Compare commits
1 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
585906a817 |
21
LICENSE
Normal file
21
LICENSE
Normal file
@ -0,0 +1,21 @@
|
|||||||
|
MIT License
|
||||||
|
|
||||||
|
Copyright (c) 2026 MemScan-EDR Contributors
|
||||||
|
|
||||||
|
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||||
|
of this software and associated documentation files (the "Software"), to deal
|
||||||
|
in the Software without restriction, including without limitation the rights
|
||||||
|
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||||
|
copies of the Software, and to permit persons to whom the Software is
|
||||||
|
furnished to do so, subject to the following conditions:
|
||||||
|
|
||||||
|
The above copyright notice and this permission notice shall be included in all
|
||||||
|
copies or substantial portions of the Software.
|
||||||
|
|
||||||
|
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||||
|
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||||
|
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||||
|
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||||
|
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||||
|
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
||||||
|
SOFTWARE.
|
||||||
242
README.md
Normal file
242
README.md
Normal file
@ -0,0 +1,242 @@
|
|||||||
|
<div align="right">
|
||||||
|
|
||||||
|
[](README_EN.md)
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
# MemScan-EDR v2.0
|
||||||
|
|
||||||
|
> **AI 驱动的内存威胁检测引擎 — 三级联动检测管线**
|
||||||
|
|
||||||
|
[](LICENSE)
|
||||||
|
[](https://dotnet.microsoft.com/)
|
||||||
|
[](https://www.microsoft.com/windows)
|
||||||
|
|
||||||
|
MemScan-EDR v2.0 全面重构了病毒识别逻辑：**40 维内存特征向量 + 无监督基线检测 + 监督分类器 + MITRE ATT&CK 规则引擎** 三级联动，大幅降低误报并提升扫描速度。基于 C# WPF 构建，打包为单个 `.exe`，无需目标机器安装 .NET 运行时。
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## v2.0 核心改进
|
||||||
|
|
||||||
|
| 维度 | v1.0 | v2.0 |
|
||||||
|
|------|------|------|
|
||||||
|
| **扫描方式** | 逐区域逐签名匹配保护位 | 预过滤 → 特征提取 → 三级 AI 判定 |
|
||||||
|
| **特征维度** | 简单 (签名/保护/类型) | **40 维** (元数据 + 权限 + 代码 + 熵 + 网络 + DLL) |
|
||||||
|
| **无监督检测** | 无 | **4 类进程基线库** (Z-score + 重构误差) |
|
||||||
|
| **误报处理** | 系统提示词约束 LLM | **JIT/安全软件/脚本引擎** 白名单修正 |
|
||||||
|
| **速度** | O(区域×签名) | **80% 进程预过滤跳过**，仅 20% 进 AI 管线 |
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 功能特性
|
||||||
|
|
||||||
|
### 核心能力
|
||||||
|
|
||||||
|
| 能力 | 描述 |
|
||||||
|
|---|---|
|
||||||
|
| **40 维特征提取** | 内存页权限分布、PE 完整性、Shannon 熵、可疑 API/字符串、网络行为、DLL 加载链 |
|
||||||
|
| **三级联动检测** | 第一层: 无监督基线异常 → 第二层: 监督分类器 → 第三层: MITRE ATT&CK 规则复核 |
|
||||||
|
| **Process Hollowing 检测** | 内存 PE 头与磁盘文件比对，识别进程掏空攻击 |
|
||||||
|
| **Shannon 熵分析** | 采样计算内存区域熵值，识别加密/压缩载荷 (高熵 > 7.0) |
|
||||||
|
| **15 条 MITRE 规则** | T1055 进程注入、T1055.012 进程掏空、T1003 凭据转储、T1496 挖矿、T1486 勒索等 |
|
||||||
|
| **15 条内置签名** | NOP sled、CobaltStrike、Meterpreter、Mimikatz、ReflectiveLoader 等 |
|
||||||
|
| **智能误报修正** | JIT 运行时 (.NET/Java/Node.js)、安全软件、脚本引擎 (PowerShell)、开发工具 |
|
||||||
|
| **扫描模式** | 快速 (元数据) / 平衡 (采样) / 深度 (全量) 三档可选 |
|
||||||
|
| **LLM 辅助研判** | 可选开启大模型对可疑进程二次确认 |
|
||||||
|
| **中英文界面** | 一键切换全部 UI 文本 |
|
||||||
|
|
||||||
|
### 三级联动检测流程
|
||||||
|
|
||||||
|
```
|
||||||
|
[快速预过滤] → 跳过 >80% 已签名安全进程
|
||||||
|
↓
|
||||||
|
[第一层: 基线异常检测] → 40 维特征 Z-score + 重构误差
|
||||||
|
↓ 完全匹配基线 → 直接安全
|
||||||
|
[第二层: 监督分类器] → 加权线性模型 + 决策树规则
|
||||||
|
↓ 良性 + 低基线异常 → 安全
|
||||||
|
[第三层: MITRE 规则复核] → 15 条内存攻击规则 + 误报修正
|
||||||
|
↓ AI + 基线 + 规则 三级交叉验证 → 最终判定
|
||||||
|
```
|
||||||
|
|
||||||
|
### 内置签名 (15 条)
|
||||||
|
|
||||||
|
| 签名 | 类别 | 严重性 |
|
||||||
|
|---|---|---|
|
||||||
|
| `SHELLCODE_NOP_SLED` | Shellcode | 中 |
|
||||||
|
| `SHELLCODE_GETEIP` | Shellcode | 中 |
|
||||||
|
| `SHELLCODE_ROR13` | Shellcode | 中 |
|
||||||
|
| `SHELLCODE_URLDOWNLOAD` | Shellcode | 中 |
|
||||||
|
| `C2_COBALTSTRIKE` | C2 | 高 |
|
||||||
|
| `C2_METERPRETER` | C2 | 中 |
|
||||||
|
| `INJECTION_REFLECTIVE` | 注入 | 高 |
|
||||||
|
| `INJECTION_CRT` | 注入 | 中 |
|
||||||
|
| `INJECTION_VAE` | 注入 | 中 |
|
||||||
|
| `PROC_HOLLOW` | 注入 | 高 |
|
||||||
|
| `MALWARE_MIMIKATZ` | 恶意软件 | 高 |
|
||||||
|
| `CRYPTO_MINER` | 挖矿 | 高 |
|
||||||
|
| `RANSOM_NOTE` | 恶意软件 | 高 |
|
||||||
|
| `PS_DOWNLOAD` | 恶意软件 | 中 |
|
||||||
|
| `KEYLOGGER_API` | 恶意软件 | 中 |
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 架构
|
||||||
|
|
||||||
|
```
|
||||||
|
Models:
|
||||||
|
MemoryFeatures ── 40 维 AI 特征向量
|
||||||
|
BaselineProfile ── 正常程序基线 (4 类进程)
|
||||||
|
ProcessInfo ── 进程元数据 + 网络 + 内存区域
|
||||||
|
|
||||||
|
Services:
|
||||||
|
FeatureExtractor ── 从进程内存提取全维度特征
|
||||||
|
EntropyAnalyzer ── Shannon 熵计算 (采样优化)
|
||||||
|
PEHeaderAnalyzer ── PE 完整性验证 + Hollowing 检测
|
||||||
|
BaselineEngine ── 无监督基线异常检测 (Z-score + 重构误差)
|
||||||
|
ClassificationEngine ── 监督分类器 (加权 + 决策树)
|
||||||
|
RuleEngine ── 15 条 MITRE ATT&CK 内存攻击规则
|
||||||
|
DetectionPipeline ── 三级联动编排引擎
|
||||||
|
AIAnalyzer ── 集成管线 + LLM 辅助研判
|
||||||
|
MemoryScanner ── 实际字节匹配 + 按需扫描
|
||||||
|
ProcessCollector ── 进程枚举 + 模块列表采集
|
||||||
|
```
|
||||||
|
|
||||||
|
数据流：
|
||||||
|
```
|
||||||
|
[开始扫描] → ProcessCollector.CollectAll()
|
||||||
|
→ 快速预过滤 (不读内存, 跳过 >80% 进程)
|
||||||
|
→ FeatureExtractor.Extract() → MemoryFeatures (40 维向量)
|
||||||
|
→ 第一层: BaselineEngine.Analyze() → 基线异常分数
|
||||||
|
→ 第二层: ClassificationEngine.Classify() → 恶意/可疑/良性
|
||||||
|
→ 第三层: RuleEngine.Validate() → MITRE 规则 + 误报修正
|
||||||
|
→ ScanResult → IProgress<> 实时更新界面
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 快速开始
|
||||||
|
|
||||||
|
### 环境要求
|
||||||
|
|
||||||
|
- Windows 10 / 11 (x64)
|
||||||
|
- [.NET 8 SDK](https://dotnet.microsoft.com/download/dotnet/8.0)
|
||||||
|
- 管理员权限（用于内存扫描）
|
||||||
|
|
||||||
|
### 编译构建
|
||||||
|
|
||||||
|
```powershell
|
||||||
|
git clone https://github.com/Huang-158/MemScan-EDR.git
|
||||||
|
cd MemScan-EDR\src-csharp
|
||||||
|
|
||||||
|
# Debug 编译
|
||||||
|
dotnet build MemScanEDR.sln
|
||||||
|
|
||||||
|
# 发布单文件 EXE
|
||||||
|
dotnet publish MemScanEDR\MemScanEDR.csproj -c Release -r win-x64 --self-contained true -p:PublishSingleFile=true -o publish
|
||||||
|
|
||||||
|
# 运行
|
||||||
|
.\publish\MemScan-EDR.exe
|
||||||
|
```
|
||||||
|
|
||||||
|
或：
|
||||||
|
|
||||||
|
```powershell
|
||||||
|
.\scripts\build_csharp.bat
|
||||||
|
```
|
||||||
|
|
||||||
|
### CE-MCP 配置（可选）
|
||||||
|
|
||||||
|
1. 将 [ce-mcp-server](https://github.com/Huang-158/ce-mcp-server) 放在项目同级目录
|
||||||
|
2. 或在设置界面 → CE-MCP 服务器路径 配置
|
||||||
|
3. 设为 `disabled` 可跳过 CE-MCP
|
||||||
|
|
||||||
|
### AI 配置
|
||||||
|
|
||||||
|
1. 选择提供商：启发式 / OpenAI 兼容 / Claude / 本地
|
||||||
|
2. 填写 API 地址
|
||||||
|
3. 填写 API Key（本地存储）
|
||||||
|
4. 填写模型名称
|
||||||
|
5. 点击保存
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## AI 分析机制
|
||||||
|
|
||||||
|
1. **预过滤**：无任何可疑特征的进程直接标记为`安全`，不调用 API
|
||||||
|
2. **结构化 Prompt**：每个进程生成含元数据、网络连接、内存签名、可疑区域的格式化报告
|
||||||
|
3. **默认安全策略**：AI 被指示 >95% 的进程是良性的；需要多个并发指标才提升风险等级
|
||||||
|
4. **启发式降级**：API 不可用时采用保守阈值（≥0.50 可疑，≥0.75 高危）
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 项目结构
|
||||||
|
|
||||||
|
```
|
||||||
|
MemScan-EDR-2.0/
|
||||||
|
├── src-csharp/
|
||||||
|
│ └── MemScanEDR/
|
||||||
|
│ ├── MemScanEDR.csproj
|
||||||
|
│ ├── App.xaml / App.xaml.cs
|
||||||
|
│ ├── MainWindow.xaml / MainWindow.xaml.cs
|
||||||
|
│ ├── Models/
|
||||||
|
│ │ ├── MemoryFeatures.cs ★ 40 维 AI 特征向量
|
||||||
|
│ │ ├── BaselineProfile.cs ★ 正常程序基线库
|
||||||
|
│ │ ├── ProcessInfo.cs
|
||||||
|
│ │ ├── AIConfig.cs
|
||||||
|
│ │ └── AppSettings.cs
|
||||||
|
│ └── Services/
|
||||||
|
│ ├── FeatureExtractor.cs ★ 核心特征提取器
|
||||||
|
│ ├── EntropyAnalyzer.cs ★ Shannon 熵分析
|
||||||
|
│ ├── PEHeaderAnalyzer.cs ★ PE 完整性验证
|
||||||
|
│ ├── BaselineEngine.cs ★ 无监督基线检测
|
||||||
|
│ ├── ClassificationEngine.cs★ 监督分类器
|
||||||
|
│ ├── RuleEngine.cs ★ MITRE ATT&CK 规则
|
||||||
|
│ ├── DetectionPipeline.cs ★ 三级联动管线
|
||||||
|
│ ├── AIAnalyzer.cs (集成管线 + LLM)
|
||||||
|
│ ├── MemoryScanner.cs (优化版字节匹配)
|
||||||
|
│ └── ProcessCollector.cs
|
||||||
|
├── rules/
|
||||||
|
│ ├── shellcode.yar
|
||||||
|
│ ├── injection.yar
|
||||||
|
│ └── malware_strings.yar
|
||||||
|
├── scripts/
|
||||||
|
│ └── build_csharp.bat
|
||||||
|
├── LICENSE
|
||||||
|
├── README.md
|
||||||
|
└── README_EN.md
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 快速开始
|
||||||
|
|
||||||
|
### 环境要求
|
||||||
|
|
||||||
|
- Windows 10 / 11 (x64)
|
||||||
|
- [.NET 8 SDK](https://dotnet.microsoft.com/download/dotnet/8.0)
|
||||||
|
- 管理员权限（用于内存扫描）
|
||||||
|
|
||||||
|
### 编译构建
|
||||||
|
|
||||||
|
```powershell
|
||||||
|
git clone https://github.com/Huang-158/MemScan-EDR.git
|
||||||
|
cd MemScan-EDR
|
||||||
|
|
||||||
|
# 发布单文件 EXE
|
||||||
|
dotnet publish src-csharp/MemScanEDR/MemScanEDR.csproj -c Release -r win-x64 --self-contained true -p:PublishSingleFile=true -o publish
|
||||||
|
|
||||||
|
# 运行
|
||||||
|
.\publish\MemScan-EDR.exe
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 声明
|
||||||
|
|
||||||
|
> 本工具仅用于**合法的安全研究、教育及授权的安全评估**。未经授权对非自有或未被许可的系统使用属违法行为。使用者须遵守当地法律法规并自行承担所有风险。
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 许可证
|
||||||
|
|
||||||
|
MIT License — 详见 [LICENSE](LICENSE)。
|
||||||
113
README_EN.md
Normal file
113
README_EN.md
Normal file
@ -0,0 +1,113 @@
|
|||||||
|
<div align="right">
|
||||||
|
|
||||||
|
[](README.md)
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
# MemScan-EDR v2.0
|
||||||
|
|
||||||
|
> **AI-Powered Memory Threat Detection Engine with 3-Layer Detection Pipeline**
|
||||||
|
|
||||||
|
[](LICENSE)
|
||||||
|
[](https://dotnet.microsoft.com/)
|
||||||
|
[](https://www.microsoft.com/windows)
|
||||||
|
|
||||||
|
MemScan-EDR v2.0 fully refactors the threat detection logic: **40-dimensional memory feature vector + unsupervised baseline detection + supervised classifier + MITRE ATT&CK rule engine** in a 3-layer pipeline, significantly reducing false positives and improving scan speed. Built with C# WPF, packaged as a single `.exe`.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## v2.0 Key Improvements
|
||||||
|
|
||||||
|
| Dimension | v1.0 | v2.0 |
|
||||||
|
|-----------|------|------|
|
||||||
|
| **Scan Method** | Per-region signature matching | Prefilter → Feature extraction → 3-layer AI |
|
||||||
|
| **Features** | Simple (sig/protect/type) | **40-dim** (metadata + perms + code + entropy + network + DLL) |
|
||||||
|
| **Unsupervised** | None | **4-class process baseline** (Z-score + reconstruction error) |
|
||||||
|
| **False Positives** | System prompt constraints | **JIT/AV/scripting engine** whitelist corrections |
|
||||||
|
| **Speed** | O(regions x signatures) | **80% prefilters skipped**, only 20% enter AI pipeline |
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Features
|
||||||
|
|
||||||
|
| Capability | Description |
|
||||||
|
|---|---|
|
||||||
|
| **40-Dim Feature Extraction** | Memory page permissions, PE integrity, Shannon entropy, suspicious APIs/strings, network behavior, DLL loading chain |
|
||||||
|
| **3-Layer Detection** | Layer 1: Unsupervised baseline → Layer 2: Supervised classifier → Layer 3: MITRE ATT&CK rules |
|
||||||
|
| **Process Hollowing Detection** | Memory PE header vs disk file comparison |
|
||||||
|
| **Shannon Entropy Analysis** | Identify encrypted/compressed payloads (high entropy > 7.0) |
|
||||||
|
| **15 MITRE Rules** | T1055 injection, T1055.012 hollowing, T1003 credential dump, T1496 mining, T1486 ransomware, etc. |
|
||||||
|
| **15 Built-in Signatures** | NOP sled, CobaltStrike, Meterpreter, Mimikatz, ReflectiveLoader, etc. |
|
||||||
|
| **Smart FP Correction** | JIT runtimes (.NET/Java/Node.js), security software, scripting engines (PowerShell), dev tools |
|
||||||
|
| **Scan Modes** | Fast (metadata) / Balanced (sampled) / Deep (full memory) |
|
||||||
|
| **LLM Assist** | Optional LLM second opinion for suspicious processes |
|
||||||
|
| **Chinese/English UI** | One-click language toggle |
|
||||||
|
|
||||||
|
### 3-Layer Detection Pipeline
|
||||||
|
|
||||||
|
```
|
||||||
|
[Fast Prefilter] → Skip >80% signed safe processes
|
||||||
|
↓
|
||||||
|
[Layer 1: Baseline Anomaly] → 40-dim Z-score + reconstruction error
|
||||||
|
↓ Matches baseline → Safe
|
||||||
|
[Layer 2: Supervised Classifier] → Weighted linear model + decision tree
|
||||||
|
↓ Benign + low anomaly → Safe
|
||||||
|
[Layer 3: MITRE Rule Review] → 15 memory attack rules + FP corrections
|
||||||
|
↓ AI + Baseline + Rules cross-validation → Final verdict
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Architecture
|
||||||
|
|
||||||
|
```
|
||||||
|
Models:
|
||||||
|
MemoryFeatures ── 40-dim AI feature vector
|
||||||
|
BaselineProfile ── Normal process baselines (4 classes)
|
||||||
|
ProcessInfo ── Process metadata + network + memory regions
|
||||||
|
|
||||||
|
Services:
|
||||||
|
FeatureExtractor ── Extract all-dimensional features from process memory
|
||||||
|
EntropyAnalyzer ── Shannon entropy calculation (sampling optimized)
|
||||||
|
PEHeaderAnalyzer ── PE integrity verification + Hollowing detection
|
||||||
|
BaselineEngine ── Unsupervised baseline anomaly detection
|
||||||
|
ClassificationEngine ── Supervised classifier (weighted + decision tree)
|
||||||
|
RuleEngine ── 15 MITRE ATT&CK memory attack rules
|
||||||
|
DetectionPipeline ── 3-layer orchestration engine
|
||||||
|
AIAnalyzer ── Pipeline integration + LLM assist
|
||||||
|
MemoryScanner ── Real byte matching + on-demand scanning
|
||||||
|
ProcessCollector ── Process enumeration + module listing
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Quick Start
|
||||||
|
|
||||||
|
### Prerequisites
|
||||||
|
|
||||||
|
- Windows 10 / 11 (x64)
|
||||||
|
- [.NET 8 SDK](https://dotnet.microsoft.com/download/dotnet/8.0)
|
||||||
|
- Administrator privileges (for memory scanning)
|
||||||
|
|
||||||
|
### Build
|
||||||
|
|
||||||
|
```powershell
|
||||||
|
git clone https://github.com/Huang-158/MemScan-EDR.git
|
||||||
|
cd MemScan-EDR
|
||||||
|
|
||||||
|
dotnet publish src-csharp/MemScanEDR/MemScanEDR.csproj -c Release -r win-x64 --self-contained true -p:PublishSingleFile=true -o publish
|
||||||
|
|
||||||
|
.\publish\MemScan-EDR.exe
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Disclaimer
|
||||||
|
|
||||||
|
> This tool is intended for **legitimate security research, education, and authorized security assessments only**. Unauthorized use is illegal. Users are responsible for complying with all applicable laws.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## License
|
||||||
|
|
||||||
|
MIT License — see [LICENSE](LICENSE).
|
||||||
89
rules/injection.yar
Normal file
89
rules/injection.yar
Normal file
@ -0,0 +1,89 @@
|
|||||||
|
/*
|
||||||
|
* MemScan-EDR 进程注入检测规则
|
||||||
|
*/
|
||||||
|
|
||||||
|
rule Remote_Thread_Creation {
|
||||||
|
meta:
|
||||||
|
description = "检测远程线程注入相关API字符串"
|
||||||
|
author = "MemScan-EDR"
|
||||||
|
severity = "medium"
|
||||||
|
category = "injection"
|
||||||
|
strings:
|
||||||
|
$createremotethread = "CreateRemoteThread" nocase
|
||||||
|
$rtlcreateuserthread = "RtlCreateUserThread" nocase
|
||||||
|
$ntcreatethreadex = "NtCreateThreadEx" nocase
|
||||||
|
condition:
|
||||||
|
any of them
|
||||||
|
}
|
||||||
|
|
||||||
|
rule DLL_Injection_APC {
|
||||||
|
meta:
|
||||||
|
description = "检测 APC 注入 (QueueUserAPC) 特征"
|
||||||
|
author = "MemScan-EDR"
|
||||||
|
severity = "medium"
|
||||||
|
category = "injection"
|
||||||
|
strings:
|
||||||
|
$queueuserapc = "QueueUserAPC" nocase
|
||||||
|
$ntqueueapcthread = "NtQueueApcThread" nocase
|
||||||
|
$setthreadcontext = "SetThreadContext" nocase
|
||||||
|
condition:
|
||||||
|
any of them
|
||||||
|
}
|
||||||
|
|
||||||
|
rule Process_DLL_Injection {
|
||||||
|
meta:
|
||||||
|
description = "检测 DLL 注入常用 API"
|
||||||
|
author = "MemScan-EDR"
|
||||||
|
severity = "medium"
|
||||||
|
category = "injection"
|
||||||
|
strings:
|
||||||
|
$virtualallocex = "VirtualAllocEx" nocase
|
||||||
|
$writeprocessmemory = "WriteProcessMemory" nocase
|
||||||
|
$loadlibrarya = "LoadLibraryA" nocase
|
||||||
|
$getprocaddress = "GetProcAddress" nocase
|
||||||
|
condition:
|
||||||
|
($virtualallocex and $writeprocessmemory) or $loadlibrarya
|
||||||
|
}
|
||||||
|
|
||||||
|
rule Process_Hollowing {
|
||||||
|
meta:
|
||||||
|
description = "检测 Process Hollowing 特征"
|
||||||
|
author = "MemScan-EDR"
|
||||||
|
severity = "high"
|
||||||
|
category = "injection"
|
||||||
|
strings:
|
||||||
|
$createprocess = "CreateProcess" nocase
|
||||||
|
$zwunmap = "ZwUnmapViewOfSection" nocase
|
||||||
|
$ntunmap = "NtUnmapViewOfSection" nocase
|
||||||
|
$rtluserprocess = "RtlUserProcessParameters" nocase
|
||||||
|
condition:
|
||||||
|
$createprocess and ($zwunmap or $ntunmap)
|
||||||
|
}
|
||||||
|
|
||||||
|
rule Atom_Bombing {
|
||||||
|
meta:
|
||||||
|
description = "检测 Atom Bombing 注入技术"
|
||||||
|
author = "MemScan-EDR"
|
||||||
|
severity = "high"
|
||||||
|
category = "injection"
|
||||||
|
strings:
|
||||||
|
$globaladd = "GlobalAddAtom" nocase
|
||||||
|
$globalget = "GlobalGetAtomName" nocase
|
||||||
|
$ntqueueapc = "NtQueueApcThread" nocase
|
||||||
|
condition:
|
||||||
|
2 of them
|
||||||
|
}
|
||||||
|
|
||||||
|
rule Early_Bird_APC {
|
||||||
|
meta:
|
||||||
|
description = "检测 Early Bird APC 注入"
|
||||||
|
author = "MemScan-EDR"
|
||||||
|
severity = "high"
|
||||||
|
category = "injection"
|
||||||
|
strings:
|
||||||
|
$create_suspended = "CREATE_SUSPENDED" nocase
|
||||||
|
$queueuserapc = "QueueUserAPC" nocase
|
||||||
|
$resumethread = "ResumeThread" nocase
|
||||||
|
condition:
|
||||||
|
2 of them
|
||||||
|
}
|
||||||
119
rules/malware_strings.yar
Normal file
119
rules/malware_strings.yar
Normal file
@ -0,0 +1,119 @@
|
|||||||
|
/*
|
||||||
|
* MemScan-EDR 恶意字符串检测规则
|
||||||
|
* 覆盖 C2 通信、勒索软件、挖矿等常见恶意字符串模式
|
||||||
|
*/
|
||||||
|
|
||||||
|
rule C2_Domain_Patterns {
|
||||||
|
meta:
|
||||||
|
description = "常见 C2 域名/URL 模式"
|
||||||
|
author = "MemScan-EDR"
|
||||||
|
severity = "high"
|
||||||
|
category = "c2"
|
||||||
|
strings:
|
||||||
|
$beacon_c2 = ".php?id=" ascii
|
||||||
|
$api_req = "/api/v1/beacon" nocase
|
||||||
|
$c2_uri = "/index.asp?id=" ascii
|
||||||
|
$heartbeat = "heartbeat" nocase
|
||||||
|
$check_in = "/checkin" nocase
|
||||||
|
$pulse = "/pulse" nocase
|
||||||
|
condition:
|
||||||
|
any of them
|
||||||
|
}
|
||||||
|
|
||||||
|
rule Ransomware_Strings {
|
||||||
|
meta:
|
||||||
|
description = "勒索软件常见字符串模式"
|
||||||
|
author = "MemScan-EDR"
|
||||||
|
severity = "high"
|
||||||
|
category = "malware"
|
||||||
|
strings:
|
||||||
|
$ransom = "ransom" nocase
|
||||||
|
$decrypt = "decrypt" nocase
|
||||||
|
$bitcoin = "bitcoin" nocase
|
||||||
|
$monero = "monero" nocase
|
||||||
|
$payment = "payment" nocase
|
||||||
|
$encrypted = "YOUR_FILES_ARE_ENCRYPTED" nocase
|
||||||
|
condition:
|
||||||
|
any of them
|
||||||
|
}
|
||||||
|
|
||||||
|
rule Crypto_Mining_Pool {
|
||||||
|
meta:
|
||||||
|
description = "加密货币挖矿池 URL 模式"
|
||||||
|
author = "MemScan-EDR"
|
||||||
|
severity = "high"
|
||||||
|
category = "crypto"
|
||||||
|
strings:
|
||||||
|
$stratum = "stratum+tcp://" ascii
|
||||||
|
$xmrig = "xmrig" nocase
|
||||||
|
$pool_url = "pool." nocase
|
||||||
|
$mining_proxy = "nicehash" nocase
|
||||||
|
$worker = "worker" nocase
|
||||||
|
condition:
|
||||||
|
any of them
|
||||||
|
}
|
||||||
|
|
||||||
|
rule Keylogger_Strings {
|
||||||
|
meta:
|
||||||
|
description = "键盘记录器常见字符串"
|
||||||
|
author = "MemScan-EDR"
|
||||||
|
severity = "high"
|
||||||
|
category = "malware"
|
||||||
|
strings:
|
||||||
|
$hook = "SetWindowsHookEx" nocase
|
||||||
|
$getkeystate = "GetAsyncKeyState" nocase
|
||||||
|
$keylog = "keylog" nocase
|
||||||
|
$clipboard = "GetClipboardData" nocase
|
||||||
|
condition:
|
||||||
|
2 of them
|
||||||
|
}
|
||||||
|
|
||||||
|
rule Credential_Theft {
|
||||||
|
meta:
|
||||||
|
description = "凭证窃取工具特征字符串"
|
||||||
|
author = "MemScan-EDR"
|
||||||
|
severity = "high"
|
||||||
|
category = "malware"
|
||||||
|
strings:
|
||||||
|
$mimikatz = "mimikatz" nocase
|
||||||
|
$sekurlsa = "sekurlsa" nocase
|
||||||
|
$lsa_dump = "lsadump" nocase
|
||||||
|
$wdigest = "wdigest" nocase
|
||||||
|
$kerberos = "kerberos" nocase
|
||||||
|
$logonpasswords = "logonpasswords" nocase
|
||||||
|
condition:
|
||||||
|
any of them
|
||||||
|
}
|
||||||
|
|
||||||
|
rule Reverse_Shell_Commands {
|
||||||
|
meta:
|
||||||
|
description = "反弹 Shell 常见命令"
|
||||||
|
author = "MemScan-EDR"
|
||||||
|
severity = "medium"
|
||||||
|
category = "c2"
|
||||||
|
strings:
|
||||||
|
$bash = "/bin/sh" ascii
|
||||||
|
$cmd = "cmd.exe" nocase
|
||||||
|
$powershell = "powershell.exe" nocase
|
||||||
|
$ncat = "nc " ascii
|
||||||
|
$pipe = "mkfifo" ascii
|
||||||
|
condition:
|
||||||
|
any of them
|
||||||
|
}
|
||||||
|
|
||||||
|
rule Credential_Dump_Tools {
|
||||||
|
meta:
|
||||||
|
description = "常见凭证提取工具名称"
|
||||||
|
author = "MemScan-EDR"
|
||||||
|
severity = "high"
|
||||||
|
category = "malware"
|
||||||
|
strings:
|
||||||
|
$pwdump = "pwdump" nocase
|
||||||
|
$fgdump = "fgdump" nocase
|
||||||
|
$cachedump = "cachedump" nocase
|
||||||
|
$samdump = "samdump" nocase
|
||||||
|
$procdump = "procdump" nocase
|
||||||
|
$lsass = "lsass" nocase
|
||||||
|
condition:
|
||||||
|
any of them
|
||||||
|
}
|
||||||
121
rules/shellcode.yar
Normal file
121
rules/shellcode.yar
Normal file
@ -0,0 +1,121 @@
|
|||||||
|
/*
|
||||||
|
* MemScan-EDR Shellcode 检测规则
|
||||||
|
* 覆盖常见 C2 框架、注入技术、恶意 Shellcode 特征
|
||||||
|
*/
|
||||||
|
|
||||||
|
rule Meterpreter_Reverse_TCP_Shellcode {
|
||||||
|
meta:
|
||||||
|
description = "检测 Metasploit Meterpreter reverse_tcp shellcode"
|
||||||
|
author = "MemScan-EDR"
|
||||||
|
severity = "high"
|
||||||
|
category = "shellcode"
|
||||||
|
reference = "https://github.com/rapid7/metasploit-framework"
|
||||||
|
strings:
|
||||||
|
$stager = "WS2_32.dll" nocase
|
||||||
|
$port_loop = { 66 B8 [4] 50 6A 02 6A }
|
||||||
|
$wsastartup = { B8 [4] 50 6A [1-2] 6A }
|
||||||
|
$connect_pattern = { 6A 00 6A 00 6A 00 6A 06 6A 01 6A 02 }
|
||||||
|
condition:
|
||||||
|
any of them
|
||||||
|
}
|
||||||
|
|
||||||
|
rule CobaltStrike_Beacon_Config {
|
||||||
|
meta:
|
||||||
|
description = "检测 CobaltStrike Beacon 配置特征"
|
||||||
|
author = "MemScan-EDR"
|
||||||
|
severity = "high"
|
||||||
|
category = "c2"
|
||||||
|
strings:
|
||||||
|
$beacon_x86 = { 00 00 00 00 [16] 00 00 00 00 00 01 00 01 }
|
||||||
|
$beacon_x64 = { 00 00 00 00 00 00 00 00 [32] 00 01 00 01 00 }
|
||||||
|
$sleep_mask = { 00 00 00 00 [8] 00 00 00 00 }
|
||||||
|
$config_header = { 00 01 00 01 [16] }
|
||||||
|
condition:
|
||||||
|
any of them
|
||||||
|
}
|
||||||
|
|
||||||
|
rule Reflective_DLL_Injection {
|
||||||
|
meta:
|
||||||
|
description = "检测 Reflective DLL Injection 特征"
|
||||||
|
author = "MemScan-EDR"
|
||||||
|
severity = "high"
|
||||||
|
category = "injection"
|
||||||
|
strings:
|
||||||
|
$reflectiveloader = "ReflectiveLoader" nocase
|
||||||
|
$reflective_dll = "reflective_dll" nocase
|
||||||
|
$pe_in_memory = "MZ" at 0
|
||||||
|
$getprocaddress_hash = { 8B [1-2] E8 [4] 01 C1 [1-2] [1-2] 85 }
|
||||||
|
condition:
|
||||||
|
($reflectiveloader or $reflective_dll) and $pe_in_memory
|
||||||
|
}
|
||||||
|
|
||||||
|
rule Shellcode_NOP_Sled {
|
||||||
|
meta:
|
||||||
|
description = "检测 NOP sled (连续 0x90 指令)"
|
||||||
|
author = "MemScan-EDR"
|
||||||
|
severity = "medium"
|
||||||
|
category = "shellcode"
|
||||||
|
strings:
|
||||||
|
$nop_sled = { 90 90 90 90 90 90 90 90 90 90 90 90 }
|
||||||
|
$nop_int3_sled = { CC CC CC CC CC CC CC CC }
|
||||||
|
condition:
|
||||||
|
$nop_sled or $nop_int3_sled
|
||||||
|
}
|
||||||
|
|
||||||
|
rule Shellcode_GetEIP_Technique {
|
||||||
|
meta:
|
||||||
|
description = "检测获取 EIP/EIP 的 Shellcode 技术"
|
||||||
|
author = "MemScan-EDR"
|
||||||
|
severity = "medium"
|
||||||
|
category = "shellcode"
|
||||||
|
strings:
|
||||||
|
$call_pop = { E8 00 00 00 00 58 } // call $+5; pop eax
|
||||||
|
$call_pop2 = { E8 00 00 00 00 59 } // call $+5; pop ecx
|
||||||
|
$fs_teb = { 64 A1 30 00 00 00 } // mov eax, fs:[0x30] (PEB x86)
|
||||||
|
$gs_teb = { 65 48 8B [1-2] 60 00 00 00 } // mov reg, gs:[0x60] (PEB x64)
|
||||||
|
condition:
|
||||||
|
any of them
|
||||||
|
}
|
||||||
|
|
||||||
|
rule Shellcode_API_Hash_ROR13 {
|
||||||
|
meta:
|
||||||
|
description = "检测 ROR13 API 哈希解析模式"
|
||||||
|
author = "MemScan-EDR"
|
||||||
|
severity = "medium"
|
||||||
|
category = "shellcode"
|
||||||
|
strings:
|
||||||
|
$ror13_x86 = { C1 C8 0D } // ror eax, 0xD
|
||||||
|
$ror13_x64 = { 41 C1 C8 0D } // ror r8d, 0xD
|
||||||
|
$rol13_x86 = { C1 C0 0D } // rol eax, 0xD
|
||||||
|
condition:
|
||||||
|
any of them
|
||||||
|
}
|
||||||
|
|
||||||
|
rule Sliver_Implant {
|
||||||
|
meta:
|
||||||
|
description = "检测 Sliver C2 框架 implant 特征"
|
||||||
|
author = "MemScan-EDR"
|
||||||
|
severity = "high"
|
||||||
|
category = "c2"
|
||||||
|
strings:
|
||||||
|
$sliver = "sliver" nocase
|
||||||
|
$mtls = "mtls" nocase
|
||||||
|
$wg = "wireguard" nocase
|
||||||
|
$grpc = "gRPC" nocase
|
||||||
|
condition:
|
||||||
|
any of them
|
||||||
|
}
|
||||||
|
|
||||||
|
rule Process_Hollowing_Indicator {
|
||||||
|
meta:
|
||||||
|
description = "检测 Process Hollowing 特征"
|
||||||
|
author = "MemScan-EDR"
|
||||||
|
severity = "high"
|
||||||
|
category = "injection"
|
||||||
|
strings:
|
||||||
|
$ntunmap = "NtUnmapViewOfSection" nocase
|
||||||
|
$create_suspended = { 00 00 00 00 00 00 00 00 [8] 04 00 00 00 }
|
||||||
|
$pe_imagebase = { 00 00 40 00 00 00 00 00 } // IMAGE_BASE 0x400000
|
||||||
|
condition:
|
||||||
|
any of them
|
||||||
|
}
|
||||||
Loading…
Reference in New Issue
Block a user