// =============================================================================
// MeshSafe L2B YARA 规则集 —— Windows PE 恶意程序专项（C1 + C8）
// =============================================================================
//
// 设计原则：
//   - 所有规则使用 2-3 特征组合命中（API 组合 + C2 URL + Mutex 持久化等）
//   - binary.py 的 PE 结构分析负责：节熵 + 签名 + 可疑导入（单 API）
//   - YARA 负责：多 API 组合 + 字符串组合 + 壳 + 勒索专项
//   - 命中后作为 finding 交给 PolicyEngine 权重累加，不直接零容忍
//
// 范围：
//   - C1: Windows PE 恶意程序（注入器 / 下载器 / RAT / Loader）
//   - C8: 勒索 / 挖矿专项
//   - C9: 壳 / 签名 / 结构异常（binary.py 已覆盖大部分，YARA 补充壳特征）
//
// 维护：
//   - 新恶意家族出现时，优先补充"API 组合 + Mutex 名 + C2 URL"三件套
//   - 壳特征（UPX/Themida/VMP）可识别后自动送沙箱深检
// =============================================================================


// =============================================================================
// C1-1 进程注入三件套（VirtualAllocEx + WriteProcessMemory + CreateRemoteThread）
// binary.py 扫了 SuspiciousImports（单个 API），但 3 个同时出现 = 必然是注入器
// =============================================================================

rule C1_PE_ProcessInjection {
    meta:
        risk_level = "critical"
        category = "C1"
        false_positive_rate = "low"
        reference = "MITRE ATT&CK T1055 Process Injection"
        description = "PE 文件同时导入 进程注入三件套 API = 远控/注入器特征"
    strings:
        $s1 = "VirtualAllocEx" ascii
        $s2 = "WriteProcessMemory" ascii
        $s3 = "CreateRemoteThread" ascii
        // 备选：Nt 系列（NtUnmapViewOfSection + VirtualAllocEx + CreateRemoteThread）
        $n1 = "NtUnmapViewOfSection" ascii
        $n2 = "NtMapViewOfSection" ascii
        $n3 = "ZwUnmapViewOfSection" ascii
        // 也可能是 QueueUserAPC 注 APC 注入
        $apc = "QueueUserAPC" ascii
        // 或 SetWindowsHookEx DLL 注入
        $hook = "SetWindowsHookEx" ascii
    condition:
        // 经典三件套（必须同时命中）
        $s1 and $s2 and $s3
        or
        // Nt 系列内存注入（至少 2 个 Nt + 1 个注入）
        (any of ($n1, $n2, $n3) and any of ($s1, $s3, $apc))
        or
        // APC 注入 + VirtualAllocEx
        $apc and $s1
        or
        // Hook DLL 注入
        $hook and $s1
}


// =============================================================================
// C1-2 下载器组合（网络 API + 本地持久化 / 执行）
// 单一 URLDownloadToFile 不致命，但 "下载 + 执行 + 持久化" 三件套 = Loader
// =============================================================================

rule C1_PE_Downloader_Loader {
    meta:
        risk_level = "high"
        category = "C1"
        false_positive_rate = "low"
        reference = "MITRE ATT&CK T1105 Ingress Tool Transfer"
        description = "下载器组合：HTTP/FTP 下载 + 写入到可疑路径 + 执行"
    strings:
        // 网络下载 API（任选其一）
        $net1 = "URLDownloadToFile" ascii
        $net2 = "InternetOpenUrl" ascii
        $net3 = "WinHttpOpen" ascii
        $net4 = "WinHttpOpenRequest" ascii
        $net5 = "FtpOpenFile" ascii
        $net6 = "DownloadFile" ascii
        $net7 = "WinHttpSendRequest" ascii

        // 写入/保存到本地
        $save1 = "WriteFile" ascii
        $save2 = "SaveToFile" ascii
        $save3 = "URLDownloadToCacheFile" ascii

        // 执行下载的载荷
        $exec1 = "WinExec" ascii
        $exec2 = "CreateProcess" ascii
        $exec3 = "ShellExecute" ascii
        $exec4 = "CreateRemoteThread" ascii

        // 持久化（注册表/启动项）
        $persist1 = "RegSetValueEx" ascii
        $persist2 = "SetServiceObjectSecurity" ascii
        $persist3 = "CreateService" ascii
        $persist4 = "schtasks.exe" ascii
        $persist5 = "RUN" ascii  // HKCU\Software\Microsoft\Windows\CurrentVersion\Run
    condition:
        // 下载 + 保存 + 执行（三件套）
        any of ($net*) and any of ($save*) and any of ($exec*)
        or
        // 下载 + 持久化（即使没执行也是准备投毒）
        any of ($net*) and any of ($persist*)
        or
        // 执行 + 持久化（下载可能在运行时动态完成）
        any of ($exec1, $exec2, $exec3) and any of ($persist*)
}


// =============================================================================
// C1-3 RAT / 远控特征（C2 通信 + 命令执行 + 持久化）
// =============================================================================

rule C1_PE_RAT_CommandControl {
    meta:
        risk_level = "critical"
        category = "C1"
        false_positive_rate = "medium"
        reference = "MITRE ATT&CK T1071 Application Layer Protocol"
        description = "RAT C2 通信特征：WinHTTP/WSASend + 命令执行 API + 可疑 URL/域名"
    strings:
        // C2 网络通道
        $c2_send = /WSASend|send\s*\(|sendto|WinHttpSendRequest|InternetWriteFile/ ascii
        $c2_recv = /WSARecv|recv\s*\(|recvfrom|WinHttpReadData|InternetReadFile/ ascii
        $c2_connect = /WSAConnect|connect\s*\(|WinHttpConnect|InternetConnect/ ascii

        // 命令执行
        $cmd = /CreateProcess|ShellExecute|WinExec|system\s*\(|popen/ ascii

        // 可疑 C2 URL（可执行文件里出现 http://...exe 或常见 C2 域名）
        $c2url1 = /http:\/\/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}:\d{2,5}/ ascii
        $c2url2 = /https?:\/\/[^\"\s'\)]+\.(ru|top|xyz|tk|ml|ga|gq|cf|pw|click|stream|xyz|buzz|loan)\/[^\"\s'\)]*\.exe/ ascii
        $c2url3 = /(c2|panel|gate|bot|ops|serv|beacon|stage|stager)\.(ru|top|xyz|cc|io|com|net)/ ascii
    condition:
        // C2 通信 + 命令执行（至少两个网络 + 一个命令）
        any of ($c2_send, $c2_recv, $c2_connect) and any of ($cmd*) and any of ($c2url*)
        or
        // C2 URL 模式 + 网络 API
        any of ($c2url*) and any of ($c2_connect, $c2_send)
}


// =============================================================================
// C1-4 Mutex 互斥体名（勒索 / RAT / Loader 的持久化标记）
// 单一 Mutex 名有一定价值，但必须配合其他特征才触发
// =============================================================================

rule C1_PE_Mutex_Persistence {
    meta:
        risk_level = "medium"
        category = "C1"
        false_positive_rate = "medium"
        reference = "MITRE ATT&CK T1057 Process Discovery (mutex as persistence marker)"
        description = "可疑 Mutex 名称 + CreateMutex API = 持久化标记"
    strings:
        $createmutex = "CreateMutexA" ascii
        $createmutexw = "CreateMutexW" ascii
        // 常见勒索/RAT Mutex 名（大小写不敏感，含 Unicode 变体用 wide）
        // LockBit
        $lockbit1 = /Global\\[Ll]ock[Bb]it/ ascii
        $lockbit2 = /Local\\[Ll]ock[Bb]it/ ascii
        // BlackCat / ALPHV
        $blackcat = /Global\\[Bb]lack[Cc]at|[Aa][Ll][Pp][Hh][Vv]/ ascii
        // Ryuk
        $ryuk = /RyukTask[\d]|Global\\Ryuk/ ascii
        // Conti
        $conti = /Global\\[Cc]onti|Local\\[Cc]onti/ ascii
        // Pseudo/Dharma
        $dharma = /Global\\[Dd]harma|Local\\[Dd]harma/ ascii
        // 通用可疑模式：Mutex 名包含 "Mutex" + UUID 变体
        $generic1 = /Global\\Mutex[0-9a-f]{8}/ ascii
        // Kryptik/Qakbot
        $qakbot = /[Qq]akbot|[Kk]ryptik/ ascii
        // Cobalt Strike named pipe
        $cs1 = /\\\\\.\\pipe\\msagent_[0-9a-f]+/ ascii
        $cs2 = /\\\\\.\\pipe\\[Bb]eacon_[0-9a-f]+/ ascii
    condition:
        // CreateMutex + 已知家族 Mutex 名
        (any of ($createmutex*)) and any of ($lockbit1, $lockbit2, $blackcat, $ryuk, $conti, $dharma, $qakbot)
        or
        // Cobalt Strike 命名管道特征（不需要 CreateMutex）
        any of ($cs*)
        or
        // CreateMutex + 通用可疑 UUID Mutex
        (any of ($createmutex*)) and $generic1
}


// =============================================================================
// C1-5 DLL 劫持 / LoadLibrary 动态加载
// =============================================================================

rule C1_PE_DLLHijacking {
    meta:
        risk_level = "high"
        category = "C1"
        false_positive_rate = "medium"
        reference = "MITRE ATT&CK T1574 Hijack Execution Flow"
        description = "PE 动态加载多个系统 DLL + 非系统路径 = DLL 劫持迹象"
    strings:
        $loadlib = "LoadLibraryA" ascii
        $loadlibw = "LoadLibraryW" ascii
        $getproc = "GetProcAddress" ascii
        // 可疑加载路径（非 System32）
        $path1 = /\\Users\\[^\\]+\\AppData\\Local\\Temp/ ascii
        $path2 = /\\AppData\\Local\\Temp/ ascii
        $path3 = /\\ProgramData\\/ ascii
        $path4 = /\\Public\\Documents\\/ ascii
    condition:
        // LoadLibrary + 可疑路径 + GetProcAddress = 完整劫持链
        (any of ($loadlib*)) and any of ($path*) and $getproc
        or
        // LoadLibrary + 多个可疑路径
        (any of ($loadlib*)) and 2 of ($path*)
}


// =============================================================================
// C1-6 LOLBin（Living Off The Land Binary）调用特征
// 已知合法 Windows 二进制被恶意利用来执行命令
// =============================================================================

rule C1_PE_LOLBin_Usage {
    meta:
        risk_level = "high"
        category = "C1"
        false_positive_rate = "low"
        reference = "https://lolbas-project.github.io/"
        description = "PE 文件中出现 LOLBin 调用：certutil / mshta / rundll32 / regsvr32 / bitsadmin / wmic / msiexec"
    strings:
        $certutil = /certutil(\.exe)?\s+(-urlcache|-decode|-encode|-hashfile)/ ascii
        $mshta = /mshta(\.exe)?\s+(https?:|javascript:|vbscript:)/ ascii
        $rundll32 = /rundll32(\.exe)?\s+[A-Za-z0-9_.]+,/ ascii
        $regsvr32 = /regsvr32(\.exe)?\s+\/s\s+\/u/ ascii
        $bitsadmin = /bitsadmin(\.exe)?\s+(\/transfer|\/create)/ ascii
        $wmic = /wmic(\.exe)?\s+(process\s+call\s+create|product\s+call)/ ascii
        $msiexec = /msiexec(\.exe)?\s+\/[ia]\s+https?:/ ascii
        $installutil = /installutil(\.exe)?\s+\/u\s+\/logfile=/ ascii
        $syncapp = /syncapp(\.exe)?\s+\/compattrack/ ascii
        $psexec = /psexec(\.exe)?\s+(-accepteula|-i\s+\d+|-w\s+https?:)/ ascii
        // 命令执行 API（用于组合条件）
        $exec1 = "CreateProcess" ascii
        $exec2 = "ShellExecute" ascii
        $exec3 = "WinExec" ascii
    condition:
        // 至少 1 个 LOLBin 调用 + 命令执行 API
        any of ($certutil*, $mshta*, $rundll32*, $regsvr32*, $bitsadmin*, $wmic*, $msiexec*, $installutil*, $syncapp*, $psexec*)
        and any of ($exec*)
}


// =============================================================================
// C8-1 勒索加密 API 组合（CryptEncrypt + BCrypt* + 文件遍历 + 删除卷影）
// =============================================================================

rule C8_Ransomware_Encryption {
    meta:
        risk_level = "critical"
        category = "C8"
        false_positive_rate = "low"
        reference = "MITRE ATT&CK T1486 Data Encrypted for Impact"
        description = "勒索加密链：CryptEncrypt/BCryptEncrypt + 大量文件遍历 + 卷影删除 = 勒索"
    strings:
        // 加密 API（至少出现两个）
        $enc1 = "CryptEncrypt" ascii
        $enc2 = "CryptDeriveKey" ascii
        $enc3 = "BCryptEncrypt" ascii
        $enc4 = "BCryptDeriveKeyPair" ascii
        $enc5 = "CryptGenKey" ascii

        // 文件遍历（全盘加密需要）
        $enum1 = "FindFirstFileA" ascii
        $enum2 = "FindFirstFileW" ascii
        $enum3 = "FindNextFileA" ascii
        $enum4 = "FindNextFileW" ascii

        // 卷影删除（勒索前置）
        $vss1 = "vssadmin" ascii
        $vss2 = "delete shadows" ascii
        $vss3 = "DeleteShadowCopies" ascii
        $vss4 = "wmic" ascii

        // 勒索信文件名变体（出现在二进制里）
        $ransomnote1 = /(HOW_TO_RECOVER|RESTORE_FILES|DECRYPT_INSTRUCTIONS|README|HELP_DECRYPT|_readme|_restore)[\w.-]*\.(txt|html|png|jpg|bmp|url)/ nocase
        $ransomnote2 = /\.(locky|zepto|cryptolocker|tor|crpt|encrypted|virus|wallet|pay2)/ nocase
        $ransomnote3 = /bitcoin|bitcash|monero|ltc|BTC\b/ ascii
    condition:
        // 加密 API + 文件遍历 = 加密工具（必须至少 2 个加密 API）
        (2 of ($enc*)) and any of ($enum*)
        or
        // 加密 API + 卷影删除 = 完整勒索
        (any of ($enc*)) and any of ($vss*)
        or
        // 加密 API + 勒索信 + 加密文件扩展名 = 明确勒索
        (any of ($enc*)) and (any of ($ransomnote1, $ransomnote2)) and $ransomnote3
}


// =============================================================================
// C8-2 挖矿（xmrig / stratum+tcp / 矿池域名）
// =============================================================================

rule C8_Mining_Monero {
    meta:
        risk_level = "high"
        category = "C8"
        false_positive_rate = "low"
        reference = "MITRE ATT&CK T1496 Resource Hijacking"
        description = "挖矿程序特征：xmrig 命令行参数 / stratum+tcp / 矿池域名"
    strings:
        // xmrig 命令行特征
        $xmrig1 = "xmrig" ascii nocase
        $xmrig2 = /--donate-level\s+\d+/ ascii
        $xmrig3 = /-o\s+stratum\+tcp/ ascii
        $xmrig4 = /--cpu-priority\s+\d/ ascii
        $xmrig5 = /--max-threads-hint/ ascii

        // 矿池域名（Monero）
        $pool1 = "pool.xmrig.com" ascii nocase
        $pool2 = "pool.minexmr.com" ascii nocase
        $pool3 = "pool.supportxmr.com" ascii nocase
        $pool4 = "mine.moneropool.com" ascii nocase
        $pool5 = "stratum+tcp://" ascii

        // CPU 高占用循环特征
        $loop = /(while|for)\s*\(\s*\d+\s*[<>=]/ ascii
        $thread = "CreateThread" ascii
    condition:
        // 至少 2 个 xmrig 特征
        (any of ($xmrig1, $xmrig2, $xmrig3, $xmrig4, $xmrig5)) and 2 of ($*)
        or
        // stratum+tcp 矿池协议 + 多个线程创建
        $pool5 and ($thread or 2 of ($xmrig*))
}


// =============================================================================
// C9 壳特征（UPX / Themida / VMProtect / Enigma）
// 壳识别后建议升级到 L3 沙箱深检，不单独阻断
// =============================================================================

rule C9_Packer_UPX {
    meta:
        risk_level = "medium"
        category = "C9"
        false_positive_rate = "low"
        reference = "UPX Packer"
        description = "UPX 加壳 PE：节名 UPX0 / UPX1 + UPX 签名"
    strings:
        $upx0 = "UPX0" ascii
        $upx1 = "UPX1" ascii
        $upx2 = "UPX!" ascii
        $upx3 = /UPX\s+\d+\.\d+/ ascii  // "UPX 3.96" 这类版本字符串
        $upx4 = /UPX\b/ ascii
    condition:
        // 节名（两个）+ 签名
        ($upx0 and $upx1) or ($upx2 and any of ($upx3, $upx4))
}

rule C9_Packer_Themida_VMP {
    meta:
        risk_level = "medium"
        category = "C9"
        false_positive_rate = "low"
        reference = "Themida / VMProtect"
        description = "商业壳特征：Themida / VMProtect 产品标识字符串"
    strings:
        $themida1 = "Themida" ascii wide
        $themida2 = "WinLicense" ascii wide
        $themida3 = "Oreans" ascii wide
        $vmp1 = "VMProtect" ascii wide
        $vmp3 = "VMProtect SDK" ascii wide
    condition:
        any of ($themida*) or any of ($vmp*)
}


// =============================================================================
// C1-7 PE 高熵 + 大量网络 API（疑似加壳下载器）
// binary.py 的 HighEntropySection 已单独扫描，但 YARA 看"熵 + 网络"组合
// =============================================================================

rule C1_PE_EntropyHighNetwork {
    meta:
        risk_level = "medium"
        category = "C1"
        false_positive_rate = "medium"
        reference = "binary.py HighEntropySection 联动"
        description = "PE 同时出现：多个网络 API + 加壳特征（熵高） + 无签名"
    strings:
        $net1 = "InternetOpenUrl" ascii
        $net2 = "WinHttpOpen" ascii
        $net3 = "URLDownloadToFile" ascii
        $net4 = "WSAConnect" ascii
        // 壳特征
        $upx = "UPX0" ascii
        $themida = "Themida" ascii
    condition:
        // 网络 API + 壳特征 = 加壳下载器
        any of ($net*) and ($upx or $themida)
}