Add files via upload
This commit is contained in:
87owo authored and GitHub committed
1 parent
71f8232ef0
commit
98b60b9833
1 file changed
+711
@@ -0,0 +1,711 @@
|
||||
{
|
||||
"DynamicRules": [
|
||||
{
|
||||
"Name": "Self_Antivirus_Protect_Command",
|
||||
"Code": 1001,
|
||||
"Kill": false,
|
||||
"Category": "Process",
|
||||
"Initiator": [
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\cmd.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\cmd.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\WindowsPowerShell\\*\\powershell.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\WindowsPowerShell\\*\\powershell.exe",
|
||||
"\\Device\\HarddiskVolume*\\Program Files\\PowerShell\\*\\pwsh.exe",
|
||||
"\\Device\\HarddiskVolume*\\Program Files (x86)\\PowerShell\\*\\pwsh.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\wscript.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\wscript.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\cscript.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\cscript.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\mshta.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\mshta.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\wsl.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\bash.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\rundll32.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\rundll32.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\regsvr32.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\regsvr32.exe",
|
||||
],
|
||||
"InitiatorExclude": [
|
||||
"*\\PYAS.exe",
|
||||
],
|
||||
"CommandLine": [
|
||||
"*taskkill*PYAS.exe*",
|
||||
"*taskkill*msedgewebview2.exe*",
|
||||
"*Stop-Process*PYAS*",
|
||||
"*Stop-Process*msedgewebview2*",
|
||||
"*Get-Process*PYAS*Stop-Process*",
|
||||
"*Get-Process*msedgewebview2*Stop-Process*",
|
||||
"*wmic*PYAS.exe*call terminate*",
|
||||
"*wmic*PYAS.exe*delete*",
|
||||
"*wmic*msedgewebview2.exe*call terminate*",
|
||||
"*wmic*msedgewebview2.exe*delete*",
|
||||
"*net stop PYAS_Driver*",
|
||||
"*net1 stop PYAS_Driver*",
|
||||
"*sc stop PYAS_Driver*",
|
||||
"*sc.exe stop PYAS_Driver*",
|
||||
"*sc delete PYAS_Driver*",
|
||||
"*sc.exe delete PYAS_Driver*",
|
||||
"*fltmc unload PYAS_Driver*",
|
||||
],
|
||||
"Operations": [
|
||||
"Execute",
|
||||
],
|
||||
"Target": [
|
||||
"*\\taskkill.exe",
|
||||
"*\\cmd.exe",
|
||||
"*\\powershell.exe",
|
||||
"*\\pwsh.exe",
|
||||
"*\\wmic.exe",
|
||||
"*\\net.exe",
|
||||
"*\\net1.exe",
|
||||
"*\\sc.exe",
|
||||
"*\\fltmc.exe",
|
||||
],
|
||||
"Priority": 110,
|
||||
"FileOpenNameAvailable": true,
|
||||
"SubsystemProcess": false,
|
||||
},
|
||||
{
|
||||
"Name": "Self_Antivirus_Protect_Handle",
|
||||
"Code": 1002,
|
||||
"Kill": false,
|
||||
"Category": "Process",
|
||||
"InitiatorExclude": [
|
||||
"*\\PYAS.exe",
|
||||
"*\\PYAS_Setup.exe",
|
||||
"*\\unins000.exe",
|
||||
"\\Device\\HarddiskVolume*\\Users\\*\\AppData\\Local\\Temp\\*\\PYAS_Setup.tmp",
|
||||
"\\Device\\HarddiskVolume*\\Users\\*\\AppData\\Local\\Temp\\*\\_unins.tmp",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\explorer.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\csrss.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\lsass.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\services.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\svchost.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\SystemApps\\*\\SearchHost.exe",
|
||||
"\\Device\\HarddiskVolume*\\Program Files\\WindowsApps\\*\\gamingservices.exe",
|
||||
"\\Device\\HarddiskVolume*\\Program Files (x86)\\Lenovo\\SmartEngine\\*\\SmartEngineHost64.exe",
|
||||
],
|
||||
"Target": [
|
||||
"*\\PYAS.exe",
|
||||
"*\\msedgewebview2.exe",
|
||||
],
|
||||
"TargetProcessTree": [
|
||||
"*\\PYAS.exe",
|
||||
],
|
||||
"Operations": [
|
||||
"Terminate",
|
||||
"SuspendResume",
|
||||
"DuplicateHandle",
|
||||
"CreateProcess",
|
||||
"SetThreadToken",
|
||||
"Impersonate",
|
||||
],
|
||||
"Priority": 130,
|
||||
"InitiatorProcessTreeExclude": [
|
||||
"*\\PYAS.exe",
|
||||
],
|
||||
"HandleTypes": [
|
||||
"Create",
|
||||
"Duplicate",
|
||||
],
|
||||
"OperationMatch": "Any",
|
||||
"MinimumRiskScore": 20,
|
||||
"ObjectTypes": [
|
||||
"Process",
|
||||
"Thread",
|
||||
]
|
||||
},
|
||||
{
|
||||
"Name": "Attack_Command_Block_EFI_Mount",
|
||||
"Code": 1003,
|
||||
"Kill": false,
|
||||
"Category": "Process",
|
||||
"Target": [
|
||||
"*\\mountvol.exe",
|
||||
],
|
||||
"CommandLine": [
|
||||
"*mountvol* /S*",
|
||||
],
|
||||
"Operations": [
|
||||
"Execute",
|
||||
],
|
||||
"Priority": 170,
|
||||
"FileOpenNameAvailable": true,
|
||||
},
|
||||
{
|
||||
"Name": "Attack_Command_Block_Destructive_Cmd_Delete",
|
||||
"Code": 1004,
|
||||
"Kill": true,
|
||||
"Category": "Process",
|
||||
"Target": [
|
||||
"*\\cmd.exe",
|
||||
],
|
||||
"CommandLine": [
|
||||
"*rd /s /q C:\\*",
|
||||
"*rmdir /s /q C:\\*",
|
||||
"*del X:\\* /s /f /q*",
|
||||
"*rd /s /q X:\\EFI*",
|
||||
],
|
||||
"Operations": [
|
||||
"Execute",
|
||||
],
|
||||
"Priority": 190,
|
||||
"FileOpenNameAvailable": true,
|
||||
},
|
||||
{
|
||||
"Name": "Attack_Command_Block_Forced_OOBE_Sysprep",
|
||||
"Code": 1005,
|
||||
"Kill": false,
|
||||
"Category": "Process",
|
||||
"Target": [
|
||||
"*\\sysprep.exe",
|
||||
],
|
||||
"CommandLine": [
|
||||
"*sysprep* /oobe*",
|
||||
"*sysprep*/oobe*",
|
||||
"* /oobe* /reboot*",
|
||||
"* /generalize* /oobe*",
|
||||
],
|
||||
"Operations": [
|
||||
"Execute",
|
||||
],
|
||||
"Priority": 185,
|
||||
"FileOpenNameAvailable": true,
|
||||
},
|
||||
{
|
||||
"Name": "Self_Antivirus_Protect_File",
|
||||
"Code": 2001,
|
||||
"Kill": false,
|
||||
"Category": "File",
|
||||
"InitiatorExclude": [
|
||||
"*\\PYAS.exe",
|
||||
"*\\PYAS_Setup.exe",
|
||||
"*\\unins000.exe",
|
||||
"*\\notepad*.exe",
|
||||
"\\Device\\HarddiskVolume*\\Users\\*\\AppData\\Local\\Temp\\*\\PYAS_Setup.tmp",
|
||||
"\\Device\\HarddiskVolume*\\Users\\*\\AppData\\Local\\Temp\\*\\_unins.tmp",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\explorer.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\cleanmgr.exe",
|
||||
],
|
||||
"Target": [
|
||||
"*\\PYAS.exe",
|
||||
"*\\ProgramData\\PYAS\\*.json",
|
||||
"*\\Engine\\Heuristic\\*.yar",
|
||||
"*\\Engine\\Heuristic\\*.yara",
|
||||
"*\\Engine\\Heuristic\\*.yc",
|
||||
"*\\Engine\\Heuristic\\*.yrc",
|
||||
"*\\Engine\\Heuristic\\*.ip",
|
||||
"*\\Engine\\Heuristic\\*.txt",
|
||||
"*\\Engine\\Pattern\\*.onnx",
|
||||
"*\\Engine\\Properties\\*.json",
|
||||
"*\\Engine\\Properties\\*.onnx",
|
||||
"*\\Interface\\static\\css\\*.css",
|
||||
"*\\Interface\\static\\img\\*.ico",
|
||||
"*\\Interface\\static\\js\\*.js",
|
||||
"*\\Interface\\templates\\*.html",
|
||||
"*\\Plugins\\Filter\\*.sys",
|
||||
"*\\Plugins\\Rules\\*.json",
|
||||
],
|
||||
"Operations": [
|
||||
"Write",
|
||||
"Delete",
|
||||
]
|
||||
},
|
||||
{
|
||||
"Name": "System_Boot_Protect_File",
|
||||
"Code": 2002,
|
||||
"Kill": true,
|
||||
"Category": "File",
|
||||
"InitiatorExclude": [
|
||||
"*\\PYAS.exe",
|
||||
"*\\Huorong\\Sysdiag\\bin\\sysclean.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\SearchIndexer.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\lsass.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\svchost.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\services.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\taskhostw.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\TrustedInstaller.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\WinSxS\\*\\TiWorker.exe",
|
||||
"\\Device\\HarddiskVolume*\\$WinREAgent\\Scratch\\*\\DismHost.exe",
|
||||
],
|
||||
"Target": [
|
||||
"\\Device\\HarddiskVolume*\\bootmgr",
|
||||
"\\Device\\HarddiskVolume*\\boot.ini",
|
||||
"\\Device\\HarddiskVolume*\\BOOTNXT",
|
||||
"\\Device\\HarddiskVolume*\\EFI\\*",
|
||||
"\\Device\\HarddiskVolume*\\Boot\\*",
|
||||
"\\Device\\HarddiskVolume*\\Recovery\\*",
|
||||
],
|
||||
"Operations": [
|
||||
"Write",
|
||||
"Delete",
|
||||
]
|
||||
},
|
||||
{
|
||||
"Name": "Illegal_Characters_Protect_File",
|
||||
"Code": 2003,
|
||||
"Kill": false,
|
||||
"Category": "File",
|
||||
"InitiatorExclude": [
|
||||
"*\\PYAS.exe",
|
||||
],
|
||||
"Target": [
|
||||
"*\\CON",
|
||||
"*\\CON\\*",
|
||||
"*\\PRN",
|
||||
"*\\PRN\\*",
|
||||
"*\\AUX",
|
||||
"*\\AUX\\*",
|
||||
"*\\NUL",
|
||||
"*\\NUL\\*",
|
||||
"*\\COM?",
|
||||
"*\\COM?\\*",
|
||||
"*\\LPT?",
|
||||
"*\\LPT?\\*",
|
||||
"*\\OSDATA",
|
||||
"*\\OSDATA\\*",
|
||||
"*\\*<*",
|
||||
"*\\*>*",
|
||||
],
|
||||
"Operations": [
|
||||
"Create",
|
||||
"Write",
|
||||
"Rename",
|
||||
]
|
||||
},
|
||||
{
|
||||
"Name": "System_Ransom_Protect_File",
|
||||
"Code": 2004,
|
||||
"Kill": true,
|
||||
"Category": "File",
|
||||
"Initiator": [
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\cmd.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\cmd.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\WindowsPowerShell\\*\\powershell.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\WindowsPowerShell\\*\\powershell.exe",
|
||||
"\\Device\\HarddiskVolume*\\Program Files\\PowerShell\\*\\pwsh.exe",
|
||||
"\\Device\\HarddiskVolume*\\Program Files (x86)\\PowerShell\\*\\pwsh.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\wscript.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\wscript.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\cscript.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\cscript.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\mshta.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\mshta.exe",
|
||||
],
|
||||
"Target": [
|
||||
"\\Device\\HarddiskVolume*\\Windows\\*",
|
||||
],
|
||||
"TargetExclude": [
|
||||
"\\Device\\HarddiskVolume*\\Windows\\Temp\\*",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\SystemTemp\\*",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\Prefetch\\*",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\Logs\\*",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\WinSxS\\*",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\servicing\\*",
|
||||
],
|
||||
"Operations": [
|
||||
"Delete",
|
||||
"Rename",
|
||||
],
|
||||
"Threshold": 50,
|
||||
"TimeWindow": 3000,
|
||||
},
|
||||
{
|
||||
"Name": "User_Ransom_Protect_File",
|
||||
"Code": 2005,
|
||||
"Kill": true,
|
||||
"Category": "File",
|
||||
"InitiatorExclude": [
|
||||
"\\Device\\HarddiskVolume*\\Windows\\*",
|
||||
"\\Device\\HarddiskVolume*\\Program Files\\*",
|
||||
"\\Device\\HarddiskVolume*\\Program Files (x86)\\*",
|
||||
"*\\Google\\Chrome\\Application\\chrome.exe",
|
||||
"*\\Microsoft\\Edge\\Application\\msedge.exe",
|
||||
"*\\Microsoft\\Edge*\\Application\\*\\msedgewebview2.exe",
|
||||
"*\\Microsoft\\Edge*\\Install\\*\\setup.exe",
|
||||
"*\\Microsoft\\Edge*\\Application\\*\\Installer\\setup.exe",
|
||||
"*\\Mozilla Firefox\\firefox.exe",
|
||||
"*\\Thorium\\Application\\thorium.exe",
|
||||
"*\\Steam\\steam.exe",
|
||||
"*\\steam\\*\\steam.exe",
|
||||
"*\\Steam\\steamapps\\common\\*",
|
||||
"*\\Battle.net\\*\\Battle.net.exe",
|
||||
"*\\Epic Games\\Launcher\\Portal\\Binaries\\*\\EpicGamesLauncher.exe",
|
||||
"*\\PC4399_WPFLauncher.exe",
|
||||
"*\\Neverness To Everness\\NTELauncher.exe",
|
||||
"*\\ThunderEv.exe",
|
||||
"*\\ThunderStart.exe",
|
||||
"*\\bin\\APlayer.exe",
|
||||
"*\\bilibili\\bilibili.exe",
|
||||
"*\\KuGou.exe",
|
||||
"*\\XLGame.exe",
|
||||
"*\\XLLiveUD.exe",
|
||||
"*\\hrkill-*.exe",
|
||||
"*\\Huorong\\Sysdiag\\bin\\HipsDaemon.exe",
|
||||
"*\\360Safe.exe",
|
||||
"*\\PYAS.exe",
|
||||
"*\\WPS Office\\ksolaunch.exe",
|
||||
"*\\WPS Office\\*\\wps.exe",
|
||||
"*\\Application\\AndrowsLauncher.exe",
|
||||
"*\\resources\\bin\\SDK\\DownloadSDKServer.exe",
|
||||
"*\\bin\\*\\codex.exe",
|
||||
"*\\bin\\codex.exe",
|
||||
"*\\Weixin\\Weixin.exe",
|
||||
],
|
||||
"Target": [
|
||||
"\\Device\\HarddiskVolume*\\Users\\*",
|
||||
],
|
||||
"TargetExclude": [
|
||||
"*\\Documents\\My Games\\*",
|
||||
"*\\Documents\\Tencent Files\\*",
|
||||
"*\\Documents\\WeChat Files\\*",
|
||||
"*\\Documents\\WPS Cloud Files\\*",
|
||||
"*\\Users\\*\\steam\\*",
|
||||
"\\Device\\HarddiskVolume*\\Users\\*\\User Data\\*",
|
||||
"\\Device\\HarddiskVolume*\\Users\\*\\AppData\\*",
|
||||
"\\Device\\HarddiskVolume*\\Users\\*\\AppData\\Local\\*",
|
||||
"\\Device\\HarddiskVolume*\\Users\\*\\Temp\\*",
|
||||
"\\Device\\HarddiskVolume*\\Users\\*\\Local\\Temp\\*",
|
||||
"\\Device\\HarddiskVolume*\\Users\\*\\cache\\*",
|
||||
"\\Device\\HarddiskVolume*\\Users\\*\\.cache\\*",
|
||||
"\\Device\\HarddiskVolume*\\Users\\*\\.aws\\*",
|
||||
"\\Device\\HarddiskVolume*\\Users\\*\\.codex\\*",
|
||||
"\\Device\\HarddiskVolume*\\Users\\*\\.designer\\*",
|
||||
"\\Device\\HarddiskVolume*\\Users\\*\\.idlerc\\*",
|
||||
"\\Device\\HarddiskVolume*\\Users\\*\\.keras\\*",
|
||||
"\\Device\\HarddiskVolume*\\Users\\*\\.matplotlib\\*",
|
||||
"\\Device\\HarddiskVolume*\\Users\\*\\.ssh\\*",
|
||||
"*\\ventoy\\Boot\\*",
|
||||
"*\\AdminRegionConfig.*",
|
||||
"*\\nt_qq\\nt_*\\*",
|
||||
],
|
||||
"Extensions": [
|
||||
".zip",
|
||||
".7z",
|
||||
".rar",
|
||||
".tar",
|
||||
".gz",
|
||||
".ppt",
|
||||
".pptx",
|
||||
".wps",
|
||||
".txt",
|
||||
".rtf",
|
||||
".pdf",
|
||||
".xls",
|
||||
".xlsx",
|
||||
".doc",
|
||||
".docx",
|
||||
".jpg",
|
||||
".jpeg",
|
||||
".png",
|
||||
".webp",
|
||||
".gif",
|
||||
".mp3",
|
||||
".wav",
|
||||
".aac",
|
||||
".ogg",
|
||||
".flac",
|
||||
".mp4",
|
||||
".avi",
|
||||
".mov",
|
||||
".wmv",
|
||||
".mkv",
|
||||
".apk",
|
||||
".jar",
|
||||
".class",
|
||||
".db",
|
||||
".sqlite",
|
||||
".sqlite3",
|
||||
".mdb",
|
||||
".accdb",
|
||||
],
|
||||
"Operations": [
|
||||
"Write",
|
||||
"Delete",
|
||||
"Rename",
|
||||
],
|
||||
"Threshold": 5,
|
||||
"TimeWindow": 3000,
|
||||
},
|
||||
{
|
||||
"Name": "System_Boot_Protect_Disk_Wiper",
|
||||
"Code": 2006,
|
||||
"Kill": false,
|
||||
"Category": "Device",
|
||||
"InitiatorExclude": [
|
||||
"*\\PYAS.exe",
|
||||
"*\\rufus-*.exe",
|
||||
"*\\DiskInfo*.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\diskpart.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\diskmgmt.msc",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\taskhostw.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\vds.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\format.com",
|
||||
],
|
||||
"Operations": [
|
||||
"Ioctl",
|
||||
]
|
||||
},
|
||||
{
|
||||
"Name": "Registry_Protect_System_Suspicious",
|
||||
"Code": 3001,
|
||||
"Kill": false,
|
||||
"Category": "Registry",
|
||||
"InitiatorExclude": [
|
||||
"\\Device\\HarddiskVolume*\\Windows\\*",
|
||||
"\\Device\\HarddiskVolume*\\Program Files\\*",
|
||||
"\\Device\\HarddiskVolume*\\Program Files (x86)\\*",
|
||||
"\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender\\*",
|
||||
"\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\*",
|
||||
"*\\hrkill-*.exe",
|
||||
"*\\Huorong\\Sysdiag\\bin\\HipsDaemon.exe",
|
||||
"*\\360Safe.exe",
|
||||
"*\\PYAS.exe",
|
||||
],
|
||||
"Target": [
|
||||
"*\\mouclass",
|
||||
"*\\kbdclass",
|
||||
"*\\DisableAntiSpyware",
|
||||
"*\\DisableWindowsUpdateAccess",
|
||||
"*\\NoWindowsUpdate",
|
||||
"*\\AutoAdminLogon",
|
||||
"*\\DefaultUserName",
|
||||
"*\\DefaultPassword",
|
||||
"*\\AltDefaultUserName",
|
||||
"*\\AltDefaultPassword",
|
||||
"*\\LegalNoticeCaption",
|
||||
"*\\LegalNoticeText",
|
||||
"*\\AutoReboot",
|
||||
"*\\DisableAutomaticRestartOnFailure",
|
||||
"*\\SystemBiosVersion",
|
||||
"*\\ClearRecentDocsOnExit",
|
||||
"*\\HideClock",
|
||||
"*\\HideFastUserSwitching",
|
||||
"*\\ShutdownWithoutLogon",
|
||||
"*\\DisableCAD",
|
||||
],
|
||||
"Operations": [
|
||||
"Write",
|
||||
"Delete",
|
||||
"Create",
|
||||
],
|
||||
"Priority": 130,
|
||||
},
|
||||
{
|
||||
"Name": "Registry_Protect_Open_With_Suspicious",
|
||||
"Code": 3002,
|
||||
"Kill": false,
|
||||
"Category": "Registry",
|
||||
"InitiatorExclude": [
|
||||
"\\Device\\HarddiskVolume*\\Windows\\*",
|
||||
"\\Device\\HarddiskVolume*\\Program Files\\*",
|
||||
"\\Device\\HarddiskVolume*\\Program Files (x86)\\*",
|
||||
"*\\PYAS.exe",
|
||||
],
|
||||
"Target": [
|
||||
"*\\Classes\\.exe",
|
||||
"*\\Classes\\.com",
|
||||
"*\\Classes\\.bat",
|
||||
"*\\Classes\\.cmd",
|
||||
"*\\Classes\\exefile\\*",
|
||||
"*\\Classes\\comfile\\*",
|
||||
"*\\Classes\\batfile\\*",
|
||||
"*\\Classes\\cmdfile\\*",
|
||||
],
|
||||
"Operations": [
|
||||
"Write",
|
||||
"Delete",
|
||||
"Create",
|
||||
],
|
||||
"Priority": 150,
|
||||
},
|
||||
{
|
||||
"Name": "Registry_Protect_BCD_Suspicious",
|
||||
"Code": 3003,
|
||||
"Kill": false,
|
||||
"Category": "Registry",
|
||||
"InitiatorExclude": [
|
||||
"\\Device\\HarddiskVolume*\\Windows\\*",
|
||||
"\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender\\*",
|
||||
"\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\*",
|
||||
"*\\PYAS.exe",
|
||||
],
|
||||
"Target": [
|
||||
"\\REGISTRY\\MACHINE\\BCD00000000",
|
||||
"\\REGISTRY\\MACHINE\\BCD00000000\\*",
|
||||
],
|
||||
"Operations": [
|
||||
"Write",
|
||||
"Delete",
|
||||
"Create",
|
||||
],
|
||||
"Priority": 140,
|
||||
},
|
||||
{
|
||||
"Name": "Registry_Protect_System_Critical",
|
||||
"Code": 3004,
|
||||
"Kill": true,
|
||||
"Category": "Registry",
|
||||
"InitiatorExclude": [
|
||||
"\\Device\\HarddiskVolume*\\Windows\\*",
|
||||
"*\\PYAS.exe",
|
||||
],
|
||||
"Target": [
|
||||
"*\\EnableLUA",
|
||||
"*\\ConsentPromptBehaviorAdmin",
|
||||
"*\\ConsentPromptBehaviorUser",
|
||||
"*\\EnableSecureUIAPaths",
|
||||
"*\\BootExecute",
|
||||
"*\\SubSystems",
|
||||
"*\\FirmwareBootDevice",
|
||||
"*\\BootDriverFlags",
|
||||
"*\\SystemStartOptions",
|
||||
"*\\Userinit",
|
||||
"*\\UIHost",
|
||||
"*\\Debugger",
|
||||
"*\\NoControlPanel",
|
||||
"*\\NoDrives",
|
||||
"*\\NoFileMenu",
|
||||
"*\\NoFind",
|
||||
"*\\NoStartMenuPinnedList",
|
||||
"*\\NoSetFolders",
|
||||
"*\\NoSetFolderOptions",
|
||||
"*\\NoViewOnDrive",
|
||||
"*\\NoClose",
|
||||
"*\\NoDesktop",
|
||||
"*\\NoLogoff",
|
||||
"*\\NoFolderOptions",
|
||||
"*\\RestrictRun",
|
||||
"*\\NoViewContextMenu",
|
||||
"*\\NoStartMenuMyGames",
|
||||
"*\\NoStartMenuMyMusic",
|
||||
"*\\DisableCMD",
|
||||
"*\\NoAddingComponents",
|
||||
"*\\NoWinKeys",
|
||||
"*\\NoStartMenuLogOff",
|
||||
"*\\NoSimpleNetIDList",
|
||||
"*\\NoLowDiskSpaceChecks",
|
||||
"*\\DisableLockWorkstation",
|
||||
"*\\Restrict_Run",
|
||||
"*\\DisableTaskMgr",
|
||||
"*\\DisableRegistryTools",
|
||||
"*\\DisableChangePassword",
|
||||
"*\\NoComponents",
|
||||
"*\\NoStartMenuMorePrograms",
|
||||
"*\\NoActiveDesktop",
|
||||
"*\\NoSetActiveDesktop",
|
||||
"*\\NoRecentDocsMenu",
|
||||
"*\\NoChangeStartMenu",
|
||||
"*\\NoFavoritesMenu",
|
||||
"*\\NoRecentDocsHistory",
|
||||
"*\\NoSetTaskbar",
|
||||
"*\\NoSMHelp",
|
||||
"*\\NoTrayContextMenu",
|
||||
"*\\NoManageMyComputerVerb",
|
||||
"*\\NoRealMode",
|
||||
"*\\NoRun",
|
||||
"*\\NoActiveDesktopChanges",
|
||||
"*\\NoStartMenuNetworkPlaces",
|
||||
"*\\NoLockScreen",
|
||||
"*\\NoSRM",
|
||||
"*\\NoInteractiveServices",
|
||||
"*\\NoTheme",
|
||||
],
|
||||
"Operations": [
|
||||
"Write",
|
||||
"Delete",
|
||||
"Create",
|
||||
],
|
||||
"Priority": 180,
|
||||
},
|
||||
{
|
||||
"Name": "Registry_Protect_SafeMode_Autostart",
|
||||
"Code": 3005,
|
||||
"Kill": true,
|
||||
"Category": "Registry",
|
||||
"InitiatorExclude": [
|
||||
"\\Device\\HarddiskVolume*\\Windows\\*",
|
||||
"\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender\\*",
|
||||
"\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\*",
|
||||
"*\\Sources\\SetupHost.exe",
|
||||
"*\\Work\\*\\DismHost.exe",
|
||||
"*\\Huorong\\Sysdiag\\bin\\HipsDaemon.exe",
|
||||
"*\\360Safe.exe",
|
||||
"*\\PYAS.exe",
|
||||
],
|
||||
"Target": [
|
||||
"\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Control\\SafeBoot\\Minimal\\*",
|
||||
"\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Control\\SafeBoot\\Network\\*",
|
||||
"\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Control\\SafeBoot\\AlternateShell",
|
||||
"\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Control\\SafeBoot\\AlternateShell\\*",
|
||||
"\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Control\\SafeBoot\\Option",
|
||||
"\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Control\\SafeBoot\\Option\\*",
|
||||
],
|
||||
"Operations": [
|
||||
"Write",
|
||||
"Delete",
|
||||
"Create",
|
||||
],
|
||||
"Priority": 170,
|
||||
},
|
||||
{
|
||||
"Name": "Registry_Protect_Pending_File_Rename",
|
||||
"Code": 3006,
|
||||
"Kill": false,
|
||||
"Category": "Registry",
|
||||
"InitiatorExclude": [
|
||||
"\\Device\\HarddiskVolume*\\Windows\\*",
|
||||
"\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender\\*",
|
||||
"\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\*",
|
||||
"*\\Sources\\SetupHost.exe",
|
||||
"*\\Work\\*\\DismHost.exe",
|
||||
"*\\Huorong\\Sysdiag\\bin\\HipsDaemon.exe",
|
||||
"*\\360Safe.exe",
|
||||
"*\\PYAS.exe",
|
||||
],
|
||||
"Target": [
|
||||
"\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Control\\Session Manager\\PendingFileRenameOperations",
|
||||
"\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Control\\Session Manager\\PendingFileRenameOperations2",
|
||||
],
|
||||
"Operations": [
|
||||
"Write",
|
||||
"Delete",
|
||||
"Create",
|
||||
],
|
||||
"Priority": 140,
|
||||
},
|
||||
{
|
||||
"Name": "Registry_Protect_OOBE_Reset",
|
||||
"Code": 3007,
|
||||
"Kill": true,
|
||||
"Category": "Registry",
|
||||
"InitiatorExclude": [
|
||||
"*\\Sources\\SetupHost.exe",
|
||||
"*\\Work\\*\\DismHost.exe",
|
||||
"*\\Windows\\System32\\Sysprep\\sysprep.exe",
|
||||
"*\\Windows\\System32\\oobe\\*",
|
||||
"*\\PYAS.exe",
|
||||
],
|
||||
"Target": [
|
||||
"\\REGISTRY\\MACHINE\\SYSTEM\\Setup\\OOBEInProgress",
|
||||
"\\REGISTRY\\MACHINE\\SYSTEM\\Setup\\SystemSetupInProgress",
|
||||
"\\REGISTRY\\MACHINE\\SYSTEM\\Setup\\SetupType",
|
||||
"\\REGISTRY\\MACHINE\\SYSTEM\\Setup\\CmdLine",
|
||||
"\\REGISTRY\\MACHINE\\SYSTEM\\Setup\\AuditInProgress",
|
||||
"\\REGISTRY\\MACHINE\\SYSTEM\\Setup\\MiniSetupInProgress",
|
||||
"\\REGISTRY\\MACHINE\\SYSTEM\\Setup\\SetupPhase",
|
||||
"\\REGISTRY\\MACHINE\\SYSTEM\\Setup\\Status\\SysprepStatus\\*",
|
||||
"\\REGISTRY\\MACHINE\\SYSTEM\\Setup\\Status\\ChildCompletion\\*",
|
||||
"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\State\\ImageState",
|
||||
"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\OOBE\\*",
|
||||
"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\*",
|
||||
],
|
||||
"Operations": [
|
||||
"Write",
|
||||
"Delete",
|
||||
"Create",
|
||||
],
|
||||
"Priority": 175,
|
||||
},
|
||||
]
|
||||
}
|
||||
Reference in new issue
Block a user