zhaolei/MeshSate
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
21aa657ff4cbbcdb0f3464a1c81456c16d65f0eb
MeshSate/tests/samples/index.json
zhaolei f1a176aae0 fix: 裁决口径重构 — rule_overrides 改处置地板，YARA 权重分档与阈值解耦 
三件事，都围绕"分数只反映证据，不放行由地板保证"：

- rule_overrides 的 manual_review 旧实现是 score=max(score,65) 并跳过该规则自身权重：
  注进去的 65 不是证据，再叠任意 ≥5 分噪声就越过 block_score=70 变拒绝，同时显示分数
  与真实证据脱钩。改为步骤 9「复核地板」：权重照常累加，裁决后处置低于复核才抬到
  manual_review，已判 reject 不降回。3661 条历史扫描重放 0 收紧 0 放行；把 review_score
  下界抬到 36/40/50 或把 DEE 权重降到 10，无地板时干净 exe 静默放行，有地板恒为人工复核。
- DangerousExecutableExtension 进 rule_overrides(manual_review)，落实光闸口径「EXE/DLL/
  脚本不自动放行」，不再依赖 weight=30 恰好等于 review_score 下界这种数值巧合。
- YARA 权重分档 85/65/45/25 → 85/60/30/10，只有 critical 一档能独立越过 70；
  档位与 rules/*.yar 的 meta.risk_level 一一对应，控制台注释与 policy.html 同步。
- 词表：RemoteDownloadUnix/PowerShell 移出零容忍、改判"工具与 URL/IP 同框"，
  新增 RemoteDownloadExec(40)/PayloadDropToDisk(45) 带内网源站白名单。裸 cmdlet 名会把
  nvidiaInspector.exe 的 add_DownloadFileCompleted 白送 30 分，把 45 分复核顶成 75 分拒绝。
- 风险等级文案：裁决已是 malicious/error 时仍输出"打开风险低"是自相矛盾的对外文案，
  强制收敛到 critical。
- 靶场 L5-005 expected_verdict reject→review：旧 85 分靠载体45+时间戳20+未签名10+架构10
  堆叠，属权重堆叠误报；真实注入器由 C1_PE_ProcessInjection(85) 拦截。
2026-11-02 20:27:30 +08:00

1891 lines
54 KiB
JSON
Raw Blame History

This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
{
"meshsafe_target_version": "v0.2.1",
"index_regenerated_at": "2026-10-29T11:48:22.953397",
"layer_definition": {
"L0": "结构分析（幻数/后缀伪装/嵌套/路径穿越/zip 炸弹）",
"L1": "ClamAV 病毒库扫描",
"L2": "文档深度检测（OLE/Macro/JS）",
"L3": "关键词匹配（恶意行为特征）",
"L4": "YARA 规则匹配",
"L5": "PE 二进制静态分析（壳/导入/节/签名）",
"NEG": "负样本（业务正常文件，应无告警）",
"L7": "历史遗留样本（CSV 之外的真实恶意/误报对照）"
},
"samples": [
{
"filename": "L0-001_jpg_normal.jpg",
"case_id": "L1-006",
"category": "L1",
"expected_verdict": "pass",
"expected_rules": [],
"description": "干净jpg图片（对照负样本）",
"_scan_verdict": "clean"
},
{
"filename": "L0-002_png_normal.png",
"case_id": "L0-002",
"category": "L0",
"expected_verdict": "pass",
"expected_rules": [],
"description": "正常文件幻数识别-PNG",
"_scan_verdict": "clean"
},
{
"filename": "L0-003_docx_normal.docx",
"case_id": "L1-007",
"category": "L1",
"expected_verdict": "pass",
"expected_rules": [],
"description": "干净docx文档（对照负样本）",
"_scan_verdict": "clean"
},
{
"filename": "L0-004_pdf_normal.pdf",
"case_id": "L0-004",
"category": "L0",
"expected_verdict": "suspicious",
"expected_rules": [
"MalformedStructure",
"PdfParseFailed"
],
"description": "正常文件幻数识别-PDF",
"_scan_verdict": "suspicious"
},
{
"filename": "L0-005_pe_clean.exe",
"case_id": "L1-008",
"category": "L1",
"expected_verdict": "suspicious",
"expected_rules": [
"DangerousExecutableExtension",
"PeParseFailed"
],
"description": "干净hello PE（对照负样本）",
"_scan_verdict": "suspicious"
},
{
"filename": "L0-006_disguise_jpg_pe.jpg",
"case_id": "L0-006",
"category": "L0",
"expected_verdict": "reject",
"expected_rules": [
"ExtensionMismatch"
],
"description": "jpg 后缀 + 实际 PE MZ 头",
"_scan_verdict": "reject"
},
{
"filename": "L0-007_disguise_txt_pdf.txt",
"case_id": "L0-007",
"category": "L0",
"expected_verdict": "review",
"expected_rules": [
"ExtensionMismatch",
"MalformedStructure"
],
"description": "后缀伪装：txt后缀，实际PDF幻数",
"_scan_verdict": "reject"
},
{
"filename": "L0-008_disguise_png_zip.png",
"case_id": "L0-008",
"category": "L0",
"expected_verdict": "review",
"expected_rules": [
"ExtensionMismatch",
"MalformedStructure"
],
"description": "后缀伪装：png后缀，实际ZIP幻数",
"_scan_verdict": "reject"
},
{
"filename": "L0-009_double_ext_pdf_exe.pdf.exe",
"case_id": "L0-009",
"category": "L0",
"expected_verdict": "reject",
"expected_rules": [
"DangerousExecutableExtension",
"DoubleExtension",
"PeParseFailed"
],
"description": "双扩展名伪装：report.pdf.exe",
"_scan_verdict": "reject"
},
{
"filename": "L0-010_double_ext_txt_ps1.txt.ps1",
"case_id": "L0-010",
"category": "L0",
"expected_verdict": "reject",
"expected_rules": [
"DangerousExecutableExtension",
"DoubleExtension"
],
"description": "双扩展名伪装：data.txt.ps1",
"_scan_verdict": "reject"
},
{
"filename": "L0-011_double_ext_docx_js.docx.js",
"case_id": "L0-011",
"category": "L0",
"expected_verdict": "reject",
"expected_rules": [
"DangerousExecutableExtension"
],
"description": "双扩展名伪装：note.docx.js",
"_scan_verdict": "suspicious"
},
{
"filename": "L0-012_double_ext_xlsx_bat.xlsx.bat",
"case_id": "L0-012",
"category": "L0",
"expected_verdict": "reject",
"expected_rules": [
"DangerousExecutableExtension",
"DoubleExtension"
],
"description": "双扩展名伪装：log.xlsx.bat",
"_scan_verdict": "reject"
},
{
"filename": "L0-013_clean.ps1",
"case_id": "L0-013",
"category": "L0",
"expected_verdict": "review",
"expected_rules": [
"DangerousExecutableExtension"
],
"description": "干净 ps1 文件",
"_scan_verdict": "suspicious"
},
{
"filename": "L0-014_clean.bat",
"case_id": "L0-014",
"category": "L0",
"expected_verdict": "review",
"expected_rules": [
"DangerousExecutableExtension"
],
"description": "干净 bat 文件",
"_scan_verdict": "suspicious"
},
{
"filename": "L0-015_clean.cmd",
"case_id": "L0-015",
"category": "L0",
"expected_verdict": "review",
"expected_rules": [
"DangerousExecutableExtension"
],
"description": "干净 cmd 文件",
"_scan_verdict": "suspicious"
},
{
"filename": "L0-016_clean.vbs",
"case_id": "L0-016",
"category": "L0",
"expected_verdict": "review",
"expected_rules": [
"DangerousExecutableExtension"
],
"description": "干净 vbs 文件",
"_scan_verdict": "suspicious"
},
{
"filename": "L0-017_clean.js",
"case_id": "L0-017",
"category": "L0",
"expected_verdict": "review",
"expected_rules": [
"DangerousExecutableExtension"
],
"description": "干净 js 文件",
"_scan_verdict": "suspicious"
},
{
"filename": "L0-018_zip_traversal.zip",
"case_id": "L0-018",
"category": "L0",
"expected_verdict": "reject",
"expected_rules": [
"PathTraversal",
"PathTraversalBlocked"
],
"description": "ZIP单级路径穿越：../test.txt",
"_scan_verdict": "malicious"
},
{
"filename": "L0-019_zip_deep_traversal.zip",
"case_id": "L0-019",
"category": "L0",
"expected_verdict": "reject",
"expected_rules": [
"PathTraversal",
"PathTraversalBlocked"
],
"description": "ZIP多级路径穿越：../../a.txt",
"_scan_verdict": "malicious"
},
{
"filename": "L0-020_zip_bomb.zip",
"case_id": "L0-020",
"category": "L0",
"expected_verdict": "reject",
"expected_rules": [],
"description": "ZIP炸弹42.zip",
"_scan_verdict": "clean"
},
{
"filename": "L0-021_small_bomb.zip",
"case_id": "L0-021",
"category": "L0",
"expected_verdict": "reject",
"expected_rules": [],
"description": "自制小型 zip 炸弹（50 成员 × 8KB STORED）",
"_scan_verdict": "clean"
},
{
"filename": "L0-022_3layer_nested.zip",
"case_id": "L0-022",
"category": "L0",
"expected_verdict": "pass",
"expected_rules": [],
"description": "3层无害嵌套ZIP",
"_scan_verdict": "clean"
},
{
"filename": "L0-023_5layer_nested.zip",
"case_id": "L0-023",
"category": "L0",
"expected_verdict": "pass",
"expected_rules": [],
"description": "5 层无害嵌套 ZIP",
"_scan_verdict": "clean"
},
{
"filename": "L0-024_encrypted.zip",
"case_id": "L0-024",
"category": "L0",
"expected_verdict": "review",
"expected_rules": [],
"description": "加密 ZIP（标记待验证）",
"_scan_verdict": "clean"
},
{
"filename": "L0-025_corrupt_zip.zip",
"case_id": "L0-025",
"category": "L0",
"expected_verdict": "review",
"expected_rules": [
"ArchiveBroken",
"MalformedStructure"
],
"description": "截断损坏 ZIP 头",
"_scan_verdict": "suspicious"
},
{
"filename": "L0-026_corrupt_direntry.zip",
"case_id": "L0-026",
"category": "L0",
"expected_verdict": "review",
"expected_rules": [],
"description": "损坏ZIP目录项",
"_scan_verdict": "clean"
},
{
"filename": "L0-027_long_filename.zip",
"case_id": "L0-027",
"category": "L0",
"expected_verdict": "review",
"expected_rules": [],
"description": "压缩包内 200 字符超长文件名",
"_scan_verdict": "clean"
},
{
"filename": "L0-028_unicode_filename.zip",
"case_id": "L0-028",
"category": "L0",
"expected_verdict": "pass",
"expected_rules": [],
"description": "unicode/emoji 文件名",
"_scan_verdict": "clean"
},
{
"filename": "L0-029_zero_byte_exe.exe",
"case_id": "L0-029",
"category": "L0",
"expected_verdict": "review",
"expected_rules": [
"DangerousExecutableExtension",
"PeParseFailed"
],
"description": "空文件（0字节）后缀exe",
"_scan_verdict": "suspicious"
},
{
"filename": "L0-030_nested_traversal.zip",
"case_id": "L0-030",
"category": "L0",
"expected_verdict": "reject",
"expected_rules": [],
"description": "嵌套 zip 内含穿越条目",
"_scan_verdict": "clean"
},
{
"filename": "L1-001_eicar.txt",
"case_id": "L1-001",
"category": "L1",
"expected_verdict": "reject",
"expected_rules": [
"Eicar-Test-Signature"
],
"description": "EICAR标准测试串文本",
"_scan_verdict": "suspicious"
},
{
"filename": "L1-002_eicar_in_zip.zip",
"case_id": "L1-002",
"category": "L1",
"expected_verdict": "reject",
"expected_rules": [
"Eicar-Test-Signature"
],
"description": "EICAR放入zip压缩包",
"_scan_verdict": "suspicious"
},
{
"filename": "L1-003_eicar_in_encrypted.zip",
"case_id": "L1-003",
"category": "L1",
"expected_verdict": "review",
"expected_rules": [
"Eicar-Test-Signature"
],
"description": "加密 ZIP（占位：实际加密需 7z/zip -P）",
"_scan_verdict": "suspicious"
},
{
"filename": "L1-004_eicar_in_docx.docx",
"case_id": "L1-004",
"category": "L1",
"expected_verdict": "reject",
"expected_rules": [
"Eicar-Test-Signature"
],
"description": "EICAR放入docx内嵌（OLE）",
"_scan_verdict": "suspicious"
},
{
"filename": "L1-005_eicar_modified.txt",
"case_id": "L1-005",
"category": "L1",
"expected_verdict": "pass",
"expected_rules": [],
"description": "修改 1 字节 EICAR，ClamAV 不应命中",
"_scan_verdict": "clean"
},
{
"filename": "L1-009_minimal.cvd",
"case_id": "L1-009",
"category": "L1",
"expected_verdict": "review",
"expected_rules": [],
"description": "热加载测试占位（需真实 .cvd 文件）",
"_scan_verdict": "reject"
},
{
"filename": "L1-010_corrupt.cvd",
"case_id": "L1-010",
"category": "L1",
"expected_verdict": "reject",
"expected_rules": [],
"description": "损坏病毒库占位",
"_scan_verdict": "reject"
},
{
"filename": "L1-011_eicar_in_3layer.zip",
"case_id": "L1-011",
"category": "L1",
"expected_verdict": "reject",
"expected_rules": [
"Eicar-Test-Signature"
],
"description": "EICAR放在多层嵌套zip",
"_scan_verdict": "suspicious"
},
{
"filename": "L1-012_eicar_base64.txt",
"case_id": "L1-012",
"category": "L1",
"expected_verdict": "pass",
"expected_rules": [],
"description": "base64 编码 EICAR，ClamAV 不解码",
"_scan_verdict": "clean"
},
{
"filename": "L1-013_bigfile_eicar.txt",
"case_id": "L1-013",
"category": "L1",
"expected_verdict": "review",
"expected_rules": [],
"description": "10MB+ 文本尾部含 EICAR",
"_scan_verdict": "clean"
},
{
"filename": "L1-014_concurrent_eicar_00.txt",
"case_id": "L1-014-00",
"category": "L1",
"expected_verdict": "reject",
"expected_rules": [
"Eicar-Test-Signature"
],
"description": "并发压测占位 #0",
"_scan_verdict": "suspicious"
},
{
"filename": "L1-014_concurrent_eicar_01.txt",
"case_id": "L1-014-01",
"category": "L1",
"expected_verdict": "reject",
"expected_rules": [
"Eicar-Test-Signature"
],
"description": "并发压测占位 #1",
"_scan_verdict": "suspicious"
},
{
"filename": "L1-014_concurrent_eicar_02.txt",
"case_id": "L1-014-02",
"category": "L1",
"expected_verdict": "reject",
"expected_rules": [
"Eicar-Test-Signature"
],
"description": "并发压测占位 #2",
"_scan_verdict": "suspicious"
},
{
"filename": "L1-014_concurrent_eicar_03.txt",
"case_id": "L1-014-03",
"category": "L1",
"expected_verdict": "reject",
"expected_rules": [
"Eicar-Test-Signature"
],
"description": "并发压测占位 #3",
"_scan_verdict": "suspicious"
},
{
"filename": "L1-014_concurrent_eicar_04.txt",
"case_id": "L1-014-04",
"category": "L1",
"expected_verdict": "reject",
"expected_rules": [
"Eicar-Test-Signature"
],
"description": "并发压测占位 #4",
"_scan_verdict": "suspicious"
},
{
"filename": "L1-014_concurrent_eicar_05.txt",
"case_id": "L1-014-05",
"category": "L1",
"expected_verdict": "reject",
"expected_rules": [
"Eicar-Test-Signature"
],
"description": "并发压测占位 #5",
"_scan_verdict": "suspicious"
},
{
"filename": "L1-014_concurrent_eicar_06.txt",
"case_id": "L1-014-06",
"category": "L1",
"expected_verdict": "reject",
"expected_rules": [
"Eicar-Test-Signature"
],
"description": "并发压测占位 #6",
"_scan_verdict": "suspicious"
},
{
"filename": "L1-014_concurrent_eicar_07.txt",
"case_id": "L1-014-07",
"category": "L1",
"expected_verdict": "reject",
"expected_rules": [
"Eicar-Test-Signature"
],
"description": "并发压测占位 #7",
"_scan_verdict": "suspicious"
},
{
"filename": "L1-014_concurrent_eicar_08.txt",
"case_id": "L1-014-08",
"category": "L1",
"expected_verdict": "reject",
"expected_rules": [
"Eicar-Test-Signature"
],
"description": "并发压测占位 #8",
"_scan_verdict": "suspicious"
},
{
"filename": "L1-014_concurrent_eicar_09.txt",
"case_id": "L1-014-09",
"category": "L1",
"expected_verdict": "reject",
"expected_rules": [
"Eicar-Test-Signature"
],
"description": "并发压测占位 #9",
"_scan_verdict": "suspicious"
},
{
"filename": "L1-014_concurrent_test.txt",
"case_id": "L1-014",
"category": "L1",
"expected_verdict": "review",
"expected_rules": [],
"description": "并发压测占位（靠 API 并发调用）",
"_scan_verdict": "clean"
},
{
"filename": "L1-015_layer_off_sample.bin",
"case_id": "L1-015",
"category": "L1",
"expected_verdict": "review",
"expected_rules": [
"DangerousExecutableExtension",
"Eicar-Test-Signature",
"ExtensionMismatch",
"PeParseFailed"
],
"description": "关闭分层开关测试占位",
"_scan_verdict": "reject"
},
{
"filename": "L3-001_001_sample.ps1",
"case_id": "L3-001",
"category": "L3",
"expected_verdict": "reject",
"expected_rules": [
"DangerousExecutableExtension",
"RemoteDownloadPowerShell",
"SuspiciousScript"
],
"description": "PS1明文：Invoke-WebRequest下载",
"_scan_verdict": "malicious"
},
{
"filename": "L3-002_002_sample.ps1",
"case_id": "L3-002",
"category": "L3",
"expected_verdict": "reject",
"expected_rules": [
"C7_Linux_ReverseShell_NC",
"DangerousExecutableExtension",
"ReverseShellNetcat"
],
"description": "PS1明文：反弹shell nc",
"_scan_verdict": "malicious"
},
{
"filename": "L3-003_003_sample.bat",
"case_id": "L3-003",
"category": "L3",
"expected_verdict": "reject",
"expected_rules": [
"DangerousExecutableExtension",
"RemoteDownloadUnix"
],
"description": "bat明文：curl下载payload",
"_scan_verdict": "suspicious"
},
{
"filename": "L3-004_004_sample.txt",
"case_id": "L3-004",
"category": "L3",
"expected_verdict": "reject",
"expected_rules": [
"CredentialStealer"
],
"description": "文本包含mimikatz关键字",
"_scan_verdict": "suspicious"
},
{
"filename": "L3-005_005_sample.txt",
"case_id": "L3-005",
"category": "L3",
"expected_verdict": "reject",
"expected_rules": [
"CredentialExport"
],
"description": "文本包含reg save导出注册表",
"_scan_verdict": "suspicious"
},
{
"filename": "L3-006_006_sample.txt",
"case_id": "L3-006",
"category": "L3",
"expected_verdict": "review",
"expected_rules": [
"RemoteSessionHijack"
],
"description": "文本包含rdp、tscon劫持关键字",
"_scan_verdict": "suspicious"
},
{
"filename": "L3-007_007_sample.txt",
"case_id": "L3-007",
"category": "L3",
"expected_verdict": "pass",
"expected_rules": [],
"description": "高危串base64编码放在txt",
"_scan_verdict": "clean"
},
{
"filename": "L3-008_008_sample.ps1",
"case_id": "L3-008",
"category": "L3",
"expected_verdict": "pass",
"expected_rules": [
"DangerousExecutableExtension"
],
"description": "Powershell字符串拆分拼接绕过",
"_scan_verdict": "suspicious"
},
{
"filename": "L3-009_newline_split.txt",
"case_id": "L3-009",
"category": "L3",
"expected_verdict": "review",
"expected_rules": [],
"description": "换行分割绕过（L3 不做换行合并，记录边界）",
"_scan_verdict": "clean"
},
{
"filename": "L3-010_010_sample.ps1",
"case_id": "L3-010",
"category": "L3",
"expected_verdict": "review",
"expected_rules": [
"DangerousExecutableExtension"
],
"description": "高危串插入注释分割（powershell #注释）",
"_scan_verdict": "suspicious"
},
{
"filename": "L3-011_011_sample.js",
"case_id": "L3-011",
"category": "L3",
"expected_verdict": "review",
"expected_rules": [
"DangerousExecutableExtension",
"RemoteDownloadUnix"
],
"description": "高危串放js脚本内",
"_scan_verdict": "suspicious"
},
{
"filename": "L3-012_012_sample.bat",
"case_id": "L3-012",
"category": "L3",
"expected_verdict": "review",
"expected_rules": [
"DangerousExecutableExtension",
"RemoteDownloadUnix"
],
"description": "正常内网运维curl（白名单对照）",
"_scan_verdict": "suspicious"
},
{
"filename": "L3-013_normal_scp.sh",
"case_id": "L3-013",
"category": "L3",
"expected_verdict": "pass",
"expected_rules": [
"DangerousExecutableExtension"
],
"description": "内网正常 scp 运维脚本，不误报",
"_scan_verdict": "suspicious"
},
{
"filename": "L3-014_l3001_in_zip.zip",
"case_id": "L3-014",
"category": "L3",
"expected_verdict": "review",
"expected_rules": [
"ArchiveContainsExecutable",
"RemoteDownloadPowerShell"
],
"description": "高危字符串放在zip内部txt",
"_scan_verdict": "malicious"
},
{
"filename": "L3-015_keyword_in_docx.docx",
"case_id": "L3-015",
"category": "L3",
"expected_verdict": "review",
"expected_rules": [
"RemoteDownloadPowerShell"
],
"description": "高危字符串放在docx文本正文",
"_scan_verdict": "suspicious"
},
{
"filename": "L3-016_016_sample.ps1",
"case_id": "L3-016",
"category": "L3",
"expected_verdict": "pass",
"expected_rules": [
"DangerousExecutableExtension"
],
"description": "空脚本文件（负样本）",
"_scan_verdict": "suspicious"
},
{
"filename": "L3-017_017_sample.txt",
"case_id": "L3-017",
"category": "L3",
"expected_verdict": "review",
"expected_rules": [
"CredentialStealer",
"ReverseShellNetcat"
],
"description": "多条高危特征同文件复合",
"_scan_verdict": "malicious"
},
{
"filename": "L3-018_018_sample.txt",
"case_id": "L3-018",
"category": "L3",
"expected_verdict": "review",
"expected_rules": [
"RemoteDownloadPowerShell"
],
"description": "高危字符串大小写混写",
"_scan_verdict": "suspicious"
},
{
"filename": "L3-019_unicode_obfuscated.txt",
"case_id": "L3-019",
"category": "L3",
"expected_verdict": "pass",
"expected_rules": [],
"description": "同形字混淆，L3 默认不命中",
"_scan_verdict": "clean"
},
{
"filename": "L3-020_log_with_keyword.log",
"case_id": "L3-020",
"category": "L3",
"expected_verdict": "reject",
"expected_rules": [
"C7_Linux_ReverseShell_NC",
"ReverseShellNetcat"
],
"description": "日志文件混杂正常日志+高危串",
"_scan_verdict": "reject"
},
{
"filename": "L3-021_021_sample.eml",
"case_id": "L3-021",
"category": "L3",
"expected_verdict": "review",
"expected_rules": [
"RemoteDownloadPowerShell"
],
"description": "高危字符串放在eml邮件正文",
"_scan_verdict": "suspicious"
},
{
"filename": "L3-022_layer_off_sample.bin",
"case_id": "L3-022",
"category": "L3",
"expected_verdict": "review",
"expected_rules": [
"DangerousExecutableExtension",
"ExtensionMismatch",
"PeParseFailed",
"RemoteDownloadPowerShell"
],
"description": "关闭分层开关测试占位",
"_scan_verdict": "reject"
},
{
"filename": "L3-023_keyword_in_encrypted.zip",
"case_id": "L3-023",
"category": "L3",
"expected_verdict": "review",
"expected_rules": [
"CredentialStealer"
],
"description": "加密 zip 内容无法扫描（标记）",
"_scan_verdict": "suspicious"
},
{
"filename": "L3-024_024_sample.txt",
"case_id": "L3-024",
"category": "L3",
"expected_verdict": "review",
"expected_rules": [
"RemoteDownloadPowerShell"
],
"description": "超长单行文本（10万字符）包含高危串",
"_scan_verdict": "suspicious"
},
{
"filename": "L3-025_whitelist_test.txt",
"case_id": "L3-025",
"category": "L3",
"expected_verdict": "review",
"expected_rules": [
"RemoteDownloadPowerShell"
],
"description": "内网白名单域名对照（策略层白名单）",
"_scan_verdict": "suspicious"
},
{
"filename": "L4-001_001_sample.txt",
"case_id": "L4-001",
"category": "L4",
"expected_verdict": "review",
"expected_rules": [],
"description": "YARA正向命中占位（需对应规则）",
"_scan_verdict": "clean"
},
{
"filename": "L4-002_002_sample.txt",
"case_id": "L4-002",
"category": "L4",
"expected_verdict": "pass",
"expected_rules": [],
"description": "干净对照",
"_scan_verdict": "clean"
},
{
"filename": "L4-003_pe_with_string.exe",
"case_id": "L4-003",
"category": "L4",
"expected_verdict": "review",
"expected_rules": [
"DangerousExecutableExtension",
"PEArchInfo",
"SuspiciousTimestamp",
"UnsignedExecutable"
],
"description": "二进制内嵌匹配字符串",
"_scan_verdict": "malicious"
},
{
"filename": "L4-004_multi_rule_match.txt",
"case_id": "L4-004",
"category": "L4",
"expected_verdict": "review",
"expected_rules": [],
"description": "同一个文件同时命中多条 YARA",
"_scan_verdict": "clean"
},
{
"filename": "L4-005_005_sample.txt",
"case_id": "L4-005",
"category": "L4",
"expected_verdict": "review",
"expected_rules": [],
"description": "热加载测试占位",
"_scan_verdict": "clean"
},
{
"filename": "L4-006_bad_syntax_rule.yar",
"case_id": "L4-006",
"category": "L4",
"expected_verdict": "review",
"expected_rules": [
"ExtensionMismatch"
],
"description": "语法错误 YARA 规则文件（输入给规则目录）",
"_scan_verdict": "reject"
},
{
"filename": "L4-007_meta_rule_match.txt",
"case_id": "L4-007",
"category": "L4",
"expected_verdict": "review",
"expected_rules": [],
"description": "带 meta 的 YARA 规则匹配",
"_scan_verdict": "clean"
},
{
"filename": "L4-008_in_zip.zip",
"case_id": "L4-008",
"category": "L4",
"expected_verdict": "review",
"expected_rules": [],
"description": "压缩包内文件匹配YARA规则",
"_scan_verdict": "clean"
},
{
"filename": "L4-009_yara_in_encrypted.zip",
"case_id": "L4-009",
"category": "L4",
"expected_verdict": "pass",
"expected_rules": [],
"description": "加密 zip 内 YARA 样本",
"_scan_verdict": "clean"
},
{
"filename": "L4-010_010_sample.txt",
"case_id": "L4-010",
"category": "L4",
"expected_verdict": "review",
"expected_rules": [],
"description": "正则 YARA 测试占位",
"_scan_verdict": "clean"
},
{
"filename": "L4-011_count_condition.txt",
"case_id": "L4-011",
"category": "L4",
"expected_verdict": "review",
"expected_rules": [],
"description": "YARA count > 3 条件",
"_scan_verdict": "clean"
},
{
"filename": "L4-012_size_condition.bin",
"case_id": "L4-012",
"category": "L4",
"expected_verdict": "review",
"expected_rules": [
"DangerousExecutableExtension",
"ExtensionMismatch",
"PeParseFailed"
],
"description": "YARA 文件大小条件",
"_scan_verdict": "reject"
},
{
"filename": "L4-013_bigfile_yara.txt",
"case_id": "L4-013",
"category": "L4",
"expected_verdict": "review",
"expected_rules": [],
"description": "100MB 文件 YARA 扫描",
"_scan_verdict": "clean"
},
{
"filename": "L4-014_layer_off_sample.bin",
"case_id": "L4-014",
"category": "L4",
"expected_verdict": "review",
"expected_rules": [
"DangerousExecutableExtension",
"ExtensionMismatch",
"PeParseFailed"
],
"description": "关闭分层开关测试占位",
"_scan_verdict": "reject"
},
{
"filename": "L4-015_hash_whitelist.txt",
"case_id": "L4-015",
"category": "L4",
"expected_verdict": "pass",
"expected_rules": [],
"description": "MD5 在白名单",
"_scan_verdict": "clean"
},
{
"filename": "L5-001_clean_hello.exe",
"case_id": "L5-001",
"category": "L5",
"expected_verdict": "pass",
"expected_rules": [
"DangerousExecutableExtension",
"PeParseFailed"
],
"description": "原生干净HelloWorld PE（无壳）",
"_scan_verdict": "suspicious"
},
{
"filename": "L5-002_upx_shell.exe",
"case_id": "L5-002",
"category": "L5",
"expected_verdict": "review",
"expected_rules": [
"DangerousExecutableExtension",
"PeParseFailed"
],
"description": "UPX0/UPX1 节名",
"_scan_verdict": "suspicious"
},
{
"filename": "L5-003_double_upx.exe",
"case_id": "L5-003",
"category": "L5",
"expected_verdict": "review",
"expected_rules": [
"DangerousExecutableExtension",
"PeParseFailed"
],
"description": "UPX加壳PE，二次压缩",
"_scan_verdict": "suspicious"
},
{
"filename": "L5-004_rwx_section.exe",
"case_id": "L5-004",
"category": "L5",
"expected_verdict": "reject",
"expected_rules": [
"DangerousExecutableExtension",
"PeParseFailed"
],
"description": "节属性 RWX",
"_scan_verdict": "suspicious"
},
{
"filename": "L5-005_injection_imports.exe",
"case_id": "L5-005",
"category": "L5",
"expected_verdict": "review",
"expected_rules": [
"DangerousExecutableExtension",
"PEArchInfo",
"SuspiciousTimestamp",
"UnsignedExecutable"
],
"description": "注入组合导入占位样本（928B 假 PE，实际没有导入表）。旧策略靠 载体45+时间戳20+未签名10+架构10 累加到 85 才判 reject，属于权重堆叠误报；权重收紧后应停在人工复核。真实注入器由 YARA C1_PE_ProcessInjection(critical=85) 直接拦截。",
"_scan_verdict": "malicious"
},
{
"filename": "L5-006_single_virtualalloc.exe",
"case_id": "L5-006",
"category": "L5",
"expected_verdict": "review",
"expected_rules": [
"DangerousExecutableExtension",
"PEArchInfo",
"SuspiciousTimestamp",
"UnsignedExecutable"
],
"description": "单一可疑内存 API",
"_scan_verdict": "malicious"
},
{
"filename": "L5-007_garbage_section.exe",
"case_id": "L5-007",
"category": "L5",
"expected_verdict": "review",
"expected_rules": [
"DangerousExecutableExtension",
"PeParseFailed"
],
"description": "节名乱码",
"_scan_verdict": "suspicious"
},
{
"filename": "L5-008_many_exports.exe",
"case_id": "L5-008",
"category": "L5",
"expected_verdict": "review",
"expected_rules": [
"DangerousExecutableExtension",
"PEArchInfo",
"SuspiciousTimestamp",
"UnsignedExecutable"
],
"description": "导出表异常（需真实工具生成）",
"_scan_verdict": "malicious"
},
{
"filename": "L5-009_shell_in_resource.exe",
"case_id": "L5-009",
"category": "L5",
"expected_verdict": "review",
"expected_rules": [
"DangerousExecutableExtension",
"PEArchInfo",
"SuspiciousTimestamp",
"UnsignedExecutable"
],
"description": "资源段内嵌字符串（占位）",
"_scan_verdict": "malicious"
},
{
"filename": "L5-010_bad_mz.exe",
"case_id": "L5-010",
"category": "L5",
"expected_verdict": "review",
"expected_rules": [
"DangerousExecutableExtension",
"ExtensionMismatch",
"PeParseFailed"
],
"description": "PE 头非法",
"_scan_verdict": "reject"
},
{
"filename": "L5-011_truncated.exe",
"case_id": "L5-011",
"category": "L5",
"expected_verdict": "review",
"expected_rules": [
"DangerousExecutableExtension",
"PeParseFailed"
],
"description": "截断 PE",
"_scan_verdict": "suspicious"
},
{
"filename": "L5-012_pe32.exe",
"case_id": "L5-012",
"category": "L5",
"expected_verdict": "pass",
"expected_rules": [
"DangerousExecutableExtension",
"PeParseFailed"
],
"description": "32 位识别",
"_scan_verdict": "suspicious"
},
{
"filename": "L5-013_pe64.exe",
"case_id": "L5-013",
"category": "L5",
"expected_verdict": "pass",
"expected_rules": [
"DangerousExecutableExtension",
"PeParseFailed"
],
"description": "64 位识别占位",
"_scan_verdict": "suspicious"
},
{
"filename": "L5-014_clean_tool.exe",
"case_id": "L5-014",
"category": "L5",
"expected_verdict": "pass",
"expected_rules": [
"DangerousExecutableExtension",
"PeParseFailed"
],
"description": "PE导入表大量系统API（正常工具）",
"_scan_verdict": "suspicious"
},
{
"filename": "L5-015_bad_reloc.exe",
"case_id": "L5-015",
"category": "L5",
"expected_verdict": "review",
"expected_rules": [
"DangerousExecutableExtension",
"PEArchInfo",
"SuspiciousTimestamp",
"UnsignedExecutable"
],
"description": "重定位表损坏占位",
"_scan_verdict": "malicious"
},
{
"filename": "L5-016_zero_section.exe",
"case_id": "L5-016",
"category": "L5",
"expected_verdict": "review",
"expected_rules": [
"DangerousExecutableExtension",
"PeParseFailed"
],
"description": "零节 PE 占位",
"_scan_verdict": "suspicious"
},
{
"filename": "L5-016_zero_sections.exe",
"case_id": "L5-016",
"category": "L5",
"expected_verdict": "review",
"expected_rules": [
"DangerousExecutableExtension",
"PEArchInfo",
"SuspiciousTimestamp",
"UnsignedExecutable"
],
"description": "无节表最小 PE",
"_scan_verdict": "malicious"
},
{
"filename": "L5-017_upx_rwx.exe",
"case_id": "L5-017",
"category": "L5",
"expected_verdict": "review",
"expected_rules": [
"DangerousExecutableExtension",
"PeParseFailed"
],
"description": "UPX壳 + RWX节复合特征",
"_scan_verdict": "suspicious"
},
{
"filename": "L5-018_debug_info.exe",
"case_id": "L5-018",
"category": "L5",
"expected_verdict": "review",
"expected_rules": [
"DangerousExecutableExtension",
"PeParseFailed"
],
"description": "调试信息占位",
"_scan_verdict": "suspicious"
},
{
"filename": "L5-019_200mb_huge.exe",
"case_id": "L5-019",
"category": "L5",
"expected_verdict": "pass",
"expected_rules": [
"DangerousExecutableExtension",
"PeParseFailed"
],
"description": "200MB 超大 PE（占位，真实生成会写满磁盘）",
"_scan_verdict": "suspicious"
},
{
"filename": "L5-020_layer_off_sample.bin",
"case_id": "L5-020",
"category": "L5",
"expected_verdict": "review",
"expected_rules": [
"DangerousExecutableExtension",
"ExtensionMismatch",
"PEArchInfo",
"RWXSectionDetected",
"SuspiciousTimestamp",
"UnsignedExecutable"
],
"description": "关闭分层开关测试占位",
"_scan_verdict": "reject"
},
{
"filename": "NEG-001_clean.jpg",
"case_id": "NEG-001",
"category": "NEG",
"expected_verdict": "pass",
"expected_rules": [],
"description": "业务标准JPG图片",
"_scan_verdict": "clean"
},
{
"filename": "NEG-002_clean.png",
"case_id": "NEG-002",
"category": "NEG",
"expected_verdict": "pass",
"expected_rules": [],
"description": "业务PNG图片",
"_scan_verdict": "clean"
},
{
"filename": "NEG-003_clean.mp4",
"case_id": "NEG-003",
"category": "NEG",
"expected_verdict": "pass",
"expected_rules": [],
"description": "业务MP4视频",
"_scan_verdict": "clean"
},
{
"filename": "NEG-004_clean.docx",
"case_id": "NEG-004",
"category": "NEG",
"expected_verdict": "pass",
"expected_rules": [],
"description": "业务正常docx报表",
"_scan_verdict": "clean"
},
{
"filename": "NEG-005_clean.xlsx",
"case_id": "NEG-005",
"category": "NEG",
"expected_verdict": "pass",
"expected_rules": [],
"description": "业务正常xlsx表格",
"_scan_verdict": "clean"
},
{
"filename": "NEG-006_clean.pdf",
"case_id": "NEG-006",
"category": "NEG",
"expected_verdict": "pass",
"expected_rules": [
"MalformedStructure",
"PdfParseFailed"
],
"description": "业务正常PDF报告",
"_scan_verdict": "suspicious"
},
{
"filename": "NEG-007_clean.java",
"case_id": "NEG-007",
"category": "NEG",
"expected_verdict": "pass",
"expected_rules": [],
"description": "业务源码java文件",
"_scan_verdict": "reject"
},
{
"filename": "NEG-008_clean.py",
"case_id": "NEG-008",
"category": "NEG",
"expected_verdict": "pass",
"expected_rules": [
"DangerousExecutableExtension"
],
"description": "业务源码python脚本",
"_scan_verdict": "suspicious"
},
{
"filename": "NEG-009_clean.zip",
"case_id": "NEG-009",
"category": "NEG",
"expected_verdict": "pass",
"expected_rules": [],
"description": "正常业务压缩包zip",
"_scan_verdict": "clean"
},
{
"filename": "NEG-010_clean.exe",
"case_id": "NEG-010",
"category": "NEG",
"expected_verdict": "pass",
"expected_rules": [
"DangerousExecutableExtension",
"PeParseFailed"
],
"description": "正常业务安装包（干净开源）",
"_scan_verdict": "suspicious"
},
{
"filename": "NEG-011_clean.log",
"case_id": "NEG-011",
"category": "NEG",
"expected_verdict": "pass",
"expected_rules": [],
"description": "正常日志文件",
"_scan_verdict": "reject"
},
{
"filename": "NEG-012_clean.csv",
"case_id": "NEG-012",
"category": "NEG",
"expected_verdict": "pass",
"expected_rules": [],
"description": "正常csv业务数据文件",
"_scan_verdict": "clean"
},
{
"filename": "NEG-013_clean.eml",
"case_id": "NEG-013",
"category": "NEG",
"expected_verdict": "pass",
"expected_rules": [],
"description": "正常eml业务邮件（无附件、无外联恶意）",
"_scan_verdict": "clean"
},
{
"filename": "NEG-014_clean.dll",
"case_id": "NEG-014",
"category": "NEG",
"expected_verdict": "pass",
"expected_rules": [
"DangerousExecutableExtension",
"PeParseFailed"
],
"description": "正常dll（系统干净dll）",
"_scan_verdict": "suspicious"
},
{
"filename": "NEG-015_clean.ttf",
"case_id": "NEG-015",
"category": "NEG",
"expected_verdict": "pass",
"expected_rules": [],
"description": "正常字体文件ttf",
"_scan_verdict": "reject"
},
{
"filename": "NEG-016_clean.dwg",
"case_id": "NEG-016",
"category": "NEG",
"expected_verdict": "pass",
"expected_rules": [],
"description": "正常CAD图纸",
"_scan_verdict": "reject"
},
{
"filename": "NEG-017_4layer_nested.zip",
"case_id": "NEG-017",
"category": "NEG",
"expected_verdict": "pass",
"expected_rules": [
"ArchiveBroken",
"MalformedStructure"
],
"description": "多层嵌套干净zip（无风险）",
"_scan_verdict": "suspicious"
},
{
"filename": "NEG-018_clean.bat",
"case_id": "NEG-018",
"category": "NEG",
"expected_verdict": "pass",
"expected_rules": [
"DangerousExecutableExtension"
],
"description": "正常bat运维脚本（内网备份）",
"_scan_verdict": "suspicious"
},
{
"filename": "NEG-019_clean.ps1",
"case_id": "NEG-019",
"category": "NEG",
"expected_verdict": "pass",
"expected_rules": [
"DangerousExecutableExtension"
],
"description": "正常ps1运维脚本（内网查询）",
"_scan_verdict": "suspicious"
},
{
"filename": "NEG-020_clean.odt",
"case_id": "NEG-020",
"category": "NEG",
"expected_verdict": "pass",
"expected_rules": [],
"description": "正常odt文档",
"_scan_verdict": "reject"
},
{
"filename": "broken.zip",
"case_id": "L7-001",
"category": "L7",
"expected_verdict": "clean",
"expected_rules": [],
"description": "损坏 ZIP",
"_scan_verdict": "clean"
},
{
"filename": "evil.iso",
"case_id": "L7-002",
"category": "L7",
"expected_verdict": "suspicious",
"expected_rules": [
"DangerousExecutableExtension"
],
"description": "恶意 ISO 镜像",
"_scan_verdict": "suspicious"
},
{
"filename": "evil_help.chm",
"case_id": "L7-003",
"category": "L7",
"expected_verdict": "malicious",
"expected_rules": [
"ChmWithScript",
"DangerousExecutableExtension",
"RemoteDownloadUnix"
],
"description": "含脚本 CHM 帮助",
"_scan_verdict": "malicious"
},
{
"filename": "linux_malicious",
"case_id": "L7-004",
"category": "L7",
"expected_verdict": "malicious",
"expected_rules": [
"C7_Linux_ReverseShell_Bash",
"LinuxExecutable",
"ReverseShellNetcat"
],
"description": "Linux 恶意脚本集",
"_scan_verdict": "malicious"
},
{
"filename": "lolbin.cmd",
"case_id": "L7-005",
"category": "L7",
"expected_verdict": "suspicious",
"expected_rules": [
"CommandExecutionObfuscated",
"DangerousExecutableExtension"
],
"description": "LOLBin cmd 混淆",
"_scan_verdict": "suspicious"
},
{
"filename": "macro_alert.docm",
"case_id": "L7-006",
"category": "L7",
"expected_verdict": "malicious",
"expected_rules": [
"RemoteDownloadPowerShell",
"RemoteDownloadUnix",
"VBAAutoExecShell"
],
"description": "含 VBA 宏 DOCM",
"_scan_verdict": "malicious"
},
{
"filename": "malicious.desktop",
"case_id": "L7-007",
"category": "L7",
"expected_verdict": "malicious",
"expected_rules": [
"C7_Linux_ReverseShell_Bash",
"C7_Linux_ReverseShell_Misc",
"DangerousExecutableExtension",
"DesktopFileAutoExec",
"ReverseShellNetcat"
],
"description": "恶意 .desktop 反序列化",
"_scan_verdict": "malicious"
},
{
"filename": "malicious.pdf",
"case_id": "L7-008",
"category": "L7",
"expected_verdict": "malicious",
"expected_rules": [
"PdfJavaScript",
"PdfOpenAction"
],
"description": "含 JS/Action PDF",
"_scan_verdict": "malicious"
},
{
"filename": "miner_config.json",
"case_id": "L7-009",
"category": "L7",
"expected_verdict": "suspicious",
"expected_rules": [
"C7_Linux_Miner_Generic"
],
"description": "挖矿配置文件",
"_scan_verdict": "suspicious"
},
{
"filename": "neg_tmp1.zip",
"case_id": "L7-035",
"category": "L7",
"expected_verdict": "clean",
"expected_rules": [],
"description": "占位残留 tmp zip",
"_scan_verdict": "clean"
},
{
"filename": "normal.pdf",
"case_id": "L7-010",
"category": "L7",
"expected_verdict": "clean",
"expected_rules": [],
"description": "干净 PDF 对照",
"_scan_verdict": "clean"
},
{
"filename": "normal_deploy.sh",
"case_id": "L7-011",
"category": "L7",
"expected_verdict": "suspicious",
"expected_rules": [
"DangerousExecutableExtension"
],
"description": "运维部署脚本（误报）",
"_scan_verdict": "suspicious"
},
{
"filename": "normal_readme.txt",
"case_id": "L7-012",
"category": "L7",
"expected_verdict": "clean",
"expected_rules": [],
"description": "干净 README 对照",
"_scan_verdict": "clean"
},
{
"filename": "normal_report.docx",
"case_id": "L7-013",
"category": "L7",
"expected_verdict": "clean",
"expected_rules": [],
"description": "干净 DOCX 对照",
"_scan_verdict": "clean"
},
{
"filename": "ole_dropper.doc",
"case_id": "L7-014",
"category": "L7",
"expected_verdict": "suspicious",
"expected_rules": [
"OleToolsUnavailable",
"RemoteSessionHijack"
],
"description": "OLE 投递 DOC",
"_scan_verdict": "suspicious"
},
{
"filename": "pe_downloader.exe",
"case_id": "L7-015",
"category": "L7",
"expected_verdict": "malicious",
"expected_rules": [
"C1_PE_Downloader_Loader",
"DangerousExecutableExtension",
"PeParseFailed"
],
"description": "PE 下载木马",
"_scan_verdict": "malicious"
},
{
"filename": "pe_injection.exe",
"case_id": "L7-016",
"category": "L7",
"expected_verdict": "malicious",
"expected_rules": [
"C1_PE_ProcessInjection",
"DangerousExecutableExtension",
"PeParseFailed",
"RemoteSessionHijack"
],
"description": "PE 注入程序",
"_scan_verdict": "malicious"
},
{
"filename": "persist_cron.sh",
"case_id": "L7-017",
"category": "L7",
"expected_verdict": "malicious",
"expected_rules": [
"C7_Linux_Persistence_Crontab",
"DangerousExecutableExtension",
"RemoteDownloadUnix",
"ShellScriptDangerous",
"Txt.Malware.Sustes-6779550-1"
],
"description": "Crontab 持久化脚本",
"_scan_verdict": "malicious"
},
{
"filename": "phishing.eml",
"case_id": "L7-018",
"category": "L7",
"expected_verdict": "reject",
"expected_rules": [
"EmailAttachmentDangerous",
"EmailAttachmentDisguised",
"EmailAttachmentWebshell",
"EmailPhishingKeyword"
],
"description": "钓鱼邮件 EML",
"_scan_verdict": "reject"
},
{
"filename": "photo.jpg.php",
"case_id": "L7-019",
"category": "L7",
"expected_verdict": "reject",
"expected_rules": [
"DangerousExecutableExtension"
],
"description": "双扩展名伪装 .jpg.php",
"_scan_verdict": "reject"
},
{
"filename": "ransom_dropper.exe.txt",
"case_id": "L7-020",
"category": "L7",
"expected_verdict": "reject",
"expected_rules": [
"C8_Ransomware_Encryption",
"C8_Ransomware_Note_Filename",
"C8_Ransomware_VolumeShadow",
"DoubleExtension"
],
"description": "勒索软件投递器",
"_scan_verdict": "reject"
},
{
"filename": "sealed.docx",
"case_id": "L7-021",
"category": "L7",
"expected_verdict": "reject",
"expected_rules": [
"ArchiveBroken",
"MalformedStructure",
"OfficeEncrypted",
"OoxmlParseFailed"
],
"description": "加密 DOCX（被视为损坏）",
"_scan_verdict": "reject"
},
{
"filename": "sealed.xlsx",
"case_id": "L7-022",
"category": "L7",
"expected_verdict": "reject",
"expected_rules": [
"ArchiveBroken",
"ExtensionMismatch",
"MalformedStructure",
"OfficeEncrypted",
"OoxmlParseFailed"
],
"description": "加密 XLSX（被视为损坏）",
"_scan_verdict": "reject"
},
{
"filename": "shell_aspx.aspx",
"case_id": "L7-023",
"category": "L7",
"expected_verdict": "reject",
"expected_rules": [
"DangerousExecutableExtension"
],
"description": "ASPX 一句话木马",
"_scan_verdict": "reject"
},
{
"filename": "shell_bash_devtcp.sh",
"case_id": "L7-024",
"category": "L7",
"expected_verdict": "malicious",
"expected_rules": [
"C7_Linux_ReverseShell_Bash",
"DangerousExecutableExtension",
"ReverseShellNetcat",
"ShellScriptDangerous"
],
"description": "Bash /dev/tcp 反弹",
"_scan_verdict": "malicious"
},
{
"filename": "shell_jsp_runtime.jsp",
"case_id": "L7-025",
"category": "L7",
"expected_verdict": "reject",
"expected_rules": [
"C3_JSP_Webshell_RuntimeExec",
"DangerousExecutableExtension"
],
"description": "JSP Runtime exec 木马",
"_scan_verdict": "reject"
},
{
"filename": "shell_nc.sh",
"case_id": "L7-026",
"category": "L7",
"expected_verdict": "malicious",
"expected_rules": [
"C7_Linux_ReverseShell_NC",
"DangerousExecutableExtension",
"ReverseShellNetcat",
"ShellScriptDangerous"
],
"description": "NC 反弹 Shell",
"_scan_verdict": "malicious"
},
{
"filename": "shell_php_eval.php",
"case_id": "L7-027",
"category": "L7",
"expected_verdict": "reject",
"expected_rules": [
"C3_PHP_Webshell_Oneliner",
"DangerousExecutableExtension"
],
"description": "PHP eval 一句话木马",
"_scan_verdict": "reject"
},
{
"filename": "shell_php_obf.php",
"case_id": "L7-028",
"category": "L7",
"expected_verdict": "reject",
"expected_rules": [
"C3_PHP_Webshell_Obfuscated",
"DangerousExecutableExtension"
],
"description": "PHP 混淆木马",
"_scan_verdict": "reject"
},
{
"filename": "shell_python.py",
"case_id": "L7-029",
"category": "L7",
"expected_verdict": "suspicious",
"expected_rules": [
"DangerousExecutableExtension"
],
"description": "Python 反弹脚本",
"_scan_verdict": "suspicious"
},
{
"filename": "shortcut.lnk",
"case_id": "L7-030",
"category": "L7",
"expected_verdict": "suspicious",
"expected_rules": [
"DangerousExecutableExtension",
"RemoteDownloadUnix"
],
"description": "恶意 .lnk 快捷方式",
"_scan_verdict": "suspicious"
},
{
"filename": "template_backdoor.docx",
"case_id": "L7-031",
"category": "L7",
"expected_verdict": "malicious",
"expected_rules": [
"AttachedTemplate"
],
"description": "模板后门 DOCX",
"_scan_verdict": "malicious"
},
{
"filename": "vba_autoexec.bas",
"case_id": "L7-032",
"category": "L7",
"expected_verdict": "malicious",
"expected_rules": [
"RemoteDownloadUnix",
"VBAAutoExecShell"
],
"description": "VBA AutoOpen 宏",
"_scan_verdict": "malicious"
},
{
"filename": "wps_macro.js",
"case_id": "L7-033",
"category": "L7",
"expected_verdict": "malicious",
"expected_rules": [
"C7_Linux_ReverseShell_Bash",
"C7_Linux_ReverseShell_Misc",
"DangerousExecutableExtension",
"ReverseShellNetcat"
],
"description": "WPS JS 宏",
"_scan_verdict": "malicious"
},
{
"filename": "zip_traversal.zip",
"case_id": "L7-034",
"category": "L7",
"expected_verdict": "malicious",
"expected_rules": [
"PathTraversal",
"PathTraversalBlocked"
],
"description": "ZIP 路径穿越（旧版）",
"_scan_verdict": "malicious"
}
]
}
Reference in New Issue View Git Blame Copy Permalink