diff --git a/Plugins/Rules/Rules_Driver_P1.json b/Plugins/Rules/Rules_Driver_P1.json index 3edc821..dfd93b7 100644 --- a/Plugins/Rules/Rules_Driver_P1.json +++ b/Plugins/Rules/Rules_Driver_P1.json @@ -1,5 +1,93 @@ { "DynamicRules": [ + { + "Name": "Process_Protect_Antivirus_Command", + "Code": 1001, + "Category": "Process", + "Initiator": [ + "\\Device\\HarddiskVolume*\\Windows\\System32\\cmd.exe", + "\\Device\\HarddiskVolume*\\Windows\\System32\\WindowsPowerShell\\*\\powershell.exe", + "\\Device\\HarddiskVolume*\\Program Files\\PowerShell\\*\\pwsh.exe", + "\\Device\\HarddiskVolume*\\Windows\\System32\\taskkill.exe", + "\\Device\\HarddiskVolume*\\Windows\\System32\\taskmgr.exe", + ], + "InitiatorExclude": [ + "*\\PYAS.exe", + ], + "CommandLine": [ + "*taskkill*", + "*PYAS.exe*", + ], + "Operations": [ + "Execute", + ], + "Target": [ + "*\\taskkill.exe", + "*\\cmd.exe", + "*\\powershell.exe", + "*\\pwsh.exe", + "*\\wmic.exe", + "*\\net.exe", + "*\\net1.exe", + ] + }, + { + "Name": "Process_Protect_Antivirus_Handle", + "Code": 1002, + "Category": "Process", + "InitiatorExclude": [ + "*\\PYAS.exe", + "*\\msedgewebview2.exe", + "\\Device\\HarddiskVolume*\\Windows\\explorer.exe", + "\\Device\\HarddiskVolume*\\Windows\\System32\\csrss.exe", + "\\Device\\HarddiskVolume*\\Windows\\System32\\lsass.exe", + "\\Device\\HarddiskVolume*\\Windows\\System32\\services.exe", + "\\Device\\HarddiskVolume*\\Windows\\System32\\svchost.exe", + ], + "Target": [ + "*\\PYAS.exe", + "*\\msedgewebview2.exe", + ], + "Operations": [ + "Terminate", + "SuspendResume", + ] + }, + { + "Name": "Memory_Protect_Write", + "Code": 1003, + "Category": "Memory", + "InitiatorExclude": [ + "*\\PYAS.exe", + "\\Device\\HarddiskVolume*\\Windows\\System32\\csrss.exe", + "\\Device\\HarddiskVolume*\\Windows\\System32\\lsass.exe", + "\\Device\\HarddiskVolume*\\Windows\\System32\\svchost.exe", + "\\Device\\HarddiskVolume*\\Windows\\System32\\services.exe", + ], + "Target": [ + "*\\PYAS.exe", + "\\Device\\HarddiskVolume*\\Windows\\System32\\lsass.exe", + "\\Device\\HarddiskVolume*\\Windows\\System32\\winlogon.exe", + ], + "Operations": [ + "VmWrite", + ] + }, + { + "Name": "Thread_Protect_Shellcode", + "Code": 1004, + "Category": "Thread", + "InitiatorExclude": [ + "*\\PYAS.exe", + ], + "Target": [ + "*\\PYAS.exe", + "\\Device\\HarddiskVolume*\\Windows\\explorer.exe", + ], + "Operations": [ + "Execute", + ] + }, { "Name": "File_Protect_Antivirus", "Code": 2001, @@ -8,41 +96,44 @@ "*\\PYAS.exe", "*\\unins000.exe", "*\\notepad*.exe", - - "\\Device\\HarddiskVolume*\\Windows\\System32\\cleanmgr.exe", - "\\Device\\HarddiskVolume*\\Windows\\explorer.exe", + "\\Device\\HarddiskVolume*\\Windows\\System32\\cleanmgr.exe", + "\\Device\\HarddiskVolume*\\Windows\\explorer.exe", ], "Target": [ - "*\\PYAS.exe", + "*\\PYAS.exe", "*\\ProgramData\\PYAS\\*.json", "*\\Engine\\Pattern\\*.onnx", "*\\Engine\\Properties\\*.onnx", "*\\Plugins\\Filter\\PYAS_Driver.sys", - "*\\Plugins\\Rules\\*.json", + "*\\Plugins\\Rules\\*.json", ], - "Operations": ["Write", "Delete"] + "Operations": [ + "Write", + "Delete", + ] }, { "Name": "File_Protect_System", "Code": 2002, "Category": "File", "InitiatorExclude": [ - "*\\PYAS.exe", + "*\\PYAS.exe", "*\\Huorong\\Sysdiag\\bin\\sysclean.exe", - "\\Device\\HarddiskVolume*\\Windows\\System32\\SearchIndexer.exe", "\\Device\\HarddiskVolume*\\Windows\\System32\\lsass.exe", "\\Device\\HarddiskVolume*\\Windows\\System32\\svchost.exe", "\\Device\\HarddiskVolume*\\Windows\\System32\\services.exe", + "\\Device\\HarddiskVolume*\\Windows\\System32\\taskhostw.exe", "\\Device\\HarddiskVolume*\\Windows\\System32\\TrustedInstaller.exe", + "\\Device\\HarddiskVolume*\\Windows\\WinSxS\\*\\TiWorker.exe", ], "Target": [ "\\Device\\HarddiskVolume*\\bootmgr", - "\\Device\\HarddiskVolume*\\boot.ini", + "\\Device\\HarddiskVolume*\\boot.ini", "\\Device\\HarddiskVolume*\\BOOTNXT", - "\\Device\\HarddiskVolume*\\EFI\\*", + "\\Device\\HarddiskVolume*\\EFI\\*", "\\Device\\HarddiskVolume*\\Boot\\*", - "\\Device\\HarddiskVolume*\\Recovery\\*", + "\\Device\\HarddiskVolume*\\Recovery\\*", "\\Device\\HarddiskVolume*\\System Volume Information\\*", "\\Device\\HarddiskVolume*\\Windows\\System32\\config\\*", ], @@ -52,61 +143,71 @@ "\\Device\\HarddiskVolume*\\System Volume Information\\SystemRestore\\FRStaging", "\\Device\\HarddiskVolume*\\System Volume Information\\IndexerVolumeGuid", ], - "Operations": ["Write", "Delete"] + "Operations": [ + "Write", + "Delete", + ] }, { "Name": "File_Protect_System_Exploit", "Code": 2003, "Category": "File", "InitiatorExclude": [ - "*\\PYAS.exe", + "*\\PYAS.exe", ], "Target": [ - "*\\CON", + "*\\CON", "*\\CON\\*", - "*\\PRN", + "*\\PRN", "*\\PRN\\*", "*\\AUX", "*\\AUX\\*", "*\\NUL", - "*\\NUL\\*", + "*\\NUL\\*", "*\\COM?", "*\\COM?\\*", "*\\LPT?", - "*\\LPT?\\*", + "*\\LPT?\\*", "*\\OSDATA", - "*\\OSDATA\\*", + "*\\OSDATA\\*", "*\\*<*", "*\\*>*", ], - "Operations": ["Create", "Write", "Rename"] + "Operations": [ + "Create", + "Write", + "Rename", + ] }, { "Name": "File_Protect_System_Ransom", "Code": 2004, "Category": "File", "Initiator": [ - "\\Device\\HarddiskVolume*\\Windows\\System32\\cmd.exe", + "\\Device\\HarddiskVolume*\\Windows\\System32\\cmd.exe", "\\Device\\HarddiskVolume*\\Windows\\System32\\WindowsPowerShell\\*\\powershell.exe", "\\Device\\HarddiskVolume*\\Program Files\\PowerShell\\*\\pwsh.exe", "\\Device\\HarddiskVolume*\\Windows\\System32\\wscript.exe", - "\\Device\\HarddiskVolume*\\Windows\\System32\\cscript.exe", + "\\Device\\HarddiskVolume*\\Windows\\System32\\cscript.exe", "\\Device\\HarddiskVolume*\\Windows\\System32\\mshta.exe", ], "Target": [ - "\\Device\\HarddiskVolume*\\Windows\\*" + "\\Device\\HarddiskVolume*\\Windows\\*", ], "TargetExclude": [ "\\Device\\HarddiskVolume*\\Windows\\Temp\\*", "\\Device\\HarddiskVolume*\\Windows\\SystemTemp\\*", "\\Device\\HarddiskVolume*\\Windows\\Prefetch\\*", - "\\Device\\HarddiskVolume*\\Windows\\Logs\\*", - "\\Device\\HarddiskVolume*\\Windows\\WinSxS\\*", - "\\Device\\HarddiskVolume*\\Windows\\servicing\\*", + "\\Device\\HarddiskVolume*\\Windows\\Logs\\*", + "\\Device\\HarddiskVolume*\\Windows\\WinSxS\\*", + "\\Device\\HarddiskVolume*\\Windows\\servicing\\*", + ], + "Operations": [ + "Delete", + "Rename", ], - "Operations": ["Delete", "Rename"], "Threshold": 50, - "TimeWindow": 5000 + "TimeWindow": 5000, }, { "Name": "File_Protect_Ransom", @@ -114,78 +215,103 @@ "Category": "File", "InitiatorExclude": [ "\\Device\\HarddiskVolume*\\Windows\\*", - "\\Device\\HarddiskVolume*\\Program Files\\*", - "\\Device\\HarddiskVolume*\\Program Files (x86)\\*", - - "*\\Google\\Chrome\\Application\\chrome.exe", + "\\Device\\HarddiskVolume*\\Program Files\\*", + "\\Device\\HarddiskVolume*\\Program Files (x86)\\*", + "*\\Google\\Chrome\\Application\\chrome.exe", "*\\Microsoft\\Edge\\Application\\msedge.exe", "*\\Microsoft\\Edge*\\Application\\*\\msedgewebview2.exe", + "*\\Microsoft\\Edge*\\Install\\*\\setup.exe", + "*\\Microsoft\\Edge*\\Application\\*\\Installer\\setup.exe", "*\\Mozilla Firefox\\firefox.exe", - "*\\Thorium\\Application\\thorium.exe", - + "*\\Thorium\\Application\\thorium.exe", "*\\Steam\\steam.exe", - "*\\steam\\*\\steam.exe", + "*\\steam\\*\\steam.exe", "*\\Steam\\steamapps\\common\\*", - "*\\Battle.net\\*\\Battle.net.exe", + "*\\Battle.net\\*\\Battle.net.exe", "*\\Epic Games\\Launcher\\Portal\\Binaries\\*\\EpicGamesLauncher.exe", "*\\PC4399_WPFLauncher.exe", - "*\\Neverness To Everness\\NTELauncher.exe", - + "*\\Neverness To Everness\\NTELauncher.exe", "*\\ThunderEv.exe", "*\\ThunderStart.exe", - "*\\bin\\APlayer.exe", - "*\\bilibili\\bilibili.exe", - "*\\KuGou.exe", + "*\\bin\\APlayer.exe", + "*\\bilibili\\bilibili.exe", + "*\\KuGou.exe", "*\\XLGame.exe", - "*\\XLLiveUD.exe", - - "*\\hrkill-*.exe", + "*\\XLLiveUD.exe", + "*\\hrkill-*.exe", "*\\Huorong\\Sysdiag\\bin\\HipsDaemon.exe", "*\\360Safe.exe", "*\\PYAS.exe", - "*\\WPS Office\\ksolaunch.exe", - "*\\WPS Office\\*\\wps.exe", - + "*\\WPS Office\\*\\wps.exe", "*\\Application\\AndrowsLauncher.exe", - "*\\resources\\bin\\SDK\\DownloadSDKServer.exe", + "*\\resources\\bin\\SDK\\DownloadSDKServer.exe", "*\\bin\\*\\codex.exe", - "*\\bin\\codex.exe", + "*\\bin\\codex.exe", ], "Target": [ - "\\Device\\HarddiskVolume*\\Users\\*" + "\\Device\\HarddiskVolume*\\Users\\*", ], "TargetExclude": [ - "*\\Documents\\My Games\\*", + "*\\Documents\\My Games\\*", "*\\Documents\\Tencent Files\\*", - "*\\Documents\\WeChat Files\\*", - "*\\Documents\\WPS Cloud Files\\*", - + "*\\Documents\\WeChat Files\\*", + "*\\Documents\\WPS Cloud Files\\*", "*\\Users\\*\\steam\\*", - "*\\User Data\\*", - "*\\AppData\\*", - "*\\AppData\\Local\\*", - - "*\\Temp\\*", - "*\\Local\\Temp\\*", - "*\\cache\\*", - - "*\\ventoy\\Boot\\*", + "\\Device\\HarddiskVolume*\\Users\\*\\User Data\\*", + "\\Device\\HarddiskVolume*\\Users\\*\\AppData\\*", + "\\Device\\HarddiskVolume*\\Users\\*\\AppData\\Local\\*", + "\\Device\\HarddiskVolume*\\Users\\*\\Temp\\*", + "\\Device\\HarddiskVolume*\\Users\\*\\Local\\Temp\\*", + "\\Device\\HarddiskVolume*\\Users\\*\\cache\\*", + "*\\ventoy\\Boot\\*", "*\\AdminRegionConfig.*", "*\\nt_qq\\nt_*\\*", ], "Extensions": [ - ".zip", ".7z", ".rar", ".tar", ".gz", - ".ppt", ".pptx", ".wps", ".txt", ".rtf", - ".pdf", ".xls", ".xlsx", ".doc", ".docx", - ".jpg", ".jpeg", ".png", ".webp", ".gif", - ".mp3", ".wav", ".aac", ".ogg", ".flac", - ".mp4", ".avi", ".mov", ".wmv", ".mkv", - ".apk", ".jar", ".class", ".db", ".sqlite", + ".zip", + ".7z", + ".rar", + ".tar", + ".gz", + ".ppt", + ".pptx", + ".wps", + ".txt", + ".rtf", + ".pdf", + ".xls", + ".xlsx", + ".doc", + ".docx", + ".jpg", + ".jpeg", + ".png", + ".webp", + ".gif", + ".mp3", + ".wav", + ".aac", + ".ogg", + ".flac", + ".mp4", + ".avi", + ".mov", + ".wmv", + ".mkv", + ".apk", + ".jar", + ".class", + ".db", + ".sqlite", + ], + "Operations": [ + "Write", + "Delete", + "Rename", ], - "Operations": ["Write", "Delete", "Rename"], "Threshold": 5, - "TimeWindow": 3000 + "TimeWindow": 3000, }, { "Name": "Device_Protect_Disk_Wiper", @@ -195,14 +321,15 @@ "*\\PYAS.exe", "*\\rufus-*.exe", "*\\DiskInfo*.exe", - "\\Device\\HarddiskVolume*\\Windows\\System32\\diskpart.exe", "\\Device\\HarddiskVolume*\\Windows\\System32\\diskmgmt.msc", "\\Device\\HarddiskVolume*\\Windows\\System32\\taskhostw.exe", "\\Device\\HarddiskVolume*\\Windows\\System32\\vds.exe", "\\Device\\HarddiskVolume*\\Windows\\System32\\format.com", ], - "Operations": ["Ioctl"] + "Operations": [ + "Ioctl", + ] }, { "Name": "Registry_Protect_System", @@ -210,146 +337,140 @@ "Category": "Registry", "InitiatorExclude": [ "\\Device\\HarddiskVolume*\\Windows\\*", - "\\Device\\HarddiskVolume*\\Program Files\\*", + "\\Device\\HarddiskVolume*\\Program Files\\*", "\\Device\\HarddiskVolume*\\Program Files (x86)\\*", - "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender\\*", - "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\*", - - "*\\Google\\Chrome\\Application\\chrome.exe", + "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender\\*", + "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\*", + "*\\Google\\Chrome\\Application\\chrome.exe", "*\\Microsoft\\Edge\\Application\\msedge.exe", - "*\\Mozilla Firefox\\firefox.exe", - "*\\Thorium\\Application\\thorium.exe", - + "*\\Mozilla Firefox\\firefox.exe", + "*\\Thorium\\Application\\thorium.exe", "*\\Sources\\SetupHost.exe", "*\\Work\\*\\DismHost.exe", - "*\\Steam\\steam.exe", - "*\\steam\\*\\steam.exe", + "*\\steam\\*\\steam.exe", "*\\Steam\\steamapps\\common\\*", - "*\\Battle.net\\*\\Battle.net.exe", - "*\\Epic Games\\Launcher\\Portal\\Binaries\\*\\EpicGamesLauncher.exe", + "*\\Battle.net\\*\\Battle.net.exe", + "*\\Epic Games\\Launcher\\Portal\\Binaries\\*\\EpicGamesLauncher.exe", "*\\PC4399_WPFLauncher.exe", - "*\\Neverness To Everness\\NTELauncher.exe", - - "*\\ThunderEv.exe", + "*\\Neverness To Everness\\NTELauncher.exe", + "*\\ThunderEv.exe", "*\\ThunderStart.exe", "*\\bin\\APlayer.exe", - "*\\bilibili\\bilibili.exe", - "*\\KuGou.exe", + "*\\bilibili\\bilibili.exe", + "*\\KuGou.exe", "*\\XLGame.exe", - "*\\XLLiveUD.exe", - + "*\\XLLiveUD.exe", "*\\hrkill-*.exe", "*\\Huorong\\Sysdiag\\bin\\HipsDaemon.exe", - "*\\360Safe.exe", + "*\\360Safe.exe", "*\\PYAS.exe", - - "*\\WPS Office\\ksolaunch.exe", + "*\\WPS Office\\ksolaunch.exe", "*\\WPS Office\\*\\wps.exe", - "*\\WPS Office\\*\\*.exe", - + "*\\WPS Office\\*\\*.exe", "*\\Application\\AndrowsLauncher.exe", - "*\\resources\\bin\\SDK\\DownloadSDKServer.exe", - "*\\bin\\*\\codex.exe", - "*\\bin\\codex.exe", + "*\\resources\\bin\\SDK\\DownloadSDKServer.exe", + "*\\bin\\*\\codex.exe", + "*\\bin\\codex.exe", ], "Target": [ "\\REGISTRY\\MACHINE\\BCD00000000", "\\REGISTRY\\MACHINE\\BCD00000000\\*", - "*\\Classes\\.exe", - "*\\Classes\\.bat", - "*\\Classes\\.cmd", + "*\\Classes\\.bat", + "*\\Classes\\.cmd", "*\\Classes\\.com", - "*\\Classes\\exefile\\*", - "*\\Classes\\batfile\\*", + "*\\Classes\\batfile\\*", "*\\Classes\\cmdfile\\*", - "*\\Classes\\comfile\\*", - + "*\\Classes\\comfile\\*", "*\\mouclass", - "*\\kbdclass", + "*\\kbdclass", "*\\DisableAntiSpyware", - "*\\DisableWindowsUpdateAccess", + "*\\DisableWindowsUpdateAccess", "*\\EnableLUA", - "*\\ConsentPromptBehaviorAdmin", + "*\\ConsentPromptBehaviorAdmin", "*\\NoControlPanel", "*\\NoDrives", - "*\\NoFileMenu", - "*\\NoFind", - "*\\NoStartMenuPinnedList", + "*\\NoFileMenu", + "*\\NoFind", + "*\\NoStartMenuPinnedList", "*\\NoSetFolders", "*\\NoSetFolderOptions", - "*\\NoViewOnDrive", - "*\\NoClose", - "*\\NoDesktop", - "*\\NoLogoff", + "*\\NoViewOnDrive", + "*\\NoClose", + "*\\NoDesktop", + "*\\NoLogoff", "*\\NoFolderOptions", "*\\RestrictRun", "*\\NoViewContextMenu", - "*\\HideClock", + "*\\HideClock", "*\\NoStartMenuMyGames", "*\\NoStartMenuMyMusic", "*\\DisableCMD", - "*\\NoAddingComponents", + "*\\NoAddingComponents", "*\\NoWinKeys", "*\\NoStartMenuLogOff", "*\\NoSimpleNetIDList", - "*\\NoLowDiskSpaceChecks", + "*\\NoLowDiskSpaceChecks", "*\\DisableLockWorkstation", "*\\Restrict_Run", "*\\DisableTaskMgr", - "*\\DisableRegistryTools", - "*\\DisableChangePassword", - "*\\NoComponents", + "*\\DisableRegistryTools", + "*\\DisableChangePassword", + "*\\NoComponents", "*\\NoStartMenuMorePrograms", - "*\\NoActiveDesktop", + "*\\NoActiveDesktop", "*\\NoSetActiveDesktop", "*\\NoRecentDocsMenu", "*\\NoWindowsUpdate", - "*\\NoChangeStartMenu", + "*\\NoChangeStartMenu", "*\\NoFavoritesMenu", "*\\NoRecentDocsHistory", "*\\NoSetTaskbar", - "*\\NoSMHelp", + "*\\NoSMHelp", "*\\NoTrayContextMenu", "*\\NoManageMyComputerVerb", "*\\NoRealMode", - "*\\NoRun", + "*\\NoRun", "*\\ClearRecentDocsOnExit", - "*\\NoActiveDesktopChanges", - "*\\NoStartMenuNetworkPlaces", + "*\\NoActiveDesktopChanges", + "*\\NoStartMenuNetworkPlaces", "*\\NoLockScreen", "*\\HideFastUserSwitching", - "*\\ConsentPromptBehaviorUser", - "*\\EnableSecureUIAPaths", - "*\\NoSRM", + "*\\ConsentPromptBehaviorUser", + "*\\EnableSecureUIAPaths", + "*\\NoSRM", "*\\NoInteractiveServices", - "*\\ShutdownWithoutLogon", + "*\\ShutdownWithoutLogon", "*\\AutoAdminLogon", "*\\BootExecute", "*\\SubSystems", - "*\\FirmwareBootDevice", + "*\\FirmwareBootDevice", "*\\BootDriverFlags", - "*\\SystemStartOptions", - "*\\DisableAutomaticRestartOnFailure", + "*\\SystemStartOptions", + "*\\DisableAutomaticRestartOnFailure", "*\\SystemBiosVersion", "*\\NoTheme", "*\\SystemSetupInProgress", - "*\\SetupType", + "*\\SetupType", "*\\AutoReboot", - "*\\Userinit", - "*\\UIHost", + "*\\Userinit", + "*\\UIHost", "*\\Debugger", - "*\\DefaultUserName", + "*\\DefaultUserName", "*\\DefaultPassword", - "*\\AltDefaultUserName", + "*\\AltDefaultUserName", "*\\AltDefaultPassword", - "*\\DisableCAD", + "*\\DisableCAD", "*\\LegalNoticeCaption", "*\\LegalNoticeText", ], - "Operations": ["Write", "Delete", "Create"] + "Operations": [ + "Write", + "Delete", + "Create", + ] } ] -} \ No newline at end of file +}