/*
 * MemScan-EDR 恶意字符串检测规则
 * 覆盖 C2 通信、勒索软件、挖矿等常见恶意字符串模式
 */

rule C2_Domain_Patterns {
    meta:
        description = "常见 C2 域名/URL 模式"
        author = "MemScan-EDR"
        severity = "high"
        category = "c2"
    strings:
        $beacon_c2 = ".php?id=" ascii
        $api_req = "/api/v1/beacon" nocase
        $c2_uri = "/index.asp?id=" ascii
        $heartbeat = "heartbeat" nocase
        $check_in = "/checkin" nocase
        $pulse = "/pulse" nocase
    condition:
        any of them
}

rule Ransomware_Strings {
    meta:
        description = "勒索软件常见字符串模式"
        author = "MemScan-EDR"
        severity = "high"
        category = "malware"
    strings:
        $ransom = "ransom" nocase
        $decrypt = "decrypt" nocase
        $bitcoin = "bitcoin" nocase
        $monero = "monero" nocase
        $payment = "payment" nocase
        $encrypted = "YOUR_FILES_ARE_ENCRYPTED" nocase
    condition:
        any of them
}

rule Crypto_Mining_Pool {
    meta:
        description = "加密货币挖矿池 URL 模式"
        author = "MemScan-EDR"
        severity = "high"
        category = "crypto"
    strings:
        $stratum = "stratum+tcp://" ascii
        $xmrig = "xmrig" nocase
        $pool_url = "pool." nocase
        $mining_proxy = "nicehash" nocase
        $worker = "worker" nocase
    condition:
        any of them
}

rule Keylogger_Strings {
    meta:
        description = "键盘记录器常见字符串"
        author = "MemScan-EDR"
        severity = "high"
        category = "malware"
    strings:
        $hook = "SetWindowsHookEx" nocase
        $getkeystate = "GetAsyncKeyState" nocase
        $keylog = "keylog" nocase
        $clipboard = "GetClipboardData" nocase
    condition:
        2 of them
}

rule Credential_Theft {
    meta:
        description = "凭证窃取工具特征字符串"
        author = "MemScan-EDR"
        severity = "high"
        category = "malware"
    strings:
        $mimikatz = "mimikatz" nocase
        $sekurlsa = "sekurlsa" nocase
        $lsa_dump = "lsadump" nocase
        $wdigest = "wdigest" nocase
        $kerberos = "kerberos" nocase
        $logonpasswords = "logonpasswords" nocase
    condition:
        any of them
}

rule Reverse_Shell_Commands {
    meta:
        description = "反弹 Shell 常见命令"
        author = "MemScan-EDR"
        severity = "medium"
        category = "c2"
    strings:
        $bash = "/bin/sh" ascii
        $cmd = "cmd.exe" nocase
        $powershell = "powershell.exe" nocase
        $ncat = "nc " ascii
        $pipe = "mkfifo" ascii
    condition:
        any of them
}

rule Credential_Dump_Tools {
    meta:
        description = "常见凭证提取工具名称"
        author = "MemScan-EDR"
        severity = "high"
        category = "malware"
    strings:
        $pwdump = "pwdump" nocase
        $fgdump = "fgdump" nocase
        $cachedump = "cachedump" nocase
        $samdump = "samdump" nocase
        $procdump = "procdump" nocase
        $lsass = "lsass" nocase
    condition:
        any of them
}