Add files via upload
This commit is contained in:
87owo authored and GitHub committed
1 parent
30629a2363
commit
511a00cf84
1 file changed
+27
-167
@@ -1,157 +1,16 @@
|
||||
{
|
||||
"DynamicRules": [
|
||||
{
|
||||
"Name": "Process_Protect_Antivirus_Command",
|
||||
"Code": 1001,
|
||||
"Category": "Process",
|
||||
"Initiator": [
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\cmd.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\WindowsPowerShell\\*\\powershell.exe",
|
||||
"\\Device\\HarddiskVolume*\\Program Files\\PowerShell\\*\\pwsh.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\sc.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\taskkill.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\taskmgr.exe",
|
||||
],
|
||||
"InitiatorExclude": [
|
||||
"*\\PYAS.exe",
|
||||
],
|
||||
"CommandLine": [
|
||||
"*PYAS.exe*", "*taskkill*", "*sc*", "*PYAS_Driver.sys*",
|
||||
],
|
||||
"Operations": ["Execute"]
|
||||
},
|
||||
{
|
||||
"Name": "Memory_Protect_Lsass",
|
||||
"Code": 1002,
|
||||
"Category": "Memory",
|
||||
"Initiator": [
|
||||
"\\Device\\HarddiskVolume*\\Users\\*\\AppData\\Local\\Temp\\*",
|
||||
"\\Device\\HarddiskVolume*\\ProgramData\\*\\Temp\\*",
|
||||
],
|
||||
"InitiatorExclude": [
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\lsass.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\svchost.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\csrss.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\winlogon.exe",
|
||||
"*\\PYAS.exe",
|
||||
],
|
||||
"Target": [
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\lsass.exe"
|
||||
],
|
||||
"Operations": ["VmRead", "VmWrite"],
|
||||
"Threshold": 3,
|
||||
"TimeWindow": 60,
|
||||
},
|
||||
{
|
||||
"Name": "Thread_Detect_Shellcode_Injection",
|
||||
"Code": 1003,
|
||||
"Category": "Thread",
|
||||
"Initiator": [
|
||||
"\\Device\\HarddiskVolume*\\Users\\*\\AppData\\Local\\Temp\\*",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\cmd.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\WindowsPowerShell\\*\\powershell.exe"
|
||||
],
|
||||
"InitiatorExclude": [
|
||||
"*\\PYAS.exe"
|
||||
],
|
||||
"Target": [
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\svchost.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\explorer.exe"
|
||||
],
|
||||
"Operations": ["Execute"]
|
||||
"Threshold": 2,
|
||||
"TimeWindow": 60,
|
||||
},
|
||||
{
|
||||
"Name": "Process_ShadowCopy_Deletion",
|
||||
"Code": 1004,
|
||||
"Category": "Process",
|
||||
"InitiatorExclude": [
|
||||
"*\\PYAS.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\svchost.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\vssvc.exe"
|
||||
],
|
||||
"Target": [
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\vssadmin.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\wbadmin.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\bcdedit.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\wbem\\wmic.exe"
|
||||
],
|
||||
"CommandLine": [
|
||||
"*delete shadows*",
|
||||
"*resize shadowstorage*",
|
||||
"*recoveryenabled no*",
|
||||
"*shadowcopy delete*"
|
||||
],
|
||||
"Operations": ["Execute"]
|
||||
},
|
||||
{
|
||||
"Name": "Process_Suspicious_Office_Child",
|
||||
"Code": 1005,
|
||||
"Category": "Process",
|
||||
"Initiator": [
|
||||
"*\\winword.exe",
|
||||
"*\\excel.exe",
|
||||
"*\\powerpnt.exe",
|
||||
"*\\msaccess.exe"
|
||||
],
|
||||
"InitiatorExclude": [
|
||||
"*\\PYAS.exe"
|
||||
],
|
||||
"Target": [
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\cmd.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\WindowsPowerShell\\*\\powershell.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\mshta.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\cscript.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\wscript.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\regsvr32.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\rundll32.exe"
|
||||
],
|
||||
"Operations": ["Execute"]
|
||||
},
|
||||
{
|
||||
"Name": "Process_LOLBins_Network_Execution",
|
||||
"Code": 1006,
|
||||
"Category": "Process",
|
||||
"InitiatorExclude": [
|
||||
"*\\PYAS.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\svchost.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\msiexec.exe"
|
||||
],
|
||||
"Target": [
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\certutil.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\regsvr32.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\rundll32.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\bitsadmin.exe"
|
||||
],
|
||||
"CommandLine": [
|
||||
"*http://*",
|
||||
"*https://*",
|
||||
"*-urlcache*",
|
||||
"*scrobj.dll*",
|
||||
"*/transfer*"
|
||||
],
|
||||
"Operations": ["Execute"]
|
||||
},
|
||||
{
|
||||
"Name": "Process_Protect_Antivirus_Security",
|
||||
"Code": 1007,
|
||||
"Category": "Process",
|
||||
"InitiatorExclude": [
|
||||
"*\\PYAS.exe",
|
||||
"\\RjBhVzl1\\WDFab\\GNtbG1hV\\05oZEdsd\\mJnPT0.exe",
|
||||
],
|
||||
"Target": [
|
||||
"\\VUZs\\QlUxOVRaV04\\xY21sMGVW\\OUJkW\\FJvYjNKcGVt.dll",
|
||||
],
|
||||
"Operations": ["Execute"]
|
||||
},
|
||||
{
|
||||
"Name": "File_Protect_Antivirus",
|
||||
"Code": 2001,
|
||||
"Category": "File",
|
||||
"InitiatorExclude": [
|
||||
"*\\PYAS.exe",
|
||||
"*\\unins000.exe",
|
||||
"*\\notepad*.exe",
|
||||
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\cleanmgr.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\explorer.exe",
|
||||
],
|
||||
"Target": [
|
||||
"*\\PYAS.exe",
|
||||
@@ -169,10 +28,13 @@
|
||||
"Category": "File",
|
||||
"InitiatorExclude": [
|
||||
"*\\PYAS.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\WinSxS\\*",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\svchost.exe",
|
||||
"*\\Huorong\\Sysdiag\\bin\\sysclean.exe",
|
||||
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\SearchIndexer.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\taskhostw.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\lsass.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\svchost.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\services.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\TrustedInstaller.exe",
|
||||
],
|
||||
"Target": [
|
||||
"\\Device\\HarddiskVolume*\\bootmgr",
|
||||
@@ -185,9 +47,10 @@
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\config\\*",
|
||||
],
|
||||
"TargetExclude": [
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\*",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Caches\\*",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\*",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\*",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\*",
|
||||
"\\Device\\HarddiskVolume*\\System Volume Information\\SystemRestore\\FRStaging",
|
||||
"\\Device\\HarddiskVolume*\\System Volume Information\\IndexerVolumeGuid",
|
||||
],
|
||||
"Operations": ["Write", "Delete"]
|
||||
},
|
||||
@@ -230,12 +93,6 @@
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\cscript.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\mshta.exe",
|
||||
],
|
||||
"InitiatorExclude": [
|
||||
"*\\hrkill-*.exe",
|
||||
"*\\bin\\HipsDaemon.exe",
|
||||
"*\\360Safe.exe",
|
||||
"*\\PYAS.exe",
|
||||
],
|
||||
"Target": [
|
||||
"\\Device\\HarddiskVolume*\\Windows\\*"
|
||||
],
|
||||
@@ -244,6 +101,8 @@
|
||||
"\\Device\\HarddiskVolume*\\Windows\\SystemTemp\\*",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\Prefetch\\*",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\Logs\\*",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\WinSxS\\*",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\servicing\\*",
|
||||
],
|
||||
"Operations": ["Delete", "Rename"],
|
||||
"Threshold": 50,
|
||||
@@ -260,11 +119,13 @@
|
||||
|
||||
"*\\Google\\Chrome\\Application\\chrome.exe",
|
||||
"*\\Microsoft\\Edge\\Application\\msedge.exe",
|
||||
"*\\Microsoft\\Edge*\\Application\\*\\msedgewebview2.exe",
|
||||
"*\\Mozilla Firefox\\firefox.exe",
|
||||
"*\\Thorium\\Application\\thorium.exe",
|
||||
|
||||
"*\\Steam\\steam.exe",
|
||||
"*\\steam\\*\\steam.exe",
|
||||
"*\\Steam\\steamapps\\common\\*",
|
||||
"*\\Battle.net\\*\\Battle.net.exe",
|
||||
"*\\Epic Games\\Launcher\\Portal\\Binaries\\*\\EpicGamesLauncher.exe",
|
||||
"*\\PC4399_WPFLauncher.exe",
|
||||
@@ -279,7 +140,7 @@
|
||||
"*\\XLLiveUD.exe",
|
||||
|
||||
"*\\hrkill-*.exe",
|
||||
"*\\bin\\HipsDaemon.exe",
|
||||
"*\\Huorong\\Sysdiag\\bin\\HipsDaemon.exe",
|
||||
"*\\360Safe.exe",
|
||||
"*\\PYAS.exe",
|
||||
|
||||
@@ -330,14 +191,16 @@
|
||||
"Name": "Device_Protect_Disk_Wiper",
|
||||
"Code": 2006,
|
||||
"Category": "Device",
|
||||
"Initiator": [
|
||||
"*"
|
||||
],
|
||||
"InitiatorExclude": [
|
||||
"*\\PYAS.exe",
|
||||
"*\\rufus-*.exe",
|
||||
"*\\DiskInfo*.exe",
|
||||
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\diskpart.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\diskmgmt.msc",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\taskhostw.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\vds.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\format.com",
|
||||
],
|
||||
"Operations": ["Ioctl"]
|
||||
},
|
||||
@@ -362,6 +225,7 @@
|
||||
|
||||
"*\\Steam\\steam.exe",
|
||||
"*\\steam\\*\\steam.exe",
|
||||
"*\\Steam\\steamapps\\common\\*",
|
||||
"*\\Battle.net\\*\\Battle.net.exe",
|
||||
"*\\Epic Games\\Launcher\\Portal\\Binaries\\*\\EpicGamesLauncher.exe",
|
||||
"*\\PC4399_WPFLauncher.exe",
|
||||
@@ -376,7 +240,7 @@
|
||||
"*\\XLLiveUD.exe",
|
||||
|
||||
"*\\hrkill-*.exe",
|
||||
"*\\bin\\HipsDaemon.exe",
|
||||
"*\\Huorong\\Sysdiag\\bin\\HipsDaemon.exe",
|
||||
"*\\360Safe.exe",
|
||||
"*\\PYAS.exe",
|
||||
|
||||
@@ -485,10 +349,6 @@
|
||||
"*\\LegalNoticeCaption",
|
||||
"*\\LegalNoticeText",
|
||||
],
|
||||
"TargetExclude": [
|
||||
"*{645FF040-5081-101B-9F08-00AA002F954E}\\DefaultIcon",
|
||||
"*\\Services\\bam\\*"
|
||||
],
|
||||
"Operations": ["Write", "Delete", "Create"]
|
||||
}
|
||||
]
|
||||
|
||||
Reference in new issue
Block a user