zhaolei
da05c544e9
- rules/rule_labels.yaml: 64 条 rule_name → 中文标签映射 - console.py: 加载 rule_labels + layer_definitions 传给 template - test_center.html: 期望规则 / 实际规则 全显示中文名（hover 保留英文原名） - scripts/regen_v2.py: 全量扫描自动打 L7 标签 + case_id - tests/samples/index.json: 168 条全有 case_id，层分布 L0=27 L1=25 L3=25 L4=15 L5=21 NEG=20 L7=35 前端效果: NC 反弹 Shell / UPX 加壳 / 压缩包路径穿越 / RWX 可写可执行节...
281 lines
8.0 KiB
YAML
281 lines
8.0 KiB
YAML
# MeshSafe 规则名中文标签映射
|
||
# 前端显示时用中文名代替引擎内部的英文 rule_name
|
||
# 层级分组对应 CSV 里的 L0-L5 + NEG + L7
|
||
|
||
# ===== L0 结构分析 =====
|
||
ArchiveBroken:
|
||
label: "压缩包损坏"
|
||
desc: "ZIP/7z 结构异常，目录项或文件头损坏"
|
||
|
||
ArchiveContainsExecutable:
|
||
label: "压缩包内含可执行文件"
|
||
desc: "归档内包含 .exe/.dll/.sys/.scr 等 PE 文件"
|
||
|
||
ExtensionMismatch:
|
||
label: "后缀伪装"
|
||
desc: "文件声明扩展名与真实幻数不符（如 jpg 后缀实际 MZ 头）"
|
||
|
||
DoubleExtension:
|
||
label: "双扩展名伪装"
|
||
desc: "文件名含两个扩展名，隐藏真实后缀（如 report.pdf.exe）"
|
||
|
||
DangerousExecutableExtension:
|
||
label: "危险可执行扩展名"
|
||
desc: "文件后缀属于可执行/脚本类型（exe/ps1/bat/cmd/js/vbs 等）"
|
||
|
||
ShellScriptDangerous:
|
||
label: "危险脚本扩展名"
|
||
desc: "shell/bash/powershell 等脚本类扩展名"
|
||
|
||
PathTraversal:
|
||
label: "压缩包路径穿越"
|
||
desc: "ZIP 内文件名包含 ../ 或绝对路径，可能覆盖系统文件"
|
||
|
||
PathTraversalBlocked:
|
||
label: "路径穿越已拦截"
|
||
desc: "扫描器已阻止路径穿越文件落地"
|
||
|
||
ArchiveBombSuspect:
|
||
label: "ZIP 炸弹"
|
||
desc: "压缩比异常高（如 42.zip），解压膨胀可能耗尽磁盘/内存"
|
||
|
||
EncryptedArchive:
|
||
label: "加密压缩包"
|
||
desc: "ZIP 设置了打开密码，无法扫描内部内容"
|
||
|
||
MalformedStructure:
|
||
label: "文件结构畸形"
|
||
desc: "文件能识别但内部结构不符合该格式规范"
|
||
|
||
ZeroByteFile:
|
||
label: "零字节文件"
|
||
desc: "空文件（0 字节）"
|
||
|
||
# ===== L1 ClamAV =====
|
||
"ClamAV:EICAR":
|
||
label: "ClamAV EICAR 测试病毒"
|
||
desc: "命中 ClamAV EICAR-STANDARD-ANTIVIRUS-TEST-FILE 签名"
|
||
|
||
Eicar-Test-Signature:
|
||
label: "EICAR 测试签名"
|
||
desc: "ClamAV 识别到 EICAR 标准测试串（行业无害测试）"
|
||
|
||
# ===== L2 文档深度 =====
|
||
OfficeEncrypted:
|
||
label: "Office 加密文档"
|
||
desc: "DOCX/XLSX/PPTX 设置了打开密码"
|
||
|
||
OleToolsUnavailable:
|
||
label: "OLE 工具不可用"
|
||
desc: "olefile 未安装，无法扫描 OLE 结构"
|
||
|
||
OoxmlParseFailed:
|
||
label: "OOXML 解析失败"
|
||
desc: "DOCX/XLSX/PPTX ZIP 内部 XML 损坏"
|
||
|
||
AttachedTemplate:
|
||
label: "模板注入风险"
|
||
desc: "Word 文档关联了外部模板（可能触发模板后门）"
|
||
|
||
VBAAutoExecShell:
|
||
label: "VBA 宏自动执行 Shell"
|
||
desc: "检测到 AutoOpen/Workbook_Open 等自动执行入口 + Shell/CreateObject 等危险调用"
|
||
|
||
PdfJavaScript:
|
||
label: "PDF 内含 JavaScript"
|
||
desc: "PDF 文档嵌入可执行 JavaScript"
|
||
|
||
PdfOpenAction:
|
||
label: "PDF OpenAction 跳转"
|
||
desc: "PDF 启动时有自动跳转/打开外部链接动作"
|
||
|
||
PdfParseFailed:
|
||
label: "PDF 解析失败"
|
||
desc: "PDF 结构异常或为占位文件，无法正常解析"
|
||
|
||
ChmWithScript:
|
||
label: "CHM 内含脚本"
|
||
desc: "CHM 帮助文档包含 ActiveScript/JScript"
|
||
|
||
DesktopFileAutoExec:
|
||
label: "Linux .desktop 自动执行"
|
||
desc: ".desktop 文件设置了自动执行属性"
|
||
|
||
# ===== L3 关键词匹配 =====
|
||
ReverseShellNetcat:
|
||
label: "NC 反弹 Shell"
|
||
desc: "包含 nc/ncat/netcat /bin/bash -i >& /dev/tcp/ 等反弹 shell 特征"
|
||
|
||
ReverseShellPowershell:
|
||
label: "PowerShell EncodedCommand"
|
||
desc: "包含 powershell -enc / -w hidden 等混淆执行"
|
||
|
||
CredentialStealer:
|
||
label: "凭据窃取工具"
|
||
desc: "包含 mimikatz/sekurlsa/gsecdump/DCSync/Rubeus 等"
|
||
|
||
CredentialExport:
|
||
label: "凭据导出命令"
|
||
desc: "包含 reg save HKLM\\SAM/SYSTEM/secretsdump 等"
|
||
|
||
RemoteDownloadPowerShell:
|
||
label: "PowerShell 远程下载"
|
||
desc: "Invoke-WebRequest/Invoke-RestMethod/DownloadString/BitsAdmin 等"
|
||
|
||
RemoteDownloadUnix:
|
||
label: "Unix 远程下载"
|
||
desc: "wget/curl/certutil -urlcache -split 等"
|
||
|
||
RemoteSessionHijack:
|
||
label: "远程会话劫持"
|
||
desc: "tscon/rdpclip/shadow/CreateRemoteThread 等"
|
||
|
||
CommandExecutionObfuscated:
|
||
label: "命令执行混淆"
|
||
desc: "certutil -decode/mshta/regsvr32 /s 等混淆执行"
|
||
|
||
WMILdapAttack:
|
||
label: "WMI/LDAP 攻击"
|
||
desc: "wmic path/wmic process call create/ldapsearch 等"
|
||
|
||
ClassifiedLevelMarkers:
|
||
label: "涉密密级标记"
|
||
desc: "包含绝密/机密/秘密/内部文件/禁止外传等密级标识"
|
||
|
||
InternalDocumentPatterns:
|
||
label: "国家机密标识"
|
||
desc: "包含国家机密|涉密|密级：等关键词"
|
||
|
||
# ===== L4 YARA =====
|
||
# 留空 → YARA 规则文件自己的 rule name 就是中文或 meta 里有描述
|
||
|
||
# ===== L5 PE 二进制 =====
|
||
UPXPackerDetected:
|
||
label: "UPX 加壳"
|
||
desc: "PE 节名包含 UPX0/UPX1/UPX!，检测到 UPX 加壳"
|
||
|
||
RWXSectionDetected:
|
||
label: "RWX 可写可执行节"
|
||
desc: "PE 节同时设置了 MEM_EXECUTE + MEM_WRITE，典型绕过 DEP 手法"
|
||
|
||
HighEntropySection:
|
||
label: "节区熵值异常"
|
||
desc: "PE 节熵 ≥ 7.2，可能经过加密或加壳"
|
||
|
||
SuspiciousImports:
|
||
label: "可疑导入表"
|
||
desc: "PE 导入表包含 VirtualAllocEx/WriteProcessMemory/CreateRemoteThread 等高危注入 API"
|
||
|
||
UnsignedExecutable:
|
||
label: "未签名可执行文件"
|
||
desc: "PE 未携带 Authenticode 数字签名"
|
||
|
||
SuspiciousTimestamp:
|
||
label: "编译时间戳异常"
|
||
desc: "PE 编译时间戳为 0 或指向未来时间，可能被伪造"
|
||
|
||
PEArchInfo:
|
||
label: "PE 架构信息"
|
||
desc: "PE 架构识别（x86/x64/ARM 等），辅助判断"
|
||
|
||
DebugInformationPresent:
|
||
label: "含调试信息"
|
||
desc: "PE 包含 PDB 调试路径或 .debug 节"
|
||
|
||
PeParseFailed:
|
||
label: "PE 结构解析失败"
|
||
desc: "pefile 无法解析 PE，可能是畸形文件"
|
||
|
||
LinuxExecutable:
|
||
label: "Linux ELF 可执行"
|
||
desc: "ELF 格式 Linux 可执行文件"
|
||
|
||
# ===== C1/C3/C7/C8 自动命名规则 =====
|
||
"C1_PE_Downloader_Loader":
|
||
label: "YARA: PE 下载木马"
|
||
desc: "YARA C1_PE_Downloader_Loader 规则命中"
|
||
|
||
"C1_PE_ProcessInjection":
|
||
label: "YARA: PE 进程注入"
|
||
desc: "YARA C1_PE_ProcessInjection 规则命中"
|
||
|
||
"C3_PHP_Webshell_Oneliner":
|
||
label: "YARA: PHP 一句话木马"
|
||
desc: "YARA C3_PHP_Webshell_Oneliner 规则命中"
|
||
|
||
"C3_PHP_Webshell_Obfuscated":
|
||
label: "YARA: PHP 混淆木马"
|
||
desc: "YARA C3_PHP_Webshell_Obfuscated 规则命中"
|
||
|
||
"C3_JSP_Webshell_RuntimeExec":
|
||
label: "YARA: JSP Runtime exec 木马"
|
||
desc: "YARA C3_JSP_Webshell_RuntimeExec 规则命中"
|
||
|
||
"C7_Linux_ReverseShell_Bash":
|
||
label: "YARA: Bash 反弹 Shell"
|
||
desc: "YARA C7_Linux_ReverseShell_Bash 规则命中"
|
||
|
||
"C7_Linux_ReverseShell_NC":
|
||
label: "YARA: NC 反弹 Shell"
|
||
desc: "YARA C7_Linux_ReverseShell_NC 规则命中"
|
||
|
||
"C7_Linux_ReverseShell_Misc":
|
||
label: "YARA: Linux 反弹 Shell（其他）"
|
||
desc: "YARA C7_Linux_ReverseShell_Misc 规则命中"
|
||
|
||
"C7_Linux_Persistence_Crontab":
|
||
label: "YARA: Crontab 持久化"
|
||
desc: "YARA C7_Linux_Persistence_Crontab 规则命中"
|
||
|
||
"C7_Linux_Miner_Generic":
|
||
label: "YARA: 挖矿程序"
|
||
desc: "YARA C7_Linux_Miner_Generic 规则命中"
|
||
|
||
"C8_Ransomware_Encryption":
|
||
label: "YARA: 勒索加密特征"
|
||
desc: "YARA C8_Ransomware_Encryption 规则命中"
|
||
|
||
"C8_Ransomware_Note_Filename":
|
||
label: "YARA: 勒索赎金文件名"
|
||
desc: "YARA C8_Ransomware_Note_Filename 规则命中"
|
||
|
||
"C8_Ransomware_VolumeShadow":
|
||
label: "YARA: VSS 卷影副本删除"
|
||
desc: "YARA C8_Ransomware_VolumeShadow 规则命中"
|
||
|
||
# ===== 邮件 =====
|
||
EmailAttachmentDangerous:
|
||
label: "邮件附件危险"
|
||
desc: "EML 包含 .exe/.dll/.ps1 等危险附件"
|
||
|
||
EmailAttachmentDisguised:
|
||
label: "邮件附件伪装"
|
||
desc: "EML 附件扩展名与真实类型不符"
|
||
|
||
EmailAttachmentWebshell:
|
||
label: "邮件附件 Webshell"
|
||
desc: "EML 附件为 PHP/ASP/JSP 一句话木马"
|
||
|
||
EmailPhishingKeyword:
|
||
label: "钓鱼邮件关键词"
|
||
desc: "EML 正文包含钓鱼诈骗关键词"
|
||
|
||
# ===== 其他 =====
|
||
SuspiciousScript:
|
||
label: "可疑脚本"
|
||
desc: "脚本内容触发通用恶意特征"
|
||
|
||
"Txt.Malware.Sustes-6779550-1":
|
||
label: "ClamAV: Sustes 木马变体"
|
||
desc: "ClamAV 识别到 Sustes 木马家族签名"
|
||
|
||
# ===== verdict → 中文 =====
|
||
# （前端直接写死在 template 里，这里留文档）
|
||
verdict_labels:
|
||
clean: "干净（放行）"
|
||
suspicious: "可疑（人工审核）"
|
||
reject: "拦截（零容忍）"
|
||
malicious: "恶意（零容忍）"
|
||
pending: "待测"
|
||
unknown: "未知"
|