zhaolei
6e3c1a40e5
feat: YARA .yar 规则自动化生成 + 边界记录验证
rules/test_rules.yar (7 条规则):
- Test_ReverseShell_Basic: nc 反弹 shell
- Test_PowerShell_Download: Invoke-WebRequest
- Newly_Added_Rule_Test: 热加载验证
- Meta_Label_Test: metadata 输出验证
- Regex_Shell_Pattern: powershell -enc 正则
- Count_Condition_Test: count >= 3 条件
- Size_Condition_Test: filesize <= 10KB 条件
YARA 命中验证: 7/7 ✅
L4-001 → Test_ReverseShell_Basic + keywords.ReverseShellNetcat 复合命中
L4-004 → Test_ReverseShell_Basic + Test_PowerShell_Download + 3 条关键词
L4-005/007/010/011/012 → 全部命中 ✅
边界记录验证: 4/4 ✅ 全 clean
L1-005 EICAR 1 字节修改 → ClamAV 不命中 ✅
L1-012 EICAR base64 → ClamAV 不解码 ✅
L3-007 高危串 base64 → 关键词不解码 ✅
L3-019 unicode 同形字 → 关键词不还原 ✅
2026-10-29 14:16:37 +08:00
..
2026-10-29 11:44:38 +08:00
2026-10-28 19:07:11 +08:00
2026-10-28 19:07:11 +08:00
2026-10-28 19:07:11 +08:00
2026-10-28 19:07:11 +08:00
2026-10-29 11:51:31 +08:00
2026-10-29 11:33:58 +08:00
2026-10-29 11:33:58 +08:00
2026-10-29 11:44:38 +08:00
2026-10-29 11:33:58 +08:00
2026-10-29 11:44:38 +08:00
2026-10-29 11:33:58 +08:00
2026-10-29 11:33:58 +08:00
2026-10-29 11:33:58 +08:00
2026-10-29 11:33:58 +08:00
2026-10-29 11:33:58 +08:00
2026-10-29 11:33:58 +08:00
2026-10-29 11:33:58 +08:00
2026-10-29 11:33:58 +08:00
2026-10-29 11:33:58 +08:00
2026-10-29 11:33:58 +08:00
2026-10-29 11:33:58 +08:00
2026-10-29 11:33:58 +08:00
2026-10-29 11:44:38 +08:00
2026-10-29 11:44:38 +08:00
2026-10-29 12:02:36 +08:00
2026-10-29 12:02:36 +08:00
2026-10-29 11:44:38 +08:00
2026-10-29 11:44:38 +08:00
2026-10-29 12:02:36 +08:00
2026-10-29 11:44:38 +08:00
2026-10-29 11:44:38 +08:00
2026-10-29 11:44:38 +08:00
2026-10-29 11:44:38 +08:00
2026-10-29 11:33:58 +08:00
2026-10-29 12:02:36 +08:00
2026-10-29 11:33:58 +08:00
2026-10-29 11:44:38 +08:00
2026-10-29 11:44:38 +08:00
2026-10-29 11:44:38 +08:00
2026-10-29 11:33:58 +08:00
2026-10-29 11:36:42 +08:00
2026-10-29 11:36:42 +08:00
2026-10-29 11:44:38 +08:00
2026-10-29 11:33:58 +08:00
2026-10-29 11:36:42 +08:00
2026-10-29 11:36:42 +08:00
2026-10-29 11:36:42 +08:00
2026-10-29 11:36:42 +08:00
2026-10-29 11:36:42 +08:00
2026-10-29 11:36:42 +08:00
2026-10-29 11:36:42 +08:00
2026-10-29 11:36:42 +08:00
2026-10-29 11:36:42 +08:00
2026-10-29 11:36:42 +08:00
2026-10-29 11:36:42 +08:00
2026-10-29 11:36:42 +08:00
2026-10-29 11:36:42 +08:00
2026-10-29 11:33:58 +08:00
2026-10-29 11:33:58 +08:00
2026-10-29 11:33:58 +08:00
2026-10-29 11:33:58 +08:00
2026-10-29 11:33:58 +08:00
2026-10-29 11:33:58 +08:00
2026-10-29 11:33:58 +08:00
2026-10-29 11:33:58 +08:00
2026-10-29 11:36:42 +08:00
2026-10-29 11:33:58 +08:00
2026-10-29 11:33:58 +08:00
2026-10-29 11:33:58 +08:00
2026-10-29 11:36:42 +08:00
2026-10-29 11:44:38 +08:00
2026-10-29 11:44:38 +08:00
2026-10-29 11:33:58 +08:00
2026-10-29 11:33:58 +08:00
2026-10-29 11:33:58 +08:00
2026-10-29 11:33:58 +08:00
2026-10-29 11:33:58 +08:00
2026-10-29 11:36:42 +08:00
2026-10-29 11:44:38 +08:00
2026-10-29 11:33:58 +08:00
2026-10-29 11:36:42 +08:00
2026-10-29 14:16:37 +08:00
2026-10-29 11:33:58 +08:00
2026-10-29 11:44:38 +08:00
2026-10-29 14:16:37 +08:00
2026-10-29 11:33:58 +08:00
2026-10-29 14:16:37 +08:00
2026-10-29 11:36:42 +08:00
2026-10-29 11:36:42 +08:00
2026-10-29 14:16:37 +08:00
2026-10-29 11:44:38 +08:00
2026-10-29 11:44:38 +08:00
2026-10-29 11:33:58 +08:00
2026-10-29 14:16:37 +08:00
2026-10-29 14:16:37 +08:00
2026-10-29 11:36:42 +08:00
2026-10-29 14:16:37 +08:00
2026-10-29 11:36:42 +08:00
2026-10-29 11:36:42 +08:00
2026-10-29 11:36:42 +08:00
2026-10-29 11:44:38 +08:00
2026-10-29 11:44:38 +08:00
2026-10-29 11:44:38 +08:00
2026-10-29 11:44:38 +08:00
2026-10-29 11:44:38 +08:00
2026-10-29 11:44:38 +08:00
2026-10-29 11:44:38 +08:00
2026-10-29 11:44:38 +08:00
2026-10-29 11:44:38 +08:00
2026-10-29 11:33:58 +08:00
2026-10-29 11:33:58 +08:00
2026-10-29 11:44:38 +08:00
2026-10-29 11:44:38 +08:00
2026-10-29 11:44:38 +08:00
2026-10-29 11:44:38 +08:00
2026-10-29 11:44:38 +08:00
2026-10-29 11:44:38 +08:00
2026-10-29 11:44:38 +08:00
2026-10-29 11:44:38 +08:00
2026-10-29 11:36:42 +08:00
2026-10-29 11:44:38 +08:00
2026-10-28 19:07:11 +08:00
2026-10-28 19:07:11 +08:00
2026-10-28 19:07:11 +08:00
2026-10-28 19:07:11 +08:00
2026-10-28 19:07:11 +08:00
2026-10-28 19:07:11 +08:00
2026-10-29 11:33:58 +08:00
2026-10-29 11:33:58 +08:00
2026-10-29 11:33:58 +08:00
2026-10-29 11:33:58 +08:00
2026-10-29 11:44:38 +08:00
2026-10-29 11:44:38 +08:00
2026-10-29 11:33:58 +08:00
2026-10-29 11:33:58 +08:00
2026-10-29 11:33:58 +08:00
2026-10-29 11:44:38 +08:00
2026-10-29 11:33:58 +08:00
2026-10-29 11:33:58 +08:00
2026-10-29 11:33:58 +08:00
2026-10-29 11:33:58 +08:00
2026-10-29 11:33:58 +08:00
2026-10-29 11:33:58 +08:00
2026-10-29 11:33:58 +08:00
2026-10-29 11:33:58 +08:00
2026-10-29 11:33:58 +08:00
2026-10-29 11:44:38 +08:00
2026-10-28 19:07:11 +08:00
2026-10-28 19:07:11 +08:00
2026-10-28 19:07:11 +08:00
2026-10-28 19:07:11 +08:00
2026-10-28 19:07:11 +08:00
2026-10-28 19:07:11 +08:00
2026-10-28 19:07:11 +08:00
2026-10-28 19:07:11 +08:00
2026-10-28 19:07:11 +08:00
2026-10-28 19:07:11 +08:00
2026-10-28 19:07:11 +08:00
2026-10-28 19:07:11 +08:00
2026-10-28 19:07:11 +08:00
2026-10-28 19:07:11 +08:00
2026-10-28 19:07:11 +08:00
2026-10-28 19:07:11 +08:00
2026-10-28 19:07:11 +08:00
2026-10-28 19:07:11 +08:00
2026-10-28 19:07:11 +08:00
2026-10-28 19:07:11 +08:00
2026-10-28 19:07:11 +08:00
2026-10-28 19:07:11 +08:00
2026-10-28 19:07:11 +08:00
2026-10-28 19:07:11 +08:00
2026-10-28 19:07:11 +08:00