{
  "meshsafe_target_version": "v0.2.1",
  "index_regenerated_at": "2026-10-29T11:48:22.953397",
  "layer_definition": {
    "L0": "结构分析（幻数/后缀伪装/嵌套/路径穿越/zip 炸弹）",
    "L1": "ClamAV 病毒库扫描",
    "L2": "文档深度检测（OLE/Macro/JS）",
    "L3": "关键词匹配（恶意行为特征）",
    "L4": "YARA 规则匹配",
    "L5": "PE 二进制静态分析（壳/导入/节/签名）",
    "NEG": "负样本（业务正常文件，应无告警）",
    "L7": "历史遗留样本（CSV 之外的真实恶意/误报对照）"
  },
  "samples": [
    {
      "filename": "L0-001_jpg_normal.jpg",
      "case_id": "L1-006",
      "category": "L1",
      "expected_verdict": "pass",
      "expected_rules": [],
      "description": "干净jpg图片（对照负样本）",
      "_scan_verdict": "clean"
    },
    {
      "filename": "L0-002_png_normal.png",
      "case_id": "L0-002",
      "category": "L0",
      "expected_verdict": "pass",
      "expected_rules": [],
      "description": "正常文件幻数识别-PNG",
      "_scan_verdict": "clean"
    },
    {
      "filename": "L0-003_docx_normal.docx",
      "case_id": "L1-007",
      "category": "L1",
      "expected_verdict": "pass",
      "expected_rules": [],
      "description": "干净docx文档（对照负样本）",
      "_scan_verdict": "clean"
    },
    {
      "filename": "L0-004_pdf_normal.pdf",
      "case_id": "L0-004",
      "category": "L0",
      "expected_verdict": "pass",
      "expected_rules": [
        "MalformedStructure",
        "PdfParseFailed"
      ],
      "description": "正常文件幻数识别-PDF",
      "_scan_verdict": "suspicious"
    },
    {
      "filename": "L0-005_pe_clean.exe",
      "case_id": "L1-008",
      "category": "L1",
      "expected_verdict": "pass",
      "expected_rules": [
        "DangerousExecutableExtension",
        "PeParseFailed"
      ],
      "description": "干净hello PE（对照负样本）",
      "_scan_verdict": "suspicious"
    },
    {
      "filename": "L0-006_disguise_jpg_pe.jpg",
      "case_id": "L0-006",
      "category": "L0",
      "expected_verdict": "reject",
      "expected_rules": [
        "ExtensionMismatch"
      ],
      "description": "jpg 后缀 + 实际 PE MZ 头",
      "_scan_verdict": "reject"
    },
    {
      "filename": "L0-007_disguise_txt_pdf.txt",
      "case_id": "L0-007",
      "category": "L0",
      "expected_verdict": "review",
      "expected_rules": [
        "ExtensionMismatch",
        "MalformedStructure"
      ],
      "description": "后缀伪装：txt后缀，实际PDF幻数",
      "_scan_verdict": "reject"
    },
    {
      "filename": "L0-008_disguise_png_zip.png",
      "case_id": "L0-008",
      "category": "L0",
      "expected_verdict": "review",
      "expected_rules": [
        "ExtensionMismatch",
        "MalformedStructure"
      ],
      "description": "后缀伪装：png后缀，实际ZIP幻数",
      "_scan_verdict": "reject"
    },
    {
      "filename": "L0-009_double_ext_pdf_exe.pdf.exe",
      "case_id": "L0-009",
      "category": "L0",
      "expected_verdict": "reject",
      "expected_rules": [
        "DangerousExecutableExtension",
        "DoubleExtension",
        "PeParseFailed"
      ],
      "description": "双扩展名伪装：report.pdf.exe",
      "_scan_verdict": "reject"
    },
    {
      "filename": "L0-010_double_ext_txt_ps1.txt.ps1",
      "case_id": "L0-010",
      "category": "L0",
      "expected_verdict": "reject",
      "expected_rules": [
        "DangerousExecutableExtension",
        "DoubleExtension"
      ],
      "description": "双扩展名伪装：data.txt.ps1",
      "_scan_verdict": "reject"
    },
    {
      "filename": "L0-011_double_ext_docx_js.docx.js",
      "case_id": "L0-011",
      "category": "L0",
      "expected_verdict": "reject",
      "expected_rules": [
        "DangerousExecutableExtension"
      ],
      "description": "双扩展名伪装：note.docx.js",
      "_scan_verdict": "suspicious"
    },
    {
      "filename": "L0-012_double_ext_xlsx_bat.xlsx.bat",
      "case_id": "L0-012",
      "category": "L0",
      "expected_verdict": "reject",
      "expected_rules": [
        "DangerousExecutableExtension",
        "DoubleExtension"
      ],
      "description": "双扩展名伪装：log.xlsx.bat",
      "_scan_verdict": "reject"
    },
    {
      "filename": "L0-013_clean.ps1",
      "case_id": "L0-013",
      "category": "L0",
      "expected_verdict": "review",
      "expected_rules": [
        "DangerousExecutableExtension"
      ],
      "description": "干净 ps1 文件",
      "_scan_verdict": "suspicious"
    },
    {
      "filename": "L0-014_clean.bat",
      "case_id": "L0-014",
      "category": "L0",
      "expected_verdict": "review",
      "expected_rules": [
        "DangerousExecutableExtension"
      ],
      "description": "干净 bat 文件",
      "_scan_verdict": "suspicious"
    },
    {
      "filename": "L0-015_clean.cmd",
      "case_id": "L0-015",
      "category": "L0",
      "expected_verdict": "review",
      "expected_rules": [
        "DangerousExecutableExtension"
      ],
      "description": "干净 cmd 文件",
      "_scan_verdict": "suspicious"
    },
    {
      "filename": "L0-016_clean.vbs",
      "case_id": "L0-016",
      "category": "L0",
      "expected_verdict": "review",
      "expected_rules": [
        "DangerousExecutableExtension"
      ],
      "description": "干净 vbs 文件",
      "_scan_verdict": "suspicious"
    },
    {
      "filename": "L0-017_clean.js",
      "case_id": "L0-017",
      "category": "L0",
      "expected_verdict": "review",
      "expected_rules": [
        "DangerousExecutableExtension"
      ],
      "description": "干净 js 文件",
      "_scan_verdict": "suspicious"
    },
    {
      "filename": "L0-018_zip_traversal.zip",
      "case_id": "L0-018",
      "category": "L0",
      "expected_verdict": "reject",
      "expected_rules": [
        "PathTraversal",
        "PathTraversalBlocked"
      ],
      "description": "ZIP单级路径穿越：../test.txt",
      "_scan_verdict": "malicious"
    },
    {
      "filename": "L0-019_zip_deep_traversal.zip",
      "case_id": "L0-019",
      "category": "L0",
      "expected_verdict": "reject",
      "expected_rules": [
        "PathTraversal",
        "PathTraversalBlocked"
      ],
      "description": "ZIP多级路径穿越：../../a.txt",
      "_scan_verdict": "malicious"
    },
    {
      "filename": "L0-020_zip_bomb.zip",
      "case_id": "L0-020",
      "category": "L0",
      "expected_verdict": "reject",
      "expected_rules": [],
      "description": "ZIP炸弹42.zip",
      "_scan_verdict": "clean"
    },
    {
      "filename": "L0-021_small_bomb.zip",
      "case_id": "L0-021",
      "category": "L0",
      "expected_verdict": "reject",
      "expected_rules": [],
      "description": "自制小型 zip 炸弹（50 成员 × 8KB STORED）",
      "_scan_verdict": "clean"
    },
    {
      "filename": "L0-022_3layer_nested.zip",
      "case_id": "L0-022",
      "category": "L0",
      "expected_verdict": "pass",
      "expected_rules": [],
      "description": "3层无害嵌套ZIP",
      "_scan_verdict": "clean"
    },
    {
      "filename": "L0-023_5layer_nested.zip",
      "case_id": "L0-023",
      "category": "L0",
      "expected_verdict": "pass",
      "expected_rules": [],
      "description": "5 层无害嵌套 ZIP",
      "_scan_verdict": "clean"
    },
    {
      "filename": "L0-024_encrypted.zip",
      "case_id": "L0-024",
      "category": "L0",
      "expected_verdict": "review",
      "expected_rules": [],
      "description": "加密 ZIP（标记待验证）",
      "_scan_verdict": "clean"
    },
    {
      "filename": "L0-025_corrupt_zip.zip",
      "case_id": "L0-025",
      "category": "L0",
      "expected_verdict": "review",
      "expected_rules": [
        "ArchiveBroken",
        "MalformedStructure"
      ],
      "description": "截断损坏 ZIP 头",
      "_scan_verdict": "suspicious"
    },
    {
      "filename": "L0-026_corrupt_direntry.zip",
      "case_id": "L0-026",
      "category": "L0",
      "expected_verdict": "review",
      "expected_rules": [],
      "description": "损坏ZIP目录项",
      "_scan_verdict": "clean"
    },
    {
      "filename": "L0-027_long_filename.zip",
      "case_id": "L0-027",
      "category": "L0",
      "expected_verdict": "review",
      "expected_rules": [],
      "description": "压缩包内 200 字符超长文件名",
      "_scan_verdict": "clean"
    },
    {
      "filename": "L0-028_unicode_filename.zip",
      "case_id": "L0-028",
      "category": "L0",
      "expected_verdict": "pass",
      "expected_rules": [],
      "description": "unicode/emoji 文件名",
      "_scan_verdict": "clean"
    },
    {
      "filename": "L0-029_zero_byte_exe.exe",
      "case_id": "L0-029",
      "category": "L0",
      "expected_verdict": "review",
      "expected_rules": [
        "DangerousExecutableExtension",
        "PeParseFailed"
      ],
      "description": "空文件（0字节）后缀exe",
      "_scan_verdict": "suspicious"
    },
    {
      "filename": "L0-030_nested_traversal.zip",
      "case_id": "L0-030",
      "category": "L0",
      "expected_verdict": "reject",
      "expected_rules": [],
      "description": "嵌套 zip 内含穿越条目",
      "_scan_verdict": "clean"
    },
    {
      "filename": "L1-001_eicar.txt",
      "case_id": "L1-001",
      "category": "L1",
      "expected_verdict": "reject",
      "expected_rules": [
        "Eicar-Test-Signature"
      ],
      "description": "EICAR标准测试串文本",
      "_scan_verdict": "suspicious"
    },
    {
      "filename": "L1-002_eicar_in_zip.zip",
      "case_id": "L1-002",
      "category": "L1",
      "expected_verdict": "reject",
      "expected_rules": [
        "Eicar-Test-Signature"
      ],
      "description": "EICAR放入zip压缩包",
      "_scan_verdict": "suspicious"
    },
    {
      "filename": "L1-003_eicar_in_encrypted.zip",
      "case_id": "L1-003",
      "category": "L1",
      "expected_verdict": "review",
      "expected_rules": [
        "Eicar-Test-Signature"
      ],
      "description": "加密 ZIP（占位：实际加密需 7z/zip -P）",
      "_scan_verdict": "suspicious"
    },
    {
      "filename": "L1-004_eicar_in_docx.docx",
      "case_id": "L1-004",
      "category": "L1",
      "expected_verdict": "reject",
      "expected_rules": [
        "Eicar-Test-Signature"
      ],
      "description": "EICAR放入docx内嵌（OLE）",
      "_scan_verdict": "suspicious"
    },
    {
      "filename": "L1-005_eicar_modified.txt",
      "case_id": "L1-005",
      "category": "L1",
      "expected_verdict": "pass",
      "expected_rules": [],
      "description": "修改 1 字节 EICAR，ClamAV 不应命中",
      "_scan_verdict": "clean"
    },
    {
      "filename": "L1-009_minimal.cvd",
      "case_id": "L1-009",
      "category": "L1",
      "expected_verdict": "review",
      "expected_rules": [],
      "description": "热加载测试占位（需真实 .cvd 文件）",
      "_scan_verdict": "reject"
    },
    {
      "filename": "L1-010_corrupt.cvd",
      "case_id": "L1-010",
      "category": "L1",
      "expected_verdict": "reject",
      "expected_rules": [],
      "description": "损坏病毒库占位",
      "_scan_verdict": "reject"
    },
    {
      "filename": "L1-011_eicar_in_3layer.zip",
      "case_id": "L1-011",
      "category": "L1",
      "expected_verdict": "reject",
      "expected_rules": [
        "Eicar-Test-Signature"
      ],
      "description": "EICAR放在多层嵌套zip",
      "_scan_verdict": "suspicious"
    },
    {
      "filename": "L1-012_eicar_base64.txt",
      "case_id": "L1-012",
      "category": "L1",
      "expected_verdict": "pass",
      "expected_rules": [],
      "description": "base64 编码 EICAR，ClamAV 不解码",
      "_scan_verdict": "clean"
    },
    {
      "filename": "L1-013_bigfile_eicar.txt",
      "case_id": "L1-013",
      "category": "L1",
      "expected_verdict": "review",
      "expected_rules": [],
      "description": "10MB+ 文本尾部含 EICAR",
      "_scan_verdict": "clean"
    },
    {
      "filename": "L1-014_concurrent_eicar_00.txt",
      "case_id": "L1-014-00",
      "category": "L1",
      "expected_verdict": "reject",
      "expected_rules": [
        "Eicar-Test-Signature"
      ],
      "description": "并发压测占位 #0",
      "_scan_verdict": "suspicious"
    },
    {
      "filename": "L1-014_concurrent_eicar_01.txt",
      "case_id": "L1-014-01",
      "category": "L1",
      "expected_verdict": "reject",
      "expected_rules": [
        "Eicar-Test-Signature"
      ],
      "description": "并发压测占位 #1",
      "_scan_verdict": "suspicious"
    },
    {
      "filename": "L1-014_concurrent_eicar_02.txt",
      "case_id": "L1-014-02",
      "category": "L1",
      "expected_verdict": "reject",
      "expected_rules": [
        "Eicar-Test-Signature"
      ],
      "description": "并发压测占位 #2",
      "_scan_verdict": "suspicious"
    },
    {
      "filename": "L1-014_concurrent_eicar_03.txt",
      "case_id": "L1-014-03",
      "category": "L1",
      "expected_verdict": "reject",
      "expected_rules": [
        "Eicar-Test-Signature"
      ],
      "description": "并发压测占位 #3",
      "_scan_verdict": "suspicious"
    },
    {
      "filename": "L1-014_concurrent_eicar_04.txt",
      "case_id": "L1-014-04",
      "category": "L1",
      "expected_verdict": "reject",
      "expected_rules": [
        "Eicar-Test-Signature"
      ],
      "description": "并发压测占位 #4",
      "_scan_verdict": "suspicious"
    },
    {
      "filename": "L1-014_concurrent_eicar_05.txt",
      "case_id": "L1-014-05",
      "category": "L1",
      "expected_verdict": "reject",
      "expected_rules": [
        "Eicar-Test-Signature"
      ],
      "description": "并发压测占位 #5",
      "_scan_verdict": "suspicious"
    },
    {
      "filename": "L1-014_concurrent_eicar_06.txt",
      "case_id": "L1-014-06",
      "category": "L1",
      "expected_verdict": "reject",
      "expected_rules": [
        "Eicar-Test-Signature"
      ],
      "description": "并发压测占位 #6",
      "_scan_verdict": "suspicious"
    },
    {
      "filename": "L1-014_concurrent_eicar_07.txt",
      "case_id": "L1-014-07",
      "category": "L1",
      "expected_verdict": "reject",
      "expected_rules": [
        "Eicar-Test-Signature"
      ],
      "description": "并发压测占位 #7",
      "_scan_verdict": "suspicious"
    },
    {
      "filename": "L1-014_concurrent_eicar_08.txt",
      "case_id": "L1-014-08",
      "category": "L1",
      "expected_verdict": "reject",
      "expected_rules": [
        "Eicar-Test-Signature"
      ],
      "description": "并发压测占位 #8",
      "_scan_verdict": "suspicious"
    },
    {
      "filename": "L1-014_concurrent_eicar_09.txt",
      "case_id": "L1-014-09",
      "category": "L1",
      "expected_verdict": "reject",
      "expected_rules": [
        "Eicar-Test-Signature"
      ],
      "description": "并发压测占位 #9",
      "_scan_verdict": "suspicious"
    },
    {
      "filename": "L1-014_concurrent_test.txt",
      "case_id": "L1-014",
      "category": "L1",
      "expected_verdict": "review",
      "expected_rules": [],
      "description": "并发压测占位（靠 API 并发调用）",
      "_scan_verdict": "clean"
    },
    {
      "filename": "L1-015_layer_off_sample.bin",
      "case_id": "L1-015",
      "category": "L1",
      "expected_verdict": "review",
      "expected_rules": [
        "DangerousExecutableExtension",
        "Eicar-Test-Signature",
        "ExtensionMismatch",
        "PeParseFailed"
      ],
      "description": "关闭分层开关测试占位",
      "_scan_verdict": "reject"
    },
    {
      "filename": "L3-001_001_sample.ps1",
      "case_id": "L3-001",
      "category": "L3",
      "expected_verdict": "reject",
      "expected_rules": [
        "DangerousExecutableExtension",
        "RemoteDownloadPowerShell",
        "SuspiciousScript"
      ],
      "description": "PS1明文：Invoke-WebRequest下载",
      "_scan_verdict": "malicious"
    },
    {
      "filename": "L3-002_002_sample.ps1",
      "case_id": "L3-002",
      "category": "L3",
      "expected_verdict": "reject",
      "expected_rules": [
        "C7_Linux_ReverseShell_NC",
        "DangerousExecutableExtension",
        "ReverseShellNetcat"
      ],
      "description": "PS1明文：反弹shell nc",
      "_scan_verdict": "malicious"
    },
    {
      "filename": "L3-003_003_sample.bat",
      "case_id": "L3-003",
      "category": "L3",
      "expected_verdict": "reject",
      "expected_rules": [
        "DangerousExecutableExtension",
        "RemoteDownloadUnix"
      ],
      "description": "bat明文：curl下载payload",
      "_scan_verdict": "suspicious"
    },
    {
      "filename": "L3-004_004_sample.txt",
      "case_id": "L3-004",
      "category": "L3",
      "expected_verdict": "reject",
      "expected_rules": [
        "CredentialStealer"
      ],
      "description": "文本包含mimikatz关键字",
      "_scan_verdict": "suspicious"
    },
    {
      "filename": "L3-005_005_sample.txt",
      "case_id": "L3-005",
      "category": "L3",
      "expected_verdict": "reject",
      "expected_rules": [
        "CredentialExport"
      ],
      "description": "文本包含reg save导出注册表",
      "_scan_verdict": "suspicious"
    },
    {
      "filename": "L3-006_006_sample.txt",
      "case_id": "L3-006",
      "category": "L3",
      "expected_verdict": "review",
      "expected_rules": [
        "RemoteSessionHijack"
      ],
      "description": "文本包含rdp、tscon劫持关键字",
      "_scan_verdict": "suspicious"
    },
    {
      "filename": "L3-007_007_sample.txt",
      "case_id": "L3-007",
      "category": "L3",
      "expected_verdict": "pass",
      "expected_rules": [],
      "description": "高危串base64编码放在txt",
      "_scan_verdict": "clean"
    },
    {
      "filename": "L3-008_008_sample.ps1",
      "case_id": "L3-008",
      "category": "L3",
      "expected_verdict": "pass",
      "expected_rules": [
        "DangerousExecutableExtension"
      ],
      "description": "Powershell字符串拆分拼接绕过",
      "_scan_verdict": "suspicious"
    },
    {
      "filename": "L3-009_newline_split.txt",
      "case_id": "L3-009",
      "category": "L3",
      "expected_verdict": "review",
      "expected_rules": [],
      "description": "换行分割绕过（L3 不做换行合并，记录边界）",
      "_scan_verdict": "clean"
    },
    {
      "filename": "L3-010_010_sample.ps1",
      "case_id": "L3-010",
      "category": "L3",
      "expected_verdict": "review",
      "expected_rules": [
        "DangerousExecutableExtension"
      ],
      "description": "高危串插入注释分割（powershell #注释）",
      "_scan_verdict": "suspicious"
    },
    {
      "filename": "L3-011_011_sample.js",
      "case_id": "L3-011",
      "category": "L3",
      "expected_verdict": "review",
      "expected_rules": [
        "DangerousExecutableExtension",
        "RemoteDownloadUnix"
      ],
      "description": "高危串放js脚本内",
      "_scan_verdict": "suspicious"
    },
    {
      "filename": "L3-012_012_sample.bat",
      "case_id": "L3-012",
      "category": "L3",
      "expected_verdict": "review",
      "expected_rules": [
        "DangerousExecutableExtension",
        "RemoteDownloadUnix"
      ],
      "description": "正常内网运维curl（白名单对照）",
      "_scan_verdict": "suspicious"
    },
    {
      "filename": "L3-013_normal_scp.sh",
      "case_id": "L3-013",
      "category": "L3",
      "expected_verdict": "pass",
      "expected_rules": [
        "DangerousExecutableExtension"
      ],
      "description": "内网正常 scp 运维脚本，不误报",
      "_scan_verdict": "suspicious"
    },
    {
      "filename": "L3-014_l3001_in_zip.zip",
      "case_id": "L3-014",
      "category": "L3",
      "expected_verdict": "review",
      "expected_rules": [
        "ArchiveContainsExecutable",
        "RemoteDownloadPowerShell"
      ],
      "description": "高危字符串放在zip内部txt",
      "_scan_verdict": "malicious"
    },
    {
      "filename": "L3-015_keyword_in_docx.docx",
      "case_id": "L3-015",
      "category": "L3",
      "expected_verdict": "review",
      "expected_rules": [
        "RemoteDownloadPowerShell"
      ],
      "description": "高危字符串放在docx文本正文",
      "_scan_verdict": "suspicious"
    },
    {
      "filename": "L3-016_016_sample.ps1",
      "case_id": "L3-016",
      "category": "L3",
      "expected_verdict": "pass",
      "expected_rules": [
        "DangerousExecutableExtension"
      ],
      "description": "空脚本文件（负样本）",
      "_scan_verdict": "suspicious"
    },
    {
      "filename": "L3-017_017_sample.txt",
      "case_id": "L3-017",
      "category": "L3",
      "expected_verdict": "review",
      "expected_rules": [
        "CredentialStealer",
        "ReverseShellNetcat"
      ],
      "description": "多条高危特征同文件复合",
      "_scan_verdict": "malicious"
    },
    {
      "filename": "L3-018_018_sample.txt",
      "case_id": "L3-018",
      "category": "L3",
      "expected_verdict": "review",
      "expected_rules": [
        "RemoteDownloadPowerShell"
      ],
      "description": "高危字符串大小写混写",
      "_scan_verdict": "suspicious"
    },
    {
      "filename": "L3-019_unicode_obfuscated.txt",
      "case_id": "L3-019",
      "category": "L3",
      "expected_verdict": "pass",
      "expected_rules": [],
      "description": "同形字混淆，L3 默认不命中",
      "_scan_verdict": "clean"
    },
    {
      "filename": "L3-020_log_with_keyword.log",
      "case_id": "L3-020",
      "category": "L3",
      "expected_verdict": "reject",
      "expected_rules": [
        "C7_Linux_ReverseShell_NC",
        "ReverseShellNetcat"
      ],
      "description": "日志文件混杂正常日志+高危串",
      "_scan_verdict": "reject"
    },
    {
      "filename": "L3-021_021_sample.eml",
      "case_id": "L3-021",
      "category": "L3",
      "expected_verdict": "review",
      "expected_rules": [
        "RemoteDownloadPowerShell"
      ],
      "description": "高危字符串放在eml邮件正文",
      "_scan_verdict": "suspicious"
    },
    {
      "filename": "L3-022_layer_off_sample.bin",
      "case_id": "L3-022",
      "category": "L3",
      "expected_verdict": "review",
      "expected_rules": [
        "DangerousExecutableExtension",
        "ExtensionMismatch",
        "PeParseFailed",
        "RemoteDownloadPowerShell"
      ],
      "description": "关闭分层开关测试占位",
      "_scan_verdict": "reject"
    },
    {
      "filename": "L3-023_keyword_in_encrypted.zip",
      "case_id": "L3-023",
      "category": "L3",
      "expected_verdict": "review",
      "expected_rules": [
        "CredentialStealer"
      ],
      "description": "加密 zip 内容无法扫描（标记）",
      "_scan_verdict": "suspicious"
    },
    {
      "filename": "L3-024_024_sample.txt",
      "case_id": "L3-024",
      "category": "L3",
      "expected_verdict": "review",
      "expected_rules": [
        "RemoteDownloadPowerShell"
      ],
      "description": "超长单行文本（10万字符）包含高危串",
      "_scan_verdict": "suspicious"
    },
    {
      "filename": "L3-025_whitelist_test.txt",
      "case_id": "L3-025",
      "category": "L3",
      "expected_verdict": "review",
      "expected_rules": [
        "RemoteDownloadPowerShell"
      ],
      "description": "内网白名单域名对照（策略层白名单）",
      "_scan_verdict": "suspicious"
    },
    {
      "filename": "L4-001_001_sample.txt",
      "case_id": "L4-001",
      "category": "L4",
      "expected_verdict": "review",
      "expected_rules": [],
      "description": "YARA正向命中占位（需对应规则）",
      "_scan_verdict": "clean"
    },
    {
      "filename": "L4-002_002_sample.txt",
      "case_id": "L4-002",
      "category": "L4",
      "expected_verdict": "pass",
      "expected_rules": [],
      "description": "干净对照",
      "_scan_verdict": "clean"
    },
    {
      "filename": "L4-003_pe_with_string.exe",
      "case_id": "L4-003",
      "category": "L4",
      "expected_verdict": "review",
      "expected_rules": [
        "DangerousExecutableExtension",
        "PEArchInfo",
        "SuspiciousTimestamp",
        "UnsignedExecutable"
      ],
      "description": "二进制内嵌匹配字符串",
      "_scan_verdict": "malicious"
    },
    {
      "filename": "L4-004_multi_rule_match.txt",
      "case_id": "L4-004",
      "category": "L4",
      "expected_verdict": "review",
      "expected_rules": [],
      "description": "同一个文件同时命中多条 YARA",
      "_scan_verdict": "clean"
    },
    {
      "filename": "L4-005_005_sample.txt",
      "case_id": "L4-005",
      "category": "L4",
      "expected_verdict": "review",
      "expected_rules": [],
      "description": "热加载测试占位",
      "_scan_verdict": "clean"
    },
    {
      "filename": "L4-006_bad_syntax_rule.yar",
      "case_id": "L4-006",
      "category": "L4",
      "expected_verdict": "review",
      "expected_rules": [
        "ExtensionMismatch"
      ],
      "description": "语法错误 YARA 规则文件（输入给规则目录）",
      "_scan_verdict": "reject"
    },
    {
      "filename": "L4-007_meta_rule_match.txt",
      "case_id": "L4-007",
      "category": "L4",
      "expected_verdict": "review",
      "expected_rules": [],
      "description": "带 meta 的 YARA 规则匹配",
      "_scan_verdict": "clean"
    },
    {
      "filename": "L4-008_in_zip.zip",
      "case_id": "L4-008",
      "category": "L4",
      "expected_verdict": "review",
      "expected_rules": [],
      "description": "压缩包内文件匹配YARA规则",
      "_scan_verdict": "clean"
    },
    {
      "filename": "L4-009_yara_in_encrypted.zip",
      "case_id": "L4-009",
      "category": "L4",
      "expected_verdict": "pass",
      "expected_rules": [],
      "description": "加密 zip 内 YARA 样本",
      "_scan_verdict": "clean"
    },
    {
      "filename": "L4-010_010_sample.txt",
      "case_id": "L4-010",
      "category": "L4",
      "expected_verdict": "review",
      "expected_rules": [],
      "description": "正则 YARA 测试占位",
      "_scan_verdict": "clean"
    },
    {
      "filename": "L4-011_count_condition.txt",
      "case_id": "L4-011",
      "category": "L4",
      "expected_verdict": "review",
      "expected_rules": [],
      "description": "YARA count > 3 条件",
      "_scan_verdict": "clean"
    },
    {
      "filename": "L4-012_size_condition.bin",
      "case_id": "L4-012",
      "category": "L4",
      "expected_verdict": "review",
      "expected_rules": [
        "DangerousExecutableExtension",
        "ExtensionMismatch",
        "PeParseFailed"
      ],
      "description": "YARA 文件大小条件",
      "_scan_verdict": "reject"
    },
    {
      "filename": "L4-013_bigfile_yara.txt",
      "case_id": "L4-013",
      "category": "L4",
      "expected_verdict": "review",
      "expected_rules": [],
      "description": "100MB 文件 YARA 扫描",
      "_scan_verdict": "clean"
    },
    {
      "filename": "L4-014_layer_off_sample.bin",
      "case_id": "L4-014",
      "category": "L4",
      "expected_verdict": "review",
      "expected_rules": [
        "DangerousExecutableExtension",
        "ExtensionMismatch",
        "PeParseFailed"
      ],
      "description": "关闭分层开关测试占位",
      "_scan_verdict": "reject"
    },
    {
      "filename": "L4-015_hash_whitelist.txt",
      "case_id": "L4-015",
      "category": "L4",
      "expected_verdict": "pass",
      "expected_rules": [],
      "description": "MD5 在白名单",
      "_scan_verdict": "clean"
    },
    {
      "filename": "L5-001_clean_hello.exe",
      "case_id": "L5-001",
      "category": "L5",
      "expected_verdict": "pass",
      "expected_rules": [
        "DangerousExecutableExtension",
        "PeParseFailed"
      ],
      "description": "原生干净HelloWorld PE（无壳）",
      "_scan_verdict": "suspicious"
    },
    {
      "filename": "L5-002_upx_shell.exe",
      "case_id": "L5-002",
      "category": "L5",
      "expected_verdict": "review",
      "expected_rules": [
        "DangerousExecutableExtension",
        "PeParseFailed"
      ],
      "description": "UPX0/UPX1 节名",
      "_scan_verdict": "suspicious"
    },
    {
      "filename": "L5-003_double_upx.exe",
      "case_id": "L5-003",
      "category": "L5",
      "expected_verdict": "review",
      "expected_rules": [
        "DangerousExecutableExtension",
        "PeParseFailed"
      ],
      "description": "UPX加壳PE，二次压缩",
      "_scan_verdict": "suspicious"
    },
    {
      "filename": "L5-004_rwx_section.exe",
      "case_id": "L5-004",
      "category": "L5",
      "expected_verdict": "reject",
      "expected_rules": [
        "DangerousExecutableExtension",
        "PeParseFailed"
      ],
      "description": "节属性 RWX",
      "_scan_verdict": "suspicious"
    },
    {
      "filename": "L5-005_injection_imports.exe",
      "case_id": "L5-005",
      "category": "L5",
      "expected_verdict": "reject",
      "expected_rules": [
        "DangerousExecutableExtension",
        "PEArchInfo",
        "SuspiciousTimestamp",
        "UnsignedExecutable"
      ],
      "description": "注入组合导入（需要真实 pefile 引入 API）",
      "_scan_verdict": "malicious"
    },
    {
      "filename": "L5-006_single_virtualalloc.exe",
      "case_id": "L5-006",
      "category": "L5",
      "expected_verdict": "review",
      "expected_rules": [
        "DangerousExecutableExtension",
        "PEArchInfo",
        "SuspiciousTimestamp",
        "UnsignedExecutable"
      ],
      "description": "单一可疑内存 API",
      "_scan_verdict": "malicious"
    },
    {
      "filename": "L5-007_garbage_section.exe",
      "case_id": "L5-007",
      "category": "L5",
      "expected_verdict": "review",
      "expected_rules": [
        "DangerousExecutableExtension",
        "PeParseFailed"
      ],
      "description": "节名乱码",
      "_scan_verdict": "suspicious"
    },
    {
      "filename": "L5-008_many_exports.exe",
      "case_id": "L5-008",
      "category": "L5",
      "expected_verdict": "review",
      "expected_rules": [
        "DangerousExecutableExtension",
        "PEArchInfo",
        "SuspiciousTimestamp",
        "UnsignedExecutable"
      ],
      "description": "导出表异常（需真实工具生成）",
      "_scan_verdict": "malicious"
    },
    {
      "filename": "L5-009_shell_in_resource.exe",
      "case_id": "L5-009",
      "category": "L5",
      "expected_verdict": "review",
      "expected_rules": [
        "DangerousExecutableExtension",
        "PEArchInfo",
        "SuspiciousTimestamp",
        "UnsignedExecutable"
      ],
      "description": "资源段内嵌字符串（占位）",
      "_scan_verdict": "malicious"
    },
    {
      "filename": "L5-010_bad_mz.exe",
      "case_id": "L5-010",
      "category": "L5",
      "expected_verdict": "review",
      "expected_rules": [
        "DangerousExecutableExtension",
        "ExtensionMismatch",
        "PeParseFailed"
      ],
      "description": "PE 头非法",
      "_scan_verdict": "reject"
    },
    {
      "filename": "L5-011_truncated.exe",
      "case_id": "L5-011",
      "category": "L5",
      "expected_verdict": "review",
      "expected_rules": [
        "DangerousExecutableExtension",
        "PeParseFailed"
      ],
      "description": "截断 PE",
      "_scan_verdict": "suspicious"
    },
    {
      "filename": "L5-012_pe32.exe",
      "case_id": "L5-012",
      "category": "L5",
      "expected_verdict": "pass",
      "expected_rules": [
        "DangerousExecutableExtension",
        "PeParseFailed"
      ],
      "description": "32 位识别",
      "_scan_verdict": "suspicious"
    },
    {
      "filename": "L5-013_pe64.exe",
      "case_id": "L5-013",
      "category": "L5",
      "expected_verdict": "pass",
      "expected_rules": [
        "DangerousExecutableExtension",
        "PeParseFailed"
      ],
      "description": "64 位识别占位",
      "_scan_verdict": "suspicious"
    },
    {
      "filename": "L5-014_clean_tool.exe",
      "case_id": "L5-014",
      "category": "L5",
      "expected_verdict": "pass",
      "expected_rules": [
        "DangerousExecutableExtension",
        "PeParseFailed"
      ],
      "description": "PE导入表大量系统API（正常工具）",
      "_scan_verdict": "suspicious"
    },
    {
      "filename": "L5-015_bad_reloc.exe",
      "case_id": "L5-015",
      "category": "L5",
      "expected_verdict": "review",
      "expected_rules": [
        "DangerousExecutableExtension",
        "PEArchInfo",
        "SuspiciousTimestamp",
        "UnsignedExecutable"
      ],
      "description": "重定位表损坏占位",
      "_scan_verdict": "malicious"
    },
    {
      "filename": "L5-016_zero_section.exe",
      "case_id": "L5-016",
      "category": "L5",
      "expected_verdict": "review",
      "expected_rules": [
        "DangerousExecutableExtension",
        "PeParseFailed"
      ],
      "description": "零节 PE 占位",
      "_scan_verdict": "suspicious"
    },
    {
      "filename": "L5-016_zero_sections.exe",
      "case_id": "L5-016",
      "category": "L5",
      "expected_verdict": "review",
      "expected_rules": [
        "DangerousExecutableExtension",
        "PEArchInfo",
        "SuspiciousTimestamp",
        "UnsignedExecutable"
      ],
      "description": "无节表最小 PE",
      "_scan_verdict": "malicious"
    },
    {
      "filename": "L5-017_upx_rwx.exe",
      "case_id": "L5-017",
      "category": "L5",
      "expected_verdict": "review",
      "expected_rules": [
        "DangerousExecutableExtension",
        "PeParseFailed"
      ],
      "description": "UPX壳 + RWX节复合特征",
      "_scan_verdict": "suspicious"
    },
    {
      "filename": "L5-018_debug_info.exe",
      "case_id": "L5-018",
      "category": "L5",
      "expected_verdict": "review",
      "expected_rules": [
        "DangerousExecutableExtension",
        "PeParseFailed"
      ],
      "description": "调试信息占位",
      "_scan_verdict": "suspicious"
    },
    {
      "filename": "L5-019_200mb_huge.exe",
      "case_id": "L5-019",
      "category": "L5",
      "expected_verdict": "pass",
      "expected_rules": [
        "DangerousExecutableExtension",
        "PeParseFailed"
      ],
      "description": "200MB 超大 PE（占位，真实生成会写满磁盘）",
      "_scan_verdict": "suspicious"
    },
    {
      "filename": "L5-020_layer_off_sample.bin",
      "case_id": "L5-020",
      "category": "L5",
      "expected_verdict": "review",
      "expected_rules": [
        "DangerousExecutableExtension",
        "ExtensionMismatch",
        "PEArchInfo",
        "RWXSectionDetected",
        "SuspiciousTimestamp",
        "UnsignedExecutable"
      ],
      "description": "关闭分层开关测试占位",
      "_scan_verdict": "reject"
    },
    {
      "filename": "NEG-001_clean.jpg",
      "case_id": "NEG-001",
      "category": "NEG",
      "expected_verdict": "pass",
      "expected_rules": [],
      "description": "业务标准JPG图片",
      "_scan_verdict": "clean"
    },
    {
      "filename": "NEG-002_clean.png",
      "case_id": "NEG-002",
      "category": "NEG",
      "expected_verdict": "pass",
      "expected_rules": [],
      "description": "业务PNG图片",
      "_scan_verdict": "clean"
    },
    {
      "filename": "NEG-003_clean.mp4",
      "case_id": "NEG-003",
      "category": "NEG",
      "expected_verdict": "pass",
      "expected_rules": [],
      "description": "业务MP4视频",
      "_scan_verdict": "clean"
    },
    {
      "filename": "NEG-004_clean.docx",
      "case_id": "NEG-004",
      "category": "NEG",
      "expected_verdict": "pass",
      "expected_rules": [],
      "description": "业务正常docx报表",
      "_scan_verdict": "clean"
    },
    {
      "filename": "NEG-005_clean.xlsx",
      "case_id": "NEG-005",
      "category": "NEG",
      "expected_verdict": "pass",
      "expected_rules": [],
      "description": "业务正常xlsx表格",
      "_scan_verdict": "clean"
    },
    {
      "filename": "NEG-006_clean.pdf",
      "case_id": "NEG-006",
      "category": "NEG",
      "expected_verdict": "pass",
      "expected_rules": [
        "MalformedStructure",
        "PdfParseFailed"
      ],
      "description": "业务正常PDF报告",
      "_scan_verdict": "suspicious"
    },
    {
      "filename": "NEG-007_clean.java",
      "case_id": "NEG-007",
      "category": "NEG",
      "expected_verdict": "pass",
      "expected_rules": [],
      "description": "业务源码java文件",
      "_scan_verdict": "reject"
    },
    {
      "filename": "NEG-008_clean.py",
      "case_id": "NEG-008",
      "category": "NEG",
      "expected_verdict": "pass",
      "expected_rules": [
        "DangerousExecutableExtension"
      ],
      "description": "业务源码python脚本",
      "_scan_verdict": "suspicious"
    },
    {
      "filename": "NEG-009_clean.zip",
      "case_id": "NEG-009",
      "category": "NEG",
      "expected_verdict": "pass",
      "expected_rules": [],
      "description": "正常业务压缩包zip",
      "_scan_verdict": "clean"
    },
    {
      "filename": "NEG-010_clean.exe",
      "case_id": "NEG-010",
      "category": "NEG",
      "expected_verdict": "pass",
      "expected_rules": [
        "DangerousExecutableExtension",
        "PeParseFailed"
      ],
      "description": "正常业务安装包（干净开源）",
      "_scan_verdict": "suspicious"
    },
    {
      "filename": "NEG-011_clean.log",
      "case_id": "NEG-011",
      "category": "NEG",
      "expected_verdict": "pass",
      "expected_rules": [],
      "description": "正常日志文件",
      "_scan_verdict": "reject"
    },
    {
      "filename": "NEG-012_clean.csv",
      "case_id": "NEG-012",
      "category": "NEG",
      "expected_verdict": "pass",
      "expected_rules": [],
      "description": "正常csv业务数据文件",
      "_scan_verdict": "clean"
    },
    {
      "filename": "NEG-013_clean.eml",
      "case_id": "NEG-013",
      "category": "NEG",
      "expected_verdict": "pass",
      "expected_rules": [],
      "description": "正常eml业务邮件（无附件、无外联恶意）",
      "_scan_verdict": "clean"
    },
    {
      "filename": "NEG-014_clean.dll",
      "case_id": "NEG-014",
      "category": "NEG",
      "expected_verdict": "pass",
      "expected_rules": [
        "DangerousExecutableExtension",
        "PeParseFailed"
      ],
      "description": "正常dll（系统干净dll）",
      "_scan_verdict": "suspicious"
    },
    {
      "filename": "NEG-015_clean.ttf",
      "case_id": "NEG-015",
      "category": "NEG",
      "expected_verdict": "pass",
      "expected_rules": [],
      "description": "正常字体文件ttf",
      "_scan_verdict": "reject"
    },
    {
      "filename": "NEG-016_clean.dwg",
      "case_id": "NEG-016",
      "category": "NEG",
      "expected_verdict": "pass",
      "expected_rules": [],
      "description": "正常CAD图纸",
      "_scan_verdict": "reject"
    },
    {
      "filename": "NEG-017_4layer_nested.zip",
      "case_id": "NEG-017",
      "category": "NEG",
      "expected_verdict": "pass",
      "expected_rules": [
        "ArchiveBroken",
        "MalformedStructure"
      ],
      "description": "多层嵌套干净zip（无风险）",
      "_scan_verdict": "suspicious"
    },
    {
      "filename": "NEG-018_clean.bat",
      "case_id": "NEG-018",
      "category": "NEG",
      "expected_verdict": "pass",
      "expected_rules": [
        "DangerousExecutableExtension"
      ],
      "description": "正常bat运维脚本（内网备份）",
      "_scan_verdict": "suspicious"
    },
    {
      "filename": "NEG-019_clean.ps1",
      "case_id": "NEG-019",
      "category": "NEG",
      "expected_verdict": "pass",
      "expected_rules": [
        "DangerousExecutableExtension"
      ],
      "description": "正常ps1运维脚本（内网查询）",
      "_scan_verdict": "suspicious"
    },
    {
      "filename": "NEG-020_clean.odt",
      "case_id": "NEG-020",
      "category": "NEG",
      "expected_verdict": "pass",
      "expected_rules": [],
      "description": "正常odt文档",
      "_scan_verdict": "reject"
    },
    {
      "filename": "broken.zip",
      "case_id": "L7-001",
      "category": "L7",
      "expected_verdict": "clean",
      "expected_rules": [],
      "description": "损坏 ZIP",
      "_scan_verdict": "clean"
    },
    {
      "filename": "evil.iso",
      "case_id": "L7-002",
      "category": "L7",
      "expected_verdict": "suspicious",
      "expected_rules": [
        "DangerousExecutableExtension"
      ],
      "description": "恶意 ISO 镜像",
      "_scan_verdict": "suspicious"
    },
    {
      "filename": "evil_help.chm",
      "case_id": "L7-003",
      "category": "L7",
      "expected_verdict": "malicious",
      "expected_rules": [
        "ChmWithScript",
        "DangerousExecutableExtension",
        "RemoteDownloadUnix"
      ],
      "description": "含脚本 CHM 帮助",
      "_scan_verdict": "malicious"
    },
    {
      "filename": "linux_malicious",
      "case_id": "L7-004",
      "category": "L7",
      "expected_verdict": "malicious",
      "expected_rules": [
        "C7_Linux_ReverseShell_Bash",
        "LinuxExecutable",
        "ReverseShellNetcat"
      ],
      "description": "Linux 恶意脚本集",
      "_scan_verdict": "malicious"
    },
    {
      "filename": "lolbin.cmd",
      "case_id": "L7-005",
      "category": "L7",
      "expected_verdict": "suspicious",
      "expected_rules": [
        "CommandExecutionObfuscated",
        "DangerousExecutableExtension"
      ],
      "description": "LOLBin cmd 混淆",
      "_scan_verdict": "suspicious"
    },
    {
      "filename": "macro_alert.docm",
      "case_id": "L7-006",
      "category": "L7",
      "expected_verdict": "malicious",
      "expected_rules": [
        "RemoteDownloadPowerShell",
        "RemoteDownloadUnix",
        "VBAAutoExecShell"
      ],
      "description": "含 VBA 宏 DOCM",
      "_scan_verdict": "malicious"
    },
    {
      "filename": "malicious.desktop",
      "case_id": "L7-007",
      "category": "L7",
      "expected_verdict": "malicious",
      "expected_rules": [
        "C7_Linux_ReverseShell_Bash",
        "C7_Linux_ReverseShell_Misc",
        "DangerousExecutableExtension",
        "DesktopFileAutoExec",
        "ReverseShellNetcat"
      ],
      "description": "恶意 .desktop 反序列化",
      "_scan_verdict": "malicious"
    },
    {
      "filename": "malicious.pdf",
      "case_id": "L7-008",
      "category": "L7",
      "expected_verdict": "malicious",
      "expected_rules": [
        "PdfJavaScript",
        "PdfOpenAction"
      ],
      "description": "含 JS/Action PDF",
      "_scan_verdict": "malicious"
    },
    {
      "filename": "miner_config.json",
      "case_id": "L7-009",
      "category": "L7",
      "expected_verdict": "suspicious",
      "expected_rules": [
        "C7_Linux_Miner_Generic"
      ],
      "description": "挖矿配置文件",
      "_scan_verdict": "suspicious"
    },
    {
      "filename": "neg_tmp1.zip",
      "case_id": "L7-035",
      "category": "L7",
      "expected_verdict": "clean",
      "expected_rules": [],
      "description": "占位残留 tmp zip",
      "_scan_verdict": "clean"
    },
    {
      "filename": "normal.pdf",
      "case_id": "L7-010",
      "category": "L7",
      "expected_verdict": "clean",
      "expected_rules": [],
      "description": "干净 PDF 对照",
      "_scan_verdict": "clean"
    },
    {
      "filename": "normal_deploy.sh",
      "case_id": "L7-011",
      "category": "L7",
      "expected_verdict": "suspicious",
      "expected_rules": [
        "DangerousExecutableExtension"
      ],
      "description": "运维部署脚本（误报）",
      "_scan_verdict": "suspicious"
    },
    {
      "filename": "normal_readme.txt",
      "case_id": "L7-012",
      "category": "L7",
      "expected_verdict": "clean",
      "expected_rules": [],
      "description": "干净 README 对照",
      "_scan_verdict": "clean"
    },
    {
      "filename": "normal_report.docx",
      "case_id": "L7-013",
      "category": "L7",
      "expected_verdict": "clean",
      "expected_rules": [],
      "description": "干净 DOCX 对照",
      "_scan_verdict": "clean"
    },
    {
      "filename": "ole_dropper.doc",
      "case_id": "L7-014",
      "category": "L7",
      "expected_verdict": "suspicious",
      "expected_rules": [
        "OleToolsUnavailable",
        "RemoteSessionHijack"
      ],
      "description": "OLE 投递 DOC",
      "_scan_verdict": "suspicious"
    },
    {
      "filename": "pe_downloader.exe",
      "case_id": "L7-015",
      "category": "L7",
      "expected_verdict": "malicious",
      "expected_rules": [
        "C1_PE_Downloader_Loader",
        "DangerousExecutableExtension",
        "PeParseFailed"
      ],
      "description": "PE 下载木马",
      "_scan_verdict": "malicious"
    },
    {
      "filename": "pe_injection.exe",
      "case_id": "L7-016",
      "category": "L7",
      "expected_verdict": "malicious",
      "expected_rules": [
        "C1_PE_ProcessInjection",
        "DangerousExecutableExtension",
        "PeParseFailed",
        "RemoteSessionHijack"
      ],
      "description": "PE 注入程序",
      "_scan_verdict": "malicious"
    },
    {
      "filename": "persist_cron.sh",
      "case_id": "L7-017",
      "category": "L7",
      "expected_verdict": "malicious",
      "expected_rules": [
        "C7_Linux_Persistence_Crontab",
        "DangerousExecutableExtension",
        "RemoteDownloadUnix",
        "ShellScriptDangerous",
        "Txt.Malware.Sustes-6779550-1"
      ],
      "description": "Crontab 持久化脚本",
      "_scan_verdict": "malicious"
    },
    {
      "filename": "phishing.eml",
      "case_id": "L7-018",
      "category": "L7",
      "expected_verdict": "reject",
      "expected_rules": [
        "EmailAttachmentDangerous",
        "EmailAttachmentDisguised",
        "EmailAttachmentWebshell",
        "EmailPhishingKeyword"
      ],
      "description": "钓鱼邮件 EML",
      "_scan_verdict": "reject"
    },
    {
      "filename": "photo.jpg.php",
      "case_id": "L7-019",
      "category": "L7",
      "expected_verdict": "reject",
      "expected_rules": [
        "DangerousExecutableExtension"
      ],
      "description": "双扩展名伪装 .jpg.php",
      "_scan_verdict": "reject"
    },
    {
      "filename": "ransom_dropper.exe.txt",
      "case_id": "L7-020",
      "category": "L7",
      "expected_verdict": "reject",
      "expected_rules": [
        "C8_Ransomware_Encryption",
        "C8_Ransomware_Note_Filename",
        "C8_Ransomware_VolumeShadow",
        "DoubleExtension"
      ],
      "description": "勒索软件投递器",
      "_scan_verdict": "reject"
    },
    {
      "filename": "sealed.docx",
      "case_id": "L7-021",
      "category": "L7",
      "expected_verdict": "reject",
      "expected_rules": [
        "ArchiveBroken",
        "MalformedStructure",
        "OfficeEncrypted",
        "OoxmlParseFailed"
      ],
      "description": "加密 DOCX（被视为损坏）",
      "_scan_verdict": "reject"
    },
    {
      "filename": "sealed.xlsx",
      "case_id": "L7-022",
      "category": "L7",
      "expected_verdict": "reject",
      "expected_rules": [
        "ArchiveBroken",
        "ExtensionMismatch",
        "MalformedStructure",
        "OfficeEncrypted",
        "OoxmlParseFailed"
      ],
      "description": "加密 XLSX（被视为损坏）",
      "_scan_verdict": "reject"
    },
    {
      "filename": "shell_aspx.aspx",
      "case_id": "L7-023",
      "category": "L7",
      "expected_verdict": "reject",
      "expected_rules": [
        "DangerousExecutableExtension"
      ],
      "description": "ASPX 一句话木马",
      "_scan_verdict": "reject"
    },
    {
      "filename": "shell_bash_devtcp.sh",
      "case_id": "L7-024",
      "category": "L7",
      "expected_verdict": "malicious",
      "expected_rules": [
        "C7_Linux_ReverseShell_Bash",
        "DangerousExecutableExtension",
        "ReverseShellNetcat",
        "ShellScriptDangerous"
      ],
      "description": "Bash /dev/tcp 反弹",
      "_scan_verdict": "malicious"
    },
    {
      "filename": "shell_jsp_runtime.jsp",
      "case_id": "L7-025",
      "category": "L7",
      "expected_verdict": "reject",
      "expected_rules": [
        "C3_JSP_Webshell_RuntimeExec",
        "DangerousExecutableExtension"
      ],
      "description": "JSP Runtime exec 木马",
      "_scan_verdict": "reject"
    },
    {
      "filename": "shell_nc.sh",
      "case_id": "L7-026",
      "category": "L7",
      "expected_verdict": "malicious",
      "expected_rules": [
        "C7_Linux_ReverseShell_NC",
        "DangerousExecutableExtension",
        "ReverseShellNetcat",
        "ShellScriptDangerous"
      ],
      "description": "NC 反弹 Shell",
      "_scan_verdict": "malicious"
    },
    {
      "filename": "shell_php_eval.php",
      "case_id": "L7-027",
      "category": "L7",
      "expected_verdict": "reject",
      "expected_rules": [
        "C3_PHP_Webshell_Oneliner",
        "DangerousExecutableExtension"
      ],
      "description": "PHP eval 一句话木马",
      "_scan_verdict": "reject"
    },
    {
      "filename": "shell_php_obf.php",
      "case_id": "L7-028",
      "category": "L7",
      "expected_verdict": "reject",
      "expected_rules": [
        "C3_PHP_Webshell_Obfuscated",
        "DangerousExecutableExtension"
      ],
      "description": "PHP 混淆木马",
      "_scan_verdict": "reject"
    },
    {
      "filename": "shell_python.py",
      "case_id": "L7-029",
      "category": "L7",
      "expected_verdict": "suspicious",
      "expected_rules": [
        "DangerousExecutableExtension"
      ],
      "description": "Python 反弹脚本",
      "_scan_verdict": "suspicious"
    },
    {
      "filename": "shortcut.lnk",
      "case_id": "L7-030",
      "category": "L7",
      "expected_verdict": "suspicious",
      "expected_rules": [
        "DangerousExecutableExtension",
        "RemoteDownloadUnix"
      ],
      "description": "恶意 .lnk 快捷方式",
      "_scan_verdict": "suspicious"
    },
    {
      "filename": "template_backdoor.docx",
      "case_id": "L7-031",
      "category": "L7",
      "expected_verdict": "malicious",
      "expected_rules": [
        "AttachedTemplate"
      ],
      "description": "模板后门 DOCX",
      "_scan_verdict": "malicious"
    },
    {
      "filename": "vba_autoexec.bas",
      "case_id": "L7-032",
      "category": "L7",
      "expected_verdict": "malicious",
      "expected_rules": [
        "RemoteDownloadUnix",
        "VBAAutoExecShell"
      ],
      "description": "VBA AutoOpen 宏",
      "_scan_verdict": "malicious"
    },
    {
      "filename": "wps_macro.js",
      "case_id": "L7-033",
      "category": "L7",
      "expected_verdict": "malicious",
      "expected_rules": [
        "C7_Linux_ReverseShell_Bash",
        "C7_Linux_ReverseShell_Misc",
        "DangerousExecutableExtension",
        "ReverseShellNetcat"
      ],
      "description": "WPS JS 宏",
      "_scan_verdict": "malicious"
    },
    {
      "filename": "zip_traversal.zip",
      "case_id": "L7-034",
      "category": "L7",
      "expected_verdict": "malicious",
      "expected_rules": [
        "PathTraversal",
        "PathTraversalBlocked"
      ],
      "description": "ZIP 路径穿越（旧版）",
      "_scan_verdict": "malicious"
    }
  ]
}