zhaolei
2daa3fcd3c
引擎修复: - policy.yaml allowed_extensions 补 .java/.log/.ttf/.dwg/.odt 等 20+ 类型 (白名单 gate 被拒根因) - structure.py SuspiciousImports weight 45→25 (单一 API 不再直接 100 分 malicious) - structure.py 新增 EncryptedArchive 显式检测 (flag_bits bit0=1) - rules/rule_labels.yaml 新增 EncryptedArchive → 加密压缩包 样本修复: - L0-020/021 zip_bomb 重写: DEFLATED 50×50MB/20×20MB → 膨胀比 1027x/1023x ✅ ArchiveBombSuspect reject - L0-030 nested_traversal 重写: 真 ../穿越 + 内层 zip → PathTraversal malicious - L0-024 encrypted 重写: flag_bits bit0=1 → EncryptedArchive suspicious 最终 P0-P2 关键修复项 9/9 通过: ✅ NEG-007 java clean (白名单放行) ✅ NEG-011 log clean (白名单放行) ✅ NEG-015 ttf clean (白名单放行) ✅ NEG-016 dwg clean (白名单放行) ✅ NEG-020 odt clean (白名单放行) ✅ L0-020 zip_bomb reject ArchiveBombSuspect ✅ L0-021 small_bomb reject ArchiveBombSuspect ✅ L0-024 encrypted suspicious EncryptedArchive ✅ L0-030 nested malicious PathTraversal
407 lines
12 KiB
YAML
407 lines
12 KiB
YAML
# ============================================================
|
||
# MeshSafe 全局检测策略
|
||
# 说明：所有裁决逻辑集中在此文件，调整策略无需改动代码。
|
||
# 修改后调用 POST /api/v1/policies/reload 或重启服务生效。
|
||
# ============================================================
|
||
|
||
version: "2026.10.2"
|
||
description: "MeshSafe 默认全局策略（麒麟桌面/UOS x86 + WPS 目标终端）"
|
||
|
||
# ---------- 全局阈值 ----------
|
||
global:
|
||
# 风险分 ≥ 该值直接拒绝
|
||
block_score: 70
|
||
# 风险分落在该区间转人工复核
|
||
review_score: [30, 70]
|
||
# 引擎不可用时的降级策略：fail_closed（拒绝）/ fail_open（放行）
|
||
# 生产环境应为 fail_closed，满足等保"安全优先"要求
|
||
engine_failure_mode: fail_closed
|
||
# 单文件大小上限（字节）—— 与 ClamAV MaxFileSize=1G 对齐，留余量给其他 5 引擎
|
||
max_file_size: 1610612736 # 1.5 GB
|
||
# 同步模式的最大文件大小，超过转异步
|
||
sync_max_size: 536870912 # 512 MB（超过转异步扫描，避免请求超时）
|
||
# 是否允许加密压缩包
|
||
allow_encrypted_archive: false
|
||
# 是否允许加密文档（Office 加密）
|
||
allow_encrypted_document: false
|
||
|
||
# ================================================================
|
||
# 零容忍规则集（独立于评分模型，优先级最高）
|
||
# 命中即 reject，不走评分累加。与 §7.2 步骤 0 对应。
|
||
# ================================================================
|
||
|
||
zero_tolerance_rules:
|
||
# ---- 跨平台通用载体 ----
|
||
- PdfJavaScript # PDF 打开即执行脚本
|
||
- PdfLaunchAction # PDF 打开即启动程序
|
||
- PdfOpenAction # PDF 打开即执行动作
|
||
- PathTraversal # 解包路径穿越
|
||
- IsoWithExecutable # ISO 挂载后内部含可执行
|
||
- MacroObfuscated # 宏代码混淆/加密（意图不可知）
|
||
- AttachedTemplate # Office 外部模板注入
|
||
|
||
# ---- 宏相关（WPS on Linux 生效）----
|
||
- VBAAutoExec # VBA 宏 AutoOpen 自动执行入口
|
||
- VBAAutoExecShell # VBA 宏自动执行 + Shell/CreateObject 调用
|
||
- MRaptorAutoExec # mraptor 判定为自动执行宏
|
||
- MRaptorAutoExecSuspicious # mraptor 判定为可疑自动执行宏
|
||
- DDEAutoExecution # DDE/DDEAUTO 自动执行字段
|
||
- EmbeddedExecutable # 文档内嵌可执行对象
|
||
|
||
# ---- Linux 专属载体 ----
|
||
- LinuxExecutable # ELF 原生二进制
|
||
- DesktopFileAutoExec # .desktop 文件 Exec= 字段含危险命令
|
||
- ShellScriptDangerous # Shell/Python/Perl/Ruby 脚本含危险函数
|
||
- LinuxPortableExecutable # AppImage/Flatpak/Snap 便携包
|
||
- ArchiveContainsLinuxExec # 压缩包内混有 .sh/.deb/.run/.bin
|
||
|
||
# ---- Windows 专属载体（纵深防御）----
|
||
- LnkWithAutoExec # LNK 快捷方式（Linux 不识别，保持检测）
|
||
- ChmWithScript # CHM 帮助文件（Linux 默认不自动执行）
|
||
|
||
# ---------- 文件类型白名单 ----------
|
||
# 只允许这些类型通过。空列表表示不限制（不推荐生产使用）。
|
||
allowed_extensions:
|
||
# --- Office 文档 ---
|
||
- .doc
|
||
- .docx
|
||
- .docm
|
||
- .xls
|
||
- .xlsx
|
||
- .xlsm
|
||
- .ppt
|
||
- .pptx
|
||
- .pptm
|
||
- .rtf
|
||
- .pdf
|
||
- .wps # WPS 文字
|
||
- .et # WPS 表格
|
||
- .dps # WPS 演示
|
||
|
||
# --- 文本与图像 ---
|
||
- .txt
|
||
- .csv
|
||
- .json
|
||
- .xml
|
||
- .yaml
|
||
- .yml
|
||
- .html
|
||
- .htm
|
||
- .md # Markdown（飞书/Notion 导出）
|
||
- .markdown
|
||
- .jpg
|
||
- .jpeg
|
||
- .png
|
||
- .gif
|
||
- .bmp
|
||
- .tiff
|
||
- .svg
|
||
- .webp
|
||
|
||
# --- 音视频 ---
|
||
- .mp4
|
||
- .mov
|
||
- .avi
|
||
- .mkv
|
||
- .wmv
|
||
- .flv
|
||
- .webm
|
||
- .mp3
|
||
- .wav
|
||
- .flac
|
||
- .m4a
|
||
|
||
# --- 脑图/设计 ---
|
||
- .xmind
|
||
- .drawio
|
||
- .vsdx
|
||
- .bpmn
|
||
- .epub
|
||
|
||
# --- 邮件 ---
|
||
- .eml
|
||
- .msg
|
||
|
||
# --- 归档（允许进入后递归扫描）---
|
||
- .zip
|
||
- .rar
|
||
- .7z
|
||
- .tar
|
||
|
||
# --- 业务源码/脚本/数据（业务开发/运维合法上传）---
|
||
- .java
|
||
- .py
|
||
- .js
|
||
- .ts
|
||
- .go
|
||
- .c
|
||
- .cpp
|
||
- .cs
|
||
- .sql
|
||
- .sh
|
||
- .log # 运维日志
|
||
- .ini
|
||
- .cfg
|
||
- .conf
|
||
- .properties
|
||
|
||
# --- 专业文档/素材 ---
|
||
- .odt
|
||
- .ods
|
||
- .odp
|
||
- .ttf # 字体文件
|
||
- .otf
|
||
- .dwg # CAD 图纸
|
||
- .dxf
|
||
- .stl
|
||
- .fbx
|
||
- .step
|
||
- .iges
|
||
- .gz
|
||
- .bz2
|
||
- .xz
|
||
- .iso
|
||
|
||
# --- 可执行与脚本（零容忍规则拦截，此处允许进入裁决流程）---
|
||
# 两层防御：零容忍（步骤 0）先拦截，扩展名白名单（步骤 3）作为兜底
|
||
# 这样策略中临时禁用某个零容忍规则时，文件仍可进入评分裁决
|
||
- .exe
|
||
- .dll
|
||
- .msi
|
||
- .scr
|
||
- .com
|
||
- .elf
|
||
- .so
|
||
- .desktop
|
||
- .appimage
|
||
- .deb
|
||
- .rpm
|
||
- .run
|
||
- .bin
|
||
- .snap
|
||
- .sh
|
||
- .bash
|
||
- .zsh
|
||
- .py
|
||
- .pl
|
||
- .rb
|
||
- .js
|
||
- .vbs
|
||
- .bat
|
||
- .cmd
|
||
- .ps1
|
||
- .hta
|
||
- .lnk
|
||
- .chm
|
||
|
||
# ---------- 需要强制深检的类型 ----------
|
||
# 一期无沙箱，此配置预留。命中这些类型自动转异步。
|
||
sandbox_required_extensions:
|
||
- .exe
|
||
- .msi
|
||
- .iso
|
||
|
||
# ---------- 特定规则的处置覆盖 ----------
|
||
# 仅针对未进入零容忍集的规则。零容忍规则已在上方处理，此处不再覆盖。
|
||
# rule_name: [action, reason_override]
|
||
# action 取值：pass / pass_with_flag / manual_review / reject / reject_and_notify
|
||
rule_overrides:
|
||
VBAShellInvocation:
|
||
action: manual_review
|
||
reason: "宏调用 Shell 但无自动执行入口，需人工复核"
|
||
ArchiveContainsExecutable:
|
||
action: manual_review
|
||
reason: "压缩包内含 Windows 可执行文件，转人工确认（Linux 不识别）"
|
||
ArchiveBombSuspect:
|
||
action: reject
|
||
reason: "压缩比异常，疑似压缩炸弹"
|
||
ExtensionMismatch:
|
||
action: reject
|
||
reason: "声明扩展名与真实类型不一致，疑似伪装"
|
||
DoubleExtension:
|
||
action: reject
|
||
reason: "双扩展名伪装，高风险"
|
||
# ---- 邮件相关 ----
|
||
EmailAttachmentDangerous:
|
||
action: manual_review
|
||
reason: "邮件附件为高风险类型，需人工确认是否为钓鱼/恶意附件"
|
||
EmailAttachmentDisguised:
|
||
action: reject
|
||
reason: "邮件附件存在双扩展名伪装，高风险钓鱼特征"
|
||
EmailPhishingKeyword:
|
||
action: manual_review
|
||
reason: "邮件正文/Subject 命中钓鱼特征，需人工确认"
|
||
# ---- 加密 ----
|
||
OfficeEncrypted:
|
||
action: reject
|
||
reason: "Office 文档已加密，策略禁止加密文档进入内网"
|
||
|
||
# ---------- 通知设置 ----------
|
||
notification:
|
||
# 拒绝时是否返回详细原因给调用方（便于摆渡系统向用户提示）
|
||
include_reason: true
|
||
# 拒绝原因的最大长度
|
||
max_reason_length: 500
|
||
|
||
# ---------- YARA 规则权重映射 ----------
|
||
# 按规则名精细设定权重（0-100），覆盖 binary.py 里的默认 weight=50
|
||
# 命中但不在下列名单中的规则 weight 保持默认值 50
|
||
# 严重度分档由规则内 meta.risk_level 决定（critical/high/medium/low）
|
||
yara_rule_weights:
|
||
critical: # weight=85
|
||
- C3_PHP_Webshell_Oneliner
|
||
- C3_JSP_Webshell_RuntimeExec
|
||
- C3_Webshell_Behinder
|
||
- C1_PE_ProcessInjection
|
||
- C8_Ransomware_Encryption
|
||
- C8_Ransomware_LockBit
|
||
- C8_Ransomware_BlackCat
|
||
- C8_Ransomware_Conti
|
||
- C7_Linux_ReverseShell_Bash
|
||
- C7_Linux_ReverseShell_NC
|
||
- C7_Linux_Rootkit_KernelModule
|
||
high: # weight=65
|
||
- C3_PHP_Webshell_Obfuscated
|
||
- C3_PHP_Webshell_VariableDeformation
|
||
- C3_Webshell_CommandExecutionEcho
|
||
- C3_Webshell_Godzilla
|
||
- C1_PE_Downloader_Loader
|
||
- C1_PE_RAT_CommandControl
|
||
- C1_PE_LOLBin_Usage
|
||
- C1_PE_Mutex_Persistence
|
||
- C7_Linux_ReverseShell_Python
|
||
- C7_Linux_ReverseShell_Perl
|
||
- C7_Linux_ReverseShell_Socat
|
||
- C7_Linux_Persistence_Crontab
|
||
- C7_Linux_Persistence_SystemD
|
||
- C7_Linux_Persistence_AuthorizedKeys
|
||
- C7_Linux_Persistence_LD_PRELOAD
|
||
- C8_Ransomware_VolumeShadow
|
||
- C8_Ransomware_Note_Filename
|
||
- C8_Ransomware_Ryuk_Pseudo
|
||
medium: # weight=45
|
||
- C9_Packer_UPX
|
||
- C9_Packer_Themida_VMP
|
||
- C1_PE_DLLHijacking
|
||
- C1_PE_EntropyHighNetwork
|
||
- C7_Linux_Miner_Generic
|
||
- C7_Misc_Ruby_Lua_ReverseShell
|
||
- C7_Network_Tools_Malicious
|
||
- C3_Webshell_AntSword
|
||
- C3_Webshell_ASPNET
|
||
- C3_Webshell_ASP_Classic
|
||
- C3_JSP_Webshell_Deserialization
|
||
- C3_JSP_Webshell_MemoryShell
|
||
- C3_Webshell_CommandExecutionEcho
|
||
- C8_Ransomware_Extension_Blacklist
|
||
low: # weight=25
|
||
- C7_Linux_ReverseShell_Misc
|
||
|
||
|
||
# ---------- 内网特征词表引擎（P1）----------
|
||
# 规则为数据驱动：在 policy.yaml 中声明，引擎从 PolicyStore 加载。
|
||
# 控制台 P2 可实时修改并热重载。
|
||
# 每条规则字段：
|
||
# name: 规则名（Finding.rule）
|
||
# match: contains | regex | any_of
|
||
# pattern: contains/regex 模式的匹配串
|
||
# keywords: any_of 模式的关键词列表
|
||
# weight: 评分权重（默认 30）
|
||
# severity: low | medium | high | critical（默认 medium）
|
||
# ignore_case: 正则模式是否忽略大小写
|
||
keyword_rules:
|
||
# ---- 内网合规特征（辅助判断，不进零容忍）----
|
||
- name: ClassifiedLevelMarkers
|
||
match: any_of
|
||
keywords: ["绝密", "机密", "秘密", "内部文件", "内部资料", "禁止外传"]
|
||
weight: 25
|
||
severity: low
|
||
|
||
- name: InternalDocumentPatterns
|
||
match: regex
|
||
pattern: "(?:国家机密|涉密|密级[：:]\\s*[一二三四五])"
|
||
ignore_case: true
|
||
weight: 30
|
||
severity: medium
|
||
|
||
# ================================================================
|
||
# 恶意行为特征词表（覆盖 CSV L3 全部 25 条用例）
|
||
# ================================================================
|
||
|
||
# ---- 远程下载执行 ----
|
||
- name: RemoteDownloadPowerShell
|
||
match: regex
|
||
pattern: "(Invoke-WebRequest|Invoke-RestMethod|DownloadString|DownloadFile|Start-BitsTransfer|BitsAdmin)"
|
||
ignore_case: true
|
||
weight: 35
|
||
severity: high
|
||
|
||
- name: RemoteDownloadUnix
|
||
match: regex
|
||
pattern: "(\\bwget\\b|\\bcurl\\b|\\bcertutil\\s+-urlcache\\s+-split|\\bfetch\\b)"
|
||
ignore_case: true
|
||
weight: 30
|
||
severity: high
|
||
|
||
# ---- 反弹 Shell ----
|
||
- name: ReverseShellNetcat
|
||
match: regex
|
||
pattern: "(\\bnc\\b|\\bncat\\b|\\bnetcat\\b|/dev/tcp/|bash\\s+-i\\s+>&|sh\\s+-i\\s+>&)"
|
||
ignore_case: true
|
||
weight: 40
|
||
severity: critical
|
||
|
||
- name: ReverseShellPowershell
|
||
match: regex
|
||
pattern: "(powershell\\s+-enc|powershell\\s+-w\\s+hidden\\s+-enc|powershell\\s+-ExecutionPolicy\\s+Bypass\\s+-enc)"
|
||
ignore_case: true
|
||
weight: 35
|
||
severity: critical
|
||
|
||
# ---- 凭据窃取工具 ----
|
||
- name: CredentialStealer
|
||
match: regex
|
||
pattern: "(mimikatz|sekurlsa|wce|gsecdump|fgdump|lsadump|dcsync|dcsyncer|rubeus)"
|
||
ignore_case: true
|
||
weight: 45
|
||
severity: critical
|
||
|
||
# ---- 凭据导出命令 ----
|
||
- name: CredentialExport
|
||
match: regex
|
||
pattern: "(reg\\s+save\\s+HKLM\\\\SYSTEM|reg\\s+save\\s+HKLM\\\\SAM|reg\\s+export\\s+SAM|reg\\s+export\\s+SYSTEM|hxdump|secretsdump)"
|
||
ignore_case: true
|
||
weight: 45
|
||
severity: critical
|
||
|
||
# ---- 远程会话劫持 ----
|
||
- name: RemoteSessionHijack
|
||
match: regex
|
||
pattern: "(\\btscon\\b|\\brdpclip\\b|\\brdp_shadow\\b|\\bshadow\\s+[0-9]+\\b|CreateRemoteThread)"
|
||
ignore_case: true
|
||
weight: 35
|
||
severity: high
|
||
|
||
# ---- 命令执行混淆 ----
|
||
- name: CommandExecutionObfuscated
|
||
match: regex
|
||
pattern: "(cmd\\s+/c|cmd\\s+/d|certutil\\s+-decode|certutil\\s+-urlcache|\\bmshta\\b|\\bregsvr32\\s+\\/s)"
|
||
ignore_case: true
|
||
weight: 25
|
||
severity: medium
|
||
|
||
# ---- WMI/LDAP 攻击 ----
|
||
- name: WMILdapAttack
|
||
match: regex
|
||
pattern: "(wmic\\s+path|wmic\\s+process\\s+call\\s+create|ldapsearch\\s+-x|ldapwhoami)"
|
||
ignore_case: true
|
||
weight: 30
|
||
severity: high
|
||
|
||
# ---------- 审计 ----------
|
||
audit:
|
||
# 记录扫描结果明细到审计日志
|
||
log_findings: true
|
||
# 是否记录提取到的子文件路径
|
||
log_extracted_paths: true
|