赎金语言）或（赎金语言 + 钱包地址）" strings: + // 只保留"文件名形态"的勒索信特征：家族专有名 + 扩展名。 + // 不再用裸 README.txt / _readme.txt：任何安装包都带这两个字面量， + // 在二进制内容上做全文匹配时必然命中（Go 官方 MSI 即被这样判成恶意）。 $n1 = /HOW_TO_RECOVER[\w.-]*\.(txt|html|png|bmp|jpg|url|vbs|js)/ nocase $n2 = /RESTORE_FILES[\w.-]*\.(txt|html|png|bmp|jpg|url|vbs|js)/ nocase $n3 = /DECRYPT_INSTRUCTIONS[\w.-]*\.(txt|html|png|bmp|jpg|url)/ nocase - $n4 = /README[_\s-]*[\d]*[_\s-]*[\w]*\.(txt|html|png|bmp|jpg|url)/ nocase + $n4 = /README[._-]*(FOR[._-]*DECRYPT|TO[._-]*RESTORE)[\w.-]*\.(txt|html|png|bmp|jpg|url)/ nocase $n5 = /HELP_DECRYPT[\w.-]*\.(txt|html|png|bmp|jpg|url)/ nocase - $n6 = /_readme[\w.-]*\.(txt|html|png|bmp|jpg|url)/ nocase - $n7 = /_restore[\w.-]*\.(txt|html|png|bmp|jpg|url)/ nocase - $bitcoin = /bitcoin address|BTC\b|monero address|XMR\b|send money|ransom|payment/ nocase - $wallet = /1[A-Za-z0-9]{25,34}|bc1[A-Za-z0-9]{11,71}|4[0-9A-Za-z]{32}/ nocase + $n6 = /\b_(readme|restore)[\w.-]*\.(txt|html|png|bmp|jpg|url)/ nocase + $n7 = /(how_to_decrypt|restore_my_files|decrypt_your_files)[\w.-]*\.(txt|html)/ nocase + + // 赎金语言：必须是完整词组。裸 "BTC"/"XMR"/"payment"/"ransom" 在压缩流里 + // 会以随机字节出现，"ransom" 还会被 "Ransomware" 子串命中。 + $payment = /(bitcoin|monero|xmr|btc)\s+(address|wallet)|send\s+(the\s+)?money|pay\s+(the\s+)?(ransom|fee)|\bransom\b\s+(note|payment|demand)|your\s+files\s+(are\s+)?encrypted|decrypt\s+your\s+files/ nocase + + // 钱包地址：锚定到整个 token，并用真实地址字符集/长度。 + // 原写法 1[A-Za-z0-9]{25,34} 无边界，单个 56MB 安装包命中 7.6 万次。 + $btc_addr = /\b[13][a-km-zA-HJ-NP-Z1-9]{25,34}\b/ + $bech32 = /\bbc1q[a-z0-9]{38}\b|\bbc1q[a-z0-9]{58}\b/ + $xmr_addr = /\b[48][0-9A-Za-z]{94}\b/ + $encapi = /CryptEncrypt|BCryptEncrypt|CryptDeriveKey/ ascii condition: - // 勒索信文件名 + 加密 API = 明确勒索 - any of ($n*) and $encapi - or - // 勒索信文件名 + 比特币/XMR 地址 = 大概率勒索 - any of ($n*) and any of ($bitcoin, $wallet) + any of ($n*) + and ( + // 投递器：真加密 API + 赎金语言 + ($encapi and $payment) + or + // 纯文本勒索信：赎金语言 + 具体钱包地址 + ($payment and any of ($btc_addr, $bech32, $xmr_addr)) + ) } @@ -199,11 +214,13 @@ rule C8_Ransomware_VolumeShadow { $vss2 = /vssadmin\s+delete\s+shadows\s+\/all\b/ ascii $wmic1 = /wmic\s+shadowcopy\s+delete/ ascii $wmic2 = /wmic\s+shadowcopy\s+where\s+\d+/ ascii - $vss3 = /ShadowCopy|VolumeShadowCopy|vss\b/i ascii // "i" flag = nocase in YARA + $vss4 = /vssadmin[^\n]{0,48}delete[^\n]{0,48}(shadows|shadow\s+copies)/ ascii $enc = /CryptEncrypt|BCryptEncrypt|CryptDeriveKey/ ascii condition: // 卷影删除 + 加密 API = 完整勒索前置 - (any of ($vss1, $vss2, $wmic*, $vss3)) and any of ($enc*) + // 不用裸 "vss"/"ShadowCopy" 子串：任何备份/卷影库的符号表都有它们， + // 和 CryptEncrypt 同框就报勒索，是典型误报来源。 + (any of ($vss1, $vss2, $wmic*, $vss4)) and any of ($enc*) or // 连续多次 vssadmin delete = 正在清卷影 any of ($vss1, $vss2) and any of ($wmic*) diff --git a/rules/webshell.yar b/rules/webshell.yar index ce68fc4..5b3ab1c 100644 --- a/rules/webshell.yar +++ b/rules/webshell.yar @@ -57,12 +57,19 @@ rule C3_PHP_Webshell_Obfuscated { $rot13 = "str_rot13" ascii wide $assert = "assert(" ascii wide $createfn = "create_function" ascii wide + // PHP 上下文证据：没有