Add README, LICENSE, YARA rules, update docs for v2.0

2026-07-16 16:30:01 +08:00
6 changed files with 705 additions and 0 deletions
--- a/21
+++ b/21
@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 MemScan-EDR Contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
--- a/README.md
+++ b/README.md
@ -0,0 +1,242 @@
+<div align="right">
+
+[![English](https://img.shields.io/badge/English-README_EN.md-blue?style=flat-square&logo=markdown)](README_EN.md)
+
+</div>
+
+# MemScan-EDR v2.0
+
+> **AI 驱动的内存威胁检测引擎 — 三级联动检测管线**
+
+[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
+[![.NET 8](https://img.shields.io/badge/.NET-8.0-purple.svg)](https://dotnet.microsoft.com/)
+[![Platform: Windows](https://img.shields.io/badge/Platform-Windows%2010%2F11-lightgrey.svg)](https://www.microsoft.com/windows)
+
+MemScan-EDR v2.0 全面重构了病毒识别逻辑：**40 维内存特征向量 + 无监督基线检测 + 监督分类器 + MITRE ATT&CK 规则引擎** 三级联动，大幅降低误报并提升扫描速度。基于 C# WPF 构建，打包为单个 `.exe`，无需目标机器安装 .NET 运行时。
+
+---
+
+## v2.0 核心改进
+
+| 维度 | v1.0 | v2.0 |
+|------|------|------|
+| **扫描方式** | 逐区域逐签名匹配保护位 | 预过滤 → 特征提取 → 三级 AI 判定 |
+| **特征维度** | 简单 (签名/保护/类型) | **40 维** (元数据 + 权限 + 代码 + 熵 + 网络 + DLL) |
+| **无监督检测** | 无 | **4 类进程基线库** (Z-score + 重构误差) |
+| **误报处理** | 系统提示词约束 LLM | **JIT/安全软件/脚本引擎** 白名单修正 |
+| **速度** | O(区域×签名) | **80% 进程预过滤跳过**，仅 20% 进 AI 管线 |
+
+---
+
+## 功能特性
+
+### 核心能力
+
+| 能力 | 描述 |
+|---|---|
+| **40 维特征提取** | 内存页权限分布、PE 完整性、Shannon 熵、可疑 API/字符串、网络行为、DLL 加载链 |
+| **三级联动检测** | 第一层: 无监督基线异常 → 第二层: 监督分类器 → 第三层: MITRE ATT&CK 规则复核 |
+| **Process Hollowing 检测** | 内存 PE 头与磁盘文件比对，识别进程掏空攻击 |
+| **Shannon 熵分析** | 采样计算内存区域熵值，识别加密/压缩载荷 (高熵 > 7.0) |
+| **15 条 MITRE 规则** | T1055 进程注入、T1055.012 进程掏空、T1003 凭据转储、T1496 挖矿、T1486 勒索等 |
+| **15 条内置签名** | NOP sled、CobaltStrike、Meterpreter、Mimikatz、ReflectiveLoader 等 |
+| **智能误报修正** | JIT 运行时 (.NET/Java/Node.js)、安全软件、脚本引擎 (PowerShell)、开发工具 |
+| **扫描模式** | 快速 (元数据) / 平衡 (采样) / 深度 (全量) 三档可选 |
+| **LLM 辅助研判** | 可选开启大模型对可疑进程二次确认 |
+| **中英文界面** | 一键切换全部 UI 文本 |
+
+### 三级联动检测流程
+
+```
+[快速预过滤] → 跳过 >80% 已签名安全进程
+    ↓
+[第一层: 基线异常检测] → 40 维特征 Z-score + 重构误差
+    ↓  完全匹配基线 → 直接安全
+[第二层: 监督分类器] → 加权线性模型 + 决策树规则
+    ↓  良性 + 低基线异常 → 安全
+[第三层: MITRE 规则复核] → 15 条内存攻击规则 + 误报修正
+    ↓  AI + 基线 + 规则 三级交叉验证 → 最终判定
+```
+
+### 内置签名 (15 条)
+
+| 签名 | 类别 | 严重性 |
+|---|---|---|
+| `SHELLCODE_NOP_SLED` | Shellcode | 中 |
+| `SHELLCODE_GETEIP` | Shellcode | 中 |
+| `SHELLCODE_ROR13` | Shellcode | 中 |
+| `SHELLCODE_URLDOWNLOAD` | Shellcode | 中 |
+| `C2_COBALTSTRIKE` | C2 | 高 |
+| `C2_METERPRETER` | C2 | 中 |
+| `INJECTION_REFLECTIVE` | 注入 | 高 |
+| `INJECTION_CRT` | 注入 | 中 |
+| `INJECTION_VAE` | 注入 | 中 |
+| `PROC_HOLLOW` | 注入 | 高 |
+| `MALWARE_MIMIKATZ` | 恶意软件 | 高 |
+| `CRYPTO_MINER` | 挖矿 | 高 |
+| `RANSOM_NOTE` | 恶意软件 | 高 |
+| `PS_DOWNLOAD` | 恶意软件 | 中 |
+| `KEYLOGGER_API` | 恶意软件 | 中 |
+
+---
+
+## 架构
+
+```
+Models:
+  MemoryFeatures    ── 40 维 AI 特征向量
+  BaselineProfile   ── 正常程序基线 (4 类进程)
+  ProcessInfo       ── 进程元数据 + 网络 + 内存区域
+
+Services:
+  FeatureExtractor  ── 从进程内存提取全维度特征
+  EntropyAnalyzer   ── Shannon 熵计算 (采样优化)
+  PEHeaderAnalyzer  ── PE 完整性验证 + Hollowing 检测
+  BaselineEngine    ── 无监督基线异常检测 (Z-score + 重构误差)
+  ClassificationEngine ── 监督分类器 (加权 + 决策树)
+  RuleEngine        ── 15 条 MITRE ATT&CK 内存攻击规则
+  DetectionPipeline ── 三级联动编排引擎
+  AIAnalyzer        ── 集成管线 + LLM 辅助研判
+  MemoryScanner     ── 实际字节匹配 + 按需扫描
+  ProcessCollector  ── 进程枚举 + 模块列表采集
+```
+
+数据流：
+```
+[开始扫描] → ProcessCollector.CollectAll()
+    → 快速预过滤 (不读内存, 跳过 >80% 进程)
+    → FeatureExtractor.Extract() → MemoryFeatures (40 维向量)
+    → 第一层: BaselineEngine.Analyze() → 基线异常分数
+    → 第二层: ClassificationEngine.Classify() → 恶意/可疑/良性
+    → 第三层: RuleEngine.Validate() → MITRE 规则 + 误报修正
+    → ScanResult → IProgress<> 实时更新界面
+```
+
+---
+
+## 快速开始
+
+### 环境要求
+
+- Windows 10 / 11 (x64)
+- [.NET 8 SDK](https://dotnet.microsoft.com/download/dotnet/8.0)
+- 管理员权限（用于内存扫描）
+
+### 编译构建
+
+```powershell
+git clone https://github.com/Huang-158/MemScan-EDR.git
+cd MemScan-EDR\src-csharp
+
+# Debug 编译
+dotnet build MemScanEDR.sln
+
+# 发布单文件 EXE
+dotnet publish MemScanEDR\MemScanEDR.csproj -c Release -r win-x64 --self-contained true -p:PublishSingleFile=true -o publish
+
+# 运行
+.\publish\MemScan-EDR.exe
+```
+
+或：
+
+```powershell
+.\scripts\build_csharp.bat
+```
+
+### CE-MCP 配置（可选）
+
+1. 将 [ce-mcp-server](https://github.com/Huang-158/ce-mcp-server) 放在项目同级目录
+2. 或在设置界面 → CE-MCP 服务器路径 配置
+3. 设为 `disabled` 可跳过 CE-MCP
+
+### AI 配置
+
+1. 选择提供商：启发式 / OpenAI 兼容 / Claude / 本地
+2. 填写 API 地址
+3. 填写 API Key（本地存储）
+4. 填写模型名称
+5. 点击保存
+
+---
+
+## AI 分析机制
+
+1. **预过滤**：无任何可疑特征的进程直接标记为`安全`，不调用 API
+2. **结构化 Prompt**：每个进程生成含元数据、网络连接、内存签名、可疑区域的格式化报告
+3. **默认安全策略**：AI 被指示 >95% 的进程是良性的；需要多个并发指标才提升风险等级
+4. **启发式降级**：API 不可用时采用保守阈值（≥0.50 可疑，≥0.75 高危）
+
+---
+
+## 项目结构
+
+```
+MemScan-EDR-2.0/
+├── src-csharp/
+│   └── MemScanEDR/
+│       ├── MemScanEDR.csproj
+│       ├── App.xaml / App.xaml.cs
+│       ├── MainWindow.xaml / MainWindow.xaml.cs
+│       ├── Models/
+│       │   ├── MemoryFeatures.cs      ★ 40 维 AI 特征向量
+│       │   ├── BaselineProfile.cs     ★ 正常程序基线库
+│       │   ├── ProcessInfo.cs
+│       │   ├── AIConfig.cs
+│       │   └── AppSettings.cs
+│       └── Services/
+│           ├── FeatureExtractor.cs    ★ 核心特征提取器
+│           ├── EntropyAnalyzer.cs     ★ Shannon 熵分析
+│           ├── PEHeaderAnalyzer.cs    ★ PE 完整性验证
+│           ├── BaselineEngine.cs      ★ 无监督基线检测
+│           ├── ClassificationEngine.cs★ 监督分类器
+│           ├── RuleEngine.cs          ★ MITRE ATT&CK 规则
+│           ├── DetectionPipeline.cs   ★ 三级联动管线
+│           ├── AIAnalyzer.cs          (集成管线 + LLM)
+│           ├── MemoryScanner.cs       (优化版字节匹配)
+│           └── ProcessCollector.cs
+├── rules/
+│   ├── shellcode.yar
+│   ├── injection.yar
+│   └── malware_strings.yar
+├── scripts/
+│   └── build_csharp.bat
+├── LICENSE
+├── README.md
+└── README_EN.md
+```
+
+---
+
+## 快速开始
+
+### 环境要求
+
+- Windows 10 / 11 (x64)
+- [.NET 8 SDK](https://dotnet.microsoft.com/download/dotnet/8.0)
+- 管理员权限（用于内存扫描）
+
+### 编译构建
+
+```powershell
+git clone https://github.com/Huang-158/MemScan-EDR.git
+cd MemScan-EDR
+
+# 发布单文件 EXE
+dotnet publish src-csharp/MemScanEDR/MemScanEDR.csproj -c Release -r win-x64 --self-contained true -p:PublishSingleFile=true -o publish
+
+# 运行
+.\publish\MemScan-EDR.exe
+```
+
+---
+
+## 声明
+
+> 本工具仅用于**合法的安全研究、教育及授权的安全评估**。未经授权对非自有或未被许可的系统使用属违法行为。使用者须遵守当地法律法规并自行承担所有风险。
+
+---
+
+## 许可证
+
+MIT License — 详见 [LICENSE](LICENSE)。
--- a/README_EN.md
+++ b/README_EN.md
@ -0,0 +1,113 @@
+<div align="right">
+
+[![中文](https://img.shields.io/badge/中文-README.md-red?style=flat-square&logo=markdown)](README.md)
+
+</div>
+
+# MemScan-EDR v2.0
+
+> **AI-Powered Memory Threat Detection Engine with 3-Layer Detection Pipeline**
+
+[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
+[![.NET 8](https://img.shields.io/badge/.NET-8.0-purple.svg)](https://dotnet.microsoft.com/)
+[![Platform: Windows](https://img.shields.io/badge/Platform-Windows%2010%2F11-lightgrey.svg)](https://www.microsoft.com/windows)
+
+MemScan-EDR v2.0 fully refactors the threat detection logic: **40-dimensional memory feature vector + unsupervised baseline detection + supervised classifier + MITRE ATT&CK rule engine** in a 3-layer pipeline, significantly reducing false positives and improving scan speed. Built with C# WPF, packaged as a single `.exe`.
+
+---
+
+## v2.0 Key Improvements
+
+| Dimension | v1.0 | v2.0 |
+|-----------|------|------|
+| **Scan Method** | Per-region signature matching | Prefilter → Feature extraction → 3-layer AI |
+| **Features** | Simple (sig/protect/type) | **40-dim** (metadata + perms + code + entropy + network + DLL) |
+| **Unsupervised** | None | **4-class process baseline** (Z-score + reconstruction error) |
+| **False Positives** | System prompt constraints | **JIT/AV/scripting engine** whitelist corrections |
+| **Speed** | O(regions x signatures) | **80% prefilters skipped**, only 20% enter AI pipeline |
+
+---
+
+## Features
+
+| Capability | Description |
+|---|---|
+| **40-Dim Feature Extraction** | Memory page permissions, PE integrity, Shannon entropy, suspicious APIs/strings, network behavior, DLL loading chain |
+| **3-Layer Detection** | Layer 1: Unsupervised baseline → Layer 2: Supervised classifier → Layer 3: MITRE ATT&CK rules |
+| **Process Hollowing Detection** | Memory PE header vs disk file comparison |
+| **Shannon Entropy Analysis** | Identify encrypted/compressed payloads (high entropy > 7.0) |
+| **15 MITRE Rules** | T1055 injection, T1055.012 hollowing, T1003 credential dump, T1496 mining, T1486 ransomware, etc. |
+| **15 Built-in Signatures** | NOP sled, CobaltStrike, Meterpreter, Mimikatz, ReflectiveLoader, etc. |
+| **Smart FP Correction** | JIT runtimes (.NET/Java/Node.js), security software, scripting engines (PowerShell), dev tools |
+| **Scan Modes** | Fast (metadata) / Balanced (sampled) / Deep (full memory) |
+| **LLM Assist** | Optional LLM second opinion for suspicious processes |
+| **Chinese/English UI** | One-click language toggle |
+
+### 3-Layer Detection Pipeline
+
+```
+[Fast Prefilter] → Skip >80% signed safe processes
+    ↓
+[Layer 1: Baseline Anomaly] → 40-dim Z-score + reconstruction error
+    ↓  Matches baseline → Safe
+[Layer 2: Supervised Classifier] → Weighted linear model + decision tree
+    ↓  Benign + low anomaly → Safe
+[Layer 3: MITRE Rule Review] → 15 memory attack rules + FP corrections
+    ↓  AI + Baseline + Rules cross-validation → Final verdict
+```
+
+---
+
+## Architecture
+
+```
+Models:
+  MemoryFeatures    ── 40-dim AI feature vector
+  BaselineProfile   ── Normal process baselines (4 classes)
+  ProcessInfo       ── Process metadata + network + memory regions
+
+Services:
+  FeatureExtractor  ── Extract all-dimensional features from process memory
+  EntropyAnalyzer   ── Shannon entropy calculation (sampling optimized)
+  PEHeaderAnalyzer  ── PE integrity verification + Hollowing detection
+  BaselineEngine    ── Unsupervised baseline anomaly detection
+  ClassificationEngine ── Supervised classifier (weighted + decision tree)
+  RuleEngine        ── 15 MITRE ATT&CK memory attack rules
+  DetectionPipeline ── 3-layer orchestration engine
+  AIAnalyzer        ── Pipeline integration + LLM assist
+  MemoryScanner     ── Real byte matching + on-demand scanning
+  ProcessCollector  ── Process enumeration + module listing
+```
+
+---
+
+## Quick Start
+
+### Prerequisites
+
+- Windows 10 / 11 (x64)
+- [.NET 8 SDK](https://dotnet.microsoft.com/download/dotnet/8.0)
+- Administrator privileges (for memory scanning)
+
+### Build
+
+```powershell
+git clone https://github.com/Huang-158/MemScan-EDR.git
+cd MemScan-EDR
+
+dotnet publish src-csharp/MemScanEDR/MemScanEDR.csproj -c Release -r win-x64 --self-contained true -p:PublishSingleFile=true -o publish
+
+.\publish\MemScan-EDR.exe
+```
+
+---
+
+## Disclaimer
+
+> This tool is intended for **legitimate security research, education, and authorized security assessments only**. Unauthorized use is illegal. Users are responsible for complying with all applicable laws.
+
+---
+
+## License
+
+MIT License — see [LICENSE](LICENSE).
--- a/rules/injection.yar
+++ b/rules/injection.yar
@ -0,0 +1,89 @@
+/*
+ * MemScan-EDR 进程注入检测规则
+ */
+
+rule Remote_Thread_Creation {
+    meta:
+        description = "检测远程线程注入相关API字符串"
+        author = "MemScan-EDR"
+        severity = "medium"
+        category = "injection"
+    strings:
+        $createremotethread = "CreateRemoteThread" nocase
+        $rtlcreateuserthread = "RtlCreateUserThread" nocase
+        $ntcreatethreadex = "NtCreateThreadEx" nocase
+    condition:
+        any of them
+}
+
+rule DLL_Injection_APC {
+    meta:
+        description = "检测 APC 注入 (QueueUserAPC) 特征"
+        author = "MemScan-EDR"
+        severity = "medium"
+        category = "injection"
+    strings:
+        $queueuserapc = "QueueUserAPC" nocase
+        $ntqueueapcthread = "NtQueueApcThread" nocase
+        $setthreadcontext = "SetThreadContext" nocase
+    condition:
+        any of them
+}
+
+rule Process_DLL_Injection {
+    meta:
+        description = "检测 DLL 注入常用 API"
+        author = "MemScan-EDR"
+        severity = "medium"
+        category = "injection"
+    strings:
+        $virtualallocex = "VirtualAllocEx" nocase
+        $writeprocessmemory = "WriteProcessMemory" nocase
+        $loadlibrarya = "LoadLibraryA" nocase
+        $getprocaddress = "GetProcAddress" nocase
+    condition:
+        ($virtualallocex and $writeprocessmemory) or $loadlibrarya
+}
+
+rule Process_Hollowing {
+    meta:
+        description = "检测 Process Hollowing 特征"
+        author = "MemScan-EDR"
+        severity = "high"
+        category = "injection"
+    strings:
+        $createprocess = "CreateProcess" nocase
+        $zwunmap = "ZwUnmapViewOfSection" nocase
+        $ntunmap = "NtUnmapViewOfSection" nocase
+        $rtluserprocess = "RtlUserProcessParameters" nocase
+    condition:
+        $createprocess and ($zwunmap or $ntunmap)
+}
+
+rule Atom_Bombing {
+    meta:
+        description = "检测 Atom Bombing 注入技术"
+        author = "MemScan-EDR"
+        severity = "high"
+        category = "injection"
+    strings:
+        $globaladd = "GlobalAddAtom" nocase
+        $globalget = "GlobalGetAtomName" nocase
+        $ntqueueapc = "NtQueueApcThread" nocase
+    condition:
+        2 of them
+}
+
+rule Early_Bird_APC {
+    meta:
+        description = "检测 Early Bird APC 注入"
+        author = "MemScan-EDR"
+        severity = "high"
+        category = "injection"
+    strings:
+        $create_suspended = "CREATE_SUSPENDED" nocase
+        $queueuserapc = "QueueUserAPC" nocase
+        $resumethread = "ResumeThread" nocase
+    condition:
+        2 of them
+}
--- a/rules/malware_strings.yar
+++ b/rules/malware_strings.yar
@ -0,0 +1,119 @@
+/*
+ * MemScan-EDR 恶意字符串检测规则
+ * 覆盖 C2 通信、勒索软件、挖矿等常见恶意字符串模式
+ */
+
+rule C2_Domain_Patterns {
+    meta:
+        description = "常见 C2 域名/URL 模式"
+        author = "MemScan-EDR"
+        severity = "high"
+        category = "c2"
+    strings:
+        $beacon_c2 = ".php?id=" ascii
+        $api_req = "/api/v1/beacon" nocase
+        $c2_uri = "/index.asp?id=" ascii
+        $heartbeat = "heartbeat" nocase
+        $check_in = "/checkin" nocase
+        $pulse = "/pulse" nocase
+    condition:
+        any of them
+}
+
+rule Ransomware_Strings {
+    meta:
+        description = "勒索软件常见字符串模式"
+        author = "MemScan-EDR"
+        severity = "high"
+        category = "malware"
+    strings:
+        $ransom = "ransom" nocase
+        $decrypt = "decrypt" nocase
+        $bitcoin = "bitcoin" nocase
+        $monero = "monero" nocase
+        $payment = "payment" nocase
+        $encrypted = "YOUR_FILES_ARE_ENCRYPTED" nocase
+    condition:
+        any of them
+}
+
+rule Crypto_Mining_Pool {
+    meta:
+        description = "加密货币挖矿池 URL 模式"
+        author = "MemScan-EDR"
+        severity = "high"
+        category = "crypto"
+    strings:
+        $stratum = "stratum+tcp://" ascii
+        $xmrig = "xmrig" nocase
+        $pool_url = "pool." nocase
+        $mining_proxy = "nicehash" nocase
+        $worker = "worker" nocase
+    condition:
+        any of them
+}
+
+rule Keylogger_Strings {
+    meta:
+        description = "键盘记录器常见字符串"
+        author = "MemScan-EDR"
+        severity = "high"
+        category = "malware"
+    strings:
+        $hook = "SetWindowsHookEx" nocase
+        $getkeystate = "GetAsyncKeyState" nocase
+        $keylog = "keylog" nocase
+        $clipboard = "GetClipboardData" nocase
+    condition:
+        2 of them
+}
+
+rule Credential_Theft {
+    meta:
+        description = "凭证窃取工具特征字符串"
+        author = "MemScan-EDR"
+        severity = "high"
+        category = "malware"
+    strings:
+        $mimikatz = "mimikatz" nocase
+        $sekurlsa = "sekurlsa" nocase
+        $lsa_dump = "lsadump" nocase
+        $wdigest = "wdigest" nocase
+        $kerberos = "kerberos" nocase
+        $logonpasswords = "logonpasswords" nocase
+    condition:
+        any of them
+}
+
+rule Reverse_Shell_Commands {
+    meta:
+        description = "反弹 Shell 常见命令"
+        author = "MemScan-EDR"
+        severity = "medium"
+        category = "c2"
+    strings:
+        $bash = "/bin/sh" ascii
+        $cmd = "cmd.exe" nocase
+        $powershell = "powershell.exe" nocase
+        $ncat = "nc " ascii
+        $pipe = "mkfifo" ascii
+    condition:
+        any of them
+}
+
+rule Credential_Dump_Tools {
+    meta:
+        description = "常见凭证提取工具名称"
+        author = "MemScan-EDR"
+        severity = "high"
+        category = "malware"
+    strings:
+        $pwdump = "pwdump" nocase
+        $fgdump = "fgdump" nocase
+        $cachedump = "cachedump" nocase
+        $samdump = "samdump" nocase
+        $procdump = "procdump" nocase
+        $lsass = "lsass" nocase
+    condition:
+        any of them
+}
--- a/rules/shellcode.yar
+++ b/rules/shellcode.yar
@ -0,0 +1,121 @@
+/*
+ * MemScan-EDR Shellcode 检测规则
+ * 覆盖常见 C2 框架、注入技术、恶意 Shellcode 特征
+ */
+
+rule Meterpreter_Reverse_TCP_Shellcode {
+    meta:
+        description = "检测 Metasploit Meterpreter reverse_tcp shellcode"
+        author = "MemScan-EDR"
+        severity = "high"
+        category = "shellcode"
+        reference = "https://github.com/rapid7/metasploit-framework"
+    strings:
+        $stager = "WS2_32.dll" nocase
+        $port_loop = { 66 B8 [4] 50 6A 02 6A }
+        $wsastartup = { B8 [4] 50 6A [1-2] 6A }
+        $connect_pattern = { 6A 00 6A 00 6A 00 6A 06 6A 01 6A 02 }
+    condition:
+        any of them
+}
+
+rule CobaltStrike_Beacon_Config {
+    meta:
+        description = "检测 CobaltStrike Beacon 配置特征"
+        author = "MemScan-EDR"
+        severity = "high"
+        category = "c2"
+    strings:
+        $beacon_x86 = { 00 00 00 00 [16] 00 00 00 00 00 01 00 01 }
+        $beacon_x64 = { 00 00 00 00 00 00 00 00 [32] 00 01 00 01 00 }
+        $sleep_mask = { 00 00 00 00 [8] 00 00 00 00 }
+        $config_header = { 00 01 00 01 [16] }
+    condition:
+        any of them
+}
+
+rule Reflective_DLL_Injection {
+    meta:
+        description = "检测 Reflective DLL Injection 特征"
+        author = "MemScan-EDR"
+        severity = "high"
+        category = "injection"
+    strings:
+        $reflectiveloader = "ReflectiveLoader" nocase
+        $reflective_dll = "reflective_dll" nocase
+        $pe_in_memory = "MZ" at 0
+        $getprocaddress_hash = { 8B [1-2] E8 [4] 01 C1 [1-2] [1-2] 85 }
+    condition:
+        ($reflectiveloader or $reflective_dll) and $pe_in_memory
+}
+
+rule Shellcode_NOP_Sled {
+    meta:
+        description = "检测 NOP sled (连续 0x90 指令)"
+        author = "MemScan-EDR"
+        severity = "medium"
+        category = "shellcode"
+    strings:
+        $nop_sled = { 90 90 90 90 90 90 90 90 90 90 90 90 }
+        $nop_int3_sled = { CC CC CC CC CC CC CC CC }
+    condition:
+        $nop_sled or $nop_int3_sled
+}
+
+rule Shellcode_GetEIP_Technique {
+    meta:
+        description = "检测获取 EIP/EIP 的 Shellcode 技术"
+        author = "MemScan-EDR"
+        severity = "medium"
+        category = "shellcode"
+    strings:
+        $call_pop = { E8 00 00 00 00 58 }  // call $+5; pop eax
+        $call_pop2 = { E8 00 00 00 00 59 }  // call $+5; pop ecx
+        $fs_teb = { 64 A1 30 00 00 00 }     // mov eax, fs:[0x30] (PEB x86)
+        $gs_teb = { 65 48 8B [1-2] 60 00 00 00 } // mov reg, gs:[0x60] (PEB x64)
+    condition:
+        any of them
+}
+
+rule Shellcode_API_Hash_ROR13 {
+    meta:
+        description = "检测 ROR13 API 哈希解析模式"
+        author = "MemScan-EDR"
+        severity = "medium"
+        category = "shellcode"
+    strings:
+        $ror13_x86 = { C1 C8 0D }  // ror eax, 0xD
+        $ror13_x64 = { 41 C1 C8 0D }  // ror r8d, 0xD
+        $rol13_x86 = { C1 C0 0D }  // rol eax, 0xD
+    condition:
+        any of them
+}
+
+rule Sliver_Implant {
+    meta:
+        description = "检测 Sliver C2 框架 implant 特征"
+        author = "MemScan-EDR"
+        severity = "high"
+        category = "c2"
+    strings:
+        $sliver = "sliver" nocase
+        $mtls = "mtls" nocase
+        $wg = "wireguard" nocase
+        $grpc = "gRPC" nocase
+    condition:
+        any of them
+}
+
+rule Process_Hollowing_Indicator {
+    meta:
+        description = "检测 Process Hollowing 特征"
+        author = "MemScan-EDR"
+        severity = "high"
+        category = "injection"
+    strings:
+        $ntunmap = "NtUnmapViewOfSection" nocase
+        $create_suspended = { 00 00 00 00 00 00 00 00 [8] 04 00 00 00 }
+        $pe_imagebase = { 00 00 40 00 00 00 00 00 } // IMAGE_BASE 0x400000
+    condition:
+        any of them
+}