90 lines
2.5 KiB
Plaintext
90 lines
2.5 KiB
Plaintext
/*
|
|
* MemScan-EDR 进程注入检测规则
|
|
*/
|
|
|
|
rule Remote_Thread_Creation {
|
|
meta:
|
|
description = "检测远程线程注入相关API字符串"
|
|
author = "MemScan-EDR"
|
|
severity = "medium"
|
|
category = "injection"
|
|
strings:
|
|
$createremotethread = "CreateRemoteThread" nocase
|
|
$rtlcreateuserthread = "RtlCreateUserThread" nocase
|
|
$ntcreatethreadex = "NtCreateThreadEx" nocase
|
|
condition:
|
|
any of them
|
|
}
|
|
|
|
rule DLL_Injection_APC {
|
|
meta:
|
|
description = "检测 APC 注入 (QueueUserAPC) 特征"
|
|
author = "MemScan-EDR"
|
|
severity = "medium"
|
|
category = "injection"
|
|
strings:
|
|
$queueuserapc = "QueueUserAPC" nocase
|
|
$ntqueueapcthread = "NtQueueApcThread" nocase
|
|
$setthreadcontext = "SetThreadContext" nocase
|
|
condition:
|
|
any of them
|
|
}
|
|
|
|
rule Process_DLL_Injection {
|
|
meta:
|
|
description = "检测 DLL 注入常用 API"
|
|
author = "MemScan-EDR"
|
|
severity = "medium"
|
|
category = "injection"
|
|
strings:
|
|
$virtualallocex = "VirtualAllocEx" nocase
|
|
$writeprocessmemory = "WriteProcessMemory" nocase
|
|
$loadlibrarya = "LoadLibraryA" nocase
|
|
$getprocaddress = "GetProcAddress" nocase
|
|
condition:
|
|
($virtualallocex and $writeprocessmemory) or $loadlibrarya
|
|
}
|
|
|
|
rule Process_Hollowing {
|
|
meta:
|
|
description = "检测 Process Hollowing 特征"
|
|
author = "MemScan-EDR"
|
|
severity = "high"
|
|
category = "injection"
|
|
strings:
|
|
$createprocess = "CreateProcess" nocase
|
|
$zwunmap = "ZwUnmapViewOfSection" nocase
|
|
$ntunmap = "NtUnmapViewOfSection" nocase
|
|
$rtluserprocess = "RtlUserProcessParameters" nocase
|
|
condition:
|
|
$createprocess and ($zwunmap or $ntunmap)
|
|
}
|
|
|
|
rule Atom_Bombing {
|
|
meta:
|
|
description = "检测 Atom Bombing 注入技术"
|
|
author = "MemScan-EDR"
|
|
severity = "high"
|
|
category = "injection"
|
|
strings:
|
|
$globaladd = "GlobalAddAtom" nocase
|
|
$globalget = "GlobalGetAtomName" nocase
|
|
$ntqueueapc = "NtQueueApcThread" nocase
|
|
condition:
|
|
2 of them
|
|
}
|
|
|
|
rule Early_Bird_APC {
|
|
meta:
|
|
description = "检测 Early Bird APC 注入"
|
|
author = "MemScan-EDR"
|
|
severity = "high"
|
|
category = "injection"
|
|
strings:
|
|
$create_suspended = "CREATE_SUSPENDED" nocase
|
|
$queueuserapc = "QueueUserAPC" nocase
|
|
$resumethread = "ResumeThread" nocase
|
|
condition:
|
|
2 of them
|
|
}
|