From 511a00cf84287b1bfcae7e7db80654a559b3faa1 Mon Sep 17 00:00:00 2001 From: 87owo <85057800+87owo@users.noreply.github.com> Date: Sun, 5 Jul 2026 00:48:18 +0800 Subject: [PATCH] Add files via upload --- Plugins/Rules/Rules_Driver_P1.json | 194 ++++------------------------- 1 file changed, 27 insertions(+), 167 deletions(-) diff --git a/Plugins/Rules/Rules_Driver_P1.json b/Plugins/Rules/Rules_Driver_P1.json index 6fad40a..3edc821 100644 --- a/Plugins/Rules/Rules_Driver_P1.json +++ b/Plugins/Rules/Rules_Driver_P1.json @@ -1,157 +1,16 @@ { "DynamicRules": [ - { - "Name": "Process_Protect_Antivirus_Command", - "Code": 1001, - "Category": "Process", - "Initiator": [ - "\\Device\\HarddiskVolume*\\Windows\\System32\\cmd.exe", - "\\Device\\HarddiskVolume*\\Windows\\System32\\WindowsPowerShell\\*\\powershell.exe", - "\\Device\\HarddiskVolume*\\Program Files\\PowerShell\\*\\pwsh.exe", - "\\Device\\HarddiskVolume*\\Windows\\System32\\sc.exe", - "\\Device\\HarddiskVolume*\\Windows\\System32\\taskkill.exe", - "\\Device\\HarddiskVolume*\\Windows\\System32\\taskmgr.exe", - ], - "InitiatorExclude": [ - "*\\PYAS.exe", - ], - "CommandLine": [ - "*PYAS.exe*", "*taskkill*", "*sc*", "*PYAS_Driver.sys*", - ], - "Operations": ["Execute"] - }, - { - "Name": "Memory_Protect_Lsass", - "Code": 1002, - "Category": "Memory", - "Initiator": [ - "\\Device\\HarddiskVolume*\\Users\\*\\AppData\\Local\\Temp\\*", - "\\Device\\HarddiskVolume*\\ProgramData\\*\\Temp\\*", - ], - "InitiatorExclude": [ - "\\Device\\HarddiskVolume*\\Windows\\System32\\lsass.exe", - "\\Device\\HarddiskVolume*\\Windows\\System32\\svchost.exe", - "\\Device\\HarddiskVolume*\\Windows\\System32\\csrss.exe", - "\\Device\\HarddiskVolume*\\Windows\\System32\\winlogon.exe", - "*\\PYAS.exe", - ], - "Target": [ - "\\Device\\HarddiskVolume*\\Windows\\System32\\lsass.exe" - ], - "Operations": ["VmRead", "VmWrite"], - "Threshold": 3, - "TimeWindow": 60, - }, - { - "Name": "Thread_Detect_Shellcode_Injection", - "Code": 1003, - "Category": "Thread", - "Initiator": [ - "\\Device\\HarddiskVolume*\\Users\\*\\AppData\\Local\\Temp\\*", - "\\Device\\HarddiskVolume*\\Windows\\System32\\cmd.exe", - "\\Device\\HarddiskVolume*\\Windows\\System32\\WindowsPowerShell\\*\\powershell.exe" - ], - "InitiatorExclude": [ - "*\\PYAS.exe" - ], - "Target": [ - "\\Device\\HarddiskVolume*\\Windows\\System32\\svchost.exe", - "\\Device\\HarddiskVolume*\\Windows\\System32\\explorer.exe" - ], - "Operations": ["Execute"] - "Threshold": 2, - "TimeWindow": 60, - }, - { - "Name": "Process_ShadowCopy_Deletion", - "Code": 1004, - "Category": "Process", - "InitiatorExclude": [ - "*\\PYAS.exe", - "\\Device\\HarddiskVolume*\\Windows\\System32\\svchost.exe", - "\\Device\\HarddiskVolume*\\Windows\\System32\\vssvc.exe" - ], - "Target": [ - "\\Device\\HarddiskVolume*\\Windows\\System32\\vssadmin.exe", - "\\Device\\HarddiskVolume*\\Windows\\System32\\wbadmin.exe", - "\\Device\\HarddiskVolume*\\Windows\\System32\\bcdedit.exe", - "\\Device\\HarddiskVolume*\\Windows\\System32\\wbem\\wmic.exe" - ], - "CommandLine": [ - "*delete shadows*", - "*resize shadowstorage*", - "*recoveryenabled no*", - "*shadowcopy delete*" - ], - "Operations": ["Execute"] - }, - { - "Name": "Process_Suspicious_Office_Child", - "Code": 1005, - "Category": "Process", - "Initiator": [ - "*\\winword.exe", - "*\\excel.exe", - "*\\powerpnt.exe", - "*\\msaccess.exe" - ], - "InitiatorExclude": [ - "*\\PYAS.exe" - ], - "Target": [ - "\\Device\\HarddiskVolume*\\Windows\\System32\\cmd.exe", - "\\Device\\HarddiskVolume*\\Windows\\System32\\WindowsPowerShell\\*\\powershell.exe", - "\\Device\\HarddiskVolume*\\Windows\\System32\\mshta.exe", - "\\Device\\HarddiskVolume*\\Windows\\System32\\cscript.exe", - "\\Device\\HarddiskVolume*\\Windows\\System32\\wscript.exe", - "\\Device\\HarddiskVolume*\\Windows\\System32\\regsvr32.exe", - "\\Device\\HarddiskVolume*\\Windows\\System32\\rundll32.exe" - ], - "Operations": ["Execute"] - }, - { - "Name": "Process_LOLBins_Network_Execution", - "Code": 1006, - "Category": "Process", - "InitiatorExclude": [ - "*\\PYAS.exe", - "\\Device\\HarddiskVolume*\\Windows\\System32\\svchost.exe", - "\\Device\\HarddiskVolume*\\Windows\\System32\\msiexec.exe" - ], - "Target": [ - "\\Device\\HarddiskVolume*\\Windows\\System32\\certutil.exe", - "\\Device\\HarddiskVolume*\\Windows\\System32\\regsvr32.exe", - "\\Device\\HarddiskVolume*\\Windows\\System32\\rundll32.exe", - "\\Device\\HarddiskVolume*\\Windows\\System32\\bitsadmin.exe" - ], - "CommandLine": [ - "*http://*", - "*https://*", - "*-urlcache*", - "*scrobj.dll*", - "*/transfer*" - ], - "Operations": ["Execute"] - }, - { - "Name": "Process_Protect_Antivirus_Security", - "Code": 1007, - "Category": "Process", - "InitiatorExclude": [ - "*\\PYAS.exe", - "\\RjBhVzl1\\WDFab\\GNtbG1hV\\05oZEdsd\\mJnPT0.exe", - ], - "Target": [ - "\\VUZs\\QlUxOVRaV04\\xY21sMGVW\\OUJkW\\FJvYjNKcGVt.dll", - ], - "Operations": ["Execute"] - }, { "Name": "File_Protect_Antivirus", "Code": 2001, "Category": "File", "InitiatorExclude": [ "*\\PYAS.exe", + "*\\unins000.exe", + "*\\notepad*.exe", + + "\\Device\\HarddiskVolume*\\Windows\\System32\\cleanmgr.exe", + "\\Device\\HarddiskVolume*\\Windows\\explorer.exe", ], "Target": [ "*\\PYAS.exe", @@ -169,10 +28,13 @@ "Category": "File", "InitiatorExclude": [ "*\\PYAS.exe", - "\\Device\\HarddiskVolume*\\Windows\\WinSxS\\*", - "\\Device\\HarddiskVolume*\\Windows\\System32\\svchost.exe", + "*\\Huorong\\Sysdiag\\bin\\sysclean.exe", + "\\Device\\HarddiskVolume*\\Windows\\System32\\SearchIndexer.exe", - "\\Device\\HarddiskVolume*\\Windows\\System32\\taskhostw.exe", + "\\Device\\HarddiskVolume*\\Windows\\System32\\lsass.exe", + "\\Device\\HarddiskVolume*\\Windows\\System32\\svchost.exe", + "\\Device\\HarddiskVolume*\\Windows\\System32\\services.exe", + "\\Device\\HarddiskVolume*\\Windows\\System32\\TrustedInstaller.exe", ], "Target": [ "\\Device\\HarddiskVolume*\\bootmgr", @@ -185,9 +47,10 @@ "\\Device\\HarddiskVolume*\\Windows\\System32\\config\\*", ], "TargetExclude": [ - "\\Device\\HarddiskVolume*\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\*", - "\\Device\\HarddiskVolume*\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Caches\\*", - "\\Device\\HarddiskVolume*\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\*", + "\\Device\\HarddiskVolume*\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\*", + "\\Device\\HarddiskVolume*\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\*", + "\\Device\\HarddiskVolume*\\System Volume Information\\SystemRestore\\FRStaging", + "\\Device\\HarddiskVolume*\\System Volume Information\\IndexerVolumeGuid", ], "Operations": ["Write", "Delete"] }, @@ -230,12 +93,6 @@ "\\Device\\HarddiskVolume*\\Windows\\System32\\cscript.exe", "\\Device\\HarddiskVolume*\\Windows\\System32\\mshta.exe", ], - "InitiatorExclude": [ - "*\\hrkill-*.exe", - "*\\bin\\HipsDaemon.exe", - "*\\360Safe.exe", - "*\\PYAS.exe", - ], "Target": [ "\\Device\\HarddiskVolume*\\Windows\\*" ], @@ -244,6 +101,8 @@ "\\Device\\HarddiskVolume*\\Windows\\SystemTemp\\*", "\\Device\\HarddiskVolume*\\Windows\\Prefetch\\*", "\\Device\\HarddiskVolume*\\Windows\\Logs\\*", + "\\Device\\HarddiskVolume*\\Windows\\WinSxS\\*", + "\\Device\\HarddiskVolume*\\Windows\\servicing\\*", ], "Operations": ["Delete", "Rename"], "Threshold": 50, @@ -260,11 +119,13 @@ "*\\Google\\Chrome\\Application\\chrome.exe", "*\\Microsoft\\Edge\\Application\\msedge.exe", + "*\\Microsoft\\Edge*\\Application\\*\\msedgewebview2.exe", "*\\Mozilla Firefox\\firefox.exe", "*\\Thorium\\Application\\thorium.exe", "*\\Steam\\steam.exe", "*\\steam\\*\\steam.exe", + "*\\Steam\\steamapps\\common\\*", "*\\Battle.net\\*\\Battle.net.exe", "*\\Epic Games\\Launcher\\Portal\\Binaries\\*\\EpicGamesLauncher.exe", "*\\PC4399_WPFLauncher.exe", @@ -279,7 +140,7 @@ "*\\XLLiveUD.exe", "*\\hrkill-*.exe", - "*\\bin\\HipsDaemon.exe", + "*\\Huorong\\Sysdiag\\bin\\HipsDaemon.exe", "*\\360Safe.exe", "*\\PYAS.exe", @@ -330,14 +191,16 @@ "Name": "Device_Protect_Disk_Wiper", "Code": 2006, "Category": "Device", - "Initiator": [ - "*" - ], "InitiatorExclude": [ "*\\PYAS.exe", + "*\\rufus-*.exe", + "*\\DiskInfo*.exe", + "\\Device\\HarddiskVolume*\\Windows\\System32\\diskpart.exe", "\\Device\\HarddiskVolume*\\Windows\\System32\\diskmgmt.msc", "\\Device\\HarddiskVolume*\\Windows\\System32\\taskhostw.exe", + "\\Device\\HarddiskVolume*\\Windows\\System32\\vds.exe", + "\\Device\\HarddiskVolume*\\Windows\\System32\\format.com", ], "Operations": ["Ioctl"] }, @@ -362,6 +225,7 @@ "*\\Steam\\steam.exe", "*\\steam\\*\\steam.exe", + "*\\Steam\\steamapps\\common\\*", "*\\Battle.net\\*\\Battle.net.exe", "*\\Epic Games\\Launcher\\Portal\\Binaries\\*\\EpicGamesLauncher.exe", "*\\PC4399_WPFLauncher.exe", @@ -376,7 +240,7 @@ "*\\XLLiveUD.exe", "*\\hrkill-*.exe", - "*\\bin\\HipsDaemon.exe", + "*\\Huorong\\Sysdiag\\bin\\HipsDaemon.exe", "*\\360Safe.exe", "*\\PYAS.exe", @@ -485,10 +349,6 @@ "*\\LegalNoticeCaption", "*\\LegalNoticeText", ], - "TargetExclude": [ - "*{645FF040-5081-101B-9F08-00AA002F954E}\\DefaultIcon", - "*\\Services\\bam\\*" - ], "Operations": ["Write", "Delete", "Create"] } ]