87owo/PYAS
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add files via upload

Browse Source
This commit is contained in:
87owo authored and GitHub committed 2026-07-22 16:55:36 +08:00
1 parent 316b061d34
commit 5b4cd6e879
1 file changed
+1 -148
Download Patch File Download Diff File Expand all files Collapse all files
Plugins/Rules/Rules_Driver_P1.json
+1 -148
View File
@@ -196,153 +196,6 @@
],
"Priority": 160,
},
{
"Name": "Memory_Protect_Critical_Process_CreateRemoteThread",
"Code": 1007,
"Kill": false,
"Category": "Memory",
"InitiatorExclude": [
"\\Device\\HarddiskVolume*\\Windows\\*",
"\\Device\\HarddiskVolume*\\Program Files\\*",
"\\Device\\HarddiskVolume*\\Program Files (x86)\\*",
"\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender\\*",
"\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\*",
"*\\Huorong\\Sysdiag\\bin\\HipsDaemon.exe",
"*\\360Safe.exe",
"*\\PYAS.exe",
],
"Target": [
"\\Device\\HarddiskVolume*\\Windows\\System32\\lsass.exe",
"\\Device\\HarddiskVolume*\\Windows\\System32\\winlogon.exe",
"\\Device\\HarddiskVolume*\\Windows\\System32\\services.exe",
"\\Device\\HarddiskVolume*\\Windows\\System32\\csrss.exe",
],
"Operations": [
"WriteMemory",
"VmOperation",
"CreateThread",
],
"OperationMatch": "All",
"MinimumRiskScore": 90,
"HandleTypes": [
"Create",
"Duplicate",
],
"ObjectTypes": [
"Process",
],
"Priority": 175,
},
{
"Name": "Memory_Protect_Critical_Process_ThreadHijack",
"Code": 1008,
"Kill": false,
"Category": "Memory",
"InitiatorExclude": [
"\\Device\\HarddiskVolume*\\Windows\\*",
"\\Device\\HarddiskVolume*\\Program Files\\*",
"\\Device\\HarddiskVolume*\\Program Files (x86)\\*",
"\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender\\*",
"\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\*",
"*\\Huorong\\Sysdiag\\bin\\HipsDaemon.exe",
"*\\360Safe.exe",
"*\\PYAS.exe",
],
"Target": [
"\\Device\\HarddiskVolume*\\Windows\\System32\\lsass.exe",
"\\Device\\HarddiskVolume*\\Windows\\System32\\winlogon.exe",
"\\Device\\HarddiskVolume*\\Windows\\System32\\services.exe",
"\\Device\\HarddiskVolume*\\Windows\\System32\\csrss.exe",
],
"Operations": [
"WriteMemory",
"VmOperation",
"SetThreadContext",
],
"OperationMatch": "All",
"MinimumRiskScore": 90,
"HandleTypes": [
"Create",
"Duplicate",
],
"ObjectTypes": [
"Process",
],
"Priority": 175,
},
{
"Name": "Memory_Protect_Service_Process_CreateRemoteThread",
"Code": 1009,
"Kill": false,
"Category": "Memory",
"InitiatorExclude": [
"\\Device\\HarddiskVolume*\\Windows\\*",
"\\Device\\HarddiskVolume*\\Program Files\\*",
"\\Device\\HarddiskVolume*\\Program Files (x86)\\*",
"\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender\\*",
"\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\*",
"\\Device\\HarddiskVolume*\\Users\\*\\AppData\\Local\\*",
"*\\Huorong\\Sysdiag\\bin\\HipsDaemon.exe",
"*\\360Safe.exe",
"*\\PYAS.exe",
],
"Target": [
"\\Device\\HarddiskVolume*\\Windows\\System32\\svchost.exe",
"\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\svchost.exe",
"\\Device\\HarddiskVolume*\\Windows\\System32\\spoolsv.exe",
],
"Operations": [
"WriteMemory",
"VmOperation",
"CreateThread",
],
"OperationMatch": "All",
"MinimumRiskScore": 90,
"HandleTypes": [
"Create",
"Duplicate",
],
"ObjectTypes": [
"Process",
],
"Priority": 170,
},
{
"Name": "Memory_Protect_Service_Process_ThreadHijack",
"Code": 1010,
"Kill": false,
"Category": "Memory",
"InitiatorExclude": [
"\\Device\\HarddiskVolume*\\Windows\\*",
"\\Device\\HarddiskVolume*\\Program Files\\*",
"\\Device\\HarddiskVolume*\\Program Files (x86)\\*",
"\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender\\*",
"\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\*",
"*\\Huorong\\Sysdiag\\bin\\HipsDaemon.exe",
"*\\360Safe.exe",
"*\\PYAS.exe",
],
"Target": [
"\\Device\\HarddiskVolume*\\Windows\\System32\\svchost.exe",
"\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\svchost.exe",
"\\Device\\HarddiskVolume*\\Windows\\System32\\spoolsv.exe",
],
"Operations": [
"WriteMemory",
"VmOperation",
"SetThreadContext",
],
"OperationMatch": "All",
"MinimumRiskScore": 90,
"HandleTypes": [
"Create",
"Duplicate",
],
"ObjectTypes": [
"Process",
],
"Priority": 170,
},
{
"Name": "Self_Antivirus_Protect_File",
"Code": 2001,
@@ -586,7 +439,7 @@
"Delete",
"Rename",
],
"Threshold": 5,
"Threshold": 10,
"TimeWindow": 3000,
},
{