From e3787523c7ffc29d36662d991f5d4d71cd7c4f71 Mon Sep 17 00:00:00 2001 From: 87owo <85057800+87owo@users.noreply.github.com> Date: Wed, 15 Jul 2026 21:19:15 +0800 Subject: [PATCH] Add files via upload --- Plugins/Rules/Rules_Driver_P1.json | 195 +++++++++++++++++++++++++++-- 1 file changed, 182 insertions(+), 13 deletions(-) diff --git a/Plugins/Rules/Rules_Driver_P1.json b/Plugins/Rules/Rules_Driver_P1.json index efcbb83..f4cd12e 100644 --- a/Plugins/Rules/Rules_Driver_P1.json +++ b/Plugins/Rules/Rules_Driver_P1.json @@ -39,13 +39,6 @@ "*wmic*PYAS.exe*delete*", "*wmic*msedgewebview2.exe*call terminate*", "*wmic*msedgewebview2.exe*delete*", - "*net stop PYAS_Driver*", - "*net1 stop PYAS_Driver*", - "*sc stop PYAS_Driver*", - "*sc.exe stop PYAS_Driver*", - "*sc delete PYAS_Driver*", - "*sc.exe delete PYAS_Driver*", - "*fltmc unload PYAS_Driver*", ], "Operations": [ "Execute", @@ -56,10 +49,6 @@ "*\\powershell.exe", "*\\pwsh.exe", "*\\wmic.exe", - "*\\net.exe", - "*\\net1.exe", - "*\\sc.exe", - "*\\fltmc.exe", ], "Priority": 110, "FileOpenNameAvailable": true, @@ -82,8 +71,8 @@ "\\Device\\HarddiskVolume*\\Windows\\System32\\services.exe", "\\Device\\HarddiskVolume*\\Windows\\System32\\svchost.exe", "\\Device\\HarddiskVolume*\\Windows\\SystemApps\\*\\SearchHost.exe", - "\\Device\\HarddiskVolume*\\Program Files\\WindowsApps\\*\\gamingservices.exe", - "\\Device\\HarddiskVolume*\\Program Files (x86)\\Lenovo\\SmartEngine\\*\\SmartEngineHost64.exe", + "\\Device\\HarddiskVolume*\\Program Files\\*", + "\\Device\\HarddiskVolume*\\Program Files (x86)\\*", ], "Target": [ "*\\PYAS.exe", @@ -172,6 +161,186 @@ "Priority": 185, "FileOpenNameAvailable": true, }, + { + "Name": "Process_Protect_UserWritable_SystemName_Dll_Load", + "Code": 1006, + "Kill": false, + "Category": "Process", + "Initiator": [ + "\\Device\\HarddiskVolume*\\Users\\*\\AppData\\*\\svchost.exe", + "\\Device\\HarddiskVolume*\\Users\\*\\AppData\\*\\rundll32.exe", + "\\Device\\HarddiskVolume*\\Users\\*\\AppData\\*\\regsvr32.exe", + "\\Device\\HarddiskVolume*\\Users\\*\\AppData\\*\\dllhost.exe", + "\\Device\\HarddiskVolume*\\Users\\*\\AppData\\*\\msiexec.exe", + "\\Device\\HarddiskVolume*\\Users\\*\\AppData\\*\\taskhostw.exe", + "\\Device\\HarddiskVolume*\\Users\\*\\AppData\\*\\spoolsv.exe", + "\\Device\\HarddiskVolume*\\Users\\*\\Downloads\\*\\svchost.exe", + "\\Device\\HarddiskVolume*\\Users\\*\\Downloads\\*\\rundll32.exe", + "\\Device\\HarddiskVolume*\\Users\\*\\Downloads\\*\\regsvr32.exe", + "\\Device\\HarddiskVolume*\\Users\\*\\Desktop\\*\\svchost.exe", + "\\Device\\HarddiskVolume*\\Users\\*\\Desktop\\*\\rundll32.exe", + "\\Device\\HarddiskVolume*\\Users\\*\\Desktop\\*\\regsvr32.exe", + "\\Device\\HarddiskVolume*\\ProgramData\\*\\svchost.exe", + "\\Device\\HarddiskVolume*\\ProgramData\\*\\rundll32.exe", + "\\Device\\HarddiskVolume*\\ProgramData\\*\\regsvr32.exe", + ], + "Target": [ + "\\Device\\HarddiskVolume*\\Users\\*\\AppData\\*\\*.dll", + "\\Device\\HarddiskVolume*\\Users\\*\\Downloads\\*\\*.dll", + "\\Device\\HarddiskVolume*\\Users\\*\\Desktop\\*\\*.dll", + "\\Device\\HarddiskVolume*\\ProgramData\\*\\*.dll", + ], + "Operations": [ + "ImageLoad", + ], + "Priority": 160, + }, + { + "Name": "Memory_Protect_Critical_Process_CreateRemoteThread", + "Code": 1007, + "Kill": false, + "Category": "Memory", + "InitiatorExclude": [ + "\\Device\\HarddiskVolume*\\Windows\\*", + "\\Device\\HarddiskVolume*\\Program Files\\*", + "\\Device\\HarddiskVolume*\\Program Files (x86)\\*", + "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender\\*", + "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\*", + "*\\Huorong\\Sysdiag\\bin\\HipsDaemon.exe", + "*\\360Safe.exe", + "*\\PYAS.exe", + ], + "Target": [ + "\\Device\\HarddiskVolume*\\Windows\\System32\\lsass.exe", + "\\Device\\HarddiskVolume*\\Windows\\System32\\winlogon.exe", + "\\Device\\HarddiskVolume*\\Windows\\System32\\services.exe", + "\\Device\\HarddiskVolume*\\Windows\\System32\\csrss.exe", + ], + "Operations": [ + "WriteMemory", + "VmOperation", + "CreateThread", + ], + "OperationMatch": "All", + "MinimumRiskScore": 90, + "HandleTypes": [ + "Create", + "Duplicate", + ], + "ObjectTypes": [ + "Process", + ], + "Priority": 175, + }, + { + "Name": "Memory_Protect_Critical_Process_ThreadHijack", + "Code": 1008, + "Kill": false, + "Category": "Memory", + "InitiatorExclude": [ + "\\Device\\HarddiskVolume*\\Windows\\*", + "\\Device\\HarddiskVolume*\\Program Files\\*", + "\\Device\\HarddiskVolume*\\Program Files (x86)\\*", + "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender\\*", + "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\*", + "*\\Huorong\\Sysdiag\\bin\\HipsDaemon.exe", + "*\\360Safe.exe", + "*\\PYAS.exe", + ], + "Target": [ + "\\Device\\HarddiskVolume*\\Windows\\System32\\lsass.exe", + "\\Device\\HarddiskVolume*\\Windows\\System32\\winlogon.exe", + "\\Device\\HarddiskVolume*\\Windows\\System32\\services.exe", + "\\Device\\HarddiskVolume*\\Windows\\System32\\csrss.exe", + ], + "Operations": [ + "WriteMemory", + "VmOperation", + "SetThreadContext", + ], + "OperationMatch": "All", + "MinimumRiskScore": 90, + "HandleTypes": [ + "Create", + "Duplicate", + ], + "ObjectTypes": [ + "Process", + ], + "Priority": 175, + }, + { + "Name": "Memory_Protect_Service_Process_CreateRemoteThread", + "Code": 1009, + "Kill": false, + "Category": "Memory", + "InitiatorExclude": [ + "\\Device\\HarddiskVolume*\\Windows\\*", + "\\Device\\HarddiskVolume*\\Program Files\\*", + "\\Device\\HarddiskVolume*\\Program Files (x86)\\*", + "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender\\*", + "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\*", + "*\\Huorong\\Sysdiag\\bin\\HipsDaemon.exe", + "*\\360Safe.exe", + "*\\PYAS.exe", + ], + "Target": [ + "\\Device\\HarddiskVolume*\\Windows\\System32\\svchost.exe", + "\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\svchost.exe", + "\\Device\\HarddiskVolume*\\Windows\\System32\\spoolsv.exe", + ], + "Operations": [ + "WriteMemory", + "VmOperation", + "CreateThread", + ], + "OperationMatch": "All", + "MinimumRiskScore": 90, + "HandleTypes": [ + "Create", + "Duplicate", + ], + "ObjectTypes": [ + "Process", + ], + "Priority": 170, + }, + { + "Name": "Memory_Protect_Service_Process_ThreadHijack", + "Code": 1010, + "Kill": false, + "Category": "Memory", + "InitiatorExclude": [ + "\\Device\\HarddiskVolume*\\Windows\\*", + "\\Device\\HarddiskVolume*\\Program Files\\*", + "\\Device\\HarddiskVolume*\\Program Files (x86)\\*", + "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender\\*", + "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\*", + "*\\Huorong\\Sysdiag\\bin\\HipsDaemon.exe", + "*\\360Safe.exe", + "*\\PYAS.exe", + ], + "Target": [ + "\\Device\\HarddiskVolume*\\Windows\\System32\\svchost.exe", + "\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\svchost.exe", + "\\Device\\HarddiskVolume*\\Windows\\System32\\spoolsv.exe", + ], + "Operations": [ + "WriteMemory", + "VmOperation", + "SetThreadContext", + ], + "OperationMatch": "All", + "MinimumRiskScore": 90, + "HandleTypes": [ + "Create", + "Duplicate", + ], + "ObjectTypes": [ + "Process", + ], + "Priority": 170, + }, { "Name": "Self_Antivirus_Protect_File", "Code": 2001,