reverse-skills-max: initial public release (restored, redacted, hardened)
This commit is contained in:
baradok609hecl1pq6qi
@@ -0,0 +1,195 @@
|
||||
# 反分析技术检测
|
||||
|
||||
> 94 种反分析技术，9 个类别，82 条已验证 YARA 规则
|
||||
> Source: Anti-VM YARA Library (Journal of Cybersecurity and Privacy, April 2026)
|
||||
|
||||
## 九类反分析技术
|
||||
|
||||
### 1. 定时检测（12 种）
|
||||
|
||||
```text
|
||||
技术原理: 恶意代码通过长时间睡眠等待，使沙箱超时退出。
|
||||
|
||||
常见实现:
|
||||
□ Sleep(300000) // 5 分钟睡眠
|
||||
□ NtDelayExecution(60000) // 直接 syscall
|
||||
□ GetTickCount 循环等待
|
||||
□ QueryPerformanceCounter 精确延时
|
||||
□ SetTimer + 回调执行恶意代码
|
||||
□ WaitForSingleObject 等待内核对象
|
||||
|
||||
YARA 检测难度: 低（时序行为需动态分析）
|
||||
绕过方法: CAPE sleep_skip、加速时间流逝
|
||||
```
|
||||
|
||||
### 2. CPU 指纹检测（8 种）
|
||||
|
||||
```text
|
||||
□ CPUID 指令 → hypervisor 签名
|
||||
- hv: "VMwareVMware", "VBoxVBoxVBox"
|
||||
- leaf 0x40000000 → Hypervisor Vendor
|
||||
|
||||
□ 核心数检测: < 2 核心 → 可能是沙箱
|
||||
□ AMD-V / Intel VT-x: 沙箱通常启用硬件虚拟化
|
||||
|
||||
YARA 检测: 中（CPUID 指令序列可被静态识别）
|
||||
```
|
||||
|
||||
### 3. 固件/BIOS 检测（6 种）★ YARA 强项
|
||||
|
||||
```text
|
||||
□ SMBIOS 字符串:
|
||||
- Manufacturer: "VMware, Inc.", "innotek GmbH"
|
||||
- Product: "VirtualBox", "KVM", "QEMU"
|
||||
- Serial: "0"（默认序列号）
|
||||
|
||||
□ ACPI 表: WAET / VRTUAL / BOCHS 签名
|
||||
|
||||
YARA 检测: 高（87% 精度） — 字符串字面量存在于二进制中
|
||||
```
|
||||
|
||||
### 4. 硬件指纹（10 种）
|
||||
|
||||
```text
|
||||
□ MAC 地址 OUI:
|
||||
- VMware: 00:0C:29, 00:50:56, 00:05:69
|
||||
- VirtualBox: 08:00:27
|
||||
- Hyper-V: 00:15:5D
|
||||
|
||||
□ 磁盘序列号: "VBOX HARDDISK", "VMware Virtual S"
|
||||
□ 显卡名称: "VMware SVGA II", "VirtualBox Graphics Adapter"
|
||||
|
||||
GetAdapterInfo / NtQuerySystemInformation → 读取硬件信息
|
||||
```
|
||||
|
||||
### 5. API Hook 枚举（5 种）
|
||||
|
||||
```text
|
||||
□ 检测 EDR/AV 的 ntdll.dll hook
|
||||
- 读取 ntdll.dll 的磁盘副本 → 对比内存中的版本
|
||||
- 如果 syscall stub 被修改 → 有 hook
|
||||
|
||||
□ 检测 sandbox hook
|
||||
- LoadLibrary → 对比函数序言
|
||||
- WriteProcessMemory → 检测 inline hook
|
||||
```
|
||||
|
||||
### 6. 进程检测（15 种）★ YARA 强项
|
||||
|
||||
```text
|
||||
□ 安全工具进程名检查:
|
||||
- "wireshark.exe", "procmon.exe", "processhacker.exe"
|
||||
- "frida-server", "magiskd", "x64dbg.exe"
|
||||
- "ida64.exe", "ollydbg.exe", "windbg.exe"
|
||||
|
||||
□ 沙箱 Agent 检测:
|
||||
- "python.exe" (CAPE agent)
|
||||
- "VBoxTray.exe", "VBoxService.exe"
|
||||
|
||||
CreateToolhelp32Snapshot → Process32First/Next 遍历
|
||||
```
|
||||
|
||||
### 7. 文件系统检测（12 种）★ YARA 强项
|
||||
|
||||
```text
|
||||
□ 沙箱/VM 文件路径:
|
||||
- C:\Program Files\VMware\
|
||||
- C:\Program Files\Oracle\VirtualBox\
|
||||
- C:\agent\agent.pyw (CAPE)
|
||||
- /usr/bin/qemu-ga
|
||||
|
||||
□ 虚拟设备文件:
|
||||
- \\.\VBoxMiniRdrDN
|
||||
- \\.\HGFS (VMware Shared Folders)
|
||||
- \\.\pipe\vbox*
|
||||
|
||||
YARA 检测: 高 — 路径字符串明确
|
||||
```
|
||||
|
||||
### 8. 注册表检测（8 种）★ YARA 强项
|
||||
|
||||
```text
|
||||
□ VM 相关注册表键:
|
||||
- HKLM\SOFTWARE\VMware, Inc.\
|
||||
- HKLM\HARDWARE\ACPI\DSDT\VBOX__
|
||||
- HKLM\SYSTEM\ControlSet001\Services\VBoxSF
|
||||
|
||||
□ 沙箱检测:
|
||||
RegOpenKeyEx / RegQueryValueEx 组合检测
|
||||
```
|
||||
|
||||
### 9. 窗口检测（8 种）★ YARA 强项
|
||||
|
||||
```text
|
||||
□ 调试器窗口:
|
||||
- "x64dbg", "OllyDbg", "IDA", "WinDbg"
|
||||
- "Wireshark", "Process Hacker"
|
||||
|
||||
□ 沙箱窗口:
|
||||
FindWindow → 枚举顶级窗口 → 匹配已知安全工具窗口标题
|
||||
|
||||
YARA 检测: 高 — 窗口标题字符串存在于内存/二进制
|
||||
```
|
||||
|
||||
## 42 条高精度 YARA 规则（精度 ≥75%）
|
||||
|
||||
以下类别在 YARA 中检测效果最好：
|
||||
|
||||
| 类别 | 规则数 | 平均精度 | 典型 FP 来源 |
|
||||
|------|:--:|:--:|------|
|
||||
| 固件/BIOS | 5 | 87% | 虚拟机软件安装包 |
|
||||
| 进程检测 | 12 | 82% | 安全工具本身 |
|
||||
| 文件系统 | 8 | 79% | 虚拟机管理工具 |
|
||||
| 注册表 | 6 | 78% | 无 |
|
||||
| 窗口检测 | 4 | 76% | 安全/调试工具 |
|
||||
| API Hook | 3 | 72% | 防病毒软件 |
|
||||
| 硬件指纹 | 2 | 68% | 虚拟化软件 |
|
||||
| 定时检测 | 1 | 45% | 游戏/多媒体软件 |
|
||||
|
||||
## 高级反分析技术
|
||||
|
||||
### 定时逃逸（Beyond Simple Sleep）
|
||||
|
||||
```c
|
||||
// 检测时间加速
|
||||
LARGE_INTEGER freq, start, end;
|
||||
QueryPerformanceFrequency(&freq);
|
||||
QueryPerformanceCounter(&start);
|
||||
Sleep(1000);
|
||||
QueryPerformanceCounter(&end);
|
||||
double elapsed = (double)(end.QuadPart - start.QuadPart) / freq.QuadPart;
|
||||
if (elapsed != 1.0) exit(); // 时间被加速 → 沙箱
|
||||
```
|
||||
|
||||
### 基于异常的检测
|
||||
|
||||
```c
|
||||
// 触发除零异常 → 检查 SEH 是否被 Hook
|
||||
__try {
|
||||
volatile int x = 0;
|
||||
volatile int y = 1 / x;
|
||||
} __except(EXCEPTION_EXECUTE_HANDLER) {
|
||||
// 正常: 异常被捕获
|
||||
// 不正常: EDR 的 vectored exception handler 先处理了 → 说明有 hook
|
||||
}
|
||||
```
|
||||
|
||||
### Return Address 完整性检查
|
||||
|
||||
```asm
|
||||
; 调用前保存返回地址预期值
|
||||
call [ntdll.NtAllocateVirtualMemory]
|
||||
; 返回后检查栈上返回地址是否被篡改
|
||||
cmp [rsp], expected_return_address
|
||||
jne edr_detected
|
||||
```
|
||||
|
||||
## 最佳实践
|
||||
|
||||
1. **分层检测**: 静态 YARA + 动态行为 + 签名 (不要只依赖一种)
|
||||
2. **定期更新规则**: 新 VM/沙箱版本需要新检测规则
|
||||
3. **FP 验证**: 每条规则必须在良性样本集上验证（推荐: Assemblage 92,508 样本）
|
||||
4. **组合条件**: 单一检测可能误报，多条件组合提高精度
|
||||
5. **关注字符串模式**: 固件/BIOS/文件/注册表/窗口检测在 YARA 中最有效
|
||||
|
||||
Source: "Automating the Detection of Evasive Windows Malware" (April 2026), CAPE docs, Joe Sandbox Analysis Reports
|
||||
@@ -0,0 +1,204 @@
|
||||
# 沙箱编排与自动化
|
||||
|
||||
## 沙箱选型
|
||||
|
||||
| 沙箱 | 类型 | 速度 | 逃逸检测 | 推荐场景 |
|
||||
|------|:--:|------|:--:|------|
|
||||
| CAPE v2 | 开源 | 中 | 强 | 深度分析 + YARA 集成 |
|
||||
| ASD Azul | 开源 | 快 | 中 | 大规模批量分类 |
|
||||
| Joe Sandbox | 商业 | 中 | 极强 | 高价值样本深度分析 |
|
||||
| ANY.RUN | 商业云 | 快 | 中 | 交互式快速分诊 |
|
||||
| Triage | 商业云 | 极快 | 弱 | 批量初筛 |
|
||||
| Cuckoo v3 | 开源 | 慢 | 弱 | 学习/研究 |
|
||||
|
||||
## CAPE Sandbox 部署
|
||||
|
||||
```bash
|
||||
# Ubuntu 22.04+
|
||||
git clone https://github.com/kevoreilly/CAPEv2
|
||||
cd CAPEv2
|
||||
sudo ./cape2.sh base # 安装依赖
|
||||
sudo ./cape2.sh all # 完整安装
|
||||
|
||||
# Web 界面: http://localhost:8000
|
||||
# API: http://localhost:8000/apiv2/
|
||||
|
||||
# 提交样本
|
||||
curl -F "file=@sample.exe" http://localhost:8000/apiv2/tasks/create/file/
|
||||
|
||||
# 批量提交
|
||||
for f in samples/*.exe; do
|
||||
curl -F "file=@$f" http://localhost:8000/apiv2/tasks/create/file/
|
||||
done
|
||||
```
|
||||
|
||||
## 自动化分析管道
|
||||
|
||||
```python
|
||||
# 多沙箱串联管道
|
||||
import requests
|
||||
import time
|
||||
|
||||
def analyze_sample(filepath):
|
||||
"""提交样本到多个沙箱并汇总结果"""
|
||||
results = {}
|
||||
|
||||
# 1. 快速分诊（Triage）
|
||||
triage_result = submit_to_triage(filepath)
|
||||
results['triage'] = triage_result
|
||||
|
||||
# 2. 如果 triage 判定可疑 → 深度分析
|
||||
if triage_result['score'] >= 5:
|
||||
cape_result = submit_to_cape(filepath)
|
||||
results['cape'] = cape_result
|
||||
|
||||
# 3. YARA 规则扫描
|
||||
yara_matches = run_yara(filepath, 'rules/')
|
||||
results['yara'] = yara_matches
|
||||
|
||||
# 4. Sigma 规则生成
|
||||
if cape_result.get('behaviors'):
|
||||
sigma_rules = generate_sigma(cape_result['behaviors'])
|
||||
results['sigma'] = sigma_rules
|
||||
|
||||
# 5. IOC 汇总
|
||||
iocs = extract_iocs(results)
|
||||
results['iocs'] = iocs
|
||||
|
||||
return results
|
||||
|
||||
def submit_to_cape(filepath):
|
||||
resp = requests.post(
|
||||
'http://cape:8000/apiv2/tasks/create/file/',
|
||||
files={'file': open(filepath, 'rb')},
|
||||
data={'timeout': 300, 'enforce_timeout': True}
|
||||
)
|
||||
task_id = resp.json()['task_id']
|
||||
|
||||
# 轮询等待完成
|
||||
while True:
|
||||
status = requests.get(
|
||||
f'http://cape:8000/apiv2/tasks/view/{task_id}'
|
||||
).json()['task']['status']
|
||||
if status == 'reported':
|
||||
break
|
||||
time.sleep(5)
|
||||
|
||||
return requests.get(
|
||||
f'http://cape:8000/apiv2/tasks/report/{task_id}/json/'
|
||||
).json()
|
||||
```
|
||||
|
||||
## ASD Azul 集成
|
||||
|
||||
```bash
|
||||
# Azul — 2026 年 ASD 发布的免费大规模分析平台
|
||||
git clone https://github.com/AustralianSignalsDirectorate/azul
|
||||
cd azul
|
||||
|
||||
# 批量导入样本
|
||||
azul import samples/ --tags "phishing_campaign_202605"
|
||||
|
||||
# 应用 YARA 规则
|
||||
azul scan --yara rules/anti_vm_rules.yar
|
||||
|
||||
# Snort 规则检测
|
||||
azul scan --snort rules/c2_detection.rules
|
||||
|
||||
# 自动提取 IOC
|
||||
azul export --format stix2 --output iocs.json
|
||||
|
||||
# 自定义插件
|
||||
azul plugin add custom_unpacker.py # 添加自定义解包逻辑
|
||||
```
|
||||
|
||||
## 反沙箱对抗
|
||||
|
||||
### 常见沙箱逃逸技术
|
||||
|
||||
```text
|
||||
1. 定时延迟
|
||||
→ Sleep(120000) // 2分钟，超出沙箱超时
|
||||
→ 检测: Hook Sleep → 加速时间
|
||||
|
||||
2. 用户交互检测
|
||||
→ GetTickCount() 检查鼠标移动
|
||||
→ 检测: 模拟用户交互
|
||||
|
||||
3. 磁盘大小检测
|
||||
→ GetDiskFreeSpaceEx < 60GB
|
||||
→ 检测: 扩展虚拟磁盘
|
||||
|
||||
4. 特定文件/进程检测
|
||||
→ C:\agent\agent.pyw (CAPE)
|
||||
→ 检测: 重命名检测组件
|
||||
|
||||
5. WMI 虚拟机检测
|
||||
→ Win32_ComputerSystem.Manufacturer = "VMware, Inc."
|
||||
→ 检测: 修改 SMBIOS
|
||||
|
||||
6. MAC 地址检测
|
||||
→ 00:0C:29 (VMware OUI), 08:00:27 (VirtualBox)
|
||||
→ 检测: 随机 MAC
|
||||
```
|
||||
|
||||
### CAPE 反逃逸配置
|
||||
|
||||
```python
|
||||
# CAPE 配置
|
||||
[processing]
|
||||
# 启用反反分析
|
||||
antievasion = yes
|
||||
|
||||
# 模拟人机交互
|
||||
human_interaction = yes
|
||||
|
||||
# 最小运行时间
|
||||
timeout = 600
|
||||
|
||||
# 检测特定技术
|
||||
detect_sleep_skip = yes
|
||||
detect_debugger_check = yes
|
||||
detect_vm_check = yes
|
||||
```
|
||||
|
||||
## IOC 自动化提取
|
||||
|
||||
```python
|
||||
def extract_iocs(analysis_results):
|
||||
iocs = {
|
||||
'network': {'ip': [], 'domain': [], 'url': [], 'user_agent': []},
|
||||
'host': {'files': [], 'registry': [], 'mutex': [], 'services': []},
|
||||
'mitre': [],
|
||||
'hashes': {}
|
||||
}
|
||||
|
||||
# CAPE → IOC 提取
|
||||
if 'cape' in analysis_results:
|
||||
cape = analysis_results['cape']
|
||||
behavior = cape.get('behavior', {})
|
||||
|
||||
# 网络 IOC
|
||||
for conn in behavior.get('network', {}).get('tcp', []):
|
||||
iocs['network']['ip'].append(conn['dst'])
|
||||
for dns in behavior.get('network', {}).get('dns', []):
|
||||
iocs['network']['domain'].append(dns['request'])
|
||||
|
||||
# 文件 IOC
|
||||
for dropped in behavior.get('dropped', []):
|
||||
iocs['host']['files'].append(dropped['path'])
|
||||
|
||||
# Mutex
|
||||
for mutex in behavior.get('summary', {}).get('mutex', []):
|
||||
iocs['host']['mutex'].append(mutex)
|
||||
|
||||
# YARA → MITRE 映射
|
||||
if 'yara' in analysis_results:
|
||||
for match in analysis_results['yara']:
|
||||
if 'mitre_id' in match.get('meta', {}):
|
||||
iocs['mitre'].extend(match['meta']['mitre_id'].split(','))
|
||||
|
||||
return iocs
|
||||
```
|
||||
|
||||
Source: CAPE v2 docs, ASD Azul documentation, Joe Sandbox v44, Anti-VM YARA Library (2026)
|
||||
@@ -0,0 +1,232 @@
|
||||
# YARA + Sigma 规则编写方法论
|
||||
|
||||
## YARA 规则编写
|
||||
|
||||
### 基本语法
|
||||
|
||||
```yara
|
||||
rule RuleName {
|
||||
meta:
|
||||
description = "规则描述"
|
||||
author = "作者"
|
||||
date = "2026-01"
|
||||
severity = "low/medium/high/critical"
|
||||
mitre_id = "T1234"
|
||||
|
||||
strings:
|
||||
$ = "ASCII 字符串"
|
||||
$ = { 48 65 6C 6C 6F } // 十六进制
|
||||
$ = /regex[0-9]{4}/ // 正则
|
||||
$ = "wide_string" wide // UTF-16
|
||||
$ = "xor_encoded" xor // XOR 编码
|
||||
$ = "case_insensitive" nocase // 忽略大小写
|
||||
|
||||
condition:
|
||||
// 逻辑组合
|
||||
uint16(0) == 0x5A4D and // MZ header
|
||||
filesize < 500KB and
|
||||
(2 of ($s*) or $hex1) and
|
||||
not ($benign1 and $benign2)
|
||||
}
|
||||
```
|
||||
|
||||
### 性能优化
|
||||
|
||||
```yara
|
||||
// ❌ 慢 — 全文件正则
|
||||
condition: /https?:\/\/.*\.php/
|
||||
|
||||
// ✅ 快 — 先锚定字符串再限定位置
|
||||
strings: $url = "http"
|
||||
condition: $url and /https?:\/\/[a-z0-9.-]+\/[a-z]{3,8}\.php/ in (0..filesize)
|
||||
|
||||
// ❌ 慢 — 无锚点
|
||||
condition: any of them
|
||||
|
||||
// ✅ 快 — 锚定在可用字符串上
|
||||
condition: uint16(0) == 0x5A4D and any of them
|
||||
```
|
||||
|
||||
### 反分析技术检测规则
|
||||
|
||||
```yara
|
||||
// 虚拟机检测
|
||||
rule AntiVM_WMI_Detection {
|
||||
meta:
|
||||
description = "检测通过 WMI 查询虚拟机信息"
|
||||
severity = "medium"
|
||||
mitre_id = "T1497"
|
||||
strings:
|
||||
$wmi1 = "SELECT * FROM Win32_BIOS" nocase
|
||||
$wmi2 = "SELECT * FROM Win32_VideoController" nocase
|
||||
$wmi3 = "SELECT * FROM Win32_NetworkAdapter" nocase
|
||||
$wmi4 = "SELECT * FROM Win32_ComputerSystem" nocase
|
||||
$bios = "VMware" nocase
|
||||
$bios2 = "VirtualBox" nocase
|
||||
$bios3 = "QEMU" nocase
|
||||
condition:
|
||||
uint16(0) == 0x5A4D and
|
||||
(2 of ($wmi*)) and
|
||||
(1 of ($bios*))
|
||||
}
|
||||
|
||||
// 调试器检测
|
||||
rule AntiDebug_PEB_Check {
|
||||
meta:
|
||||
description = "通过 PEB.BeingDebugged 检测调试器"
|
||||
severity = "medium"
|
||||
mitre_id = "T1622"
|
||||
strings:
|
||||
// x64: mov rax, gs:[0x60]; movzx eax, byte [rax+2]
|
||||
$peb_x64 = { 65 48 8B 04 25 60 00 00 00 0F B6 40 02 }
|
||||
// x86: mov eax, fs:[0x30]; movzx eax, byte [eax+2]
|
||||
$peb_x86 = { 64 A1 30 00 00 00 0F B6 40 02 }
|
||||
condition:
|
||||
uint16(0) == 0x5A4D and
|
||||
any of them
|
||||
}
|
||||
```
|
||||
|
||||
### 94 种反分析技术分类
|
||||
|
||||
| 类别 | 技术数量 | YARA 可检测 | 示例 |
|
||||
|------|:--:|:--:|------|
|
||||
| 定时检测 | 12 | 低 | Sleep → GetTickCount 对比 |
|
||||
| CPU 指纹 | 8 | 中 | CPUID 指令检测 hypervisor |
|
||||
| 固件/BIOS 检测 | 6 | **高** | SMBIOS 字符串匹配 |
|
||||
| 硬件指纹 | 10 | 中 | MAC 地址/硬盘序列号检测 |
|
||||
| API Hook 枚举 | 5 | 中 | NtQueryInformationProcess |
|
||||
| 进程检测 | 15 | **高** | 进程名字符串 (frida, wireshark) |
|
||||
| 文件系统检测 | 12 | **高** | 路径字符串 (C:\Program Files\VMware) |
|
||||
| 注册表检测 | 8 | **高** | 注册表路径字符串 |
|
||||
| 窗口检测 | 8 | **高** | 窗口类名/标题 (x64dbg, OLLYDBG) |
|
||||
|
||||
> 42/82 条规则 ≥75% 精度 (Anti-VM YARA Library, April 2026)
|
||||
|
||||
## Sigma 规则编写
|
||||
|
||||
### 规则模板
|
||||
|
||||
```yaml
|
||||
title: 标题 — 描述检测行为
|
||||
id: UUID-v4（生成后不变）
|
||||
status: stable/experimental/test/deprecated
|
||||
description: 详细描述
|
||||
author: 作者
|
||||
date: YYYY/MM/DD
|
||||
modified: YYYY/MM/DD
|
||||
references:
|
||||
- https://attack.mitre.org/techniques/TXXXX/
|
||||
- 内部引用
|
||||
|
||||
logsource:
|
||||
category: process_creation # Windows 事件 ID 4688
|
||||
product: windows
|
||||
# 或: service, product: linux, category: sysmon
|
||||
|
||||
detection:
|
||||
# 选择条件
|
||||
selection_base:
|
||||
EventID: 4688
|
||||
selection_malicious:
|
||||
CommandLine|contains:
|
||||
- 'suspicious_command'
|
||||
- 'malware_pattern'
|
||||
# 过滤条件
|
||||
filter_legitimate:
|
||||
ParentImage|endswith: '\explorer.exe'
|
||||
|
||||
# 最终条件
|
||||
condition: selection_base and selection_malicious and not filter_legitimate
|
||||
|
||||
falsepositives:
|
||||
- 合法管理工具
|
||||
- 软件开发工具
|
||||
level: low/medium/high/critical
|
||||
tags:
|
||||
- attack.tXXXX
|
||||
- attack.tXXXX.XXX
|
||||
- detection.malware
|
||||
```
|
||||
|
||||
### PowerShell 恶意行为检测
|
||||
|
||||
```yaml
|
||||
title: Suspicious PowerShell Download and Execute
|
||||
id: e3b0c442-98fc-4c78-a0e5-123456789abc
|
||||
status: experimental
|
||||
description: |
|
||||
检测使用 PowerShell 下载并执行 Payload 的行为，
|
||||
常见于无文件恶意软件和初始访问阶段。
|
||||
logsource:
|
||||
category: process_creation
|
||||
product: windows
|
||||
detection:
|
||||
selection:
|
||||
Image|endswith:
|
||||
- '\powershell.exe'
|
||||
- '\pwsh.exe'
|
||||
CommandLine|contains|all:
|
||||
- 'DownloadString'
|
||||
- 'Invoke-Expression'
|
||||
condition: selection
|
||||
falsepositives:
|
||||
- 系统管理员自动化脚本
|
||||
- 软件部署工具
|
||||
level: high
|
||||
tags:
|
||||
- attack.t1059.001 # PowerShell
|
||||
- attack.t1105 # Ingress Tool Transfer
|
||||
```
|
||||
|
||||
### 勒索软件行为检测
|
||||
|
||||
```yaml
|
||||
title: Potential Ransomware Activity — File Encryption + Shadow Copy Deletion
|
||||
id: a1b2c3d4-5678-90ab-cdef-0123456789ab
|
||||
status: stable
|
||||
description: |
|
||||
检测同时出现批量文件写入和卷影副本删除的勒索软件特征行为。
|
||||
logsource:
|
||||
category: process_creation
|
||||
product: windows
|
||||
detection:
|
||||
sel_vss:
|
||||
CommandLine|contains:
|
||||
- 'vssadmin delete shadows'
|
||||
- 'wmic shadowcopy delete'
|
||||
- 'Get-WmiObject Win32_Shadowcopy | Remove-WmiObject'
|
||||
sel_bcdedit:
|
||||
CommandLine|contains:
|
||||
- 'bcdedit /set {default} recoveryenabled No'
|
||||
condition: sel_vss or sel_bcdedit
|
||||
level: critical
|
||||
tags:
|
||||
- attack.t1490 # Inhibit System Recovery
|
||||
- attack.t1486 # Data Encrypted for Impact
|
||||
```
|
||||
|
||||
## 规则测试
|
||||
|
||||
```bash
|
||||
# YARA 规则验证
|
||||
yara -C rule.yara sample_dir/ # 编译规则并扫描
|
||||
yara -s rule.yara sample.exe # 显示匹配字符串
|
||||
yara --print-meta rule.yara # 打印元数据
|
||||
|
||||
# Sigma 规则转换
|
||||
sigmac -t splunk rule.yml # → Splunk SPL
|
||||
sigmac -t elastalert rule.yml # → Elastalert
|
||||
sigmac -t es-qs rule.yml # → Elasticsearch Query
|
||||
sigma convert -t splunk rule.yml # sigma-cli 新版
|
||||
|
||||
# 规则质量检查
|
||||
# 1. 不会在正常系统触发
|
||||
# 2. 不会在常见软件安装/运行中触发
|
||||
# 3. 在已知恶意样本上 100% 触发
|
||||
|
||||
# False Positive 验证
|
||||
# 在 Assemblage 良性样本集（92,508 样本）上测试
|
||||
```
|
||||
|
||||
Source: CCCS YARA Standard, SigmaHQ, Anti-VM YARA Library (2026), Joe Sandbox v44
|
||||
Reference in New Issue
Block a user