MemScan-EDR/rules/injection.yar

/*
 * MemScan-EDR 进程注入检测规则
 */

rule Remote_Thread_Creation {
    meta:
        description = "检测远程线程注入相关API字符串"
        author = "MemScan-EDR"
        severity = "medium"
        category = "injection"
    strings:
        $createremotethread = "CreateRemoteThread" nocase
        $rtlcreateuserthread = "RtlCreateUserThread" nocase
        $ntcreatethreadex = "NtCreateThreadEx" nocase
    condition:
        any of them
}

rule DLL_Injection_APC {
    meta:
        description = "检测 APC 注入 (QueueUserAPC) 特征"
        author = "MemScan-EDR"
        severity = "medium"
        category = "injection"
    strings:
        $queueuserapc = "QueueUserAPC" nocase
        $ntqueueapcthread = "NtQueueApcThread" nocase
        $setthreadcontext = "SetThreadContext" nocase
    condition:
        any of them
}

rule Process_DLL_Injection {
    meta:
        description = "检测 DLL 注入常用 API"
        author = "MemScan-EDR"
        severity = "medium"
        category = "injection"
    strings:
        $virtualallocex = "VirtualAllocEx" nocase
        $writeprocessmemory = "WriteProcessMemory" nocase
        $loadlibrarya = "LoadLibraryA" nocase
        $getprocaddress = "GetProcAddress" nocase
    condition:
        ($virtualallocex and $writeprocessmemory) or $loadlibrarya
}

rule Process_Hollowing {
    meta:
        description = "检测 Process Hollowing 特征"
        author = "MemScan-EDR"
        severity = "high"
        category = "injection"
    strings:
        $createprocess = "CreateProcess" nocase
        $zwunmap = "ZwUnmapViewOfSection" nocase
        $ntunmap = "NtUnmapViewOfSection" nocase
        $rtluserprocess = "RtlUserProcessParameters" nocase
    condition:
        $createprocess and ($zwunmap or $ntunmap)
}

rule Atom_Bombing {
    meta:
        description = "检测 Atom Bombing 注入技术"
        author = "MemScan-EDR"
        severity = "high"
        category = "injection"
    strings:
        $globaladd = "GlobalAddAtom" nocase
        $globalget = "GlobalGetAtomName" nocase
        $ntqueueapc = "NtQueueApcThread" nocase
    condition:
        2 of them
}

rule Early_Bird_APC {
    meta:
        description = "检测 Early Bird APC 注入"
        author = "MemScan-EDR"
        severity = "high"
        category = "injection"
    strings:
        $create_suspended = "CREATE_SUSPENDED" nocase
        $queueuserapc = "QueueUserAPC" nocase
        $resumethread = "ResumeThread" nocase
    condition:
        2 of them
}