87owo/PYAS
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add files via upload

Browse Source
This commit is contained in:
87owo authored and GitHub committed 2026-07-15 21:19:15 +08:00
1 parent 1c4e908b1b
commit e3787523c7
1 file changed
+182 -13
Download Patch File Download Diff File Expand all files Collapse all files
Plugins/Rules/Rules_Driver_P1.json
+182 -13
View File
@@ -39,13 +39,6 @@
"*wmic*PYAS.exe*delete*",
"*wmic*msedgewebview2.exe*call terminate*",
"*wmic*msedgewebview2.exe*delete*",
"*net stop PYAS_Driver*",
"*net1 stop PYAS_Driver*",
"*sc stop PYAS_Driver*",
"*sc.exe stop PYAS_Driver*",
"*sc delete PYAS_Driver*",
"*sc.exe delete PYAS_Driver*",
"*fltmc unload PYAS_Driver*",
],
"Operations": [
"Execute",
@@ -56,10 +49,6 @@
"*\\powershell.exe",
"*\\pwsh.exe",
"*\\wmic.exe",
"*\\net.exe",
"*\\net1.exe",
"*\\sc.exe",
"*\\fltmc.exe",
],
"Priority": 110,
"FileOpenNameAvailable": true,
@@ -82,8 +71,8 @@
"\\Device\\HarddiskVolume*\\Windows\\System32\\services.exe",
"\\Device\\HarddiskVolume*\\Windows\\System32\\svchost.exe",
"\\Device\\HarddiskVolume*\\Windows\\SystemApps\\*\\SearchHost.exe",
"\\Device\\HarddiskVolume*\\Program Files\\WindowsApps\\*\\gamingservices.exe",
"\\Device\\HarddiskVolume*\\Program Files (x86)\\Lenovo\\SmartEngine\\*\\SmartEngineHost64.exe",
"\\Device\\HarddiskVolume*\\Program Files\\*",
"\\Device\\HarddiskVolume*\\Program Files (x86)\\*",
],
"Target": [
"*\\PYAS.exe",
@@ -172,6 +161,186 @@
"Priority": 185,
"FileOpenNameAvailable": true,
},
{
"Name": "Process_Protect_UserWritable_SystemName_Dll_Load",
"Code": 1006,
"Kill": false,
"Category": "Process",
"Initiator": [
"\\Device\\HarddiskVolume*\\Users\\*\\AppData\\*\\svchost.exe",
"\\Device\\HarddiskVolume*\\Users\\*\\AppData\\*\\rundll32.exe",
"\\Device\\HarddiskVolume*\\Users\\*\\AppData\\*\\regsvr32.exe",
"\\Device\\HarddiskVolume*\\Users\\*\\AppData\\*\\dllhost.exe",
"\\Device\\HarddiskVolume*\\Users\\*\\AppData\\*\\msiexec.exe",
"\\Device\\HarddiskVolume*\\Users\\*\\AppData\\*\\taskhostw.exe",
"\\Device\\HarddiskVolume*\\Users\\*\\AppData\\*\\spoolsv.exe",
"\\Device\\HarddiskVolume*\\Users\\*\\Downloads\\*\\svchost.exe",
"\\Device\\HarddiskVolume*\\Users\\*\\Downloads\\*\\rundll32.exe",
"\\Device\\HarddiskVolume*\\Users\\*\\Downloads\\*\\regsvr32.exe",
"\\Device\\HarddiskVolume*\\Users\\*\\Desktop\\*\\svchost.exe",
"\\Device\\HarddiskVolume*\\Users\\*\\Desktop\\*\\rundll32.exe",
"\\Device\\HarddiskVolume*\\Users\\*\\Desktop\\*\\regsvr32.exe",
"\\Device\\HarddiskVolume*\\ProgramData\\*\\svchost.exe",
"\\Device\\HarddiskVolume*\\ProgramData\\*\\rundll32.exe",
"\\Device\\HarddiskVolume*\\ProgramData\\*\\regsvr32.exe",
],
"Target": [
"\\Device\\HarddiskVolume*\\Users\\*\\AppData\\*\\*.dll",
"\\Device\\HarddiskVolume*\\Users\\*\\Downloads\\*\\*.dll",
"\\Device\\HarddiskVolume*\\Users\\*\\Desktop\\*\\*.dll",
"\\Device\\HarddiskVolume*\\ProgramData\\*\\*.dll",
],
"Operations": [
"ImageLoad",
],
"Priority": 160,
},
{
"Name": "Memory_Protect_Critical_Process_CreateRemoteThread",
"Code": 1007,
"Kill": false,
"Category": "Memory",
"InitiatorExclude": [
"\\Device\\HarddiskVolume*\\Windows\\*",
"\\Device\\HarddiskVolume*\\Program Files\\*",
"\\Device\\HarddiskVolume*\\Program Files (x86)\\*",
"\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender\\*",
"\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\*",
"*\\Huorong\\Sysdiag\\bin\\HipsDaemon.exe",
"*\\360Safe.exe",
"*\\PYAS.exe",
],
"Target": [
"\\Device\\HarddiskVolume*\\Windows\\System32\\lsass.exe",
"\\Device\\HarddiskVolume*\\Windows\\System32\\winlogon.exe",
"\\Device\\HarddiskVolume*\\Windows\\System32\\services.exe",
"\\Device\\HarddiskVolume*\\Windows\\System32\\csrss.exe",
],
"Operations": [
"WriteMemory",
"VmOperation",
"CreateThread",
],
"OperationMatch": "All",
"MinimumRiskScore": 90,
"HandleTypes": [
"Create",
"Duplicate",
],
"ObjectTypes": [
"Process",
],
"Priority": 175,
},
{
"Name": "Memory_Protect_Critical_Process_ThreadHijack",
"Code": 1008,
"Kill": false,
"Category": "Memory",
"InitiatorExclude": [
"\\Device\\HarddiskVolume*\\Windows\\*",
"\\Device\\HarddiskVolume*\\Program Files\\*",
"\\Device\\HarddiskVolume*\\Program Files (x86)\\*",
"\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender\\*",
"\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\*",
"*\\Huorong\\Sysdiag\\bin\\HipsDaemon.exe",
"*\\360Safe.exe",
"*\\PYAS.exe",
],
"Target": [
"\\Device\\HarddiskVolume*\\Windows\\System32\\lsass.exe",
"\\Device\\HarddiskVolume*\\Windows\\System32\\winlogon.exe",
"\\Device\\HarddiskVolume*\\Windows\\System32\\services.exe",
"\\Device\\HarddiskVolume*\\Windows\\System32\\csrss.exe",
],
"Operations": [
"WriteMemory",
"VmOperation",
"SetThreadContext",
],
"OperationMatch": "All",
"MinimumRiskScore": 90,
"HandleTypes": [
"Create",
"Duplicate",
],
"ObjectTypes": [
"Process",
],
"Priority": 175,
},
{
"Name": "Memory_Protect_Service_Process_CreateRemoteThread",
"Code": 1009,
"Kill": false,
"Category": "Memory",
"InitiatorExclude": [
"\\Device\\HarddiskVolume*\\Windows\\*",
"\\Device\\HarddiskVolume*\\Program Files\\*",
"\\Device\\HarddiskVolume*\\Program Files (x86)\\*",
"\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender\\*",
"\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\*",
"*\\Huorong\\Sysdiag\\bin\\HipsDaemon.exe",
"*\\360Safe.exe",
"*\\PYAS.exe",
],
"Target": [
"\\Device\\HarddiskVolume*\\Windows\\System32\\svchost.exe",
"\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\svchost.exe",
"\\Device\\HarddiskVolume*\\Windows\\System32\\spoolsv.exe",
],
"Operations": [
"WriteMemory",
"VmOperation",
"CreateThread",
],
"OperationMatch": "All",
"MinimumRiskScore": 90,
"HandleTypes": [
"Create",
"Duplicate",
],
"ObjectTypes": [
"Process",
],
"Priority": 170,
},
{
"Name": "Memory_Protect_Service_Process_ThreadHijack",
"Code": 1010,
"Kill": false,
"Category": "Memory",
"InitiatorExclude": [
"\\Device\\HarddiskVolume*\\Windows\\*",
"\\Device\\HarddiskVolume*\\Program Files\\*",
"\\Device\\HarddiskVolume*\\Program Files (x86)\\*",
"\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender\\*",
"\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\*",
"*\\Huorong\\Sysdiag\\bin\\HipsDaemon.exe",
"*\\360Safe.exe",
"*\\PYAS.exe",
],
"Target": [
"\\Device\\HarddiskVolume*\\Windows\\System32\\svchost.exe",
"\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\svchost.exe",
"\\Device\\HarddiskVolume*\\Windows\\System32\\spoolsv.exe",
],
"Operations": [
"WriteMemory",
"VmOperation",
"SetThreadContext",
],
"OperationMatch": "All",
"MinimumRiskScore": 90,
"HandleTypes": [
"Create",
"Duplicate",
],
"ObjectTypes": [
"Process",
],
"Priority": 170,
},
{
"Name": "Self_Antivirus_Protect_File",
"Code": 2001,