859 lines
35 KiB
JSON
859 lines
35 KiB
JSON
{
|
|
"DynamicRules": [
|
|
{
|
|
"Name": "Self_Antivirus_Protect_Command",
|
|
"Code": 1001,
|
|
"Kill": false,
|
|
"Category": "Process",
|
|
"Initiator": [
|
|
"\\Device\\HarddiskVolume*\\Windows\\System32\\cmd.exe",
|
|
"\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\cmd.exe",
|
|
"\\Device\\HarddiskVolume*\\Windows\\System32\\WindowsPowerShell\\*\\powershell.exe",
|
|
"\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\WindowsPowerShell\\*\\powershell.exe",
|
|
"\\Device\\HarddiskVolume*\\Program Files\\PowerShell\\*\\pwsh.exe",
|
|
"\\Device\\HarddiskVolume*\\Program Files (x86)\\PowerShell\\*\\pwsh.exe",
|
|
"\\Device\\HarddiskVolume*\\Windows\\System32\\wscript.exe",
|
|
"\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\wscript.exe",
|
|
"\\Device\\HarddiskVolume*\\Windows\\System32\\cscript.exe",
|
|
"\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\cscript.exe",
|
|
"\\Device\\HarddiskVolume*\\Windows\\System32\\mshta.exe",
|
|
"\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\mshta.exe",
|
|
"\\Device\\HarddiskVolume*\\Windows\\System32\\wsl.exe",
|
|
"\\Device\\HarddiskVolume*\\Windows\\System32\\bash.exe",
|
|
"\\Device\\HarddiskVolume*\\Windows\\System32\\rundll32.exe",
|
|
"\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\rundll32.exe",
|
|
"\\Device\\HarddiskVolume*\\Windows\\System32\\regsvr32.exe",
|
|
"\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\regsvr32.exe",
|
|
],
|
|
"InitiatorExclude": [
|
|
"*\\PYAS.exe",
|
|
],
|
|
"CommandLine": [
|
|
"*taskkill*PYAS.exe*",
|
|
"*taskkill*msedgewebview2.exe*",
|
|
"*Stop-Process*PYAS*",
|
|
"*Stop-Process*msedgewebview2*",
|
|
"*Get-Process*PYAS*Stop-Process*",
|
|
"*Get-Process*msedgewebview2*Stop-Process*",
|
|
"*wmic*PYAS.exe*call terminate*",
|
|
"*wmic*PYAS.exe*delete*",
|
|
"*wmic*msedgewebview2.exe*call terminate*",
|
|
"*wmic*msedgewebview2.exe*delete*",
|
|
],
|
|
"Operations": [
|
|
"Execute",
|
|
],
|
|
"Target": [
|
|
"*\\taskkill.exe",
|
|
"*\\cmd.exe",
|
|
"*\\powershell.exe",
|
|
"*\\pwsh.exe",
|
|
"*\\wmic.exe",
|
|
],
|
|
"Priority": 110,
|
|
"FileOpenNameAvailable": true,
|
|
"SubsystemProcess": false,
|
|
},
|
|
{
|
|
"Name": "Self_Antivirus_Protect_Handle",
|
|
"Code": 1002,
|
|
"Kill": false,
|
|
"Category": "Process",
|
|
"InitiatorExclude": [
|
|
"*\\PYAS.exe",
|
|
"*\\PYAS_Setup.exe",
|
|
"*\\unins000.exe",
|
|
"\\Device\\HarddiskVolume*\\Users\\*\\AppData\\Local\\Temp\\*\\PYAS_Setup.tmp",
|
|
"\\Device\\HarddiskVolume*\\Users\\*\\AppData\\Local\\Temp\\*\\_unins.tmp",
|
|
"\\Device\\HarddiskVolume*\\Windows\\explorer.exe",
|
|
"\\Device\\HarddiskVolume*\\Windows\\System32\\csrss.exe",
|
|
"\\Device\\HarddiskVolume*\\Windows\\System32\\lsass.exe",
|
|
"\\Device\\HarddiskVolume*\\Windows\\System32\\services.exe",
|
|
"\\Device\\HarddiskVolume*\\Windows\\System32\\svchost.exe",
|
|
"\\Device\\HarddiskVolume*\\Windows\\System32\\msiexec.exe",
|
|
"\\Device\\HarddiskVolume*\\Windows\\SystemApps\\*\\SearchHost.exe",
|
|
"\\Device\\HarddiskVolume*\\Program Files\\*",
|
|
"\\Device\\HarddiskVolume*\\Program Files (x86)\\*",
|
|
"*\\games\\Arknights Game\\Arknights.exe",
|
|
"*\\games\\EndField Game\\EndField.exe",
|
|
],
|
|
"Target": [
|
|
"*\\PYAS.exe",
|
|
"*\\msedgewebview2.exe",
|
|
],
|
|
"TargetProcessTree": [
|
|
"*\\PYAS.exe",
|
|
],
|
|
"Operations": [
|
|
"Terminate",
|
|
"SuspendResume",
|
|
"DuplicateHandle",
|
|
"CreateProcess",
|
|
"SetThreadToken",
|
|
"Impersonate",
|
|
],
|
|
"Priority": 130,
|
|
"InitiatorProcessTreeExclude": [
|
|
"*\\PYAS.exe",
|
|
],
|
|
"HandleTypes": [
|
|
"Create",
|
|
"Duplicate",
|
|
],
|
|
"OperationMatch": "Any",
|
|
"MinimumRiskScore": 20,
|
|
"ObjectTypes": [
|
|
"Process",
|
|
"Thread",
|
|
]
|
|
},
|
|
{
|
|
"Name": "Attack_Command_Block_EFI_Mount",
|
|
"Code": 1003,
|
|
"Kill": false,
|
|
"Category": "Process",
|
|
"Target": [
|
|
"*\\mountvol.exe",
|
|
],
|
|
"CommandLine": [
|
|
"*mountvol* /S*",
|
|
],
|
|
"Operations": [
|
|
"Execute",
|
|
],
|
|
"Priority": 170,
|
|
"FileOpenNameAvailable": true,
|
|
},
|
|
{
|
|
"Name": "Attack_Command_Block_Destructive_Cmd_Delete",
|
|
"Code": 1004,
|
|
"Kill": true,
|
|
"Category": "Process",
|
|
"Target": [
|
|
"*\\cmd.exe",
|
|
],
|
|
"CommandLine": [
|
|
"*rd /s /q C:\\*",
|
|
"*rmdir /s /q C:\\*",
|
|
"*del X:\\* /s /f /q*",
|
|
"*rd /s /q X:\\EFI*",
|
|
],
|
|
"Operations": [
|
|
"Execute",
|
|
],
|
|
"Priority": 190,
|
|
"FileOpenNameAvailable": true,
|
|
},
|
|
{
|
|
"Name": "Attack_Command_Block_Forced_OOBE_Sysprep",
|
|
"Code": 1005,
|
|
"Kill": false,
|
|
"Category": "Process",
|
|
"Target": [
|
|
"*\\sysprep.exe",
|
|
],
|
|
"CommandLine": [
|
|
"*sysprep* /oobe*",
|
|
"*sysprep*/oobe*",
|
|
"* /oobe* /reboot*",
|
|
"* /generalize* /oobe*",
|
|
],
|
|
"Operations": [
|
|
"Execute",
|
|
],
|
|
"Priority": 185,
|
|
"FileOpenNameAvailable": true,
|
|
},
|
|
{
|
|
"Name": "Process_Protect_UserWritable_SystemName_Dll_Load",
|
|
"Code": 1006,
|
|
"Kill": false,
|
|
"Category": "Process",
|
|
"Initiator": [
|
|
"\\Device\\HarddiskVolume*\\Users\\*\\AppData\\*\\svchost.exe",
|
|
"\\Device\\HarddiskVolume*\\Users\\*\\AppData\\*\\rundll32.exe",
|
|
"\\Device\\HarddiskVolume*\\Users\\*\\AppData\\*\\regsvr32.exe",
|
|
"\\Device\\HarddiskVolume*\\Users\\*\\AppData\\*\\dllhost.exe",
|
|
"\\Device\\HarddiskVolume*\\Users\\*\\AppData\\*\\msiexec.exe",
|
|
"\\Device\\HarddiskVolume*\\Users\\*\\AppData\\*\\taskhostw.exe",
|
|
"\\Device\\HarddiskVolume*\\Users\\*\\AppData\\*\\spoolsv.exe",
|
|
"\\Device\\HarddiskVolume*\\Users\\*\\Downloads\\*\\svchost.exe",
|
|
"\\Device\\HarddiskVolume*\\Users\\*\\Downloads\\*\\rundll32.exe",
|
|
"\\Device\\HarddiskVolume*\\Users\\*\\Downloads\\*\\regsvr32.exe",
|
|
"\\Device\\HarddiskVolume*\\Users\\*\\Desktop\\*\\svchost.exe",
|
|
"\\Device\\HarddiskVolume*\\Users\\*\\Desktop\\*\\rundll32.exe",
|
|
"\\Device\\HarddiskVolume*\\Users\\*\\Desktop\\*\\regsvr32.exe",
|
|
"\\Device\\HarddiskVolume*\\ProgramData\\*\\svchost.exe",
|
|
"\\Device\\HarddiskVolume*\\ProgramData\\*\\rundll32.exe",
|
|
"\\Device\\HarddiskVolume*\\ProgramData\\*\\regsvr32.exe",
|
|
],
|
|
"Target": [
|
|
"\\Device\\HarddiskVolume*\\Users\\*\\AppData\\*\\*.dll",
|
|
"\\Device\\HarddiskVolume*\\Users\\*\\Downloads\\*\\*.dll",
|
|
"\\Device\\HarddiskVolume*\\Users\\*\\Desktop\\*\\*.dll",
|
|
"\\Device\\HarddiskVolume*\\ProgramData\\*\\*.dll",
|
|
],
|
|
"Operations": [
|
|
"ImageLoad",
|
|
],
|
|
"Priority": 160,
|
|
},
|
|
{
|
|
"Name": "Memory_Protect_Critical_Process_CreateRemoteThread",
|
|
"Code": 1007,
|
|
"Kill": false,
|
|
"Category": "Memory",
|
|
"InitiatorExclude": [
|
|
"\\Device\\HarddiskVolume*\\Windows\\*",
|
|
"\\Device\\HarddiskVolume*\\Program Files\\*",
|
|
"\\Device\\HarddiskVolume*\\Program Files (x86)\\*",
|
|
"\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender\\*",
|
|
"\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\*",
|
|
"*\\Huorong\\Sysdiag\\bin\\HipsDaemon.exe",
|
|
"*\\360Safe.exe",
|
|
"*\\PYAS.exe",
|
|
],
|
|
"Target": [
|
|
"\\Device\\HarddiskVolume*\\Windows\\System32\\lsass.exe",
|
|
"\\Device\\HarddiskVolume*\\Windows\\System32\\winlogon.exe",
|
|
"\\Device\\HarddiskVolume*\\Windows\\System32\\services.exe",
|
|
"\\Device\\HarddiskVolume*\\Windows\\System32\\csrss.exe",
|
|
],
|
|
"Operations": [
|
|
"WriteMemory",
|
|
"VmOperation",
|
|
"CreateThread",
|
|
],
|
|
"OperationMatch": "All",
|
|
"MinimumRiskScore": 90,
|
|
"HandleTypes": [
|
|
"Create",
|
|
"Duplicate",
|
|
],
|
|
"ObjectTypes": [
|
|
"Process",
|
|
],
|
|
"Priority": 175,
|
|
},
|
|
{
|
|
"Name": "Memory_Protect_Critical_Process_ThreadHijack",
|
|
"Code": 1008,
|
|
"Kill": false,
|
|
"Category": "Memory",
|
|
"InitiatorExclude": [
|
|
"\\Device\\HarddiskVolume*\\Windows\\*",
|
|
"\\Device\\HarddiskVolume*\\Program Files\\*",
|
|
"\\Device\\HarddiskVolume*\\Program Files (x86)\\*",
|
|
"\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender\\*",
|
|
"\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\*",
|
|
"*\\Huorong\\Sysdiag\\bin\\HipsDaemon.exe",
|
|
"*\\360Safe.exe",
|
|
"*\\PYAS.exe",
|
|
],
|
|
"Target": [
|
|
"\\Device\\HarddiskVolume*\\Windows\\System32\\lsass.exe",
|
|
"\\Device\\HarddiskVolume*\\Windows\\System32\\winlogon.exe",
|
|
"\\Device\\HarddiskVolume*\\Windows\\System32\\services.exe",
|
|
"\\Device\\HarddiskVolume*\\Windows\\System32\\csrss.exe",
|
|
],
|
|
"Operations": [
|
|
"WriteMemory",
|
|
"VmOperation",
|
|
"SetThreadContext",
|
|
],
|
|
"OperationMatch": "All",
|
|
"MinimumRiskScore": 90,
|
|
"HandleTypes": [
|
|
"Create",
|
|
"Duplicate",
|
|
],
|
|
"ObjectTypes": [
|
|
"Process",
|
|
],
|
|
"Priority": 175,
|
|
},
|
|
{
|
|
"Name": "Memory_Protect_Service_Process_CreateRemoteThread",
|
|
"Code": 1009,
|
|
"Kill": false,
|
|
"Category": "Memory",
|
|
"InitiatorExclude": [
|
|
"\\Device\\HarddiskVolume*\\Windows\\*",
|
|
"\\Device\\HarddiskVolume*\\Program Files\\*",
|
|
"\\Device\\HarddiskVolume*\\Program Files (x86)\\*",
|
|
"\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender\\*",
|
|
"\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\*",
|
|
"\\Device\\HarddiskVolume*\\Users\\*\\AppData\\Local\\*",
|
|
"*\\Huorong\\Sysdiag\\bin\\HipsDaemon.exe",
|
|
"*\\360Safe.exe",
|
|
"*\\PYAS.exe",
|
|
],
|
|
"Target": [
|
|
"\\Device\\HarddiskVolume*\\Windows\\System32\\svchost.exe",
|
|
"\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\svchost.exe",
|
|
"\\Device\\HarddiskVolume*\\Windows\\System32\\spoolsv.exe",
|
|
],
|
|
"Operations": [
|
|
"WriteMemory",
|
|
"VmOperation",
|
|
"CreateThread",
|
|
],
|
|
"OperationMatch": "All",
|
|
"MinimumRiskScore": 90,
|
|
"HandleTypes": [
|
|
"Create",
|
|
"Duplicate",
|
|
],
|
|
"ObjectTypes": [
|
|
"Process",
|
|
],
|
|
"Priority": 170,
|
|
},
|
|
{
|
|
"Name": "Memory_Protect_Service_Process_ThreadHijack",
|
|
"Code": 1010,
|
|
"Kill": false,
|
|
"Category": "Memory",
|
|
"InitiatorExclude": [
|
|
"\\Device\\HarddiskVolume*\\Windows\\*",
|
|
"\\Device\\HarddiskVolume*\\Program Files\\*",
|
|
"\\Device\\HarddiskVolume*\\Program Files (x86)\\*",
|
|
"\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender\\*",
|
|
"\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\*",
|
|
"*\\Huorong\\Sysdiag\\bin\\HipsDaemon.exe",
|
|
"*\\360Safe.exe",
|
|
"*\\PYAS.exe",
|
|
],
|
|
"Target": [
|
|
"\\Device\\HarddiskVolume*\\Windows\\System32\\svchost.exe",
|
|
"\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\svchost.exe",
|
|
"\\Device\\HarddiskVolume*\\Windows\\System32\\spoolsv.exe",
|
|
],
|
|
"Operations": [
|
|
"WriteMemory",
|
|
"VmOperation",
|
|
"SetThreadContext",
|
|
],
|
|
"OperationMatch": "All",
|
|
"MinimumRiskScore": 90,
|
|
"HandleTypes": [
|
|
"Create",
|
|
"Duplicate",
|
|
],
|
|
"ObjectTypes": [
|
|
"Process",
|
|
],
|
|
"Priority": 170,
|
|
},
|
|
{
|
|
"Name": "Self_Antivirus_Protect_File",
|
|
"Code": 2001,
|
|
"Kill": false,
|
|
"Category": "File",
|
|
"InitiatorExclude": [
|
|
"*\\PYAS.exe",
|
|
"*\\PYAS_Setup.exe",
|
|
"*\\unins000.exe",
|
|
"*\\notepad*.exe",
|
|
"\\Device\\HarddiskVolume*\\Users\\*\\AppData\\Local\\Temp\\*\\PYAS_Setup.tmp",
|
|
"\\Device\\HarddiskVolume*\\Users\\*\\AppData\\Local\\Temp\\*\\_unins.tmp",
|
|
"\\Device\\HarddiskVolume*\\Windows\\explorer.exe",
|
|
"\\Device\\HarddiskVolume*\\Windows\\System32\\cleanmgr.exe",
|
|
],
|
|
"Target": [
|
|
"*\\PYAS.exe",
|
|
"*\\ProgramData\\PYAS\\*.json",
|
|
"*\\Engine\\Heuristic\\*.yar",
|
|
"*\\Engine\\Heuristic\\*.yara",
|
|
"*\\Engine\\Heuristic\\*.yc",
|
|
"*\\Engine\\Heuristic\\*.yrc",
|
|
"*\\Engine\\Heuristic\\*.ip",
|
|
"*\\Engine\\Heuristic\\*.txt",
|
|
"*\\Engine\\Pattern\\*.onnx",
|
|
"*\\Engine\\Properties\\*.json",
|
|
"*\\Engine\\Properties\\*.onnx",
|
|
"*\\Interface\\static\\css\\*.css",
|
|
"*\\Interface\\static\\img\\*.ico",
|
|
"*\\Interface\\static\\js\\*.js",
|
|
"*\\Interface\\templates\\*.html",
|
|
"*\\Plugins\\Filter\\*.sys",
|
|
"*\\Plugins\\Rules\\*.json",
|
|
],
|
|
"Operations": [
|
|
"Write",
|
|
"Delete",
|
|
]
|
|
},
|
|
{
|
|
"Name": "System_Boot_Protect_File",
|
|
"Code": 2002,
|
|
"Kill": true,
|
|
"Category": "File",
|
|
"InitiatorExclude": [
|
|
"*\\PYAS.exe",
|
|
"*\\Huorong\\Sysdiag\\bin\\sysclean.exe",
|
|
"\\Device\\HarddiskVolume*\\Windows\\System32\\SearchIndexer.exe",
|
|
"\\Device\\HarddiskVolume*\\Windows\\System32\\lsass.exe",
|
|
"\\Device\\HarddiskVolume*\\Windows\\System32\\svchost.exe",
|
|
"\\Device\\HarddiskVolume*\\Windows\\System32\\services.exe",
|
|
"\\Device\\HarddiskVolume*\\Windows\\System32\\taskhostw.exe",
|
|
"\\Device\\HarddiskVolume*\\Windows\\System32\\TrustedInstaller.exe",
|
|
"\\Device\\HarddiskVolume*\\Windows\\WinSxS\\*\\TiWorker.exe",
|
|
"\\Device\\HarddiskVolume*\\$WinREAgent\\Scratch\\*\\DismHost.exe",
|
|
],
|
|
"Target": [
|
|
"\\Device\\HarddiskVolume*\\bootmgr",
|
|
"\\Device\\HarddiskVolume*\\boot.ini",
|
|
"\\Device\\HarddiskVolume*\\BOOTNXT",
|
|
"\\Device\\HarddiskVolume*\\EFI\\*",
|
|
"\\Device\\HarddiskVolume*\\Boot\\*",
|
|
"\\Device\\HarddiskVolume*\\Recovery\\*",
|
|
],
|
|
"Operations": [
|
|
"Write",
|
|
"Delete",
|
|
]
|
|
},
|
|
{
|
|
"Name": "Illegal_Characters_Protect_File",
|
|
"Code": 2003,
|
|
"Kill": false,
|
|
"Category": "File",
|
|
"InitiatorExclude": [
|
|
"*\\PYAS.exe",
|
|
],
|
|
"Target": [
|
|
"*\\CON",
|
|
"*\\CON\\*",
|
|
"*\\PRN",
|
|
"*\\PRN\\*",
|
|
"*\\AUX",
|
|
"*\\AUX\\*",
|
|
"*\\NUL",
|
|
"*\\NUL\\*",
|
|
"*\\COM?",
|
|
"*\\COM?\\*",
|
|
"*\\LPT?",
|
|
"*\\LPT?\\*",
|
|
"*\\OSDATA",
|
|
"*\\OSDATA\\*",
|
|
"*\\*<*",
|
|
"*\\*>*",
|
|
],
|
|
"Operations": [
|
|
"Create",
|
|
"Write",
|
|
"Rename",
|
|
]
|
|
},
|
|
{
|
|
"Name": "System_Ransom_Protect_File",
|
|
"Code": 2004,
|
|
"Kill": true,
|
|
"Category": "File",
|
|
"Initiator": [
|
|
"\\Device\\HarddiskVolume*\\Windows\\System32\\cmd.exe",
|
|
"\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\cmd.exe",
|
|
"\\Device\\HarddiskVolume*\\Windows\\System32\\WindowsPowerShell\\*\\powershell.exe",
|
|
"\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\WindowsPowerShell\\*\\powershell.exe",
|
|
"\\Device\\HarddiskVolume*\\Program Files\\PowerShell\\*\\pwsh.exe",
|
|
"\\Device\\HarddiskVolume*\\Program Files (x86)\\PowerShell\\*\\pwsh.exe",
|
|
"\\Device\\HarddiskVolume*\\Windows\\System32\\wscript.exe",
|
|
"\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\wscript.exe",
|
|
"\\Device\\HarddiskVolume*\\Windows\\System32\\cscript.exe",
|
|
"\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\cscript.exe",
|
|
"\\Device\\HarddiskVolume*\\Windows\\System32\\mshta.exe",
|
|
"\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\mshta.exe",
|
|
],
|
|
"Target": [
|
|
"\\Device\\HarddiskVolume*\\Windows\\*",
|
|
],
|
|
"TargetExclude": [
|
|
"\\Device\\HarddiskVolume*\\Windows\\Temp\\*",
|
|
"\\Device\\HarddiskVolume*\\Windows\\SystemTemp\\*",
|
|
"\\Device\\HarddiskVolume*\\Windows\\Prefetch\\*",
|
|
"\\Device\\HarddiskVolume*\\Windows\\Logs\\*",
|
|
"\\Device\\HarddiskVolume*\\Windows\\WinSxS\\*",
|
|
"\\Device\\HarddiskVolume*\\Windows\\servicing\\*",
|
|
],
|
|
"Operations": [
|
|
"Delete",
|
|
"Rename",
|
|
],
|
|
"Threshold": 50,
|
|
"TimeWindow": 3000,
|
|
},
|
|
{
|
|
"Name": "User_Ransom_Protect_File",
|
|
"Code": 2005,
|
|
"Kill": true,
|
|
"Category": "File",
|
|
"InitiatorExclude": [
|
|
"\\Device\\HarddiskVolume*\\Windows\\*",
|
|
"\\Device\\HarddiskVolume*\\Program Files\\*",
|
|
"\\Device\\HarddiskVolume*\\Program Files (x86)\\*",
|
|
"*\\Google\\Chrome\\Application\\chrome.exe",
|
|
"*\\Microsoft\\Edge\\Application\\msedge.exe",
|
|
"*\\Microsoft\\Edge*\\Application\\*\\msedgewebview2.exe",
|
|
"*\\Microsoft\\Edge*\\Install\\*\\setup.exe",
|
|
"*\\Microsoft\\Edge*\\Application\\*\\Installer\\setup.exe",
|
|
"*\\Mozilla Firefox\\firefox.exe",
|
|
"*\\Thorium\\Application\\thorium.exe",
|
|
"*\\Steam\\steam.exe",
|
|
"*\\steam\\*\\steam.exe",
|
|
"*\\Steam\\steamapps\\common\\*",
|
|
"*\\Battle.net\\*\\Battle.net.exe",
|
|
"*\\Epic Games\\Launcher\\Portal\\Binaries\\*\\EpicGamesLauncher.exe",
|
|
"*\\PC4399_WPFLauncher.exe",
|
|
"*\\Neverness To Everness\\NTELauncher.exe",
|
|
"*\\ThunderEv.exe",
|
|
"*\\ThunderStart.exe",
|
|
"*\\bin\\APlayer.exe",
|
|
"*\\bilibili\\bilibili.exe",
|
|
"*\\KuGou.exe",
|
|
"*\\XLGame.exe",
|
|
"*\\XLLiveUD.exe",
|
|
"*\\hrkill-*.exe",
|
|
"*\\Huorong\\Sysdiag\\bin\\HipsDaemon.exe",
|
|
"*\\360Safe.exe",
|
|
"*\\PYAS.exe",
|
|
"*\\WPS Office\\ksolaunch.exe",
|
|
"*\\WPS Office\\*\\wps.exe",
|
|
"*\\Application\\AndrowsLauncher.exe",
|
|
"*\\resources\\bin\\SDK\\DownloadSDKServer.exe",
|
|
"*\\bin\\*\\codex.exe",
|
|
"*\\bin\\codex.exe",
|
|
"*\\Weixin\\Weixin.exe",
|
|
],
|
|
"Target": [
|
|
"\\Device\\HarddiskVolume*\\Users\\*",
|
|
],
|
|
"TargetExclude": [
|
|
"*\\Documents\\My Games\\*",
|
|
"*\\Documents\\Tencent Files\\*",
|
|
"*\\Documents\\WeChat Files\\*",
|
|
"*\\Documents\\WPS Cloud Files\\*",
|
|
"*\\Users\\*\\steam\\*",
|
|
"\\Device\\HarddiskVolume*\\Users\\*\\User Data\\*",
|
|
"\\Device\\HarddiskVolume*\\Users\\*\\AppData\\*",
|
|
"\\Device\\HarddiskVolume*\\Users\\*\\AppData\\Local\\*",
|
|
"\\Device\\HarddiskVolume*\\Users\\*\\Temp\\*",
|
|
"\\Device\\HarddiskVolume*\\Users\\*\\Local\\Temp\\*",
|
|
"\\Device\\HarddiskVolume*\\Users\\*\\cache\\*",
|
|
"\\Device\\HarddiskVolume*\\Users\\*\\.cache\\*",
|
|
"\\Device\\HarddiskVolume*\\Users\\*\\.aws\\*",
|
|
"\\Device\\HarddiskVolume*\\Users\\*\\.codex\\*",
|
|
"\\Device\\HarddiskVolume*\\Users\\*\\.designer\\*",
|
|
"\\Device\\HarddiskVolume*\\Users\\*\\.idlerc\\*",
|
|
"\\Device\\HarddiskVolume*\\Users\\*\\.keras\\*",
|
|
"\\Device\\HarddiskVolume*\\Users\\*\\.matplotlib\\*",
|
|
"\\Device\\HarddiskVolume*\\Users\\*\\.ssh\\*",
|
|
"*\\ventoy\\Boot\\*",
|
|
"*\\AdminRegionConfig.*",
|
|
"*\\nt_qq\\nt_*\\*",
|
|
"\\Device\\HarddiskVolume*\\Users\\*\\Documents\\Tencent Files\\*\\nt_qq\\nt_*\\*",
|
|
],
|
|
"Extensions": [
|
|
".zip",
|
|
".7z",
|
|
".rar",
|
|
".tar",
|
|
".gz",
|
|
".ppt",
|
|
".pptx",
|
|
".wps",
|
|
".txt",
|
|
".rtf",
|
|
".pdf",
|
|
".xls",
|
|
".xlsx",
|
|
".doc",
|
|
".docx",
|
|
".jpg",
|
|
".jpeg",
|
|
".png",
|
|
".webp",
|
|
".gif",
|
|
".mp3",
|
|
".wav",
|
|
".aac",
|
|
".ogg",
|
|
".flac",
|
|
".mp4",
|
|
".avi",
|
|
".mov",
|
|
".wmv",
|
|
".mkv",
|
|
],
|
|
"Operations": [
|
|
"Write",
|
|
"Delete",
|
|
"Rename",
|
|
],
|
|
"Threshold": 5,
|
|
"TimeWindow": 3000,
|
|
},
|
|
{
|
|
"Name": "System_Boot_Protect_Disk_Wiper",
|
|
"Code": 2006,
|
|
"Kill": false,
|
|
"Category": "Device",
|
|
"InitiatorExclude": [
|
|
"*\\PYAS.exe",
|
|
"*\\rufus-*.exe",
|
|
"*\\DiskInfo*.exe",
|
|
"\\Device\\HarddiskVolume*\\Windows\\System32\\diskpart.exe",
|
|
"\\Device\\HarddiskVolume*\\Windows\\System32\\diskmgmt.msc",
|
|
"\\Device\\HarddiskVolume*\\Windows\\System32\\taskhostw.exe",
|
|
"\\Device\\HarddiskVolume*\\Windows\\System32\\vds.exe",
|
|
"\\Device\\HarddiskVolume*\\Windows\\System32\\format.com",
|
|
],
|
|
"Operations": [
|
|
"Ioctl",
|
|
]
|
|
},
|
|
{
|
|
"Name": "Registry_Protect_System_Suspicious",
|
|
"Code": 3001,
|
|
"Kill": false,
|
|
"Category": "Registry",
|
|
"InitiatorExclude": [
|
|
"\\Device\\HarddiskVolume*\\Windows\\*",
|
|
"\\Device\\HarddiskVolume*\\Program Files\\*",
|
|
"\\Device\\HarddiskVolume*\\Program Files (x86)\\*",
|
|
"\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender\\*",
|
|
"\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\*",
|
|
"*\\hrkill-*.exe",
|
|
"*\\Huorong\\Sysdiag\\bin\\HipsDaemon.exe",
|
|
"*\\360Safe.exe",
|
|
"*\\PYAS.exe",
|
|
],
|
|
"Target": [
|
|
"*\\mouclass",
|
|
"*\\kbdclass",
|
|
"*\\DisableAntiSpyware",
|
|
"*\\DisableWindowsUpdateAccess",
|
|
"*\\NoWindowsUpdate",
|
|
"*\\AutoAdminLogon",
|
|
"*\\DefaultUserName",
|
|
"*\\DefaultPassword",
|
|
"*\\AltDefaultUserName",
|
|
"*\\AltDefaultPassword",
|
|
"*\\LegalNoticeCaption",
|
|
"*\\LegalNoticeText",
|
|
"*\\AutoReboot",
|
|
"*\\DisableAutomaticRestartOnFailure",
|
|
"*\\SystemBiosVersion",
|
|
"*\\ClearRecentDocsOnExit",
|
|
"*\\HideClock",
|
|
"*\\HideFastUserSwitching",
|
|
"*\\ShutdownWithoutLogon",
|
|
"*\\DisableCAD",
|
|
],
|
|
"Operations": [
|
|
"Write",
|
|
"Delete",
|
|
"Create",
|
|
],
|
|
"Priority": 130,
|
|
},
|
|
{
|
|
"Name": "Registry_Protect_Open_With_Suspicious",
|
|
"Code": 3002,
|
|
"Kill": false,
|
|
"Category": "Registry",
|
|
"InitiatorExclude": [
|
|
"\\Device\\HarddiskVolume*\\Windows\\*",
|
|
"\\Device\\HarddiskVolume*\\Program Files\\*",
|
|
"\\Device\\HarddiskVolume*\\Program Files (x86)\\*",
|
|
"*\\PYAS.exe",
|
|
],
|
|
"Target": [
|
|
"*\\Classes\\.exe",
|
|
"*\\Classes\\.com",
|
|
"*\\Classes\\.bat",
|
|
"*\\Classes\\.cmd",
|
|
"*\\Classes\\exefile\\*",
|
|
"*\\Classes\\comfile\\*",
|
|
"*\\Classes\\batfile\\*",
|
|
"*\\Classes\\cmdfile\\*",
|
|
],
|
|
"Operations": [
|
|
"Write",
|
|
"Delete",
|
|
"Create",
|
|
],
|
|
"Priority": 150,
|
|
},
|
|
{
|
|
"Name": "Registry_Protect_BCD_Suspicious",
|
|
"Code": 3003,
|
|
"Kill": false,
|
|
"Category": "Registry",
|
|
"InitiatorExclude": [
|
|
"\\Device\\HarddiskVolume*\\Windows\\*",
|
|
"\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender\\*",
|
|
"\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\*",
|
|
"*\\PYAS.exe",
|
|
],
|
|
"Target": [
|
|
"\\REGISTRY\\MACHINE\\BCD00000000",
|
|
"\\REGISTRY\\MACHINE\\BCD00000000\\*",
|
|
],
|
|
"Operations": [
|
|
"Write",
|
|
"Delete",
|
|
"Create",
|
|
],
|
|
"Priority": 140,
|
|
},
|
|
{
|
|
"Name": "Registry_Protect_System_Critical",
|
|
"Code": 3004,
|
|
"Kill": true,
|
|
"Category": "Registry",
|
|
"InitiatorExclude": [
|
|
"\\Device\\HarddiskVolume*\\Windows\\*",
|
|
"*\\PYAS.exe",
|
|
],
|
|
"Target": [
|
|
"*\\EnableLUA",
|
|
"*\\ConsentPromptBehaviorAdmin",
|
|
"*\\ConsentPromptBehaviorUser",
|
|
"*\\EnableSecureUIAPaths",
|
|
"*\\BootExecute",
|
|
"*\\SubSystems",
|
|
"*\\FirmwareBootDevice",
|
|
"*\\BootDriverFlags",
|
|
"*\\SystemStartOptions",
|
|
"*\\Userinit",
|
|
"*\\UIHost",
|
|
"*\\Debugger",
|
|
"*\\NoControlPanel",
|
|
"*\\NoDrives",
|
|
"*\\NoFileMenu",
|
|
"*\\NoFind",
|
|
"*\\NoStartMenuPinnedList",
|
|
"*\\NoSetFolders",
|
|
"*\\NoSetFolderOptions",
|
|
"*\\NoViewOnDrive",
|
|
"*\\NoClose",
|
|
"*\\NoDesktop",
|
|
"*\\NoLogoff",
|
|
"*\\NoFolderOptions",
|
|
"*\\RestrictRun",
|
|
"*\\NoViewContextMenu",
|
|
"*\\NoStartMenuMyGames",
|
|
"*\\NoStartMenuMyMusic",
|
|
"*\\DisableCMD",
|
|
"*\\NoAddingComponents",
|
|
"*\\NoWinKeys",
|
|
"*\\NoStartMenuLogOff",
|
|
"*\\NoSimpleNetIDList",
|
|
"*\\NoLowDiskSpaceChecks",
|
|
"*\\DisableLockWorkstation",
|
|
"*\\Restrict_Run",
|
|
"*\\DisableTaskMgr",
|
|
"*\\DisableRegistryTools",
|
|
"*\\DisableChangePassword",
|
|
"*\\NoComponents",
|
|
"*\\NoStartMenuMorePrograms",
|
|
"*\\NoActiveDesktop",
|
|
"*\\NoSetActiveDesktop",
|
|
"*\\NoRecentDocsMenu",
|
|
"*\\NoChangeStartMenu",
|
|
"*\\NoFavoritesMenu",
|
|
"*\\NoRecentDocsHistory",
|
|
"*\\NoSetTaskbar",
|
|
"*\\NoSMHelp",
|
|
"*\\NoTrayContextMenu",
|
|
"*\\NoManageMyComputerVerb",
|
|
"*\\NoRealMode",
|
|
"*\\NoRun",
|
|
"*\\NoActiveDesktopChanges",
|
|
"*\\NoStartMenuNetworkPlaces",
|
|
"*\\NoLockScreen",
|
|
"*\\NoSRM",
|
|
"*\\NoInteractiveServices",
|
|
"*\\NoTheme",
|
|
],
|
|
"Operations": [
|
|
"Write",
|
|
"Delete",
|
|
"Create",
|
|
],
|
|
"Priority": 180,
|
|
},
|
|
{
|
|
"Name": "Registry_Protect_SafeMode_Autostart",
|
|
"Code": 3005,
|
|
"Kill": true,
|
|
"Category": "Registry",
|
|
"InitiatorExclude": [
|
|
"\\Device\\HarddiskVolume*\\Windows\\*",
|
|
"\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender\\*",
|
|
"\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\*",
|
|
"*\\Sources\\SetupHost.exe",
|
|
"*\\Work\\*\\DismHost.exe",
|
|
"*\\Huorong\\Sysdiag\\bin\\HipsDaemon.exe",
|
|
"*\\360Safe.exe",
|
|
"*\\PYAS.exe",
|
|
],
|
|
"Target": [
|
|
"\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Control\\SafeBoot\\Minimal\\*",
|
|
"\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Control\\SafeBoot\\Network\\*",
|
|
"\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Control\\SafeBoot\\AlternateShell",
|
|
"\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Control\\SafeBoot\\AlternateShell\\*",
|
|
"\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Control\\SafeBoot\\Option",
|
|
"\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Control\\SafeBoot\\Option\\*",
|
|
],
|
|
"Operations": [
|
|
"Write",
|
|
"Delete",
|
|
"Create",
|
|
],
|
|
"Priority": 170,
|
|
},
|
|
{
|
|
"Name": "Registry_Protect_OOBE_Reset",
|
|
"Code": 3006,
|
|
"Kill": false,
|
|
"Category": "Registry",
|
|
"InitiatorExclude": [
|
|
"*\\Sources\\SetupHost.exe",
|
|
"*\\Work\\*\\DismHost.exe",
|
|
"*\\Windows\\UUS\\amd64\\MoUsoCoreWorker.exe",
|
|
"*\\Windows\\System32\\MoUsoCoreWorker.exe",
|
|
"*\\Windows\\System32\\Sysprep\\sysprep.exe",
|
|
"*\\Windows\\System32\\oobe\\*",
|
|
"*\\Windows\\System32\\svchost.exe",
|
|
"*\\Windows\\explorer.exe",
|
|
"*\\PYAS.exe",
|
|
],
|
|
"Target": [
|
|
"\\REGISTRY\\MACHINE\\SYSTEM\\Setup\\OOBEInProgress",
|
|
"\\REGISTRY\\MACHINE\\SYSTEM\\Setup\\SystemSetupInProgress",
|
|
"\\REGISTRY\\MACHINE\\SYSTEM\\Setup\\SetupType",
|
|
"\\REGISTRY\\MACHINE\\SYSTEM\\Setup\\CmdLine",
|
|
"\\REGISTRY\\MACHINE\\SYSTEM\\Setup\\AuditInProgress",
|
|
"\\REGISTRY\\MACHINE\\SYSTEM\\Setup\\MiniSetupInProgress",
|
|
"\\REGISTRY\\MACHINE\\SYSTEM\\Setup\\SetupPhase",
|
|
"\\REGISTRY\\MACHINE\\SYSTEM\\Setup\\Status\\SysprepStatus\\*",
|
|
"\\REGISTRY\\MACHINE\\SYSTEM\\Setup\\Status\\ChildCompletion\\*",
|
|
"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\State\\ImageState",
|
|
"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\OOBE\\*",
|
|
"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\*",
|
|
],
|
|
"TargetExclude": [
|
|
"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\TelemetryCorrelation",
|
|
],
|
|
"Operations": [
|
|
"Write",
|
|
"Delete",
|
|
"Create",
|
|
],
|
|
"Priority": 175,
|
|
},
|
|
]
|
|
}
|