diff --git a/LICENSE b/LICENSE
new file mode 100644
index 0000000..0557a73
--- /dev/null
+++ b/LICENSE
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 MemScan-EDR Contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..271e52b
--- /dev/null
+++ b/README.md
@@ -0,0 +1,242 @@
+
+
+[](README_EN.md)
+
+
+
+# MemScan-EDR v2.0
+
+> **AI 驱动的内存威胁检测引擎 — 三级联动检测管线**
+
+[](LICENSE)
+[](https://dotnet.microsoft.com/)
+[](https://www.microsoft.com/windows)
+
+MemScan-EDR v2.0 全面重构了病毒识别逻辑：**40 维内存特征向量 + 无监督基线检测 + 监督分类器 + MITRE ATT&CK 规则引擎** 三级联动，大幅降低误报并提升扫描速度。基于 C# WPF 构建，打包为单个 `.exe`，无需目标机器安装 .NET 运行时。
+
+---
+
+## v2.0 核心改进
+
+| 维度 | v1.0 | v2.0 |
+|------|------|------|
+| **扫描方式** | 逐区域逐签名匹配保护位 | 预过滤 → 特征提取 → 三级 AI 判定 |
+| **特征维度** | 简单 (签名/保护/类型) | **40 维** (元数据 + 权限 + 代码 + 熵 + 网络 + DLL) |
+| **无监督检测** | 无 | **4 类进程基线库** (Z-score + 重构误差) |
+| **误报处理** | 系统提示词约束 LLM | **JIT/安全软件/脚本引擎** 白名单修正 |
+| **速度** | O(区域×签名) | **80% 进程预过滤跳过**，仅 20% 进 AI 管线 |
+
+---
+
+## 功能特性
+
+### 核心能力
+
+| 能力 | 描述 |
+|---|---|
+| **40 维特征提取** | 内存页权限分布、PE 完整性、Shannon 熵、可疑 API/字符串、网络行为、DLL 加载链 |
+| **三级联动检测** | 第一层: 无监督基线异常 → 第二层: 监督分类器 → 第三层: MITRE ATT&CK 规则复核 |
+| **Process Hollowing 检测** | 内存 PE 头与磁盘文件比对，识别进程掏空攻击 |
+| **Shannon 熵分析** | 采样计算内存区域熵值，识别加密/压缩载荷 (高熵 > 7.0) |
+| **15 条 MITRE 规则** | T1055 进程注入、T1055.012 进程掏空、T1003 凭据转储、T1496 挖矿、T1486 勒索等 |
+| **15 条内置签名** | NOP sled、CobaltStrike、Meterpreter、Mimikatz、ReflectiveLoader 等 |
+| **智能误报修正** | JIT 运行时 (.NET/Java/Node.js)、安全软件、脚本引擎 (PowerShell)、开发工具 |
+| **扫描模式** | 快速 (元数据) / 平衡 (采样) / 深度 (全量) 三档可选 |
+| **LLM 辅助研判** | 可选开启大模型对可疑进程二次确认 |
+| **中英文界面** | 一键切换全部 UI 文本 |
+
+### 三级联动检测流程
+
+```
+[快速预过滤] → 跳过 >80% 已签名安全进程
+ ↓
+[第一层: 基线异常检测] → 40 维特征 Z-score + 重构误差
+ ↓ 完全匹配基线 → 直接安全
+[第二层: 监督分类器] → 加权线性模型 + 决策树规则
+ ↓ 良性 + 低基线异常 → 安全
+[第三层: MITRE 规则复核] → 15 条内存攻击规则 + 误报修正
+ ↓ AI + 基线 + 规则 三级交叉验证 → 最终判定
+```
+
+### 内置签名 (15 条)
+
+| 签名 | 类别 | 严重性 |
+|---|---|---|
+| `SHELLCODE_NOP_SLED` | Shellcode | 中 |
+| `SHELLCODE_GETEIP` | Shellcode | 中 |
+| `SHELLCODE_ROR13` | Shellcode | 中 |
+| `SHELLCODE_URLDOWNLOAD` | Shellcode | 中 |
+| `C2_COBALTSTRIKE` | C2 | 高 |
+| `C2_METERPRETER` | C2 | 中 |
+| `INJECTION_REFLECTIVE` | 注入 | 高 |
+| `INJECTION_CRT` | 注入 | 中 |
+| `INJECTION_VAE` | 注入 | 中 |
+| `PROC_HOLLOW` | 注入 | 高 |
+| `MALWARE_MIMIKATZ` | 恶意软件 | 高 |
+| `CRYPTO_MINER` | 挖矿 | 高 |
+| `RANSOM_NOTE` | 恶意软件 | 高 |
+| `PS_DOWNLOAD` | 恶意软件 | 中 |
+| `KEYLOGGER_API` | 恶意软件 | 中 |
+
+---
+
+## 架构
+
+```
+Models:
+ MemoryFeatures ── 40 维 AI 特征向量
+ BaselineProfile ── 正常程序基线 (4 类进程)
+ ProcessInfo ── 进程元数据 + 网络 + 内存区域
+
+Services:
+ FeatureExtractor ── 从进程内存提取全维度特征
+ EntropyAnalyzer ── Shannon 熵计算 (采样优化)
+ PEHeaderAnalyzer ── PE 完整性验证 + Hollowing 检测
+ BaselineEngine ── 无监督基线异常检测 (Z-score + 重构误差)
+ ClassificationEngine ── 监督分类器 (加权 + 决策树)
+ RuleEngine ── 15 条 MITRE ATT&CK 内存攻击规则
+ DetectionPipeline ── 三级联动编排引擎
+ AIAnalyzer ── 集成管线 + LLM 辅助研判
+ MemoryScanner ── 实际字节匹配 + 按需扫描
+ ProcessCollector ── 进程枚举 + 模块列表采集
+```
+
+数据流：
+```
+[开始扫描] → ProcessCollector.CollectAll()
+ → 快速预过滤 (不读内存, 跳过 >80% 进程)
+ → FeatureExtractor.Extract() → MemoryFeatures (40 维向量)
+ → 第一层: BaselineEngine.Analyze() → 基线异常分数
+ → 第二层: ClassificationEngine.Classify() → 恶意/可疑/良性
+ → 第三层: RuleEngine.Validate() → MITRE 规则 + 误报修正
+ → ScanResult → IProgress<> 实时更新界面
+```
+
+---
+
+## 快速开始
+
+### 环境要求
+
+- Windows 10 / 11 (x64)
+- [.NET 8 SDK](https://dotnet.microsoft.com/download/dotnet/8.0)
+- 管理员权限（用于内存扫描）
+
+### 编译构建
+
+```powershell
+git clone https://github.com/Huang-158/MemScan-EDR.git
+cd MemScan-EDR\src-csharp
+
+# Debug 编译
+dotnet build MemScanEDR.sln
+
+# 发布单文件 EXE
+dotnet publish MemScanEDR\MemScanEDR.csproj -c Release -r win-x64 --self-contained true -p:PublishSingleFile=true -o publish
+
+# 运行
+.\publish\MemScan-EDR.exe
+```
+
+或：
+
+```powershell
+.\scripts\build_csharp.bat
+```
+
+### CE-MCP 配置（可选）
+
+1. 将 [ce-mcp-server](https://github.com/Huang-158/ce-mcp-server) 放在项目同级目录
+2. 或在设置界面 → CE-MCP 服务器路径 配置
+3. 设为 `disabled` 可跳过 CE-MCP
+
+### AI 配置
+
+1. 选择提供商：启发式 / OpenAI 兼容 / Claude / 本地
+2. 填写 API 地址
+3. 填写 API Key（本地存储）
+4. 填写模型名称
+5. 点击保存
+
+---
+
+## AI 分析机制
+
+1. **预过滤**：无任何可疑特征的进程直接标记为`安全`，不调用 API
+2. **结构化 Prompt**：每个进程生成含元数据、网络连接、内存签名、可疑区域的格式化报告
+3. **默认安全策略**：AI 被指示 >95% 的进程是良性的；需要多个并发指标才提升风险等级
+4. **启发式降级**：API 不可用时采用保守阈值（≥0.50 可疑，≥0.75 高危）
+
+---
+
+## 项目结构
+
+```
+MemScan-EDR-2.0/
+├── src-csharp/
+│ └── MemScanEDR/
+│ ├── MemScanEDR.csproj
+│ ├── App.xaml / App.xaml.cs
+│ ├── MainWindow.xaml / MainWindow.xaml.cs
+│ ├── Models/
+│ │ ├── MemoryFeatures.cs ★ 40 维 AI 特征向量
+│ │ ├── BaselineProfile.cs ★ 正常程序基线库
+│ │ ├── ProcessInfo.cs
+│ │ ├── AIConfig.cs
+│ │ └── AppSettings.cs
+│ └── Services/
+│ ├── FeatureExtractor.cs ★ 核心特征提取器
+│ ├── EntropyAnalyzer.cs ★ Shannon 熵分析
+│ ├── PEHeaderAnalyzer.cs ★ PE 完整性验证
+│ ├── BaselineEngine.cs ★ 无监督基线检测
+│ ├── ClassificationEngine.cs★ 监督分类器
+│ ├── RuleEngine.cs ★ MITRE ATT&CK 规则
+│ ├── DetectionPipeline.cs ★ 三级联动管线
+│ ├── AIAnalyzer.cs (集成管线 + LLM)
+│ ├── MemoryScanner.cs (优化版字节匹配)
+│ └── ProcessCollector.cs
+├── rules/
+│ ├── shellcode.yar
+│ ├── injection.yar
+│ └── malware_strings.yar
+├── scripts/
+│ └── build_csharp.bat
+├── LICENSE
+├── README.md
+└── README_EN.md
+```
+
+---
+
+## 快速开始
+
+### 环境要求
+
+- Windows 10 / 11 (x64)
+- [.NET 8 SDK](https://dotnet.microsoft.com/download/dotnet/8.0)
+- 管理员权限（用于内存扫描）
+
+### 编译构建
+
+```powershell
+git clone https://github.com/Huang-158/MemScan-EDR.git
+cd MemScan-EDR
+
+# 发布单文件 EXE
+dotnet publish src-csharp/MemScanEDR/MemScanEDR.csproj -c Release -r win-x64 --self-contained true -p:PublishSingleFile=true -o publish
+
+# 运行
+.\publish\MemScan-EDR.exe
+```
+
+---
+
+## 声明
+
+> 本工具仅用于**合法的安全研究、教育及授权的安全评估**。未经授权对非自有或未被许可的系统使用属违法行为。使用者须遵守当地法律法规并自行承担所有风险。
+
+---
+
+## 许可证
+
+MIT License — 详见 [LICENSE](LICENSE)。
diff --git a/README_EN.md b/README_EN.md
new file mode 100644
index 0000000..6321904
--- /dev/null
+++ b/README_EN.md
@@ -0,0 +1,113 @@
+
+
+[](README.md)
+
+
+
+# MemScan-EDR v2.0
+
+> **AI-Powered Memory Threat Detection Engine with 3-Layer Detection Pipeline**
+
+[](LICENSE)
+[](https://dotnet.microsoft.com/)
+[](https://www.microsoft.com/windows)
+
+MemScan-EDR v2.0 fully refactors the threat detection logic: **40-dimensional memory feature vector + unsupervised baseline detection + supervised classifier + MITRE ATT&CK rule engine** in a 3-layer pipeline, significantly reducing false positives and improving scan speed. Built with C# WPF, packaged as a single `.exe`.
+
+---
+
+## v2.0 Key Improvements
+
+| Dimension | v1.0 | v2.0 |
+|-----------|------|------|
+| **Scan Method** | Per-region signature matching | Prefilter → Feature extraction → 3-layer AI |
+| **Features** | Simple (sig/protect/type) | **40-dim** (metadata + perms + code + entropy + network + DLL) |
+| **Unsupervised** | None | **4-class process baseline** (Z-score + reconstruction error) |
+| **False Positives** | System prompt constraints | **JIT/AV/scripting engine** whitelist corrections |
+| **Speed** | O(regions x signatures) | **80% prefilters skipped**, only 20% enter AI pipeline |
+
+---
+
+## Features
+
+| Capability | Description |
+|---|---|
+| **40-Dim Feature Extraction** | Memory page permissions, PE integrity, Shannon entropy, suspicious APIs/strings, network behavior, DLL loading chain |
+| **3-Layer Detection** | Layer 1: Unsupervised baseline → Layer 2: Supervised classifier → Layer 3: MITRE ATT&CK rules |
+| **Process Hollowing Detection** | Memory PE header vs disk file comparison |
+| **Shannon Entropy Analysis** | Identify encrypted/compressed payloads (high entropy > 7.0) |
+| **15 MITRE Rules** | T1055 injection, T1055.012 hollowing, T1003 credential dump, T1496 mining, T1486 ransomware, etc. |
+| **15 Built-in Signatures** | NOP sled, CobaltStrike, Meterpreter, Mimikatz, ReflectiveLoader, etc. |
+| **Smart FP Correction** | JIT runtimes (.NET/Java/Node.js), security software, scripting engines (PowerShell), dev tools |
+| **Scan Modes** | Fast (metadata) / Balanced (sampled) / Deep (full memory) |
+| **LLM Assist** | Optional LLM second opinion for suspicious processes |
+| **Chinese/English UI** | One-click language toggle |
+
+### 3-Layer Detection Pipeline
+
+```
+[Fast Prefilter] → Skip >80% signed safe processes
+ ↓
+[Layer 1: Baseline Anomaly] → 40-dim Z-score + reconstruction error
+ ↓ Matches baseline → Safe
+[Layer 2: Supervised Classifier] → Weighted linear model + decision tree
+ ↓ Benign + low anomaly → Safe
+[Layer 3: MITRE Rule Review] → 15 memory attack rules + FP corrections
+ ↓ AI + Baseline + Rules cross-validation → Final verdict
+```
+
+---
+
+## Architecture
+
+```
+Models:
+ MemoryFeatures ── 40-dim AI feature vector
+ BaselineProfile ── Normal process baselines (4 classes)
+ ProcessInfo ── Process metadata + network + memory regions
+
+Services:
+ FeatureExtractor ── Extract all-dimensional features from process memory
+ EntropyAnalyzer ── Shannon entropy calculation (sampling optimized)
+ PEHeaderAnalyzer ── PE integrity verification + Hollowing detection
+ BaselineEngine ── Unsupervised baseline anomaly detection
+ ClassificationEngine ── Supervised classifier (weighted + decision tree)
+ RuleEngine ── 15 MITRE ATT&CK memory attack rules
+ DetectionPipeline ── 3-layer orchestration engine
+ AIAnalyzer ── Pipeline integration + LLM assist
+ MemoryScanner ── Real byte matching + on-demand scanning
+ ProcessCollector ── Process enumeration + module listing
+```
+
+---
+
+## Quick Start
+
+### Prerequisites
+
+- Windows 10 / 11 (x64)
+- [.NET 8 SDK](https://dotnet.microsoft.com/download/dotnet/8.0)
+- Administrator privileges (for memory scanning)
+
+### Build
+
+```powershell
+git clone https://github.com/Huang-158/MemScan-EDR.git
+cd MemScan-EDR
+
+dotnet publish src-csharp/MemScanEDR/MemScanEDR.csproj -c Release -r win-x64 --self-contained true -p:PublishSingleFile=true -o publish
+
+.\publish\MemScan-EDR.exe
+```
+
+---
+
+## Disclaimer
+
+> This tool is intended for **legitimate security research, education, and authorized security assessments only**. Unauthorized use is illegal. Users are responsible for complying with all applicable laws.
+
+---
+
+## License
+
+MIT License — see [LICENSE](LICENSE).
diff --git a/rules/injection.yar b/rules/injection.yar
new file mode 100644
index 0000000..211ce1d
--- /dev/null
+++ b/rules/injection.yar
@@ -0,0 +1,89 @@
+/*
+ * MemScan-EDR 进程注入检测规则
+ */
+
+rule Remote_Thread_Creation {
+ meta:
+ description = "检测远程线程注入相关API字符串"
+ author = "MemScan-EDR"
+ severity = "medium"
+ category = "injection"
+ strings:
+ $createremotethread = "CreateRemoteThread" nocase
+ $rtlcreateuserthread = "RtlCreateUserThread" nocase
+ $ntcreatethreadex = "NtCreateThreadEx" nocase
+ condition:
+ any of them
+}
+
+rule DLL_Injection_APC {
+ meta:
+ description = "检测 APC 注入 (QueueUserAPC) 特征"
+ author = "MemScan-EDR"
+ severity = "medium"
+ category = "injection"
+ strings:
+ $queueuserapc = "QueueUserAPC" nocase
+ $ntqueueapcthread = "NtQueueApcThread" nocase
+ $setthreadcontext = "SetThreadContext" nocase
+ condition:
+ any of them
+}
+
+rule Process_DLL_Injection {
+ meta:
+ description = "检测 DLL 注入常用 API"
+ author = "MemScan-EDR"
+ severity = "medium"
+ category = "injection"
+ strings:
+ $virtualallocex = "VirtualAllocEx" nocase
+ $writeprocessmemory = "WriteProcessMemory" nocase
+ $loadlibrarya = "LoadLibraryA" nocase
+ $getprocaddress = "GetProcAddress" nocase
+ condition:
+ ($virtualallocex and $writeprocessmemory) or $loadlibrarya
+}
+
+rule Process_Hollowing {
+ meta:
+ description = "检测 Process Hollowing 特征"
+ author = "MemScan-EDR"
+ severity = "high"
+ category = "injection"
+ strings:
+ $createprocess = "CreateProcess" nocase
+ $zwunmap = "ZwUnmapViewOfSection" nocase
+ $ntunmap = "NtUnmapViewOfSection" nocase
+ $rtluserprocess = "RtlUserProcessParameters" nocase
+ condition:
+ $createprocess and ($zwunmap or $ntunmap)
+}
+
+rule Atom_Bombing {
+ meta:
+ description = "检测 Atom Bombing 注入技术"
+ author = "MemScan-EDR"
+ severity = "high"
+ category = "injection"
+ strings:
+ $globaladd = "GlobalAddAtom" nocase
+ $globalget = "GlobalGetAtomName" nocase
+ $ntqueueapc = "NtQueueApcThread" nocase
+ condition:
+ 2 of them
+}
+
+rule Early_Bird_APC {
+ meta:
+ description = "检测 Early Bird APC 注入"
+ author = "MemScan-EDR"
+ severity = "high"
+ category = "injection"
+ strings:
+ $create_suspended = "CREATE_SUSPENDED" nocase
+ $queueuserapc = "QueueUserAPC" nocase
+ $resumethread = "ResumeThread" nocase
+ condition:
+ 2 of them
+}
diff --git a/rules/malware_strings.yar b/rules/malware_strings.yar
new file mode 100644
index 0000000..7e360d9
--- /dev/null
+++ b/rules/malware_strings.yar
@@ -0,0 +1,119 @@
+/*
+ * MemScan-EDR 恶意字符串检测规则
+ * 覆盖 C2 通信、勒索软件、挖矿等常见恶意字符串模式
+ */
+
+rule C2_Domain_Patterns {
+ meta:
+ description = "常见 C2 域名/URL 模式"
+ author = "MemScan-EDR"
+ severity = "high"
+ category = "c2"
+ strings:
+ $beacon_c2 = ".php?id=" ascii
+ $api_req = "/api/v1/beacon" nocase
+ $c2_uri = "/index.asp?id=" ascii
+ $heartbeat = "heartbeat" nocase
+ $check_in = "/checkin" nocase
+ $pulse = "/pulse" nocase
+ condition:
+ any of them
+}
+
+rule Ransomware_Strings {
+ meta:
+ description = "勒索软件常见字符串模式"
+ author = "MemScan-EDR"
+ severity = "high"
+ category = "malware"
+ strings:
+ $ransom = "ransom" nocase
+ $decrypt = "decrypt" nocase
+ $bitcoin = "bitcoin" nocase
+ $monero = "monero" nocase
+ $payment = "payment" nocase
+ $encrypted = "YOUR_FILES_ARE_ENCRYPTED" nocase
+ condition:
+ any of them
+}
+
+rule Crypto_Mining_Pool {
+ meta:
+ description = "加密货币挖矿池 URL 模式"
+ author = "MemScan-EDR"
+ severity = "high"
+ category = "crypto"
+ strings:
+ $stratum = "stratum+tcp://" ascii
+ $xmrig = "xmrig" nocase
+ $pool_url = "pool." nocase
+ $mining_proxy = "nicehash" nocase
+ $worker = "worker" nocase
+ condition:
+ any of them
+}
+
+rule Keylogger_Strings {
+ meta:
+ description = "键盘记录器常见字符串"
+ author = "MemScan-EDR"
+ severity = "high"
+ category = "malware"
+ strings:
+ $hook = "SetWindowsHookEx" nocase
+ $getkeystate = "GetAsyncKeyState" nocase
+ $keylog = "keylog" nocase
+ $clipboard = "GetClipboardData" nocase
+ condition:
+ 2 of them
+}
+
+rule Credential_Theft {
+ meta:
+ description = "凭证窃取工具特征字符串"
+ author = "MemScan-EDR"
+ severity = "high"
+ category = "malware"
+ strings:
+ $mimikatz = "mimikatz" nocase
+ $sekurlsa = "sekurlsa" nocase
+ $lsa_dump = "lsadump" nocase
+ $wdigest = "wdigest" nocase
+ $kerberos = "kerberos" nocase
+ $logonpasswords = "logonpasswords" nocase
+ condition:
+ any of them
+}
+
+rule Reverse_Shell_Commands {
+ meta:
+ description = "反弹 Shell 常见命令"
+ author = "MemScan-EDR"
+ severity = "medium"
+ category = "c2"
+ strings:
+ $bash = "/bin/sh" ascii
+ $cmd = "cmd.exe" nocase
+ $powershell = "powershell.exe" nocase
+ $ncat = "nc " ascii
+ $pipe = "mkfifo" ascii
+ condition:
+ any of them
+}
+
+rule Credential_Dump_Tools {
+ meta:
+ description = "常见凭证提取工具名称"
+ author = "MemScan-EDR"
+ severity = "high"
+ category = "malware"
+ strings:
+ $pwdump = "pwdump" nocase
+ $fgdump = "fgdump" nocase
+ $cachedump = "cachedump" nocase
+ $samdump = "samdump" nocase
+ $procdump = "procdump" nocase
+ $lsass = "lsass" nocase
+ condition:
+ any of them
+}
diff --git a/rules/shellcode.yar b/rules/shellcode.yar
new file mode 100644
index 0000000..92dcae0
--- /dev/null
+++ b/rules/shellcode.yar
@@ -0,0 +1,121 @@
+/*
+ * MemScan-EDR Shellcode 检测规则
+ * 覆盖常见 C2 框架、注入技术、恶意 Shellcode 特征
+ */
+
+rule Meterpreter_Reverse_TCP_Shellcode {
+ meta:
+ description = "检测 Metasploit Meterpreter reverse_tcp shellcode"
+ author = "MemScan-EDR"
+ severity = "high"
+ category = "shellcode"
+ reference = "https://github.com/rapid7/metasploit-framework"
+ strings:
+ $stager = "WS2_32.dll" nocase
+ $port_loop = { 66 B8 [4] 50 6A 02 6A }
+ $wsastartup = { B8 [4] 50 6A [1-2] 6A }
+ $connect_pattern = { 6A 00 6A 00 6A 00 6A 06 6A 01 6A 02 }
+ condition:
+ any of them
+}
+
+rule CobaltStrike_Beacon_Config {
+ meta:
+ description = "检测 CobaltStrike Beacon 配置特征"
+ author = "MemScan-EDR"
+ severity = "high"
+ category = "c2"
+ strings:
+ $beacon_x86 = { 00 00 00 00 [16] 00 00 00 00 00 01 00 01 }
+ $beacon_x64 = { 00 00 00 00 00 00 00 00 [32] 00 01 00 01 00 }
+ $sleep_mask = { 00 00 00 00 [8] 00 00 00 00 }
+ $config_header = { 00 01 00 01 [16] }
+ condition:
+ any of them
+}
+
+rule Reflective_DLL_Injection {
+ meta:
+ description = "检测 Reflective DLL Injection 特征"
+ author = "MemScan-EDR"
+ severity = "high"
+ category = "injection"
+ strings:
+ $reflectiveloader = "ReflectiveLoader" nocase
+ $reflective_dll = "reflective_dll" nocase
+ $pe_in_memory = "MZ" at 0
+ $getprocaddress_hash = { 8B [1-2] E8 [4] 01 C1 [1-2] [1-2] 85 }
+ condition:
+ ($reflectiveloader or $reflective_dll) and $pe_in_memory
+}
+
+rule Shellcode_NOP_Sled {
+ meta:
+ description = "检测 NOP sled (连续 0x90 指令)"
+ author = "MemScan-EDR"
+ severity = "medium"
+ category = "shellcode"
+ strings:
+ $nop_sled = { 90 90 90 90 90 90 90 90 90 90 90 90 }
+ $nop_int3_sled = { CC CC CC CC CC CC CC CC }
+ condition:
+ $nop_sled or $nop_int3_sled
+}
+
+rule Shellcode_GetEIP_Technique {
+ meta:
+ description = "检测获取 EIP/EIP 的 Shellcode 技术"
+ author = "MemScan-EDR"
+ severity = "medium"
+ category = "shellcode"
+ strings:
+ $call_pop = { E8 00 00 00 00 58 } // call $+5; pop eax
+ $call_pop2 = { E8 00 00 00 00 59 } // call $+5; pop ecx
+ $fs_teb = { 64 A1 30 00 00 00 } // mov eax, fs:[0x30] (PEB x86)
+ $gs_teb = { 65 48 8B [1-2] 60 00 00 00 } // mov reg, gs:[0x60] (PEB x64)
+ condition:
+ any of them
+}
+
+rule Shellcode_API_Hash_ROR13 {
+ meta:
+ description = "检测 ROR13 API 哈希解析模式"
+ author = "MemScan-EDR"
+ severity = "medium"
+ category = "shellcode"
+ strings:
+ $ror13_x86 = { C1 C8 0D } // ror eax, 0xD
+ $ror13_x64 = { 41 C1 C8 0D } // ror r8d, 0xD
+ $rol13_x86 = { C1 C0 0D } // rol eax, 0xD
+ condition:
+ any of them
+}
+
+rule Sliver_Implant {
+ meta:
+ description = "检测 Sliver C2 框架 implant 特征"
+ author = "MemScan-EDR"
+ severity = "high"
+ category = "c2"
+ strings:
+ $sliver = "sliver" nocase
+ $mtls = "mtls" nocase
+ $wg = "wireguard" nocase
+ $grpc = "gRPC" nocase
+ condition:
+ any of them
+}
+
+rule Process_Hollowing_Indicator {
+ meta:
+ description = "检测 Process Hollowing 特征"
+ author = "MemScan-EDR"
+ severity = "high"
+ category = "injection"
+ strings:
+ $ntunmap = "NtUnmapViewOfSection" nocase
+ $create_suspended = { 00 00 00 00 00 00 00 00 [8] 04 00 00 00 }
+ $pe_imagebase = { 00 00 40 00 00 00 00 00 } // IMAGE_BASE 0x400000
+ condition:
+ any of them
+}