MemScan-EDR/rules/shellcode.yar

/*
 * MemScan-EDR Shellcode 检测规则
 * 覆盖常见 C2 框架、注入技术、恶意 Shellcode 特征
 */

rule Meterpreter_Reverse_TCP_Shellcode {
    meta:
        description = "检测 Metasploit Meterpreter reverse_tcp shellcode"
        author = "MemScan-EDR"
        severity = "high"
        category = "shellcode"
        reference = "https://github.com/rapid7/metasploit-framework"
    strings:
        $stager = "WS2_32.dll" nocase
        $port_loop = { 66 B8 [4] 50 6A 02 6A }
        $wsastartup = { B8 [4] 50 6A [1-2] 6A }
        $connect_pattern = { 6A 00 6A 00 6A 00 6A 06 6A 01 6A 02 }
    condition:
        any of them
}

rule CobaltStrike_Beacon_Config {
    meta:
        description = "检测 CobaltStrike Beacon 配置特征"
        author = "MemScan-EDR"
        severity = "high"
        category = "c2"
    strings:
        $beacon_x86 = { 00 00 00 00 [16] 00 00 00 00 00 01 00 01 }
        $beacon_x64 = { 00 00 00 00 00 00 00 00 [32] 00 01 00 01 00 }
        $sleep_mask = { 00 00 00 00 [8] 00 00 00 00 }
        $config_header = { 00 01 00 01 [16] }
    condition:
        any of them
}

rule Reflective_DLL_Injection {
    meta:
        description = "检测 Reflective DLL Injection 特征"
        author = "MemScan-EDR"
        severity = "high"
        category = "injection"
    strings:
        $reflectiveloader = "ReflectiveLoader" nocase
        $reflective_dll = "reflective_dll" nocase
        $pe_in_memory = "MZ" at 0
        $getprocaddress_hash = { 8B [1-2] E8 [4] 01 C1 [1-2] [1-2] 85 }
    condition:
        ($reflectiveloader or $reflective_dll) and $pe_in_memory
}

rule Shellcode_NOP_Sled {
    meta:
        description = "检测 NOP sled (连续 0x90 指令)"
        author = "MemScan-EDR"
        severity = "medium"
        category = "shellcode"
    strings:
        $nop_sled = { 90 90 90 90 90 90 90 90 90 90 90 90 }
        $nop_int3_sled = { CC CC CC CC CC CC CC CC }
    condition:
        $nop_sled or $nop_int3_sled
}

rule Shellcode_GetEIP_Technique {
    meta:
        description = "检测获取 EIP/EIP 的 Shellcode 技术"
        author = "MemScan-EDR"
        severity = "medium"
        category = "shellcode"
    strings:
        $call_pop = { E8 00 00 00 00 58 }  // call $+5; pop eax
        $call_pop2 = { E8 00 00 00 00 59 }  // call $+5; pop ecx
        $fs_teb = { 64 A1 30 00 00 00 }     // mov eax, fs:[0x30] (PEB x86)
        $gs_teb = { 65 48 8B [1-2] 60 00 00 00 } // mov reg, gs:[0x60] (PEB x64)
    condition:
        any of them
}

rule Shellcode_API_Hash_ROR13 {
    meta:
        description = "检测 ROR13 API 哈希解析模式"
        author = "MemScan-EDR"
        severity = "medium"
        category = "shellcode"
    strings:
        $ror13_x86 = { C1 C8 0D }  // ror eax, 0xD
        $ror13_x64 = { 41 C1 C8 0D }  // ror r8d, 0xD
        $rol13_x86 = { C1 C0 0D }  // rol eax, 0xD
    condition:
        any of them
}

rule Sliver_Implant {
    meta:
        description = "检测 Sliver C2 框架 implant 特征"
        author = "MemScan-EDR"
        severity = "high"
        category = "c2"
    strings:
        $sliver = "sliver" nocase
        $mtls = "mtls" nocase
        $wg = "wireguard" nocase
        $grpc = "gRPC" nocase
    condition:
        any of them
}

rule Process_Hollowing_Indicator {
    meta:
        description = "检测 Process Hollowing 特征"
        author = "MemScan-EDR"
        severity = "high"
        category = "injection"
    strings:
        $ntunmap = "NtUnmapViewOfSection" nocase
        $create_suspended = { 00 00 00 00 00 00 00 00 [8] 04 00 00 00 }
        $pe_imagebase = { 00 00 40 00 00 00 00 00 } // IMAGE_BASE 0x400000
    condition:
        any of them
}