120 lines
3.1 KiB
Plaintext
120 lines
3.1 KiB
Plaintext
/*
|
|
* MemScan-EDR 恶意字符串检测规则
|
|
* 覆盖 C2 通信、勒索软件、挖矿等常见恶意字符串模式
|
|
*/
|
|
|
|
rule C2_Domain_Patterns {
|
|
meta:
|
|
description = "常见 C2 域名/URL 模式"
|
|
author = "MemScan-EDR"
|
|
severity = "high"
|
|
category = "c2"
|
|
strings:
|
|
$beacon_c2 = ".php?id=" ascii
|
|
$api_req = "/api/v1/beacon" nocase
|
|
$c2_uri = "/index.asp?id=" ascii
|
|
$heartbeat = "heartbeat" nocase
|
|
$check_in = "/checkin" nocase
|
|
$pulse = "/pulse" nocase
|
|
condition:
|
|
any of them
|
|
}
|
|
|
|
rule Ransomware_Strings {
|
|
meta:
|
|
description = "勒索软件常见字符串模式"
|
|
author = "MemScan-EDR"
|
|
severity = "high"
|
|
category = "malware"
|
|
strings:
|
|
$ransom = "ransom" nocase
|
|
$decrypt = "decrypt" nocase
|
|
$bitcoin = "bitcoin" nocase
|
|
$monero = "monero" nocase
|
|
$payment = "payment" nocase
|
|
$encrypted = "YOUR_FILES_ARE_ENCRYPTED" nocase
|
|
condition:
|
|
any of them
|
|
}
|
|
|
|
rule Crypto_Mining_Pool {
|
|
meta:
|
|
description = "加密货币挖矿池 URL 模式"
|
|
author = "MemScan-EDR"
|
|
severity = "high"
|
|
category = "crypto"
|
|
strings:
|
|
$stratum = "stratum+tcp://" ascii
|
|
$xmrig = "xmrig" nocase
|
|
$pool_url = "pool." nocase
|
|
$mining_proxy = "nicehash" nocase
|
|
$worker = "worker" nocase
|
|
condition:
|
|
any of them
|
|
}
|
|
|
|
rule Keylogger_Strings {
|
|
meta:
|
|
description = "键盘记录器常见字符串"
|
|
author = "MemScan-EDR"
|
|
severity = "high"
|
|
category = "malware"
|
|
strings:
|
|
$hook = "SetWindowsHookEx" nocase
|
|
$getkeystate = "GetAsyncKeyState" nocase
|
|
$keylog = "keylog" nocase
|
|
$clipboard = "GetClipboardData" nocase
|
|
condition:
|
|
2 of them
|
|
}
|
|
|
|
rule Credential_Theft {
|
|
meta:
|
|
description = "凭证窃取工具特征字符串"
|
|
author = "MemScan-EDR"
|
|
severity = "high"
|
|
category = "malware"
|
|
strings:
|
|
$mimikatz = "mimikatz" nocase
|
|
$sekurlsa = "sekurlsa" nocase
|
|
$lsa_dump = "lsadump" nocase
|
|
$wdigest = "wdigest" nocase
|
|
$kerberos = "kerberos" nocase
|
|
$logonpasswords = "logonpasswords" nocase
|
|
condition:
|
|
any of them
|
|
}
|
|
|
|
rule Reverse_Shell_Commands {
|
|
meta:
|
|
description = "反弹 Shell 常见命令"
|
|
author = "MemScan-EDR"
|
|
severity = "medium"
|
|
category = "c2"
|
|
strings:
|
|
$bash = "/bin/sh" ascii
|
|
$cmd = "cmd.exe" nocase
|
|
$powershell = "powershell.exe" nocase
|
|
$ncat = "nc " ascii
|
|
$pipe = "mkfifo" ascii
|
|
condition:
|
|
any of them
|
|
}
|
|
|
|
rule Credential_Dump_Tools {
|
|
meta:
|
|
description = "常见凭证提取工具名称"
|
|
author = "MemScan-EDR"
|
|
severity = "high"
|
|
category = "malware"
|
|
strings:
|
|
$pwdump = "pwdump" nocase
|
|
$fgdump = "fgdump" nocase
|
|
$cachedump = "cachedump" nocase
|
|
$samdump = "samdump" nocase
|
|
$procdump = "procdump" nocase
|
|
$lsass = "lsass" nocase
|
|
condition:
|
|
any of them
|
|
}
|