[C언어] Data Conversion Tool - RawVera : rules_log_yara.yar

rules_log_yara.yar

0.01MB

 

 

/*
 * rules_log_yara.yar
 * PcapAnalyzer — 내장 웹 공격 탐지 룰
 *
 * 원본: Yara_InitRules() 하드코딩 룰을 외부 파일로 분리
 * 엔진: PcapAnalyzer 자체 미니 NFA Regex 엔진 (Yara_ParseFile 호환)
 *
 * [내역]
 * 1. SQLi_HighRisk: PostgreSQL(COPY TO), Oracle(DBMS_) 타겟 추가
 * 2. PathTraversal: Windows 환경 민감 파일 접근 패턴 추가
 * 3. RFI: 파라미터 기반 가중치 방식 또는 엄격한 매칭으로 오탐률(FP) 감소
 * 4. Webshell: 단독 문자열 매칭으로 인한 오탐 방지를 위해 파일명 경계(/) 추가
 * 5. Insecure_Deserialization: 역직렬화 공격 탐지
 * 6. SSTI: 서버 사이드 템플릿 인젝션 탐지
 * 7. File_Upload_Bypass: 이중 확장자 및 널바이트 파일 업로드 우회 탐지
 * 8. Auto_Scanners: 자동화 취약점 스캐너 탐지
 */

/* ================================================================
   1. SQLi — 고위험 (YARA_COND_ANY)
================================================================ */
rule SQLi_HighRisk
{
    meta:
        description   = "SQL Injection 고위험 패턴 (MySQL, MSSQL, PgSQL, Oracle)"
        attack_type   = "sqli"
        condition_type = "any"

    strings:
        /* UNION [공백/주석/URL인코딩] SELECT (ALL/DISTINCT 포함) */
        $r_union_select = /union([\s+?]|\/\*[^*]*\*\/|%09|%0[aAdD]|%20)+(all([\s+?]|\/\*[^*]*\*\/|%09|%0[aAdD]|%20)+)?(distinct([\s+?]|\/\*[^*]*\*\/|%09|%0[aAdD]|%20)+)?select/ nocase

        /* 시간 기반 블라인드 */
        $r_time_blind = /(sleep|pg_sleep|benchmark|waitfor([\s+?]|\/\*[^*]*\*\/|%20)+(delay|time))\s*\(/ nocase

        /* 저장 프로시저 실행 */
        $r_exec_proc = /(exec(ute)?\s+)?(sp_|xp_)(executesql|cmdshell|regread|dirtree)/ nocase

        /* 파일 I/O (PostgreSQL COPY TO 추가) */
        $r_file_ops = /(into\s+(outfile|dumpfile)|load_file\s*\(|load\s+data\s+infile|copy\s+[^\s]+\s+to\s+['"])/ nocase

        /* 메타데이터 조회 */
        $r_info_schema = /(information_schema|sys\.(tables|columns|user_tables)|pg_catalog|pg_tables)/ nocase

        /* 에러 기반 */
        $r_error_based = /(extractvalue|updatexml|exp\(~\(|xmltype)\s*\(/ nocase

        /* 시스템 변수 */
        $r_sysvar = /@@(version|datadir|hostname|servername|basedir)/ nocase

        /* Oracle DBMS 패키지 공격 */
        $r_oracle_dbms = /dbms_(sql|xmlquery|assert|utility)\./ nocase

    condition:
        any of them
}

/* ================================================================
   2. SQLi — 저위험 가중치 기반 (YARA_COND_WEIGHT, 임계값 2)
================================================================ */
rule SQLi_LowRisk
{
    meta:
        description      = "SQL Injection 저위험 패턴 (가중치 합산)"
        attack_type      = "sqli"
        condition_type   = "weight"
        weight_threshold = "2"

    strings:
        $r_logic_bypass = /('|")\s*(or|and)\s+['"]?1['"]?\s*=\s*['"]?1/ nocase weight:2
        $r_comment_term = /('|")\s*(;\s*--|\s*--|\s*#)/ nocase weight:1
        $r_cast_convert = /(cast|convert)\s*\(/ nocase weight:1
        $r_having_case = /\s(having|case\s+when|group\s+by|order\s+by)\s/ nocase weight:1

    condition:
        weight_threshold
}

/* ================================================================
   3. XSS — 크로스 사이트 스크립팅 (YARA_COND_ANY)
================================================================ */
rule XSS
{
    meta:
        description   = "Cross-Site Scripting 패턴"
        attack_type   = "xss"
        condition_type = "any"

    strings:
        $r_script_tag = /<\s*script[\s>\/]/ nocase
        $r_js_uri = /(javascript|vbscript)\s*:/ nocase
        $r_event_handler = /on(error|load|click|mouseover|focus|blur|input|change|abort|drag|keydown|keypress|keyup|mousedown|mouseup|submit|toggle|pointerdown|pointerup|animationstart|animationend|transitionend)\s*=/ nocase
        $r_eval_funcs = /(alert|confirm|prompt|eval|settimeout|setinterval)\s*\(/ nocase
        $r_dom_write = /(document\.(cookie|location|write\s*\()|window\.location|innerhtml|outerhtml)/ nocase
        $r_data_uri = /data:\s*(text\/html|application\/javascript)/ nocase

    condition:
        any of them
}

/* ================================================================
   4. Path Traversal / LFI (YARA_COND_ANY)
================================================================ */
rule PathTraversal
{
    meta:
        description   = "경로 이동 및 로컬 파일 인클루전(LFI) 패턴 (Unix & Win)"
        attack_type   = "trav"
        condition_type = "any"

    strings:
        /* ../ / ..\ 및 변형 */
        $r_dotdot = /(\.\.\/|\.\.\\|%2e%2e%2f|%2e%2e\/|\.\. ?%2f|%2e%2e%5c|%c0%ae%c0%ae%c0%af|%252e%252e%252f|\.\.(;|%3b)\/)/ nocase
        
        /* Unix 민감 경로 */
        $r_sensitive_unix = /(\/etc\/(passwd|shadow|group|sudoers|hosts|motd|issue)|\/proc\/(self|version|cmdline)|\/root\/\.bash_history|\/var\/log)/ nocase
        
        /* Windows 민감 경로 (추가) */
        $r_sensitive_win = /(c:\\|c:%5c|c:\/)?(windows|winnt)\/(system32|win\.ini|boot\.ini)/ nocase
        
        /* PHP 래퍼 */
        $r_php_wrapper = /php:\/\/(filter|input)|zip:\/\/|phar:\/\// nocase
        
        /* 널 바이트 인젝션 */
        $r_null_byte = /%00/ nocase

    condition:
        any of them
}

/* ================================================================
   5. RFI — 원격 파일 인클루전 (YARA_COND_ANY)
================================================================ */
rule RFI
{
    meta:
        description   = "Remote File Inclusion 패턴 (오탐 방지 적용)"
        attack_type   = "rfi"
        condition_type = "any"

    strings:
        /* 일반적인 리다이렉트가 아닌, 파일/페이지 참조 파라미터에 URL이 올 때만 탐지 */
        $r_rfi_strict = /[?&](page|file|inc|path|url|doc|view|module)= *(https?|ftp)(:\/\/|%3a%2f%2f)/ nocase

    condition:
        any of them
}

/* ================================================================
   6. Command Injection (YARA_COND_ANY)
================================================================ */
rule CmdInjection
{
    meta:
        description   = "OS 커맨드 인젝션 패턴"
        attack_type   = "cmd"
        condition_type = "any"

    strings:
        $r_shell_cmd = /(cmd(\.exe)?\s+\/[ck]|powershell(\s+-[a-z]+)?|\/bin\/(sh|bash|zsh)|\bwget\b|\bcurl\b|\bnc\s|netcat|ncat|\bmkfifo\b)/ nocase
        $r_cmd_sep = /[;|`&]\s*(id|whoami|ls|cat|echo|ping|wget|curl|chmod|chown|uname|hostname)\b/ nocase
        $r_reverse_shell = /(\/dev\/(tcp|udp)\/[0-9]+\.[0-9]|python[23]?\s+-c|perl\s+-(e|mio)|php\s+-r|ruby\s+-rsocket)/ nocase
        $r_ifs_bypass = /\$\{?IFS\}?/ nocase

    condition:
        any of them
}

/* ================================================================
   7. Webshell (YARA_COND_ANY)
================================================================ */
rule Webshell
{
    meta:
        description   = "웹셸"
        attack_type   = "webshell"
        condition_type = "any"

    strings:
        /* 슬래시(/)를 포함하여 c99 같은 일반 문자열이 오탐되지 않도록 수정 */
        $r_known_shells = /\/(c99|wso|r57|b374k|china\.chopper|godzilla|behinder|regeorg|cobaltstrike|aspxspy|phpspy)\.(php|asp|aspx|jsp)/ nocase
        $r_dangerous_funcs = /(system|passthru|shell_exec|popen|proc_open|pcntl_exec|assert|create_function|preg_replace)\s*\(/ nocase
        $r_encoded_payload = /(base64_decode|gzinflate|gzdecode)\s*\(/ nocase
        $r_shell_param = /[?&](cmd|exec|run|shell|code)=/ nocase

    condition:
        any of them
}

/* ================================================================
   8. SSRF — 서버 사이드 요청 위조 (YARA_COND_ANY)
================================================================ */
rule SSRF
{
    meta:
        description   = "Server-Side Request Forgery 패턴"
        attack_type   = "ssrf"
        condition_type = "any"

    strings:
        $r_metadata = /(169\.254\.169\.254|metadata\.(google|azure)|0177\.|0x7f|2130706433|\[::1\]|\[::\]|localhost)/ nocase
        $r_internal_net = /\/\/\s*(127\.|10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.)/ nocase
        $r_proto_smuggle = /(dict|gopher|sftp|ldaps?|file):\/\// nocase

    condition:
        any of them
}

/* ================================================================
   9. XXE — XML 외부 엔티티 인젝션 (YARA_COND_ANY)
================================================================ */
rule XXE
{
    meta:
        description   = "XML External Entity Injection 패턴"
        attack_type   = "xxe"
        condition_type = "any"

    strings:
        $r_entity = /<!(\s*)(entity|doctype)/ nocase
        $r_system_uri = /system\s+['"]\s*(file|http|https):\/\// nocase

    condition:
        any of them
}

/* ================================================================
   10. Log4Shell & Spring/Struts (YARA_COND_ANY)
================================================================ */
rule Framework_Exploits
{
    meta:
        description   = "Log4Shell, Spring4Shell, Struts2 패턴 모음"
        attack_type   = "log4shell"
        condition_type = "any"

    strings:
        /* Log4Shell */
        $r_jndi_basic = /\$\{[^}]*jndi\s*:/ nocase
        $r_jndi_proto = /\$\{jndi:(ldap|rmi|dns|ldaps|corba|iiop)s?:\/\// nocase
        $r_jndi_obfuscated = /\$\{[^}]*(lower|upper|:-)[^}]*:[^}]*\}/ nocase
        
        /* Spring & Struts2 */
        $r_classloader = /class\.(module\.classloader|classloader\.(resources|defaultassertionsstatus|uricharset|parent))/ nocase
        $r_ognl = /(ognl:|#(application|session|request|parameters|attr|this|root)\[|@java\.lang\.(runtime|processbuilder)@)/ nocase
        $r_struts2_bypass = /%\{(#nike=|#_=|#_memberaccess|#application|#container=@ognl)/ nocase
        $r_spring_cloud = /spring\.cloud\.(bootstrap|function\.routing-expression)/ nocase
        $r_proto_pollution = /(__proto__|constructor\.prototype|prototype\.constructor|__define[gs]etter__)/ nocase

    condition:
        any of them
}

/* ================================================================
   11. [신규] Insecure Deserialization (YARA_COND_ANY)
================================================================ */
rule Insecure_Deserialization
{
    meta:
        description   = "안전하지 않은 역직렬화 공격 (Java, PHP, .NET)"
        attack_type   = "deserial"
        condition_type = "any"

    strings:
        /* Java Base64 (rO0AB) 및 Hex (aced0005) 매직 바이트 */
        $r_java_magic = /(rO0ABX|aced0005)/ nocase
        
        /* PHP 직렬화 객체 형식 (예: O:8:"MyClass":) */
        $r_php_obj = /O:\d+:"[A-Za-z0-9_]+":/ nocase
        
        /* .NET Base64 인코딩된 포맷터 헤더 */
        $r_dotnet_fmt = /AAEAAAD\/\/\/\/\// nocase

    condition:
        any of them
}

/* ================================================================
   12. [신규] SSTI — 서버 사이드 템플릿 인젝션 (YARA_COND_ANY)
================================================================ */
rule SSTI
{
    meta:
        description   = "Server-Side Template Injection 패턴"
        attack_type   = "ssti"
        condition_type = "any"

    strings:
        /* Java 계열 (Spring/Thymeleaf/FreeMarker) RCE 시도 */
        $r_ssti_java = /\$\{(T\(java\.lang\.Runtime\)|T\(java\.lang\.ProcessBuilder\))/ nocase
        
        /* Python/Jinja2/Twig 계열 민감 객체 접근 */
        $r_ssti_python = /\{\{\s*(request|self|config|url_for)\s*\./ nocase
        
        /* 일반적인 템플릿 명령어 실행 블록 */
        $r_ssti_generic = /(\{\%|\[\%|#set\s*\().*(exec|system|eval)/ nocase

    condition:
        any of them
}

/* ================================================================
   13. [신규] Malicious File Upload Bypass (YARA_COND_ANY)
================================================================ */
rule File_Upload_Bypass
{
    meta:
        description   = "악성 파일 업로드 우회 기법 (이중 확장자, 널바이트)"
        attack_type   = "upload"
        condition_type = "any"

    strings:
        /* 이중 확장자 (예: shell.php.jpg) */
        $r_double_ext = /\.(php[345]?|asp[x]?|jsp[x]?|cgi|sh|pl)\.(jpg|png|gif|txt|pdf|zip)/ nocase
        
        /* 널바이트 인젝션 (예: shell.php%00.jpg) */
        $r_null_ext = /\.(php[345]?|asp[x]?|jsp[x]?|cgi|sh|pl)%00\.(jpg|png|gif|txt|pdf)/ nocase

    condition:
        any of them
}

/* ================================================================
   14. [신규] Automated Scanners & Attack Tools (YARA_COND_ANY)
================================================================ */
rule Auto_Scanners
{
    meta:
        description   = "자동화 취약점 스캐너 및 공격 도구 헤더/User-Agent"
        attack_type   = "scanner"
        condition_type = "any"

    strings:
        /* 주요 스캐너 및 공격 프록시 시그니처 */
        $r_scanners = /(sqlmap|nikto|dirbuster|nmap|zgrab|masscan|w3af|acunetix|netsparker|appscan|arachni|burpcollaborator)/ nocase
        
        /* Python/Go 등 스크립트 기반 기본 헤더 통신 시도 */
        $r_script_ua = /(python-requests|python-urllib|go-http-client|java\/[0-9\.]+)/ nocase

    condition:
        any of them
}