From da05c544e957ddbf27c44a299dfcc5d781f22510 Mon Sep 17 00:00:00 2001
From: zhaolei <12153398@qq.com>
Date: Thu, 29 Oct 2026 11:51:31 +0800
Subject: [PATCH] =?UTF-8?q?feat:=20=E6=97=A7=E6=A0=B7=E6=9C=AC=20L7=20?=
=?UTF-8?q?=E5=BD=92=E7=B1=BB=20+=20=E4=B8=AD=E6=96=87=E8=A7=84=E5=88=99?=
=?UTF-8?q?=E6=A0=87=E7=AD=BE?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
- rules/rule_labels.yaml: 64 条 rule_name → 中文标签映射
- console.py: 加载 rule_labels + layer_definitions 传给 template
- test_center.html: 期望规则 / 实际规则 全显示中文名（hover 保留英文原名）
- scripts/regen_v2.py: 全量扫描自动打 L7 标签 + case_id
- tests/samples/index.json: 168 条全有 case_id，层分布 L0=27 L1=25 L3=25 L4=15 L5=21 NEG=20 L7=35
前端效果: NC 反弹 Shell / UPX 加壳 / 压缩包路径穿越 / RWX 可写可执行节...
---
app/console.py | 21 +
app/templates/test_center.html | 4 +-
rules/rule_labels.yaml | 280 ++++++++++
tests/samples/index.json | 903 +++++++++++----------------------
4 files changed, 591 insertions(+), 617 deletions(-)
create mode 100644 rules/rule_labels.yaml
diff --git a/app/console.py b/app/console.py
index fdaa1ab..6001d32 100644
--- a/app/console.py
+++ b/app/console.py
@@ -885,6 +885,25 @@ async def test_page(request: Request, current=Depends(require_login)):
samples_dir = Path(__file__).resolve().parent.parent / "tests" / "samples"
index_path = samples_dir / "index.json"
+ labels_path = Path(__file__).resolve().parent.parent / "rules" / "rule_labels.yaml"
+
+ # 加载规则中文标签
+ rule_labels: dict[str, str] = {}
+ layer_definitions: dict[str, str] = {}
+ try:
+ import yaml as _yaml
+ if labels_path.exists():
+ _lbl_raw = _yaml.safe_load(labels_path.read_text(encoding="utf-8")) or {}
+ # 映射 engine_rule_name → 中文标签
+ for k, v in _lbl_raw.items():
+ if isinstance(v, dict) and "label" in v:
+ rule_labels[k] = v["label"]
+ # 层定义
+ if index_path.exists():
+ _idx = json.loads(index_path.read_text(encoding="utf-8"))
+ layer_definitions = _idx.get("layer_definition", {})
+ except Exception: # noqa: BLE001
+ pass
rescan = request.query_params.get("rescan") == "1"
samples_list: list[Path] = []
@@ -1146,6 +1165,8 @@ async def test_page(request: Request, current=Depends(require_login)):
"policy_version": policy_version,
"last_run_at": last_run_at,
"rescan": rescan,
+ "rule_labels": rule_labels,
+ "layer_definitions": layer_definitions,
},
)
diff --git a/app/templates/test_center.html b/app/templates/test_center.html
index 88da8c2..8c8127d 100644
--- a/app/templates/test_center.html
+++ b/app/templates/test_center.html
@@ -139,7 +139,7 @@
{% if r.expected_rules %}
{% for rule in r.expected_rules %}
- {{ rule }}
+ {{ rule_labels.get(rule, rule) }}
{% endfor %}
{% endif %}
@@ -152,7 +152,7 @@
{% if r.actual_rules %}
{% for rule in r.actual_rules %}
- {{ rule }}
+ {{ rule_labels.get(rule, rule) }}
{% endfor %}
{% elif r.actual_verdict in ('pass', 'clean') %}
diff --git a/rules/rule_labels.yaml b/rules/rule_labels.yaml
new file mode 100644
index 0000000..7375d6d
--- /dev/null
+++ b/rules/rule_labels.yaml
@@ -0,0 +1,280 @@
+# MeshSafe 规则名中文标签映射
+# 前端显示时用中文名代替引擎内部的英文 rule_name
+# 层级分组对应 CSV 里的 L0-L5 + NEG + L7
+
+# ===== L0 结构分析 =====
+ArchiveBroken:
+ label: "压缩包损坏"
+ desc: "ZIP/7z 结构异常，目录项或文件头损坏"
+
+ArchiveContainsExecutable:
+ label: "压缩包内含可执行文件"
+ desc: "归档内包含 .exe/.dll/.sys/.scr 等 PE 文件"
+
+ExtensionMismatch:
+ label: "后缀伪装"
+ desc: "文件声明扩展名与真实幻数不符（如 jpg 后缀实际 MZ 头）"
+
+DoubleExtension:
+ label: "双扩展名伪装"
+ desc: "文件名含两个扩展名，隐藏真实后缀（如 report.pdf.exe）"
+
+DangerousExecutableExtension:
+ label: "危险可执行扩展名"
+ desc: "文件后缀属于可执行/脚本类型（exe/ps1/bat/cmd/js/vbs 等）"
+
+ShellScriptDangerous:
+ label: "危险脚本扩展名"
+ desc: "shell/bash/powershell 等脚本类扩展名"
+
+PathTraversal:
+ label: "压缩包路径穿越"
+ desc: "ZIP 内文件名包含 ../ 或绝对路径，可能覆盖系统文件"
+
+PathTraversalBlocked:
+ label: "路径穿越已拦截"
+ desc: "扫描器已阻止路径穿越文件落地"
+
+ArchiveBombSuspect:
+ label: "ZIP 炸弹"
+ desc: "压缩比异常高（如 42.zip），解压膨胀可能耗尽磁盘/内存"
+
+EncryptedArchive:
+ label: "加密压缩包"
+ desc: "ZIP 设置了打开密码，无法扫描内部内容"
+
+MalformedStructure:
+ label: "文件结构畸形"
+ desc: "文件能识别但内部结构不符合该格式规范"
+
+ZeroByteFile:
+ label: "零字节文件"
+ desc: "空文件（0 字节）"
+
+# ===== L1 ClamAV =====
+"ClamAV:EICAR":
+ label: "ClamAV EICAR 测试病毒"
+ desc: "命中 ClamAV EICAR-STANDARD-ANTIVIRUS-TEST-FILE 签名"
+
+Eicar-Test-Signature:
+ label: "EICAR 测试签名"
+ desc: "ClamAV 识别到 EICAR 标准测试串（行业无害测试）"
+
+# ===== L2 文档深度 =====
+OfficeEncrypted:
+ label: "Office 加密文档"
+ desc: "DOCX/XLSX/PPTX 设置了打开密码"
+
+OleToolsUnavailable:
+ label: "OLE 工具不可用"
+ desc: "olefile 未安装，无法扫描 OLE 结构"
+
+OoxmlParseFailed:
+ label: "OOXML 解析失败"
+ desc: "DOCX/XLSX/PPTX ZIP 内部 XML 损坏"
+
+AttachedTemplate:
+ label: "模板注入风险"
+ desc: "Word 文档关联了外部模板（可能触发模板后门）"
+
+VBAAutoExecShell:
+ label: "VBA 宏自动执行 Shell"
+ desc: "检测到 AutoOpen/Workbook_Open 等自动执行入口 + Shell/CreateObject 等危险调用"
+
+PdfJavaScript:
+ label: "PDF 内含 JavaScript"
+ desc: "PDF 文档嵌入可执行 JavaScript"
+
+PdfOpenAction:
+ label: "PDF OpenAction 跳转"
+ desc: "PDF 启动时有自动跳转/打开外部链接动作"
+
+PdfParseFailed:
+ label: "PDF 解析失败"
+ desc: "PDF 结构异常或为占位文件，无法正常解析"
+
+ChmWithScript:
+ label: "CHM 内含脚本"
+ desc: "CHM 帮助文档包含 ActiveScript/JScript"
+
+DesktopFileAutoExec:
+ label: "Linux .desktop 自动执行"
+ desc: ".desktop 文件设置了自动执行属性"
+
+# ===== L3 关键词匹配 =====
+ReverseShellNetcat:
+ label: "NC 反弹 Shell"
+ desc: "包含 nc/ncat/netcat /bin/bash -i >& /dev/tcp/ 等反弹 shell 特征"
+
+ReverseShellPowershell:
+ label: "PowerShell EncodedCommand"
+ desc: "包含 powershell -enc / -w hidden 等混淆执行"
+
+CredentialStealer:
+ label: "凭据窃取工具"
+ desc: "包含 mimikatz/sekurlsa/gsecdump/DCSync/Rubeus 等"
+
+CredentialExport:
+ label: "凭据导出命令"
+ desc: "包含 reg save HKLM\\SAM/SYSTEM/secretsdump 等"
+
+RemoteDownloadPowerShell:
+ label: "PowerShell 远程下载"
+ desc: "Invoke-WebRequest/Invoke-RestMethod/DownloadString/BitsAdmin 等"
+
+RemoteDownloadUnix:
+ label: "Unix 远程下载"
+ desc: "wget/curl/certutil -urlcache -split 等"
+
+RemoteSessionHijack:
+ label: "远程会话劫持"
+ desc: "tscon/rdpclip/shadow/CreateRemoteThread 等"
+
+CommandExecutionObfuscated:
+ label: "命令执行混淆"
+ desc: "certutil -decode/mshta/regsvr32 /s 等混淆执行"
+
+WMILdapAttack:
+ label: "WMI/LDAP 攻击"
+ desc: "wmic path/wmic process call create/ldapsearch 等"
+
+ClassifiedLevelMarkers:
+ label: "涉密密级标记"
+ desc: "包含绝密/机密/秘密/内部文件/禁止外传等密级标识"
+
+InternalDocumentPatterns:
+ label: "国家机密标识"
+ desc: "包含国家机密|涉密|密级：等关键词"
+
+# ===== L4 YARA =====
+# 留空 → YARA 规则文件自己的 rule name 就是中文或 meta 里有描述
+
+# ===== L5 PE 二进制 =====
+UPXPackerDetected:
+ label: "UPX 加壳"
+ desc: "PE 节名包含 UPX0/UPX1/UPX!，检测到 UPX 加壳"
+
+RWXSectionDetected:
+ label: "RWX 可写可执行节"
+ desc: "PE 节同时设置了 MEM_EXECUTE + MEM_WRITE，典型绕过 DEP 手法"
+
+HighEntropySection:
+ label: "节区熵值异常"
+ desc: "PE 节熵 ≥ 7.2，可能经过加密或加壳"
+
+SuspiciousImports:
+ label: "可疑导入表"
+ desc: "PE 导入表包含 VirtualAllocEx/WriteProcessMemory/CreateRemoteThread 等高危注入 API"
+
+UnsignedExecutable:
+ label: "未签名可执行文件"
+ desc: "PE 未携带 Authenticode 数字签名"
+
+SuspiciousTimestamp:
+ label: "编译时间戳异常"
+ desc: "PE 编译时间戳为 0 或指向未来时间，可能被伪造"
+
+PEArchInfo:
+ label: "PE 架构信息"
+ desc: "PE 架构识别（x86/x64/ARM 等），辅助判断"
+
+DebugInformationPresent:
+ label: "含调试信息"
+ desc: "PE 包含 PDB 调试路径或 .debug 节"
+
+PeParseFailed:
+ label: "PE 结构解析失败"
+ desc: "pefile 无法解析 PE，可能是畸形文件"
+
+LinuxExecutable:
+ label: "Linux ELF 可执行"
+ desc: "ELF 格式 Linux 可执行文件"
+
+# ===== C1/C3/C7/C8 自动命名规则 =====
+"C1_PE_Downloader_Loader":
+ label: "YARA: PE 下载木马"
+ desc: "YARA C1_PE_Downloader_Loader 规则命中"
+
+"C1_PE_ProcessInjection":
+ label: "YARA: PE 进程注入"
+ desc: "YARA C1_PE_ProcessInjection 规则命中"
+
+"C3_PHP_Webshell_Oneliner":
+ label: "YARA: PHP 一句话木马"
+ desc: "YARA C3_PHP_Webshell_Oneliner 规则命中"
+
+"C3_PHP_Webshell_Obfuscated":
+ label: "YARA: PHP 混淆木马"
+ desc: "YARA C3_PHP_Webshell_Obfuscated 规则命中"
+
+"C3_JSP_Webshell_RuntimeExec":
+ label: "YARA: JSP Runtime exec 木马"
+ desc: "YARA C3_JSP_Webshell_RuntimeExec 规则命中"
+
+"C7_Linux_ReverseShell_Bash":
+ label: "YARA: Bash 反弹 Shell"
+ desc: "YARA C7_Linux_ReverseShell_Bash 规则命中"
+
+"C7_Linux_ReverseShell_NC":
+ label: "YARA: NC 反弹 Shell"
+ desc: "YARA C7_Linux_ReverseShell_NC 规则命中"
+
+"C7_Linux_ReverseShell_Misc":
+ label: "YARA: Linux 反弹 Shell（其他）"
+ desc: "YARA C7_Linux_ReverseShell_Misc 规则命中"
+
+"C7_Linux_Persistence_Crontab":
+ label: "YARA: Crontab 持久化"
+ desc: "YARA C7_Linux_Persistence_Crontab 规则命中"
+
+"C7_Linux_Miner_Generic":
+ label: "YARA: 挖矿程序"
+ desc: "YARA C7_Linux_Miner_Generic 规则命中"
+
+"C8_Ransomware_Encryption":
+ label: "YARA: 勒索加密特征"
+ desc: "YARA C8_Ransomware_Encryption 规则命中"
+
+"C8_Ransomware_Note_Filename":
+ label: "YARA: 勒索赎金文件名"
+ desc: "YARA C8_Ransomware_Note_Filename 规则命中"
+
+"C8_Ransomware_VolumeShadow":
+ label: "YARA: VSS 卷影副本删除"
+ desc: "YARA C8_Ransomware_VolumeShadow 规则命中"
+
+# ===== 邮件 =====
+EmailAttachmentDangerous:
+ label: "邮件附件危险"
+ desc: "EML 包含 .exe/.dll/.ps1 等危险附件"
+
+EmailAttachmentDisguised:
+ label: "邮件附件伪装"
+ desc: "EML 附件扩展名与真实类型不符"
+
+EmailAttachmentWebshell:
+ label: "邮件附件 Webshell"
+ desc: "EML 附件为 PHP/ASP/JSP 一句话木马"
+
+EmailPhishingKeyword:
+ label: "钓鱼邮件关键词"
+ desc: "EML 正文包含钓鱼诈骗关键词"
+
+# ===== 其他 =====
+SuspiciousScript:
+ label: "可疑脚本"
+ desc: "脚本内容触发通用恶意特征"
+
+"Txt.Malware.Sustes-6779550-1":
+ label: "ClamAV: Sustes 木马变体"
+ desc: "ClamAV 识别到 Sustes 木马家族签名"
+
+# ===== verdict → 中文 =====
+# （前端直接写死在 template 里，这里留文档）
+verdict_labels:
+ clean: "干净（放行）"
+ suspicious: "可疑（人工审核）"
+ reject: "拦截（零容忍）"
+ malicious: "恶意（零容忍）"
+ pending: "待测"
+ unknown: "未知"
diff --git a/tests/samples/index.json b/tests/samples/index.json
index 68456ca..0afd9ec 100644
--- a/tests/samples/index.json
+++ b/tests/samples/index.json
@@ -1,7 +1,16 @@
{
"meshsafe_target_version": "v0.2.1",
- "index_regenerated_at": "2026-10-29T11:43:14.552192",
- "regenerate_note": "expected_rules 已对齐引擎真实输出的 rule 字段（之前是手写瞎编名）",
+ "index_regenerated_at": "2026-10-29T11:48:22.953397",
+ "layer_definition": {
+ "L0": "结构分析（幻数/后缀伪装/嵌套/路径穿越/zip 炸弹）",
+ "L1": "ClamAV 病毒库扫描",
+ "L2": "文档深度检测（OLE/Macro/JS）",
+ "L3": "关键词匹配（恶意行为特征）",
+ "L4": "YARA 规则匹配",
+ "L5": "PE 二进制静态分析（壳/导入/节/签名）",
+ "NEG": "负样本（业务正常文件，应无告警）",
+ "L7": "历史遗留样本（CSV 之外的真实恶意/误报对照）"
+ },
"samples": [
{
"filename": "L0-001_jpg_normal.jpg",
@@ -10,9 +19,7 @@
"expected_verdict": "pass",
"expected_rules": [],
"description": "干净jpg图片（对照负样本）",
- "_last_scan_verdict": "clean",
- "_last_scan_score": 0.0,
- "_last_scan_findings": 0
+ "_scan_verdict": "clean"
},
{
"filename": "L0-002_png_normal.png",
@@ -21,9 +28,7 @@
"expected_verdict": "pass",
"expected_rules": [],
"description": "正常文件幻数识别-PNG",
- "_last_scan_verdict": "clean",
- "_last_scan_score": 0.0,
- "_last_scan_findings": 0
+ "_scan_verdict": "clean"
},
{
"filename": "L0-003_docx_normal.docx",
@@ -32,9 +37,7 @@
"expected_verdict": "pass",
"expected_rules": [],
"description": "干净docx文档（对照负样本）",
- "_last_scan_verdict": "clean",
- "_last_scan_score": 0.0,
- "_last_scan_findings": 0
+ "_scan_verdict": "clean"
},
{
"filename": "L0-004_pdf_normal.pdf",
@@ -46,9 +49,7 @@
"PdfParseFailed"
],
"description": "正常文件幻数识别-PDF",
- "_last_scan_verdict": "suspicious",
- "_last_scan_score": 20.0,
- "_last_scan_findings": 2
+ "_scan_verdict": "suspicious"
},
{
"filename": "L0-005_pe_clean.exe",
@@ -60,9 +61,7 @@
"PeParseFailed"
],
"description": "干净hello PE（对照负样本）",
- "_last_scan_verdict": "suspicious",
- "_last_scan_score": 55.0,
- "_last_scan_findings": 2
+ "_scan_verdict": "suspicious"
},
{
"filename": "L0-006_disguise_jpg_pe.jpg",
@@ -73,9 +72,7 @@
"ExtensionMismatch"
],
"description": "jpg 后缀 + 实际 PE MZ 头",
- "_last_scan_verdict": "reject",
- "_last_scan_score": 100.0,
- "_last_scan_findings": 2
+ "_scan_verdict": "reject"
},
{
"filename": "L0-007_disguise_txt_pdf.txt",
@@ -87,9 +84,7 @@
"MalformedStructure"
],
"description": "后缀伪装：txt后缀，实际PDF幻数",
- "_last_scan_verdict": "reject",
- "_last_scan_score": 100.0,
- "_last_scan_findings": 2
+ "_scan_verdict": "reject"
},
{
"filename": "L0-008_disguise_png_zip.png",
@@ -101,9 +96,7 @@
"MalformedStructure"
],
"description": "后缀伪装：png后缀，实际ZIP幻数",
- "_last_scan_verdict": "reject",
- "_last_scan_score": 100.0,
- "_last_scan_findings": 2
+ "_scan_verdict": "reject"
},
{
"filename": "L0-009_double_ext_pdf_exe.pdf.exe",
@@ -116,9 +109,7 @@
"PeParseFailed"
],
"description": "双扩展名伪装：report.pdf.exe",
- "_last_scan_verdict": "reject",
- "_last_scan_score": 100.0,
- "_last_scan_findings": 3
+ "_scan_verdict": "reject"
},
{
"filename": "L0-010_double_ext_txt_ps1.txt.ps1",
@@ -130,9 +121,7 @@
"DoubleExtension"
],
"description": "双扩展名伪装：data.txt.ps1",
- "_last_scan_verdict": "reject",
- "_last_scan_score": 100.0,
- "_last_scan_findings": 2
+ "_scan_verdict": "reject"
},
{
"filename": "L0-011_double_ext_docx_js.docx.js",
@@ -143,9 +132,7 @@
"DangerousExecutableExtension"
],
"description": "双扩展名伪装：note.docx.js",
- "_last_scan_verdict": "suspicious",
- "_last_scan_score": 30.0,
- "_last_scan_findings": 1
+ "_scan_verdict": "suspicious"
},
{
"filename": "L0-012_double_ext_xlsx_bat.xlsx.bat",
@@ -157,9 +144,7 @@
"DoubleExtension"
],
"description": "双扩展名伪装：log.xlsx.bat",
- "_last_scan_verdict": "reject",
- "_last_scan_score": 100.0,
- "_last_scan_findings": 2
+ "_scan_verdict": "reject"
},
{
"filename": "L0-013_clean.ps1",
@@ -170,9 +155,7 @@
"DangerousExecutableExtension"
],
"description": "干净 ps1 文件",
- "_last_scan_verdict": "suspicious",
- "_last_scan_score": 30.0,
- "_last_scan_findings": 1
+ "_scan_verdict": "suspicious"
},
{
"filename": "L0-014_clean.bat",
@@ -183,9 +166,7 @@
"DangerousExecutableExtension"
],
"description": "干净 bat 文件",
- "_last_scan_verdict": "suspicious",
- "_last_scan_score": 30.0,
- "_last_scan_findings": 1
+ "_scan_verdict": "suspicious"
},
{
"filename": "L0-015_clean.cmd",
@@ -196,9 +177,7 @@
"DangerousExecutableExtension"
],
"description": "干净 cmd 文件",
- "_last_scan_verdict": "suspicious",
- "_last_scan_score": 30.0,
- "_last_scan_findings": 1
+ "_scan_verdict": "suspicious"
},
{
"filename": "L0-016_clean.vbs",
@@ -209,9 +188,7 @@
"DangerousExecutableExtension"
],
"description": "干净 vbs 文件",
- "_last_scan_verdict": "suspicious",
- "_last_scan_score": 30.0,
- "_last_scan_findings": 1
+ "_scan_verdict": "suspicious"
},
{
"filename": "L0-017_clean.js",
@@ -222,9 +199,7 @@
"DangerousExecutableExtension"
],
"description": "干净 js 文件",
- "_last_scan_verdict": "suspicious",
- "_last_scan_score": 30.0,
- "_last_scan_findings": 1
+ "_scan_verdict": "suspicious"
},
{
"filename": "L0-018_zip_traversal.zip",
@@ -236,9 +211,7 @@
"PathTraversalBlocked"
],
"description": "ZIP单级路径穿越：../test.txt",
- "_last_scan_verdict": "malicious",
- "_last_scan_score": 100.0,
- "_last_scan_findings": 2
+ "_scan_verdict": "malicious"
},
{
"filename": "L0-019_zip_deep_traversal.zip",
@@ -250,9 +223,7 @@
"PathTraversalBlocked"
],
"description": "ZIP多级路径穿越：../../a.txt",
- "_last_scan_verdict": "malicious",
- "_last_scan_score": 100.0,
- "_last_scan_findings": 2
+ "_scan_verdict": "malicious"
},
{
"filename": "L0-020_zip_bomb.zip",
@@ -261,9 +232,7 @@
"expected_verdict": "reject",
"expected_rules": [],
"description": "ZIP炸弹42.zip",
- "_last_scan_verdict": "clean",
- "_last_scan_score": 0.0,
- "_last_scan_findings": 0
+ "_scan_verdict": "clean"
},
{
"filename": "L0-021_small_bomb.zip",
@@ -272,9 +241,7 @@
"expected_verdict": "reject",
"expected_rules": [],
"description": "自制小型 zip 炸弹（50 成员 × 8KB STORED）",
- "_last_scan_verdict": "clean",
- "_last_scan_score": 0.0,
- "_last_scan_findings": 0
+ "_scan_verdict": "clean"
},
{
"filename": "L0-022_3layer_nested.zip",
@@ -283,9 +250,7 @@
"expected_verdict": "pass",
"expected_rules": [],
"description": "3层无害嵌套ZIP",
- "_last_scan_verdict": "clean",
- "_last_scan_score": 0.0,
- "_last_scan_findings": 0
+ "_scan_verdict": "clean"
},
{
"filename": "L0-023_5layer_nested.zip",
@@ -294,9 +259,7 @@
"expected_verdict": "pass",
"expected_rules": [],
"description": "5 层无害嵌套 ZIP",
- "_last_scan_verdict": "clean",
- "_last_scan_score": 0.0,
- "_last_scan_findings": 0
+ "_scan_verdict": "clean"
},
{
"filename": "L0-024_encrypted.zip",
@@ -305,9 +268,7 @@
"expected_verdict": "review",
"expected_rules": [],
"description": "加密 ZIP（标记待验证）",
- "_last_scan_verdict": "clean",
- "_last_scan_score": 0.0,
- "_last_scan_findings": 0
+ "_scan_verdict": "clean"
},
{
"filename": "L0-025_corrupt_zip.zip",
@@ -319,9 +280,7 @@
"MalformedStructure"
],
"description": "截断损坏 ZIP 头",
- "_last_scan_verdict": "suspicious",
- "_last_scan_score": 35.0,
- "_last_scan_findings": 2
+ "_scan_verdict": "suspicious"
},
{
"filename": "L0-026_corrupt_direntry.zip",
@@ -330,9 +289,7 @@
"expected_verdict": "review",
"expected_rules": [],
"description": "损坏ZIP目录项",
- "_last_scan_verdict": "clean",
- "_last_scan_score": 0.0,
- "_last_scan_findings": 0
+ "_scan_verdict": "clean"
},
{
"filename": "L0-027_long_filename.zip",
@@ -341,9 +298,7 @@
"expected_verdict": "pass",
"expected_rules": [],
"description": "压缩包内 200 字符超长文件名",
- "_last_scan_verdict": "clean",
- "_last_scan_score": 0.0,
- "_last_scan_findings": 0
+ "_scan_verdict": "clean"
},
{
"filename": "L0-028_unicode_filename.zip",
@@ -352,9 +307,7 @@
"expected_verdict": "pass",
"expected_rules": [],
"description": "unicode/emoji 文件名",
- "_last_scan_verdict": "clean",
- "_last_scan_score": 0.0,
- "_last_scan_findings": 0
+ "_scan_verdict": "clean"
},
{
"filename": "L0-029_zero_byte_exe.exe",
@@ -366,9 +319,7 @@
"PeParseFailed"
],
"description": "空文件（0字节）后缀exe",
- "_last_scan_verdict": "suspicious",
- "_last_scan_score": 55.0,
- "_last_scan_findings": 2
+ "_scan_verdict": "suspicious"
},
{
"filename": "L0-030_nested_traversal.zip",
@@ -377,9 +328,7 @@
"expected_verdict": "reject",
"expected_rules": [],
"description": "嵌套 zip 内含穿越条目",
- "_last_scan_verdict": "clean",
- "_last_scan_score": 0.0,
- "_last_scan_findings": 0
+ "_scan_verdict": "clean"
},
{
"filename": "L1-001_eicar.txt",
@@ -390,9 +339,7 @@
"Eicar-Test-Signature"
],
"description": "EICAR标准测试串文本",
- "_last_scan_verdict": "suspicious",
- "_last_scan_score": 55.0,
- "_last_scan_findings": 1
+ "_scan_verdict": "suspicious"
},
{
"filename": "L1-002_eicar_in_zip.zip",
@@ -403,9 +350,7 @@
"Eicar-Test-Signature"
],
"description": "EICAR放入zip压缩包",
- "_last_scan_verdict": "suspicious",
- "_last_scan_score": 55.0,
- "_last_scan_findings": 1
+ "_scan_verdict": "suspicious"
},
{
"filename": "L1-003_eicar_in_encrypted.zip",
@@ -416,9 +361,7 @@
"Eicar-Test-Signature"
],
"description": "加密 ZIP（占位：实际加密需 7z/zip -P）",
- "_last_scan_verdict": "suspicious",
- "_last_scan_score": 55.0,
- "_last_scan_findings": 1
+ "_scan_verdict": "suspicious"
},
{
"filename": "L1-004_eicar_in_docx.docx",
@@ -429,9 +372,7 @@
"Eicar-Test-Signature"
],
"description": "EICAR放入docx内嵌（OLE）",
- "_last_scan_verdict": "suspicious",
- "_last_scan_score": 55.0,
- "_last_scan_findings": 1
+ "_scan_verdict": "suspicious"
},
{
"filename": "L1-005_eicar_modified.txt",
@@ -440,9 +381,7 @@
"expected_verdict": "pass",
"expected_rules": [],
"description": "修改 1 字节 EICAR，ClamAV 不应命中",
- "_last_scan_verdict": "clean",
- "_last_scan_score": 0.0,
- "_last_scan_findings": 0
+ "_scan_verdict": "clean"
},
{
"filename": "L1-009_minimal.cvd",
@@ -451,9 +390,7 @@
"expected_verdict": "reject",
"expected_rules": [],
"description": "热加载测试占位（需真实 .cvd 文件）",
- "_last_scan_verdict": "reject",
- "_last_scan_score": 100.0,
- "_last_scan_findings": 0
+ "_scan_verdict": "reject"
},
{
"filename": "L1-010_corrupt.cvd",
@@ -462,9 +399,7 @@
"expected_verdict": "reject",
"expected_rules": [],
"description": "损坏病毒库占位",
- "_last_scan_verdict": "reject",
- "_last_scan_score": 100.0,
- "_last_scan_findings": 0
+ "_scan_verdict": "reject"
},
{
"filename": "L1-011_eicar_in_3layer.zip",
@@ -475,9 +410,7 @@
"Eicar-Test-Signature"
],
"description": "EICAR放在多层嵌套zip",
- "_last_scan_verdict": "suspicious",
- "_last_scan_score": 55.0,
- "_last_scan_findings": 1
+ "_scan_verdict": "suspicious"
},
{
"filename": "L1-012_eicar_base64.txt",
@@ -486,9 +419,7 @@
"expected_verdict": "pass",
"expected_rules": [],
"description": "base64 编码 EICAR，ClamAV 不解码",
- "_last_scan_verdict": "clean",
- "_last_scan_score": 0.0,
- "_last_scan_findings": 0
+ "_scan_verdict": "clean"
},
{
"filename": "L1-013_bigfile_eicar.txt",
@@ -497,9 +428,7 @@
"expected_verdict": "reject",
"expected_rules": [],
"description": "10MB+ 文本尾部含 EICAR",
- "_last_scan_verdict": "clean",
- "_last_scan_score": 0.0,
- "_last_scan_findings": 0
+ "_scan_verdict": "clean"
},
{
"filename": "L1-014_concurrent_eicar_00.txt",
@@ -510,9 +439,7 @@
"Eicar-Test-Signature"
],
"description": "并发压测占位 #0",
- "_last_scan_verdict": "suspicious",
- "_last_scan_score": 55.0,
- "_last_scan_findings": 1
+ "_scan_verdict": "suspicious"
},
{
"filename": "L1-014_concurrent_eicar_01.txt",
@@ -523,9 +450,7 @@
"Eicar-Test-Signature"
],
"description": "并发压测占位 #1",
- "_last_scan_verdict": "suspicious",
- "_last_scan_score": 55.0,
- "_last_scan_findings": 1
+ "_scan_verdict": "suspicious"
},
{
"filename": "L1-014_concurrent_eicar_02.txt",
@@ -536,9 +461,7 @@
"Eicar-Test-Signature"
],
"description": "并发压测占位 #2",
- "_last_scan_verdict": "suspicious",
- "_last_scan_score": 55.0,
- "_last_scan_findings": 1
+ "_scan_verdict": "suspicious"
},
{
"filename": "L1-014_concurrent_eicar_03.txt",
@@ -549,9 +472,7 @@
"Eicar-Test-Signature"
],
"description": "并发压测占位 #3",
- "_last_scan_verdict": "suspicious",
- "_last_scan_score": 55.0,
- "_last_scan_findings": 1
+ "_scan_verdict": "suspicious"
},
{
"filename": "L1-014_concurrent_eicar_04.txt",
@@ -562,9 +483,7 @@
"Eicar-Test-Signature"
],
"description": "并发压测占位 #4",
- "_last_scan_verdict": "suspicious",
- "_last_scan_score": 55.0,
- "_last_scan_findings": 1
+ "_scan_verdict": "suspicious"
},
{
"filename": "L1-014_concurrent_eicar_05.txt",
@@ -575,9 +494,7 @@
"Eicar-Test-Signature"
],
"description": "并发压测占位 #5",
- "_last_scan_verdict": "suspicious",
- "_last_scan_score": 55.0,
- "_last_scan_findings": 1
+ "_scan_verdict": "suspicious"
},
{
"filename": "L1-014_concurrent_eicar_06.txt",
@@ -588,9 +505,7 @@
"Eicar-Test-Signature"
],
"description": "并发压测占位 #6",
- "_last_scan_verdict": "suspicious",
- "_last_scan_score": 55.0,
- "_last_scan_findings": 1
+ "_scan_verdict": "suspicious"
},
{
"filename": "L1-014_concurrent_eicar_07.txt",
@@ -601,9 +516,7 @@
"Eicar-Test-Signature"
],
"description": "并发压测占位 #7",
- "_last_scan_verdict": "suspicious",
- "_last_scan_score": 55.0,
- "_last_scan_findings": 1
+ "_scan_verdict": "suspicious"
},
{
"filename": "L1-014_concurrent_eicar_08.txt",
@@ -614,9 +527,7 @@
"Eicar-Test-Signature"
],
"description": "并发压测占位 #8",
- "_last_scan_verdict": "suspicious",
- "_last_scan_score": 55.0,
- "_last_scan_findings": 1
+ "_scan_verdict": "suspicious"
},
{
"filename": "L1-014_concurrent_eicar_09.txt",
@@ -627,20 +538,16 @@
"Eicar-Test-Signature"
],
"description": "并发压测占位 #9",
- "_last_scan_verdict": "suspicious",
- "_last_scan_score": 55.0,
- "_last_scan_findings": 1
+ "_scan_verdict": "suspicious"
},
{
"filename": "L1-014_concurrent_test.txt",
"case_id": "L1-014",
"category": "L1",
- "expected_verdict": "clean",
+ "expected_verdict": "pass",
"expected_rules": [],
"description": "并发压测占位（靠 API 并发调用）",
- "_last_scan_verdict": "clean",
- "_last_scan_score": 0.0,
- "_last_scan_findings": 0
+ "_scan_verdict": "clean"
},
{
"filename": "L1-015_layer_off_sample.bin",
@@ -654,9 +561,7 @@
"PeParseFailed"
],
"description": "关闭分层开关测试占位",
- "_last_scan_verdict": "reject",
- "_last_scan_score": 100.0,
- "_last_scan_findings": 4
+ "_scan_verdict": "reject"
},
{
"filename": "L3-001_001_sample.ps1",
@@ -669,9 +574,7 @@
"SuspiciousScript"
],
"description": "PS1明文：Invoke-WebRequest下载",
- "_last_scan_verdict": "malicious",
- "_last_scan_score": 100.0,
- "_last_scan_findings": 3
+ "_scan_verdict": "malicious"
},
{
"filename": "L3-002_002_sample.ps1",
@@ -684,9 +587,7 @@
"ReverseShellNetcat"
],
"description": "PS1明文：反弹shell nc",
- "_last_scan_verdict": "malicious",
- "_last_scan_score": 100.0,
- "_last_scan_findings": 3
+ "_scan_verdict": "malicious"
},
{
"filename": "L3-003_003_sample.bat",
@@ -698,9 +599,7 @@
"RemoteDownloadUnix"
],
"description": "bat明文：curl下载payload",
- "_last_scan_verdict": "suspicious",
- "_last_scan_score": 60.0,
- "_last_scan_findings": 2
+ "_scan_verdict": "suspicious"
},
{
"filename": "L3-004_004_sample.txt",
@@ -711,9 +610,7 @@
"CredentialStealer"
],
"description": "文本包含mimikatz关键字",
- "_last_scan_verdict": "suspicious",
- "_last_scan_score": 45.0,
- "_last_scan_findings": 1
+ "_scan_verdict": "suspicious"
},
{
"filename": "L3-005_005_sample.txt",
@@ -724,9 +621,7 @@
"CredentialExport"
],
"description": "文本包含reg save导出注册表",
- "_last_scan_verdict": "suspicious",
- "_last_scan_score": 45.0,
- "_last_scan_findings": 1
+ "_scan_verdict": "suspicious"
},
{
"filename": "L3-006_006_sample.txt",
@@ -737,9 +632,7 @@
"RemoteSessionHijack"
],
"description": "文本包含rdp、tscon劫持关键字",
- "_last_scan_verdict": "suspicious",
- "_last_scan_score": 35.0,
- "_last_scan_findings": 1
+ "_scan_verdict": "suspicious"
},
{
"filename": "L3-007_007_sample.txt",
@@ -748,9 +641,7 @@
"expected_verdict": "pass",
"expected_rules": [],
"description": "高危串base64编码放在txt",
- "_last_scan_verdict": "clean",
- "_last_scan_score": 0.0,
- "_last_scan_findings": 0
+ "_scan_verdict": "clean"
},
{
"filename": "L3-008_008_sample.ps1",
@@ -761,9 +652,7 @@
"DangerousExecutableExtension"
],
"description": "Powershell字符串拆分拼接绕过",
- "_last_scan_verdict": "suspicious",
- "_last_scan_score": 30.0,
- "_last_scan_findings": 1
+ "_scan_verdict": "suspicious"
},
{
"filename": "L3-009_newline_split.txt",
@@ -772,9 +661,7 @@
"expected_verdict": "pass",
"expected_rules": [],
"description": "换行分割绕过（L3 不做换行合并，记录边界）",
- "_last_scan_verdict": "clean",
- "_last_scan_score": 0.0,
- "_last_scan_findings": 0
+ "_scan_verdict": "clean"
},
{
"filename": "L3-010_010_sample.ps1",
@@ -785,9 +672,7 @@
"DangerousExecutableExtension"
],
"description": "高危串插入注释分割（powershell #注释）",
- "_last_scan_verdict": "suspicious",
- "_last_scan_score": 30.0,
- "_last_scan_findings": 1
+ "_scan_verdict": "suspicious"
},
{
"filename": "L3-011_011_sample.js",
@@ -799,9 +684,7 @@
"RemoteDownloadUnix"
],
"description": "高危串放js脚本内",
- "_last_scan_verdict": "suspicious",
- "_last_scan_score": 60.0,
- "_last_scan_findings": 2
+ "_scan_verdict": "suspicious"
},
{
"filename": "L3-012_012_sample.bat",
@@ -813,9 +696,7 @@
"RemoteDownloadUnix"
],
"description": "正常内网运维curl（白名单对照）",
- "_last_scan_verdict": "suspicious",
- "_last_scan_score": 60.0,
- "_last_scan_findings": 2
+ "_scan_verdict": "suspicious"
},
{
"filename": "L3-013_normal_scp.sh",
@@ -826,9 +707,7 @@
"DangerousExecutableExtension"
],
"description": "内网正常 scp 运维脚本，不误报",
- "_last_scan_verdict": "suspicious",
- "_last_scan_score": 30.0,
- "_last_scan_findings": 1
+ "_scan_verdict": "suspicious"
},
{
"filename": "L3-014_l3001_in_zip.zip",
@@ -840,9 +719,7 @@
"RemoteDownloadPowerShell"
],
"description": "高危字符串放在zip内部txt",
- "_last_scan_verdict": "malicious",
- "_last_scan_score": 100.0,
- "_last_scan_findings": 2
+ "_scan_verdict": "malicious"
},
{
"filename": "L3-015_keyword_in_docx.docx",
@@ -853,9 +730,7 @@
"RemoteDownloadPowerShell"
],
"description": "高危字符串放在docx文本正文",
- "_last_scan_verdict": "suspicious",
- "_last_scan_score": 35.0,
- "_last_scan_findings": 1
+ "_scan_verdict": "suspicious"
},
{
"filename": "L3-016_016_sample.ps1",
@@ -866,9 +741,7 @@
"DangerousExecutableExtension"
],
"description": "空脚本文件（负样本）",
- "_last_scan_verdict": "suspicious",
- "_last_scan_score": 30.0,
- "_last_scan_findings": 1
+ "_scan_verdict": "suspicious"
},
{
"filename": "L3-017_017_sample.txt",
@@ -880,9 +753,7 @@
"ReverseShellNetcat"
],
"description": "多条高危特征同文件复合",
- "_last_scan_verdict": "malicious",
- "_last_scan_score": 85.0,
- "_last_scan_findings": 2
+ "_scan_verdict": "malicious"
},
{
"filename": "L3-018_018_sample.txt",
@@ -893,9 +764,7 @@
"RemoteDownloadPowerShell"
],
"description": "高危字符串大小写混写",
- "_last_scan_verdict": "suspicious",
- "_last_scan_score": 35.0,
- "_last_scan_findings": 1
+ "_scan_verdict": "suspicious"
},
{
"filename": "L3-019_unicode_obfuscated.txt",
@@ -904,9 +773,7 @@
"expected_verdict": "pass",
"expected_rules": [],
"description": "同形字混淆，L3 默认不命中",
- "_last_scan_verdict": "clean",
- "_last_scan_score": 0.0,
- "_last_scan_findings": 0
+ "_scan_verdict": "clean"
},
{
"filename": "L3-020_log_with_keyword.log",
@@ -918,9 +785,7 @@
"ReverseShellNetcat"
],
"description": "日志文件混杂正常日志+高危串",
- "_last_scan_verdict": "reject",
- "_last_scan_score": 100.0,
- "_last_scan_findings": 2
+ "_scan_verdict": "reject"
},
{
"filename": "L3-021_021_sample.eml",
@@ -931,9 +796,7 @@
"RemoteDownloadPowerShell"
],
"description": "高危字符串放在eml邮件正文",
- "_last_scan_verdict": "suspicious",
- "_last_scan_score": 35.0,
- "_last_scan_findings": 1
+ "_scan_verdict": "suspicious"
},
{
"filename": "L3-022_layer_off_sample.bin",
@@ -947,9 +810,7 @@
"RemoteDownloadPowerShell"
],
"description": "关闭分层开关测试占位",
- "_last_scan_verdict": "reject",
- "_last_scan_score": 100.0,
- "_last_scan_findings": 4
+ "_scan_verdict": "reject"
},
{
"filename": "L3-023_keyword_in_encrypted.zip",
@@ -960,9 +821,7 @@
"CredentialStealer"
],
"description": "加密 zip 内容无法扫描（标记）",
- "_last_scan_verdict": "suspicious",
- "_last_scan_score": 45.0,
- "_last_scan_findings": 1
+ "_scan_verdict": "suspicious"
},
{
"filename": "L3-024_024_sample.txt",
@@ -973,9 +832,7 @@
"RemoteDownloadPowerShell"
],
"description": "超长单行文本（10万字符）包含高危串",
- "_last_scan_verdict": "suspicious",
- "_last_scan_score": 35.0,
- "_last_scan_findings": 1
+ "_scan_verdict": "suspicious"
},
{
"filename": "L3-025_whitelist_test.txt",
@@ -986,9 +843,7 @@
"RemoteDownloadPowerShell"
],
"description": "内网白名单域名对照（策略层白名单）",
- "_last_scan_verdict": "suspicious",
- "_last_scan_score": 35.0,
- "_last_scan_findings": 1
+ "_scan_verdict": "suspicious"
},
{
"filename": "L4-001_001_sample.txt",
@@ -997,9 +852,7 @@
"expected_verdict": "reject",
"expected_rules": [],
"description": "YARA正向命中占位（需对应规则）",
- "_last_scan_verdict": "clean",
- "_last_scan_score": 0.0,
- "_last_scan_findings": 0
+ "_scan_verdict": "clean"
},
{
"filename": "L4-002_002_sample.txt",
@@ -1008,9 +861,7 @@
"expected_verdict": "pass",
"expected_rules": [],
"description": "干净对照",
- "_last_scan_verdict": "clean",
- "_last_scan_score": 0.0,
- "_last_scan_findings": 0
+ "_scan_verdict": "clean"
},
{
"filename": "L4-003_pe_with_string.exe",
@@ -1024,9 +875,7 @@
"UnsignedExecutable"
],
"description": "二进制内嵌匹配字符串",
- "_last_scan_verdict": "malicious",
- "_last_scan_score": 75.0,
- "_last_scan_findings": 4
+ "_scan_verdict": "malicious"
},
{
"filename": "L4-004_multi_rule_match.txt",
@@ -1035,20 +884,16 @@
"expected_verdict": "reject",
"expected_rules": [],
"description": "同一个文件同时命中多条 YARA",
- "_last_scan_verdict": "clean",
- "_last_scan_score": 0.0,
- "_last_scan_findings": 0
+ "_scan_verdict": "clean"
},
{
"filename": "L4-005_005_sample.txt",
"case_id": "L4-005",
"category": "L4",
- "expected_verdict": "clean",
+ "expected_verdict": "pass",
"expected_rules": [],
"description": "热加载测试占位",
- "_last_scan_verdict": "clean",
- "_last_scan_score": 0.0,
- "_last_scan_findings": 0
+ "_scan_verdict": "clean"
},
{
"filename": "L4-006_bad_syntax_rule.yar",
@@ -1059,9 +904,7 @@
"ExtensionMismatch"
],
"description": "语法错误 YARA 规则文件（输入给规则目录）",
- "_last_scan_verdict": "reject",
- "_last_scan_score": 100.0,
- "_last_scan_findings": 1
+ "_scan_verdict": "reject"
},
{
"filename": "L4-007_meta_rule_match.txt",
@@ -1070,20 +913,16 @@
"expected_verdict": "reject",
"expected_rules": [],
"description": "带 meta 的 YARA 规则匹配",
- "_last_scan_verdict": "clean",
- "_last_scan_score": 0.0,
- "_last_scan_findings": 0
+ "_scan_verdict": "clean"
},
{
"filename": "L4-008_in_zip.zip",
"case_id": "L4-008",
"category": "L4",
- "expected_verdict": "clean",
+ "expected_verdict": "pass",
"expected_rules": [],
"description": "压缩包内文件匹配YARA规则",
- "_last_scan_verdict": "clean",
- "_last_scan_score": 0.0,
- "_last_scan_findings": 0
+ "_scan_verdict": "clean"
},
{
"filename": "L4-009_yara_in_encrypted.zip",
@@ -1092,20 +931,16 @@
"expected_verdict": "review",
"expected_rules": [],
"description": "加密 zip 内 YARA 样本",
- "_last_scan_verdict": "clean",
- "_last_scan_score": 0.0,
- "_last_scan_findings": 0
+ "_scan_verdict": "clean"
},
{
"filename": "L4-010_010_sample.txt",
"case_id": "L4-010",
"category": "L4",
- "expected_verdict": "clean",
+ "expected_verdict": "pass",
"expected_rules": [],
"description": "正则 YARA 测试占位",
- "_last_scan_verdict": "clean",
- "_last_scan_score": 0.0,
- "_last_scan_findings": 0
+ "_scan_verdict": "clean"
},
{
"filename": "L4-011_count_condition.txt",
@@ -1114,9 +949,7 @@
"expected_verdict": "reject",
"expected_rules": [],
"description": "YARA count > 3 条件",
- "_last_scan_verdict": "clean",
- "_last_scan_score": 0.0,
- "_last_scan_findings": 0
+ "_scan_verdict": "clean"
},
{
"filename": "L4-012_size_condition.bin",
@@ -1129,9 +962,7 @@
"PeParseFailed"
],
"description": "YARA 文件大小条件",
- "_last_scan_verdict": "reject",
- "_last_scan_score": 100.0,
- "_last_scan_findings": 3
+ "_scan_verdict": "reject"
},
{
"filename": "L4-013_bigfile_yara.txt",
@@ -1140,9 +971,7 @@
"expected_verdict": "reject",
"expected_rules": [],
"description": "100MB 文件 YARA 扫描",
- "_last_scan_verdict": "clean",
- "_last_scan_score": 0.0,
- "_last_scan_findings": 0
+ "_scan_verdict": "clean"
},
{
"filename": "L4-014_layer_off_sample.bin",
@@ -1155,9 +984,7 @@
"PeParseFailed"
],
"description": "关闭分层开关测试占位",
- "_last_scan_verdict": "reject",
- "_last_scan_score": 100.0,
- "_last_scan_findings": 3
+ "_scan_verdict": "reject"
},
{
"filename": "L4-015_hash_whitelist.txt",
@@ -1166,9 +993,7 @@
"expected_verdict": "pass",
"expected_rules": [],
"description": "MD5 在白名单",
- "_last_scan_verdict": "clean",
- "_last_scan_score": 0.0,
- "_last_scan_findings": 0
+ "_scan_verdict": "clean"
},
{
"filename": "L5-001_clean_hello.exe",
@@ -1180,9 +1005,7 @@
"PeParseFailed"
],
"description": "原生干净HelloWorld PE（无壳）",
- "_last_scan_verdict": "suspicious",
- "_last_scan_score": 55.0,
- "_last_scan_findings": 2
+ "_scan_verdict": "suspicious"
},
{
"filename": "L5-002_upx_shell.exe",
@@ -1194,9 +1017,7 @@
"PeParseFailed"
],
"description": "UPX0/UPX1 节名",
- "_last_scan_verdict": "suspicious",
- "_last_scan_score": 55.0,
- "_last_scan_findings": 2
+ "_scan_verdict": "suspicious"
},
{
"filename": "L5-003_double_upx.exe",
@@ -1208,9 +1029,7 @@
"PeParseFailed"
],
"description": "UPX加壳PE，二次压缩",
- "_last_scan_verdict": "suspicious",
- "_last_scan_score": 55.0,
- "_last_scan_findings": 2
+ "_scan_verdict": "suspicious"
},
{
"filename": "L5-004_rwx_section.exe",
@@ -1222,9 +1041,7 @@
"PeParseFailed"
],
"description": "节属性 RWX",
- "_last_scan_verdict": "suspicious",
- "_last_scan_score": 55.0,
- "_last_scan_findings": 2
+ "_scan_verdict": "suspicious"
},
{
"filename": "L5-005_injection_imports.exe",
@@ -1238,9 +1055,7 @@
"UnsignedExecutable"
],
"description": "注入组合导入（需要真实 pefile 引入 API）",
- "_last_scan_verdict": "malicious",
- "_last_scan_score": 75.0,
- "_last_scan_findings": 4
+ "_scan_verdict": "malicious"
},
{
"filename": "L5-006_single_virtualalloc.exe",
@@ -1254,9 +1069,7 @@
"UnsignedExecutable"
],
"description": "单一可疑内存 API",
- "_last_scan_verdict": "malicious",
- "_last_scan_score": 75.0,
- "_last_scan_findings": 4
+ "_scan_verdict": "malicious"
},
{
"filename": "L5-007_garbage_section.exe",
@@ -1268,9 +1081,7 @@
"PeParseFailed"
],
"description": "节名乱码",
- "_last_scan_verdict": "suspicious",
- "_last_scan_score": 55.0,
- "_last_scan_findings": 2
+ "_scan_verdict": "suspicious"
},
{
"filename": "L5-008_many_exports.exe",
@@ -1284,9 +1095,7 @@
"UnsignedExecutable"
],
"description": "导出表异常（需真实工具生成）",
- "_last_scan_verdict": "malicious",
- "_last_scan_score": 75.0,
- "_last_scan_findings": 4
+ "_scan_verdict": "malicious"
},
{
"filename": "L5-009_shell_in_resource.exe",
@@ -1300,9 +1109,7 @@
"UnsignedExecutable"
],
"description": "资源段内嵌字符串（占位）",
- "_last_scan_verdict": "malicious",
- "_last_scan_score": 75.0,
- "_last_scan_findings": 4
+ "_scan_verdict": "malicious"
},
{
"filename": "L5-010_bad_mz.exe",
@@ -1315,9 +1122,7 @@
"PeParseFailed"
],
"description": "PE 头非法",
- "_last_scan_verdict": "reject",
- "_last_scan_score": 100.0,
- "_last_scan_findings": 3
+ "_scan_verdict": "reject"
},
{
"filename": "L5-011_truncated.exe",
@@ -1329,9 +1134,7 @@
"PeParseFailed"
],
"description": "截断 PE",
- "_last_scan_verdict": "suspicious",
- "_last_scan_score": 55.0,
- "_last_scan_findings": 2
+ "_scan_verdict": "suspicious"
},
{
"filename": "L5-012_pe32.exe",
@@ -1343,9 +1146,7 @@
"PeParseFailed"
],
"description": "32 位识别",
- "_last_scan_verdict": "suspicious",
- "_last_scan_score": 55.0,
- "_last_scan_findings": 2
+ "_scan_verdict": "suspicious"
},
{
"filename": "L5-013_pe64.exe",
@@ -1357,9 +1158,7 @@
"PeParseFailed"
],
"description": "64 位识别占位",
- "_last_scan_verdict": "suspicious",
- "_last_scan_score": 55.0,
- "_last_scan_findings": 2
+ "_scan_verdict": "suspicious"
},
{
"filename": "L5-014_clean_tool.exe",
@@ -1371,9 +1170,7 @@
"PeParseFailed"
],
"description": "PE导入表大量系统API（正常工具）",
- "_last_scan_verdict": "suspicious",
- "_last_scan_score": 55.0,
- "_last_scan_findings": 2
+ "_scan_verdict": "suspicious"
},
{
"filename": "L5-015_bad_reloc.exe",
@@ -1387,9 +1184,7 @@
"UnsignedExecutable"
],
"description": "重定位表损坏占位",
- "_last_scan_verdict": "malicious",
- "_last_scan_score": 75.0,
- "_last_scan_findings": 4
+ "_scan_verdict": "malicious"
},
{
"filename": "L5-016_zero_section.exe",
@@ -1401,9 +1196,7 @@
"PeParseFailed"
],
"description": "零节 PE 占位",
- "_last_scan_verdict": "suspicious",
- "_last_scan_score": 55.0,
- "_last_scan_findings": 2
+ "_scan_verdict": "suspicious"
},
{
"filename": "L5-016_zero_sections.exe",
@@ -1417,9 +1210,7 @@
"UnsignedExecutable"
],
"description": "无节表最小 PE",
- "_last_scan_verdict": "malicious",
- "_last_scan_score": 75.0,
- "_last_scan_findings": 4
+ "_scan_verdict": "malicious"
},
{
"filename": "L5-017_upx_rwx.exe",
@@ -1431,9 +1222,7 @@
"PeParseFailed"
],
"description": "UPX壳 + RWX节复合特征",
- "_last_scan_verdict": "suspicious",
- "_last_scan_score": 55.0,
- "_last_scan_findings": 2
+ "_scan_verdict": "suspicious"
},
{
"filename": "L5-018_debug_info.exe",
@@ -1445,9 +1234,7 @@
"PeParseFailed"
],
"description": "调试信息占位",
- "_last_scan_verdict": "suspicious",
- "_last_scan_score": 55.0,
- "_last_scan_findings": 2
+ "_scan_verdict": "suspicious"
},
{
"filename": "L5-019_200mb_huge.exe",
@@ -1459,9 +1246,7 @@
"PeParseFailed"
],
"description": "200MB 超大 PE（占位，真实生成会写满磁盘）",
- "_last_scan_verdict": "suspicious",
- "_last_scan_score": 55.0,
- "_last_scan_findings": 2
+ "_scan_verdict": "suspicious"
},
{
"filename": "L5-020_layer_off_sample.bin",
@@ -1477,9 +1262,7 @@
"UnsignedExecutable"
],
"description": "关闭分层开关测试占位",
- "_last_scan_verdict": "reject",
- "_last_scan_score": 100.0,
- "_last_scan_findings": 6
+ "_scan_verdict": "reject"
},
{
"filename": "NEG-001_clean.jpg",
@@ -1488,9 +1271,7 @@
"expected_verdict": "pass",
"expected_rules": [],
"description": "业务标准JPG图片",
- "_last_scan_verdict": "clean",
- "_last_scan_score": 0.0,
- "_last_scan_findings": 0
+ "_scan_verdict": "clean"
},
{
"filename": "NEG-002_clean.png",
@@ -1499,9 +1280,7 @@
"expected_verdict": "pass",
"expected_rules": [],
"description": "业务PNG图片",
- "_last_scan_verdict": "clean",
- "_last_scan_score": 0.0,
- "_last_scan_findings": 0
+ "_scan_verdict": "clean"
},
{
"filename": "NEG-003_clean.mp4",
@@ -1510,9 +1289,7 @@
"expected_verdict": "pass",
"expected_rules": [],
"description": "业务MP4视频",
- "_last_scan_verdict": "clean",
- "_last_scan_score": 0.0,
- "_last_scan_findings": 0
+ "_scan_verdict": "clean"
},
{
"filename": "NEG-004_clean.docx",
@@ -1521,9 +1298,7 @@
"expected_verdict": "pass",
"expected_rules": [],
"description": "业务正常docx报表",
- "_last_scan_verdict": "clean",
- "_last_scan_score": 0.0,
- "_last_scan_findings": 0
+ "_scan_verdict": "clean"
},
{
"filename": "NEG-005_clean.xlsx",
@@ -1532,9 +1307,7 @@
"expected_verdict": "pass",
"expected_rules": [],
"description": "业务正常xlsx表格",
- "_last_scan_verdict": "clean",
- "_last_scan_score": 0.0,
- "_last_scan_findings": 0
+ "_scan_verdict": "clean"
},
{
"filename": "NEG-006_clean.pdf",
@@ -1546,9 +1319,7 @@
"PdfParseFailed"
],
"description": "业务正常PDF报告",
- "_last_scan_verdict": "suspicious",
- "_last_scan_score": 20.0,
- "_last_scan_findings": 2
+ "_scan_verdict": "suspicious"
},
{
"filename": "NEG-007_clean.java",
@@ -1557,9 +1328,7 @@
"expected_verdict": "pass",
"expected_rules": [],
"description": "业务源码java文件",
- "_last_scan_verdict": "reject",
- "_last_scan_score": 100.0,
- "_last_scan_findings": 0
+ "_scan_verdict": "reject"
},
{
"filename": "NEG-008_clean.py",
@@ -1570,9 +1339,7 @@
"DangerousExecutableExtension"
],
"description": "业务源码python脚本",
- "_last_scan_verdict": "suspicious",
- "_last_scan_score": 30.0,
- "_last_scan_findings": 1
+ "_scan_verdict": "suspicious"
},
{
"filename": "NEG-009_clean.zip",
@@ -1581,9 +1348,7 @@
"expected_verdict": "pass",
"expected_rules": [],
"description": "正常业务压缩包zip",
- "_last_scan_verdict": "clean",
- "_last_scan_score": 0.0,
- "_last_scan_findings": 0
+ "_scan_verdict": "clean"
},
{
"filename": "NEG-010_clean.exe",
@@ -1595,9 +1360,7 @@
"PeParseFailed"
],
"description": "正常业务安装包（干净开源）",
- "_last_scan_verdict": "suspicious",
- "_last_scan_score": 55.0,
- "_last_scan_findings": 2
+ "_scan_verdict": "suspicious"
},
{
"filename": "NEG-011_clean.log",
@@ -1606,9 +1369,7 @@
"expected_verdict": "pass",
"expected_rules": [],
"description": "正常日志文件",
- "_last_scan_verdict": "reject",
- "_last_scan_score": 100.0,
- "_last_scan_findings": 0
+ "_scan_verdict": "reject"
},
{
"filename": "NEG-012_clean.csv",
@@ -1617,9 +1378,7 @@
"expected_verdict": "pass",
"expected_rules": [],
"description": "正常csv业务数据文件",
- "_last_scan_verdict": "clean",
- "_last_scan_score": 0.0,
- "_last_scan_findings": 0
+ "_scan_verdict": "clean"
},
{
"filename": "NEG-013_clean.eml",
@@ -1628,9 +1387,7 @@
"expected_verdict": "pass",
"expected_rules": [],
"description": "正常eml业务邮件（无附件、无外联恶意）",
- "_last_scan_verdict": "clean",
- "_last_scan_score": 0.0,
- "_last_scan_findings": 0
+ "_scan_verdict": "clean"
},
{
"filename": "NEG-014_clean.dll",
@@ -1642,9 +1399,7 @@
"PeParseFailed"
],
"description": "正常dll（系统干净dll）",
- "_last_scan_verdict": "suspicious",
- "_last_scan_score": 55.0,
- "_last_scan_findings": 2
+ "_scan_verdict": "suspicious"
},
{
"filename": "NEG-015_clean.ttf",
@@ -1653,9 +1408,7 @@
"expected_verdict": "pass",
"expected_rules": [],
"description": "正常字体文件ttf",
- "_last_scan_verdict": "reject",
- "_last_scan_score": 100.0,
- "_last_scan_findings": 0
+ "_scan_verdict": "reject"
},
{
"filename": "NEG-016_clean.dwg",
@@ -1664,9 +1417,7 @@
"expected_verdict": "pass",
"expected_rules": [],
"description": "正常CAD图纸",
- "_last_scan_verdict": "reject",
- "_last_scan_score": 100.0,
- "_last_scan_findings": 0
+ "_scan_verdict": "reject"
},
{
"filename": "NEG-017_4layer_nested.zip",
@@ -1678,9 +1429,7 @@
"MalformedStructure"
],
"description": "多层嵌套干净zip（无风险）",
- "_last_scan_verdict": "suspicious",
- "_last_scan_score": 35.0,
- "_last_scan_findings": 2
+ "_scan_verdict": "suspicious"
},
{
"filename": "NEG-018_clean.bat",
@@ -1691,9 +1440,7 @@
"DangerousExecutableExtension"
],
"description": "正常bat运维脚本（内网备份）",
- "_last_scan_verdict": "suspicious",
- "_last_scan_score": 30.0,
- "_last_scan_findings": 1
+ "_scan_verdict": "suspicious"
},
{
"filename": "NEG-019_clean.ps1",
@@ -1704,9 +1451,7 @@
"DangerousExecutableExtension"
],
"description": "正常ps1运维脚本（内网查询）",
- "_last_scan_verdict": "suspicious",
- "_last_scan_score": 30.0,
- "_last_scan_findings": 1
+ "_scan_verdict": "suspicious"
},
{
"filename": "NEG-020_clean.odt",
@@ -1715,97 +1460,83 @@
"expected_verdict": "pass",
"expected_rules": [],
"description": "正常odt文档",
- "_last_scan_verdict": "reject",
- "_last_scan_score": 100.0,
- "_last_scan_findings": 0
+ "_scan_verdict": "reject"
},
{
"filename": "broken.zip",
- "case_id": "",
- "category": "",
+ "case_id": "L7-001",
+ "category": "L7",
"expected_verdict": "clean",
"expected_rules": [],
- "description": "",
- "_last_scan_verdict": "clean",
- "_last_scan_score": 0.0,
- "_last_scan_findings": 0
+ "description": "损坏 ZIP",
+ "_scan_verdict": "clean"
},
{
"filename": "evil.iso",
- "case_id": "",
- "category": "",
+ "case_id": "L7-002",
+ "category": "L7",
"expected_verdict": "suspicious",
"expected_rules": [
"DangerousExecutableExtension"
],
- "description": "",
- "_last_scan_verdict": "suspicious",
- "_last_scan_score": 30.0,
- "_last_scan_findings": 1
+ "description": "恶意 ISO 镜像",
+ "_scan_verdict": "suspicious"
},
{
"filename": "evil_help.chm",
- "case_id": "",
- "category": "",
+ "case_id": "L7-003",
+ "category": "L7",
"expected_verdict": "malicious",
"expected_rules": [
"ChmWithScript",
"DangerousExecutableExtension",
"RemoteDownloadUnix"
],
- "description": "",
- "_last_scan_verdict": "malicious",
- "_last_scan_score": 100.0,
- "_last_scan_findings": 3
+ "description": "含脚本 CHM 帮助",
+ "_scan_verdict": "malicious"
},
{
"filename": "linux_malicious",
- "case_id": "",
- "category": "",
+ "case_id": "L7-004",
+ "category": "L7",
"expected_verdict": "malicious",
"expected_rules": [
"C7_Linux_ReverseShell_Bash",
"LinuxExecutable",
"ReverseShellNetcat"
],
- "description": "",
- "_last_scan_verdict": "malicious",
- "_last_scan_score": 100.0,
- "_last_scan_findings": 3
+ "description": "Linux 恶意脚本集",
+ "_scan_verdict": "malicious"
},
{
"filename": "lolbin.cmd",
- "case_id": "",
- "category": "",
+ "case_id": "L7-005",
+ "category": "L7",
"expected_verdict": "suspicious",
"expected_rules": [
"CommandExecutionObfuscated",
"DangerousExecutableExtension"
],
- "description": "",
- "_last_scan_verdict": "suspicious",
- "_last_scan_score": 55.0,
- "_last_scan_findings": 2
+ "description": "LOLBin cmd 混淆",
+ "_scan_verdict": "suspicious"
},
{
"filename": "macro_alert.docm",
- "case_id": "",
- "category": "",
+ "case_id": "L7-006",
+ "category": "L7",
"expected_verdict": "malicious",
"expected_rules": [
"RemoteDownloadPowerShell",
"RemoteDownloadUnix",
"VBAAutoExecShell"
],
- "description": "",
- "_last_scan_verdict": "malicious",
- "_last_scan_score": 100.0,
- "_last_scan_findings": 3
+ "description": "含 VBA 宏 DOCM",
+ "_scan_verdict": "malicious"
},
{
"filename": "malicious.desktop",
- "case_id": "",
- "category": "",
+ "case_id": "L7-007",
+ "category": "L7",
"expected_verdict": "malicious",
"expected_rules": [
"C7_Linux_ReverseShell_Bash",
@@ -1814,128 +1545,108 @@
"DesktopFileAutoExec",
"ReverseShellNetcat"
],
- "description": "",
- "_last_scan_verdict": "malicious",
- "_last_scan_score": 100.0,
- "_last_scan_findings": 6
+ "description": "恶意 .desktop 反序列化",
+ "_scan_verdict": "malicious"
},
{
"filename": "malicious.pdf",
- "case_id": "",
- "category": "",
+ "case_id": "L7-008",
+ "category": "L7",
"expected_verdict": "malicious",
"expected_rules": [
"PdfJavaScript",
"PdfOpenAction"
],
- "description": "",
- "_last_scan_verdict": "malicious",
- "_last_scan_score": 100.0,
- "_last_scan_findings": 2
+ "description": "含 JS/Action PDF",
+ "_scan_verdict": "malicious"
},
{
"filename": "miner_config.json",
- "case_id": "",
- "category": "",
+ "case_id": "L7-009",
+ "category": "L7",
"expected_verdict": "suspicious",
"expected_rules": [
"C7_Linux_Miner_Generic"
],
- "description": "",
- "_last_scan_verdict": "suspicious",
- "_last_scan_score": 45.0,
- "_last_scan_findings": 1
+ "description": "挖矿配置文件",
+ "_scan_verdict": "suspicious"
},
{
"filename": "neg_tmp1.zip",
- "case_id": "",
- "category": "",
+ "case_id": "L7-035",
+ "category": "L7",
"expected_verdict": "clean",
"expected_rules": [],
- "description": "",
- "_last_scan_verdict": "clean",
- "_last_scan_score": 0.0,
- "_last_scan_findings": 0
+ "description": "占位残留 tmp zip",
+ "_scan_verdict": "clean"
},
{
"filename": "normal.pdf",
- "case_id": "",
- "category": "",
+ "case_id": "L7-010",
+ "category": "L7",
"expected_verdict": "clean",
"expected_rules": [],
- "description": "",
- "_last_scan_verdict": "clean",
- "_last_scan_score": 0.0,
- "_last_scan_findings": 0
+ "description": "干净 PDF 对照",
+ "_scan_verdict": "clean"
},
{
"filename": "normal_deploy.sh",
- "case_id": "",
- "category": "",
+ "case_id": "L7-011",
+ "category": "L7",
"expected_verdict": "suspicious",
"expected_rules": [
"DangerousExecutableExtension"
],
- "description": "",
- "_last_scan_verdict": "suspicious",
- "_last_scan_score": 30.0,
- "_last_scan_findings": 1
+ "description": "运维部署脚本（误报）",
+ "_scan_verdict": "suspicious"
},
{
"filename": "normal_readme.txt",
- "case_id": "",
- "category": "",
+ "case_id": "L7-012",
+ "category": "L7",
"expected_verdict": "clean",
"expected_rules": [],
- "description": "",
- "_last_scan_verdict": "clean",
- "_last_scan_score": 0.0,
- "_last_scan_findings": 0
+ "description": "干净 README 对照",
+ "_scan_verdict": "clean"
},
{
"filename": "normal_report.docx",
- "case_id": "",
- "category": "",
+ "case_id": "L7-013",
+ "category": "L7",
"expected_verdict": "clean",
"expected_rules": [],
- "description": "",
- "_last_scan_verdict": "clean",
- "_last_scan_score": 0.0,
- "_last_scan_findings": 0
+ "description": "干净 DOCX 对照",
+ "_scan_verdict": "clean"
},
{
"filename": "ole_dropper.doc",
- "case_id": "",
- "category": "",
+ "case_id": "L7-014",
+ "category": "L7",
"expected_verdict": "suspicious",
"expected_rules": [
"OleToolsUnavailable",
"RemoteSessionHijack"
],
- "description": "",
- "_last_scan_verdict": "suspicious",
- "_last_scan_score": 35.0,
- "_last_scan_findings": 2
+ "description": "OLE 投递 DOC",
+ "_scan_verdict": "suspicious"
},
{
"filename": "pe_downloader.exe",
- "case_id": "",
- "category": "",
+ "case_id": "L7-015",
+ "category": "L7",
"expected_verdict": "malicious",
"expected_rules": [
"C1_PE_Downloader_Loader",
"DangerousExecutableExtension",
"PeParseFailed"
],
- "description": "",
- "_last_scan_verdict": "malicious",
- "_last_scan_score": 100.0,
- "_last_scan_findings": 3
+ "description": "PE 下载木马",
+ "_scan_verdict": "malicious"
},
{
"filename": "pe_injection.exe",
- "case_id": "",
- "category": "",
+ "case_id": "L7-016",
+ "category": "L7",
"expected_verdict": "malicious",
"expected_rules": [
"C1_PE_ProcessInjection",
@@ -1943,15 +1654,13 @@
"PeParseFailed",
"RemoteSessionHijack"
],
- "description": "",
- "_last_scan_verdict": "malicious",
- "_last_scan_score": 100.0,
- "_last_scan_findings": 4
+ "description": "PE 注入程序",
+ "_scan_verdict": "malicious"
},
{
"filename": "persist_cron.sh",
- "case_id": "",
- "category": "",
+ "case_id": "L7-017",
+ "category": "L7",
"expected_verdict": "malicious",
"expected_rules": [
"C7_Linux_Persistence_Crontab",
@@ -1960,15 +1669,13 @@
"ShellScriptDangerous",
"Txt.Malware.Sustes-6779550-1"
],
- "description": "",
- "_last_scan_verdict": "malicious",
- "_last_scan_score": 100.0,
- "_last_scan_findings": 6
+ "description": "Crontab 持久化脚本",
+ "_scan_verdict": "malicious"
},
{
"filename": "phishing.eml",
- "case_id": "",
- "category": "",
+ "case_id": "L7-018",
+ "category": "L7",
"expected_verdict": "reject",
"expected_rules": [
"EmailAttachmentDangerous",
@@ -1976,28 +1683,24 @@
"EmailAttachmentWebshell",
"EmailPhishingKeyword"
],
- "description": "",
- "_last_scan_verdict": "reject",
- "_last_scan_score": 100.0,
- "_last_scan_findings": 10
+ "description": "钓鱼邮件 EML",
+ "_scan_verdict": "reject"
},
{
"filename": "photo.jpg.php",
- "case_id": "",
- "category": "",
+ "case_id": "L7-019",
+ "category": "L7",
"expected_verdict": "reject",
"expected_rules": [
"DangerousExecutableExtension"
],
- "description": "",
- "_last_scan_verdict": "reject",
- "_last_scan_score": 100.0,
- "_last_scan_findings": 1
+ "description": "双扩展名伪装 .jpg.php",
+ "_scan_verdict": "reject"
},
{
"filename": "ransom_dropper.exe.txt",
- "case_id": "",
- "category": "",
+ "case_id": "L7-020",
+ "category": "L7",
"expected_verdict": "reject",
"expected_rules": [
"C8_Ransomware_Encryption",
@@ -2005,15 +1708,13 @@
"C8_Ransomware_VolumeShadow",
"DoubleExtension"
],
- "description": "",
- "_last_scan_verdict": "reject",
- "_last_scan_score": 100.0,
- "_last_scan_findings": 4
+ "description": "勒索软件投递器",
+ "_scan_verdict": "reject"
},
{
"filename": "sealed.docx",
- "case_id": "",
- "category": "",
+ "case_id": "L7-021",
+ "category": "L7",
"expected_verdict": "reject",
"expected_rules": [
"ArchiveBroken",
@@ -2021,15 +1722,13 @@
"OfficeEncrypted",
"OoxmlParseFailed"
],
- "description": "",
- "_last_scan_verdict": "reject",
- "_last_scan_score": 100.0,
- "_last_scan_findings": 4
+ "description": "加密 DOCX（被视为损坏）",
+ "_scan_verdict": "reject"
},
{
"filename": "sealed.xlsx",
- "case_id": "",
- "category": "",
+ "case_id": "L7-022",
+ "category": "L7",
"expected_verdict": "reject",
"expected_rules": [
"ArchiveBroken",
@@ -2038,28 +1737,24 @@
"OfficeEncrypted",
"OoxmlParseFailed"
],
- "description": "",
- "_last_scan_verdict": "reject",
- "_last_scan_score": 100.0,
- "_last_scan_findings": 5
+ "description": "加密 XLSX（被视为损坏）",
+ "_scan_verdict": "reject"
},
{
"filename": "shell_aspx.aspx",
- "case_id": "",
- "category": "",
+ "case_id": "L7-023",
+ "category": "L7",
"expected_verdict": "reject",
"expected_rules": [
"DangerousExecutableExtension"
],
- "description": "",
- "_last_scan_verdict": "reject",
- "_last_scan_score": 100.0,
- "_last_scan_findings": 1
+ "description": "ASPX 一句话木马",
+ "_scan_verdict": "reject"
},
{
"filename": "shell_bash_devtcp.sh",
- "case_id": "",
- "category": "",
+ "case_id": "L7-024",
+ "category": "L7",
"expected_verdict": "malicious",
"expected_rules": [
"C7_Linux_ReverseShell_Bash",
@@ -2067,29 +1762,25 @@
"ReverseShellNetcat",
"ShellScriptDangerous"
],
- "description": "",
- "_last_scan_verdict": "malicious",
- "_last_scan_score": 100.0,
- "_last_scan_findings": 4
+ "description": "Bash /dev/tcp 反弹",
+ "_scan_verdict": "malicious"
},
{
"filename": "shell_jsp_runtime.jsp",
- "case_id": "",
- "category": "",
+ "case_id": "L7-025",
+ "category": "L7",
"expected_verdict": "reject",
"expected_rules": [
"C3_JSP_Webshell_RuntimeExec",
"DangerousExecutableExtension"
],
- "description": "",
- "_last_scan_verdict": "reject",
- "_last_scan_score": 100.0,
- "_last_scan_findings": 2
+ "description": "JSP Runtime exec 木马",
+ "_scan_verdict": "reject"
},
{
"filename": "shell_nc.sh",
- "case_id": "",
- "category": "",
+ "case_id": "L7-026",
+ "category": "L7",
"expected_verdict": "malicious",
"expected_rules": [
"C7_Linux_ReverseShell_NC",
@@ -2097,97 +1788,83 @@
"ReverseShellNetcat",
"ShellScriptDangerous"
],
- "description": "",
- "_last_scan_verdict": "malicious",
- "_last_scan_score": 100.0,
- "_last_scan_findings": 4
+ "description": "NC 反弹 Shell",
+ "_scan_verdict": "malicious"
},
{
"filename": "shell_php_eval.php",
- "case_id": "",
- "category": "",
+ "case_id": "L7-027",
+ "category": "L7",
"expected_verdict": "reject",
"expected_rules": [
"C3_PHP_Webshell_Oneliner",
"DangerousExecutableExtension"
],
- "description": "",
- "_last_scan_verdict": "reject",
- "_last_scan_score": 100.0,
- "_last_scan_findings": 2
+ "description": "PHP eval 一句话木马",
+ "_scan_verdict": "reject"
},
{
"filename": "shell_php_obf.php",
- "case_id": "",
- "category": "",
+ "case_id": "L7-028",
+ "category": "L7",
"expected_verdict": "reject",
"expected_rules": [
"C3_PHP_Webshell_Obfuscated",
"DangerousExecutableExtension"
],
- "description": "",
- "_last_scan_verdict": "reject",
- "_last_scan_score": 100.0,
- "_last_scan_findings": 2
+ "description": "PHP 混淆木马",
+ "_scan_verdict": "reject"
},
{
"filename": "shell_python.py",
- "case_id": "",
- "category": "",
+ "case_id": "L7-029",
+ "category": "L7",
"expected_verdict": "suspicious",
"expected_rules": [
"DangerousExecutableExtension"
],
- "description": "",
- "_last_scan_verdict": "suspicious",
- "_last_scan_score": 30.0,
- "_last_scan_findings": 1
+ "description": "Python 反弹脚本",
+ "_scan_verdict": "suspicious"
},
{
"filename": "shortcut.lnk",
- "case_id": "",
- "category": "",
+ "case_id": "L7-030",
+ "category": "L7",
"expected_verdict": "suspicious",
"expected_rules": [
"DangerousExecutableExtension",
"RemoteDownloadUnix"
],
- "description": "",
- "_last_scan_verdict": "suspicious",
- "_last_scan_score": 60.0,
- "_last_scan_findings": 2
+ "description": "恶意 .lnk 快捷方式",
+ "_scan_verdict": "suspicious"
},
{
"filename": "template_backdoor.docx",
- "case_id": "",
- "category": "",
+ "case_id": "L7-031",
+ "category": "L7",
"expected_verdict": "malicious",
"expected_rules": [
"AttachedTemplate"
],
- "description": "",
- "_last_scan_verdict": "malicious",
- "_last_scan_score": 100.0,
- "_last_scan_findings": 1
+ "description": "模板后门 DOCX",
+ "_scan_verdict": "malicious"
},
{
"filename": "vba_autoexec.bas",
- "case_id": "",
- "category": "",
+ "case_id": "L7-032",
+ "category": "L7",
"expected_verdict": "malicious",
"expected_rules": [
"RemoteDownloadUnix",
"VBAAutoExecShell"
],
- "description": "",
- "_last_scan_verdict": "malicious",
- "_last_scan_score": 100.0,
- "_last_scan_findings": 2
+ "description": "VBA AutoOpen 宏",
+ "_scan_verdict": "malicious"
},
{
"filename": "wps_macro.js",
- "case_id": "",
- "category": "",
+ "case_id": "L7-033",
+ "category": "L7",
"expected_verdict": "malicious",
"expected_rules": [
"C7_Linux_ReverseShell_Bash",
@@ -2195,24 +1872,20 @@
"DangerousExecutableExtension",
"ReverseShellNetcat"
],
- "description": "",
- "_last_scan_verdict": "malicious",
- "_last_scan_score": 100.0,
- "_last_scan_findings": 4
+ "description": "WPS JS 宏",
+ "_scan_verdict": "malicious"
},
{
"filename": "zip_traversal.zip",
- "case_id": "",
- "category": "",
+ "case_id": "L7-034",
+ "category": "L7",
"expected_verdict": "malicious",
"expected_rules": [
"PathTraversal",
"PathTraversalBlocked"
],
- "description": "",
- "_last_scan_verdict": "malicious",
- "_last_scan_score": 100.0,
- "_last_scan_findings": 2
+ "description": "ZIP 路径穿越（旧版）",
+ "_scan_verdict": "malicious"
}
]
}
\ No newline at end of file